Activity report of the authorising officer by delegation (pursuant to Article 74(9) of the Financial Regulation) : 2024.
Date: 2025-07-01
Institutions: European Court of Auditors
Subjects: European Court of Auditors, accounting system, activity report, audit, financial management, financial regulation

EN

2024

Activity report
of the authorising officer by delegation
(pursuant to Article 74(9) of the Financial Regulation)

EUROPEAN COURT OF AUDITORS 
12, rue Alcide De Gasperi 
1615 Luxembourg 
LUXEMBOURG

Tel. +352 4398-1
Enquiries: https://eca.europa.eu/en/contact 
Website: https://eca.europa.eu 
Social media: @EUauditors

02

More information on the European Union is available on the Internet (https://europa.eu) 

Luxembourg: Publications Office of the European Union, 2025

 
2024 

Activity report 
of the authorising officer by delegation 
(pursuant to Article 74(9) of the Financial Regulation) 

 
 
Contents 

Introduction 

The Secretariat-General’s main activities and 
achievements 

Directorate of Human Resources, Finance and General Services 

Directorate of Information, Workplace and Innovation 

Language and Editorial Directorate 

Data Protection Officer (DPO) 

Information Security Officer (ISO) 

Procurement in the Secretariat-General 

Results of the Secretariat-General’s internal control 
systems 

Internal control framework 

I. Control environment 

II. Risk assessment 

III. Control activities 

IV. Information and communication 

V. Monitoring 

Results of controls 

Directorate of Human Resources, Finance and General Services 

Directorate of Information, Workplace and Innovation 

Language and Editorial Directorate 

Other directorates/departments 

Conclusion regarding the efficiency and effectiveness of internal 
control systems 

Accountability 

Overview of the ECA budget 

External audit 

2 

Paragraph 

01-07 

08-35 

10-15 

16-21 

22-27 

28-29 

30-31 

32-35 

36-86 

36-57 

38-43 

44-45 

46-52 

53-54 

55-57 

58-82 

58-72 

73-74 

75-80 

81-82 

83-86 

87-92 

87-90 

91-92 

 
 
3 

Declaration by the authorising officer by delegation 

93-95 

Annexes 

Annex I – The ECA’s internal control framework 

Annex II – Report on budgetary and financial management for 2024 

 
 
 
 
4 

Introduction 

01 The financial rules applicable to the general budget of the Union (the 
Financial Regulation) require the Secretary-General of the European Court of Auditors 
(ECA), as the institution’s authorising officer by delegation (AOD), to submit an annual 
activity report to the ECA and the budgetary authority on the performance of his 
duties. 

02 This report contains financial and management information, an analysis of the 
efficiency and effectiveness of internal control systems, and the Secretary-General’s 
annual declaration of assurance regarding the legality and regularity and sound 
financial management of the financial transactions under his responsibility. It 
complements the ECA’s “Our activities in 2024” report, which gives an account of the 
institution’s core activities, main achievements and use of resources during the year. 

03 The role of the Secretariat-General is to provide appropriate resources, services 
and facilities to enable the ECA to accomplish its mission and strategic objectives. The 
Secretary-General is responsible for administration, staff management and the 
institution’s budget, as well as for language and publication services, training, buildings 
and facilities, the digital workplace, security and safety, medical and social assistance, 
and business continuity. 

04 The Secretariat-General comprises the following directorates and other 
departments: 

o 

o 

o 

the Directorate of Human Resources, Finance and General Services (SG1), which 
supports the ECA in seven main areas: human resources management, ethics, and 
diversity and inclusion; medical and social assistance; learning and development; 
business travel and transportation; catering, protocol and events; physical safety 
and security; and budget management and accounting; 

the Directorate of Information, Workplace and Innovation (SG2), which is 
responsible for the physical workplace (buildings, technical facilities, offices and 
logistics), the digital workplace (IT equipment, services and devices) and the ECA 
Library; 

the Language and Editorial Directorate (SG3), which provides the institution with 
translation from and into 24 languages, English editing and drafting services, 
language assistance for auditors going on mission, and publication services; 

 
 
5 

o 

o 

o 

o 

the team of the Data Protection Officer (DPO), which monitors compliance with 
EU data protection rules and promotes a culture of personal data protection; 

the team of the Information Security Officer (ISO), which is responsible for 
security governance and security planning, developing and implementing 
information security policy, mitigating information risks, and carrying out 
information security audits; 

the procurement team (PRC), which manages procurement procedures from start 
to finish, ensuring the efficient and legal use of financial resources and optimising 
planning in collaboration with operational departments; 

the Secretariat of the Court, whose main duties are to ensure that Court meetings 
are correctly prepared and followed up; 

o 

the cabinet of the Secretary-General (SGL). 

05 At the end of 2024, the Secretariat-General had 335 staff, who were assigned to 
the various directorates and departments as shown below. 

Figure 1 – Distribution of staff in the Secretariat-General 

Officials

Contract staff

Temporary staff

Seconded 
national experts

SG3

SG1

SG2

Secretariat

SGL 

DPO

ISO

PRC

Source: Directorate of Human Resources, Finance and General Services. 

Total staff 
per service

Total staff:
335

 
 
 
6 

06 In 2024, the Secretariat-General managed an initial budget of €185 280 890, or 
99.80 % of the total ECA budget of €185 655 890. The budget execution rate was high, 
at 97.69 % of final appropriations. Total payments came to €171 115 161 (94.52 % of 
commitments) – see Table 1. 

Table 1 – Budget managed by the Secretariat-General (euros) 

Directorate 

Human Resources, 
Finance and 
General Services 

Information, 
Workplace and 
Innovation 

Language and 
Editorial 

Initial 
budget 

Appropriations 
(final) 

Commitments 

% use 
(commitments/ 
appropriations) 

Payments 

168 706 360 

166 374 360 

162 275 820 

97.54 

161 258 261 

15 273 530 

17 905 530 

17 901 479 

99.98 

9 158 632 

1 301 000 

1 051 000 

863 647 

82.17 

698 268 

Total 

185 280 890 

185 330 890 

181 040 946 

97.69 

171 115 161 

Source: Data consolidated by the Directorate of Human Resources, Finance and General Services. 

07 The remaining ECA budget lines (concerned with communication, legal costs, and 
the costs of missions outside the Secretariat-General’s direct remit) are managed by 
the Directorate of the Presidency and the Legal Service. In 2024 the total initial budget 
was €375 000 (0.20 % of the total ECA budget) and the total final appropriations were 
€325 000. For details, see the “Other directorates/departments” section of this report. 

 
 
 
 
7 

The Secretariat-General’s main 
activities and achievements 

08 The Secretariat-General has contributed to the ECA’s strategy for 2021-2025 
adopting strategic development plans and setting priorities in its various areas of 
competence: IT, human resources, learning and development, language and 
publication services, data protection, information security, and facilities management. 
The development plans take account of the need for policies, services, and working 
and workplace arrangements that are suited to the reality of hybrid work. 
The main priorities are to: 

(1)  recruit, develop and retain highly qualified, knowledgeable and skilled employees, 

and keep them engaged and motivated throughout their career; 

(2) 

foster employee wellbeing by creating a safe and attractive working environment, 
providing support for staff, ensuring flexible working arrangements, and 
facilitating the transition from a physical to a virtual workplace; 

(3)  promote the digital transformation by adapting to the paradigm of hybrid working 
and using new technologies to modernise both audit and non-audit parts of the 
organisation, simplify procedures and increase productivity; 

(4)  ensure that budgetary resources are managed in accordance with the principles 

of economy, efficiency and effectiveness; 

(5)  provide prompt and high-quality language and publication services; 

(6) 

foster interinstitutional cooperation, through the identification of synergies, so as 
to develop and benefit from a common interinstitutional approach in all areas. 

 
 
8 

09 The implementation status of these priorities, reflected in business performance 
indicators, is presented below (see Table 2). 

Table 2 – Status of the Secretariat-General’s business performance indicators 

Priority 

Indicator 

Threshold 

2024 

Human Resources, Finances and General Services 

(1) 

Staff engagement index 

(1) 

Proportion of vacant posts 

(2) 

Average rate of response by 
HR Services Centre 

(2) 

Average training days per auditor 

(2) 

(4) 

Average training days per non-
auditor 

Obtain discharge for the 
management of the ECA budget and 
an unmodified audit opinion on the 
ECA’s financial statements 

Information, Workplace and Innovation 

(3) 

(3) 

System availability for critical 
systems 

Percentage of incidents resolved 
within 24 hours 

Language and Editorial 

(5) 

Percentage of translation deadlines 
met 

Information Security Officer 

(1) 

Phishing exercises per year 

Source: Directorates of the Secretariat-General. 

Level of engagement on a 
scale from 1 to 5. 
Green: stable or improving. 
2021: 3.54 
2022: 3.57 
2023: 3.63 
Green: ≤ 3 % 
Yellow: > 3 %, ≤ 5 % 
Red: > 5 % 
Green: ≥ 90 % 
Yellow: ≥ 75 %, < 90 % 
Red: < 75 % 
Green: ≥ 5 days 
Yellow: ≥ 4 days, < 5 days 
Red: < 4 days 
Green: ≥ 2 days 
Yellow: ≥ 1 day, < 2 days 
Red: < 1 day 
Green: discharge and 
unmodified audit opinion 
Red: no discharge and/or 
modified audit opinion 

Green: ≥ 99.5 % 
Yellow: ≥ 99 %, < 99.5 % 
Red: < 99 % 
Green: ≥ 95 % 
Red: < 95 % 

Green: ≥ 95 % 
Yellow: ≥ 90 %, < 95 % 
Red: < 90 % 

Green: ≥ 3 
Yellow: ≥ 1, < 3 
Red: < 1 

3.71 

2.49 % 

99.89 % 

5.79 days 

3.82 days 

Green 

99.91 % 

93.59 % 

99.44 % 

3 

 
 
9 

Directorate of Human Resources, Finance and General Services 

10 SG1 is responsible for the management of human resources, budget and finances, 
professional training, internal communication, medical services, security and safety, 
events, protocol and visits, and other general services at the ECA (transportation, post 
and printing). These management areas account for 90.87 % of the total ECA budget, 
mainly under the “remuneration and other entitlements” budget lines for Members 
and staff. 

11 During 2024, SG1 completed several selection procedures, including an internal 
competition for auditors, another for translators, and a call for expressions of interest 
for seconded national experts. It also saw three managerial selection procedures 
through to a successful conclusion: two for principal managers and one for a director. 

12 To address the Secretariat-General’s first priority, SG1 recruited a total of 
104 new members of staff: 40 officials, 31 temporary staff, 22 contract staff and 
11 seconded national experts. Forty of the new recruits were auditors. A total of 
21 auditors left the ECA during 2024 (including eight who retired or reached the end of 
their contracts). SG1 is closely monitoring the number of vacant posts and maintains 
regular contact with the audit chambers in this connection. There are plans to fill 
five vacant posts on 1 January 2025 from the current reserve list of Danish and 
Swedish-speaking auditors. Table 3 summarises the ECA’s recruitment activity during 
the past five years. 

Table 3 – New ECA Members and staff (2020-2024) 

2020 

2021 

2022 

2023 

2024 

TOTAL 

Members 

Officials 

Temporary staff 

Contract staff 

Seconded national experts 

Trainees 

3 

18 

21 

20 

3 

44 

1 

16 

21 

30 

13 

56 

5 

33 

47 

16 

11 

60 

3 

27 

47 

17 

4 

64 

TOTAL 

162 
Source: Directorate of Human Resources, Finance and General Services. 

109 

137 

172 

8 

40 

31 

22 

11 

64 

176 

20 

134 

167 

105 

42 

288 

756 

 
 
 
10 

13 The geographical balance of staff is still a major concern. After carefully assessing 
the situation, SG1 developed an action plan comprising 10 concrete measures to tackle 
current and future geographical imbalances at the institution. Outreach was stepped 
up by ensuring a presence at career fairs in under-represented member states. SG1 
also organised a first ever online presentation for potential trainees, met with the 
permanent representations of under-represented member states, and continued to 
play an active part in the interinstitutional project to make Luxembourg more 
attractive as a place of employment. 

14 Regarding learning and professional training, SG1 continued to organise audit 
and policy-area courses and presentations as a key priority. In cooperation with the 
ECA data team, it launched a new learning path on the use of AI in audit. It further 
improved “blended” and micro-learning courses by updating the content of e-learning 
modules for newcomers. 

15 In the area of budget and accounting, SG1 played an active part in 
interinstitutional projects relating to the ECA’s financial system, such as a SAP technical 
upgrade and a data retention management project, and it made significant progress on 
increasing the overall share of electronic invoices (above 60 % at year-end). The 
external auditors gave a clean opinion of the ECA’s 2024 financial statements in their 
report published on 30 April 2025. 

Directorate of Information, Workplace and Innovation 

16 SG2 is responsible for establishing and maintaining the ECA’s digital resources 
(IT equipment, services and devices) and physical workplace (buildings, technical 
facilities, offices and logistics), as well as stimulating innovation and managing the 
ECA Library. It manages 8.23 % of the total ECA budget, mainly on the “equipment, 
operating costs and services relating to data processing and telecommunications” 
budget line. 

17 In 2024, to provide the technological foundations for artificial intelligence (AI), 
SG2 launched a procedure to purchase IT infrastructure in the form of specialised 
servers and local computers and storage capacity for the new ECA innovation lab. 

18 In the area of knowledge management, a new tool known as the Document 
Reading Assistant (DORA) has been put into production. Access to the Orbis database 
through the Library has been granted to auditors on request, and some new apps have 
been developed in the ECA Data Warehouse, also in response to user requests. 

 
 
11 

19 The modernisation of the workspace has continued in several areas. Innovations 
to modernise mobile technologies and services have included a major revamping of 
the ECA’s identity and access management infrastructure and the introduction of 
Microsoft Authenticator as the tool for accessing cloud and EU Login applications. 
Windows Hello for Business has been rolled out to permit biometric authentication on 
Windows laptops. Lastly, there has been significant progress on equipping the ECA 
meeting rooms with hybrid meeting capabilities. 

20 SG2 has continued to maintain and upgrade the institution’s backbone 
IT infrastructure: powerful new servers have been purchased and incorporated into 
the data centre, IT storage capacity has been increased, and the firmware of the 
Fortinet external firewalls has been updated. The deployment of open app extensions 
has begun in MS Teams, and a pilot exercise has been launched to test the potential of 
Microsoft Copilot for the ECA. Finally, a start has been made on implementing the new 
regulation laying down measures for a high common level of cybersecurity at the EU 
institutions. 

21 In the area of sustainability, implementation of the EMAS action plan for 
2023-2025 has continued. The 2024 audit of EMAS was carried out successfully. Energy 
saving measures were applied during the summer break, including an increase in the 
temperature of air-conditioned areas and the deactivation of ventilation and cooling 
systems in some parts of the buildings. 

Language and Editorial Directorate 

22 SG3 is responsible for translating and publishing all ECA products in the EU’s 
24 official languages. The Directorate is committed to enhancing transparency, both 
internally and towards its stakeholders, while diversifying its activities to respond to 
other ECA departments’ needs (e.g. audit and communication). It manages 0.70 % of 
the total ECA budget, mainly on the “external services in the linguistic field” budget 
line. 

23 In 2024, SG3 continued to respond to the Secretariat-General’s priorities by 
further diversifying its activities outside the field of translation/revision, with new 
developments in language assistance for auditors, video subtitling and collaboration on 
communication. 

 
 
12 

24 The Directorate’s authoring, translation and publication output was 9.4 % higher 
than in 2023. A total of 227 802 pages (2 427 translation requests) were translated and 
revised. The year was marked by significant peaks in workload, both for translators and 
for the horizontal teams. The FastTrad service, which provides a 24-hour turnaround 
for the translation and editing of short texts in English and French, accounted for 
847 pages. 

25 Language assistance for auditors in connection with audit missions, a key area of 
SG3 diversification, has continued to develop. Most language assistance is now 
provided by SG3 translators, who have continued to work on their skills. 
Translators from 16 language teams completed 32 language assistance assignments in 
2024 – a total of 183 days’ work inclusive of preparation, mission days in 13 member 
states, and follow-up. 

26 The English Language Services team provided drafting assistance to the audit 
chambers for the vast majority of ECA products, as well as guidance during adversarial 
and pre-adversarial meetings. The team is part of the production chain at all stages of 
the reporting process, from helping with task plans to reviewing press releases 
announcing the publication of audit reports. These measures have strengthened the 
Directorate’s partnership with other internal stakeholders and further embedded 
linguistic expertise in critical operational processes. 

27 In 2024, SG3 strengthened its role as a partner in interinstitutional cooperation. 
It was closely involved in both the EU Summer School on Multilingualism and trainee 
study visits. These are important features of the Multilingualism Hub of Excellence, an 
initiative to enhance the attractiveness of Luxembourg as a pole of the European civil 
service. 

Data Protection Officer (DPO) 

28 The DPO reports directly to the Secretary-General and manages no expenditure. 
In 2024, the DPO team continued to monitor the ECA’s compliance with the EU Data 
Protection Regulation (EUDPR), provide expert knowledge of data protection law and 
practices, and advise ECA staff on data protection matters such as the notification of 
processing activities, privacy statements, risk assessments, personal data breaches, 
opinions and data subject requests. 

 
 
13 

29 The DPO also worked to raise awareness among ECA staff about data protection 
roles and responsibilities, including the emerging new legal framework governing 
artificial intelligence. 

Information Security Officer (ISO) 

30 The ISO does not manage any expenditure, and reports directly to the 
Secretary-General (also working closely with the IT security officers, the Registry 
Control Officer, the DPO, the archivist and the Safety and Security Service). 

31 In 2024, the ISO made significant progress on enhancing cybersecurity awareness 
and strengthening policy frameworks. Alongside these initiatives, the team contributed 
to updating several key policies, including the information security policy, basic user 
entitlements, the electronic signature policy and the e-content policy. It also 
developed new guidelines on managing sensitive information, EU classified 
information (EUCI), information security during audits, and limitations in eTranslation, 
and issued the ECAFiles security statement. Taken together, these efforts have 
strengthened the ECA’s cybersecurity system and ensured the better handling of 
sensitive and classified information. 

Procurement in the Secretariat-General 

32 In 2024, the ECA used one negotiated procedure under paragraph 11.1(b) of 
Annex I to the Financial Regulation to conclude a contract worth more than €60 000. 
The purpose of the contract was to renew the ECA’s Financial Times corporate 
subscription for 2024, and the contract value was €85 227. The FT is the most 
reputable English-language business newspaper and provides comprehensive 
information about EU policies; it has no reasonable equivalent or substitute. The 
current licence allows all staff to access the FT’s digital content both inside and outside 
the institution. 

33 The annual list of contracts, including those worth between €15 000 and €60 000 
and concluded in 2024 following a negotiated procedure, will be available on the 
ECA website by 30 June 2025. 

34 All negotiated procedures valued at more than €15 000 were subject to the ECA’s 
rigorous internal procedures covering legality, regularity and sound financial 
management. 

 
 
35 Also during 2024, we launched a call for tenders and finalised the public 
procurement procedure for a new framework contract for the partial externalisation of 
the security service. This contract came into force in January 2025. 

14 

 
 
 
 
15 

Results of the Secretariat-General’s 
internal control systems 

Internal control framework 

36 The ECA’s internal control framework supplements its legal framework (see 
paragraph 38). Its purpose is to align the legal framework with the globally recognised 
integrated internal control rules known as the COSO framework. It is designed to 
provide reasonable assurance regarding the legality, regularity and sound financial 
management of all financial transactions, and helps each directorate achieve its 
operational objectives. 

37 The five high-level components of the internal control systems designed and 
implemented by the Secretariat-General are summarised in Table 4. 

Table 4 – The Secretariat-General’s internal control systems 

Component 

Description 

Legal basis and procedures: all the legislation, ECA decisions, internal rules 
and procedures that frame the activity of the Secretariat-General. 
Information systems: all IT systems supporting the activity of the 
Secretariat-General. 
Operational controls of expenditure: ex ante controls to minimise potential 
errors. Carried out by the initiating, verifying and authorising officers of 
each budget line. 
Processes: procedures and structures to maximise effectiveness in the 
Secretariat-General’s activities. 

• Budget lines are examined to determine level of risk (low, medium, high). 

• Controls focus on medium and high-risk activities. 

• Controls are also made ex post (following payments or events) to detect 
and correct errors that might not have been detected ex ante, as well as 
weaknesses in the design of operational controls. 

• Controls to address the medium and high risks detected are planned 
every year as part of the annual control programme. 

• The results of each control are summarised in control reports and 
consolidated in the report accompanying each directorate’s declaration of 
assurance. 

• Management is informed of the errors identified, and action plans / 
system improvement recommendations are communicated to all staff. 

I. Control 
environment 

II. Risk 
assessment 

III. Control 
activities 

IV. Information 
and 
communication 

V. Monitoring 

Monitoring takes the form of follow-up of the results of ex ante and ex post 
controls. 

 
 
 
16 

I.  Control environment 

38 The Secretariat-General operates within a legal framework that includes: 
o 

the Financial Regulation; 

o 

o 

o 

o 

o 

the Staff Regulations; 

the ECA’s internal control framework; 

the ECA’s rules of procedure; 

internal rules for implementing the budget; 

the charter of tasks and responsibilities of authorising officers by sub-delegation 
(AOSDs); 

o 

all ECA decisions on the use of its human, material and financial resources. 

39 As the guardian of the EU’s finances, the ECA has significant public responsibility, 
which requires it to ensure that there is no legal or ethical infringement of the rules in 
the course of its activities (internal operations). In this connection, the ECA has 
adopted various internal rules that apply to the processes managed by each 
directorate, and especially by SG1. This ensures both that there is sufficient 
segregation of tasks in the processing of individual transactions, and that overall 
internal controls are effective. Fraud risk is dealt with as an integral part of the overall 
risk management and internal control framework. For example, according to 
principle 8 of the control framework, “the ECA considers the potential for fraud in 
assessing risks to the achievement of objectives”. 

40 There are no material weaknesses associated with the spending of the ECA’s 
operational budget. The use of standard and framework contracts significantly 
reduces the risk of fraud, errors and undetected conflicts of interest, and confirms the 
robustness of the management system, which is based on integrated software and 
includes a significant number of automatic controls, combined with the experience of 
the staff implementing and checking the ECA budget. For more information on the 
ECA’s controls to address fraud risk, please see Annex I. 

41 The calculation and management of the financial rights and salaries of Members 
and staff, and the payment of mission expenses, have been externalised to the 
Paymaster’s Office of the Commission (PMO). The PMO is the AOD for payroll, the 
management of retirement and survivor’s pensions, and invalidity allowances. 
All these activities together represent approximately 85 % of the ECA budget. 
SG1 supervises and checks the implementation of the service-level agreement with 
the PMO. 

 
 
17 

42 The internal control framework did not change significantly in 2024, and 
administrative procedures were also unchanged. For SG2, these are based on the 
principles of COBIT 51. They consist of management supervision, preventive and 
detection controls, and automated controls embedded in information systems 
covering all the Secretariat-General’s main business processes. 

43 Financial business processes are managed using SAP software, which allows a 
proper separation of tasks between initiation, verification and validation by authorising 
officers. The system covers budgetary management, fund reservations, commitments, 
purchase orders, and contract and invoice control, all of these in accordance with the 
Financial Regulation and the ECA’s internal rules and procedures. It also provides 
automated controls to prevent errors in the processing of financial data. Staff who 
initiate processes and carry out controls use specific checklists to assess compliance 
with the procedure for budgetary commitments and payment orders. 

II.  Risk assessment 

44 Since 2016, all audit chambers and directorates have been required to carry out a 
risk analysis of their activities, with a description of the potential impact if a risk 
materialises, the corresponding internal controls, and the action they have taken to 
reduce the likelihood of occurrence and the potential impact. Risk management action 
plans are considered in the design and implementation of ex ante and ex post 
controls. The results of these controls then feed into the annual declarations which all 
AOSDs contribute to the annual activity report, and into the following year’s risk 
assessments. The design of internal control systems also takes due account of the cost-
effectiveness of controls. 

45 The main risks identified by the risk assessment cycle for 2024 concern: 
o 

the impact of the external economic and political situation (e.g. disruption of 
supply chains, inflation and war) on the ECA’s resources and work patterns, 
including the adaptation to hybrid working and the safety and health of staff; 

o 

non-compliance with the Financial Regulation’s provisions on the legality and 
regularity of payments and the economy, efficiency and effectiveness of activities; 

1  COBIT 5 is an international IT governance framework. It structures IT tasks into generic 

processes and control objectives, and provides a framework for IT governance across the 
organisation. 

 
 
 
18 

o 

o 

o 

dependence on outsourcing and the quality of outsourced services (including 
those provided by the Commission); 

data breaches or non-compliance with data protection rules, including incidents 
caused by cyber-attacks; 

inadequate resource levels owing to restrictions on budget increases and 
difficulties in meeting recruitment needs while ensuring a satisfactory work/life 
balance for staff. 

III.  Control activities 

46 The precise mix of control activities is developed and updated each year after an 
evaluation of each process’s complexity and maturity level, the perceived inherent and 
control risk of each activity, the use of automated controls to mitigate risk, and the 
lessons learnt from previous control results. 

SG1 

47 SG1’s annual control programme was developed on the basis of the specific risk 
assessment for 2024, the results of internal controls carried out in 2023, exchanges 
with the PMO and the recommendations of the internal and external auditors, as well 
as other data from events that took place in 2023. 

48 Well-established and well-documented financial circuits and sub-delegations 
ensure that ex ante controls of transactions are adequate. Ex post controls are carried 
out in both financial and non-financial areas, covering topics such as missions, internal 
events and the representation costs of Members and staff, other payments from the 
budget lines managed by SG1, absences / leave and time management, and personal 
files (e.g. the presence and completeness of essential documents and updates) – 
see Table 5. 

 
 
19 

Table 5 – Summary of specific ex post control activities selected for 2024 

Category 

Financial activity 

Missions 

Budget line or activity 

Mission costs (reimbursement of mission expenses) for 
Members and staff 

Refunds of unused plane tickets 

Internal events 

Miscellaneous expenditure on internal meetings 

Representation costs 

Representation expenses 

Overall legality and 
regularity of payments from 
other budget lines 

Non-financial activity 

All budget lines managed by SG1 (excluding those covered 
above) 

Missions 

Authorisations 

Timeliness of approvals 

Consistency of time arrangements for missions 

Accounting reconciliation between MiPS+ and SAP 

Absences and time 
management 

Long-term sick leave 

Sick leave without medical certificate 

Unjustified absences 

Compensatory time off 

Friday afternoons 

Debit balance of working time 

Carry-over for part-time workers 

Teleworking limits in time recording 

Availability during core hours 

Personal files 

Outside activities of staff 

Occupational activities after leaving the institution 

Spouse employment declarations 

Source: SG1 annual control programme. 

SG2 

49 SG2 based its control programme on the results of the 2024 risk register review, 
the process maturity assessment, and the follow-up of internal audit 
recommendations. 

 
 
20 

50 In its budget implementation activities, SG2 refers to the applicable legal 
framework, which mainly consists of the Financial Regulation, internal budget 
implementation rules, and the charter of tasks and responsibilities of AOSDs. It makes 
ex ante controls to identify non-compliance with the Financial Regulation and any 
administrative or clerical errors (e.g. incorrect references, wrong dates in text fields, 
missing non-critical attachments). 

51 In 2024, SG2 made ex post controls in five areas: 
o 

legality and regularity of payment transactions in the area of facilities; 

o 

o 

reconciliation of the mobile phones inventory; 

compliance with project management procedures; 

o  management of IT licence renewals; 

o 

software vulnerability management (patch management). 

SG3 

52 The SG3 control programme was based on the risk analysis for 2024 and the 
results of controls for 2023. It focused on financial aspects and the quality of language 
services. Ex post controls covered: 

o 

o 

the legality and regularity of payments from the budget lines managed by SG3; 

the quality of translations provided, supplemented by an analysis of comments 
made in the form of user feedback. 

IV.  Information and communication 

53 All three SG directorates have established a programme of controls for evaluating 
compliance with the Financial Regulation and Court decisions, and the directors send 
annual declarations of assurance to the Secretary-General in their capacity as AOSDs. 
Additional declarations of assurance for 2024 were given by other ECA directorates, 
departments and Members’ offices which authorised expenditure during the year. 

54 The overall results of the Secretariat-General’s 2024 internal controls (both 
ex ante and ex post) reveal general compliance with the Financial Regulation, 
Court decisions, and internal procedures and policies. There are frequent staff 
communications on the rules for missions, time management, and the need to update 
personal files by declaring changes in their personal situation. There is also regular 
communication with relevant external parties on internal control matters. 

 
 
21 

V.  Monitoring 

55 All directorates have examined the results of their 2024 ex ante and ex post 
controls, and have found no major weaknesses in internal control systems. The 
directors have also reviewed the status of all pending internal audit recommendations 
to ensure they will be implemented by the stipulated deadline. 

56 Before signing his declaration of assurance in accordance with Article 74(9) of the 
Financial Regulation, the Secretary-General examined the information in the internal 
control reports sent by the three Secretariat-General directors, the seven other ECA 
directors and the Head of the Legal Service. 

57 None of the identified exceptions and cases of non-compliance are material, 
and they do not indicate any internal control weaknesses. Action plans for corrective 
measures / further improvements have been issued and their implementation will be 
followed up. The ECA’s senior management have also been notified of the risks 
detected. 

Results of controls 

Directorate of Human Resources, Finance and General Services 

58 The central organisation of PMO ex post controls has made it possible to simplify 
and harmonise the control methodology and results, thus increasing efficiency. The 
PMO takes samples for ex post controls on a random basis. It aims to detect any errors 
in the sampled files, calculate their financial impact and make the necessary 
corrections. 

59 In 2024, the main topic selected by the ECA for ex post control was the 
reimbursement of the mission expenses of Members and staff (see the summary in 
Table 5). Ex post verifications were carried out using the methodology put in place and 
coordinated by SG1 so as to ensure consistency in the control approach among all ECA 
directorates and other departments. 

 
 
22 

60 The controls covered a main representative sample of 80 missions divided into 
three strata on the basis of the risk assessment for 2024 (Members, non-private 
arrangements, and private arrangements). The sample was taken from a population of 
2 019 missions on which payments were made during 2024 – a total of roughly 
€2 million – but excluding missions with costs lower than €100, which are outside the 
scope of ex post controls. The missions thus excluded accounted for 30 % by number 
of all missions paid in 2024, and 2 % by value. 

61 A further part of the controls on missions consisted of horizontal ex post 
verifications to obtain additional assurance in respect of mission costs in 2024: 

o 

o 

o 

o 

o 

confirmation that mission orders and cost declarations were authorised by the 
relevant AOSD – controls on the main sample; 

verification that missions were authorised before the mission start date – 
controls on the main sample; 

consistency checks on the declarations of leave days, mission days and 
teleworking in, respectively, MiPS+ (missions application) and Sysper2 (time 
recording application) – controls on the main sample; 

follow-up of refunds for plane tickets bought by the travel agency but not used by 
the person going on mission – overall review; 

reconciliation checks between the costs shown as paid in MiPS+ and the 
accounting of mission costs in SAP – overall review. 

62 The missions of Members are also subject to an additional cross-check between 
representation costs and the declaration of meals while on mission. This is to prevent 
any double reimbursement for meals. 

63 All quantifiable errors were consolidated to produce an estimated level of error in 
mission costs before and after corrections. As well as extrapolating from the volume of 
errors found in the main sample of 80 missions, the error rate calculation took account 
both of the absolute volume of errors found in an extended sample that was taken to 
verify consistency with the cost declarations of other participants in the same missions 
(34 additional missions), and of supplementary controls of cost declarations by SG1 
and SG3 (38 additional missions). 

 
 
23 

64 The controls did not reveal any material errors. The estimated level of error for 
the ECA’s mission costs in 2024 (confidence level 80 %) is 1.07 % before corrections 
and 0.84 % after corrections (see Figure 2). 

Figure 2 – Estimated level of error in mission costs 

2.73 %

1.07 %

Materiality level of 2 %

2.50 %

0.84 %

Upper error limit

Estimated 
level of error

Lower error limit

0.00 %

0.00 %

Before corrections

After corrections

65 Financial errors were found in 15 missions in the main control sample and four 
missions in the extended sample checked for consistency. A further 30 financial errors 
were revealed by supplementary checks of cost declarations: 24 in SG1, and six in SG3. 

66 Please note that the above estimated level of error does not reflect the impact of 
the errors on the ECA budget. Of the 19 errors, 11 were overpayments and eight were 
underpayments. The estimated level of error in the ECA’s missions budget in 2024 
(confidence level 80 %) is 0.21 % before corrections and 0.00 % after corrections 
(see Figure 3). 

 
 
 
24 

Figure 3 – Estimated level of error in the ECA’s missions budget 

1.87 %

0.21 %

-1.46 %

1.66 %

0.00 %

-1.67 %

Materiality level of 2 %

Upper error limit

Estimated 
level of error

Lower error limit

Before corrections

After corrections

67 The total value of payment errors, without offsetting overpayments against 
underpayments for the same mission, was €4 7282. Of this amount, €4 525 was 
submitted to the PMO for correction3 (the remainder being errors deemed too 
insignificant to warrant the cost of correction). The residual (net) impact of the total 
errors on the ECA’s 2024 budget for missions (overpayments minus underpayments) 
was €4 204. 

68 The errors found most frequently in the main control sample (15 cost 
declarations with errors totalling €1 063, mainly overpayments) related to hotel costs 
(nine incorrect reimbursements because breakfast costs / local taxes were treated 
wrongly) and travel costs (five instances where the notional journey / private 
arrangement rules were not applied, e.g. to the cost of a plane ticket). 

69 Controls on the extended sample revealed four cost declarations with errors 
totalling €56 in absolute figures, mainly overpayments, relating to the incorrect 
calculation of hotel costs (wrong treatment of breakfast costs) and the reimbursement 
of daily allowances and taxi fares. 

70 The controls also revealed weaknesses in the main sample concerning the 
approval of nine cost declarations (non-financial errors). Seven of these errors related 
to incomplete supporting documentation: two to hotel invoices not attached or not 

2  €1 063 in the main control sample (mainly overpayments), €56 in the extended sample 

(mainly overpayments), €372 detected by SG3 (mainly overpayments), and €3 237 detected 
by SG1 (only overpayments subject to correction by the PMO). 

3  €932 in the main control sample, €356 detected by SG3, and €3 237 detected by SG1. 

 
 
 
 
25 

issued in the correct name; two to missing boarding passes; and three to missing 
support for a hotel. 

71 Overall, the ex post controls of the legality and regularity of payments made 
from the budget lines managed by SG1 showed that the payments were legal and 
regular, and that the documentation procedures were duly followed. 

72 The exception and non-compliance register included one exception, relating to a 
procedure not correctly followed for a payment of €352.03 on the 
“miscellaneous expenditure on internal meetings” budget line, and the following 
eight non-compliance events: 

(1)  Reimbursement of mission costs: the total value of errors, without offsetting 
overpayments against underpayments for the same mission, was €4 728. The 
residual (net) impact of the total errors on the ECA’s 2024 budget for missions 
(overpayments minus underpayments) was €4 204. 
The overall error rate is below the materiality threshold of 2 %, both before and 
after corrections, and controls on mission costs did not reveal any significant 
weaknesses. 

(2)  AOSD authorisation for missions: one mission order was approved by a member 

of staff who did not have valid delegation (total value €794.50). In the end, the 
cost declaration was correctly approved. This represents 1.25 % of the total 
number of mission orders in the control sample. 

(3)  Authorisation prior to the start of a mission: one mission order was signed after 
the start of the mission, but before the first meeting (1.25 % of the control 
sample, value €177.20). 

(4)  Accounting reconciliation between MiPS+ and SAP: a temporary negative 

difference between the costs paid in MiPS+ and the actual amount recorded in 
SAP, equivalent to €38 990.33 (1.7 % of the SAP amount). 

(5)  Payments: five legal commitments made before the corresponding budgetary 

commitments (total €22 163.05). 

(6)  Payments: one payment made in 2024 related to expenses incurred in 2023 

(€475.57). 

(7)  Teleworking 

o 

Exceeding the limit of 10 working days per month at the declared residence: 
55 cases (0.60 % non-compliance rate); 

 
 
26 

o 

Exceeding the limit of five working days per month of teleworking from 
outside the main place of residence: 12 cases (0.37 % non-compliance rate). 

(8)  Personal files (occupational activity after leaving the institution): three former 
staff reported that they were undertaking a post-ECA activity, although the 
corresponding data was not updated in their electronic personnel file. These 
cases were resolved during the control period. 

Directorate of Information, Workplace and Innovation 

73 Overall, SG2’s ex ante controls on financial transactions in SAP in 2024 did not 
reveal any significant errors. Out of 2 075 SAP transactions, comprising purchase 
orders, payment requests and invoices, only 61 were returned to the staff concerned 
for correction. Most rejections of purchase orders and invoices were triggered by a 
failure to attach documentation in SAP or some other administrative error. 

74 SG2’s ex post controls in 2024 proved the robustness of the Directorate’s internal 
control systems. None of the controls revealed any significant problems. Detailed 
results are provided in Table 6. 

Table 6 – Results of SG2 ex post controls 

Control 
Legality and 
regularity of 
payment 
transactions in 
the area of 
facilities 

Reconciliation 
of the mobile 
phones 
inventory 

Compliance 
with project 
management 
procedures 

Results 

The results were satisfactory and confirm the soundness of SG2’s 
financial management. Some minor exceptions without a financial 
impact were identified, in particular in relation to delays in the payment 
workflow after the recording of invoices in SAP. 

Comparison of the two inventory sources was completed. The 
differences showed that all active mobile phones are included in the 
accounting inventory in SAP – some, however, with a wrong asset code. 
A few differences were caused by manual interventions in the Service 
Desk inventory. 
Controls showed that the start of almost all projects was dependent on 
the prior publication of a project charter or project initiation report, and 
that an estimated end date was always given. Some weaknesses were 
found, resulting in recommendations on: project progress reporting in 
the PMO application; the need for project changes to be accompanied 
by information about the steering committee’s meetings and decisions; 
a new function in the PMO application to notify project managers 
automatically when a project’s initial end date is past but its status is 
still not “Closed”. 

 
 
27 

Control 

Results 

Management 
of IT licence 
renewals 

Software 
vulnerability 
management 
(patch 
management) 

Controls did not reveal any significant failings, but confirmed that the 
renewal procedure had consistently conformed to the practice of 
having service managers validate each renewal to ensure that all 
necessary IT licences are renewed on time and in sufficient quantity. 
The only recommendation was to expand information requests to 
service managers by requiring them explicitly to justify the need for 
renewal and give a brief description of the rationale for requesting each 
licence. 
Analysis of the vulnerabilities discovered and followed up in 2024 
showed that 14 could be deemed relevant threats to the ECA’s IT 
infrastructure; they were addressed accordingly. Eleven of these 
vulnerabilities were remediated strictly as required by the patch 
management standard, and 12 were addressed with no significant 
delay. It was recommended that the standard be updated to ensure its 
continued relevance (last previous update 2018), and that a dashboard 
be developed in ServiceNow to monitor the corresponding KPIs. 

Source: 2024 report on the results of SG2’s internal control systems. 

Language and Editorial Directorate 

75 Overall, SG3’s ex post controls of the legality and regularity of payments made 
from the budget lines for which the Directorate is responsible showed that payments 
were legal and regular, and that documentation procedures were duly followed. 

76 The two components of SG3’s quality control and assurance system are 
ex post controls of translations and user feedback. Together, they provide a 
comprehensive external assessment, both by translation peers working in the EU 
institutions and by those actually requesting translation services. 

77 In 2024, the Committee of the Regions’ Translation Directorate assessed the 
quality of ECA translations. This ex post review covered translations by all except the 
English language team, whose work is rather different in nature. For each of the 
23 other teams, ten documents were selected as a representative sample of the main 
types of ECA products, and two pages from each document were then checked (a total 
of 460 pages). The evaluations were generally very good. Of the 230 translations 
reviewed, only nine scored lower than 70 %, and corrective action was taken where 
needed. 

78 Secondly, translation quality was assessed by gathering feedback from the 
Directorate’s internal and external clients. Given the largely positive results, the 
principal managers of all language teams concluded that their translations were of 
acceptable quality and gave declarations of assurance. 

 
 
28 

79 As in 2023, there were additional quality controls on the visuals of six reports 
that were ready for publication, focusing on the intelligibility of text and graphics, 
compliance with conventions for the cover page, and a more detailed analysis of text 
(e.g. compliance with the rules on footnotes, hyperlinks, and visual elements). 
No major issues were detected. 

80 In 2024, a comprehensive review of missions performed by SG3 staff and 
including private arrangements, which accounted for 14 out of 31 missions, revealed 
six errors with a financial impact. SG1 has consolidated these errors as part of its error 
rate calculation for the ECA as a whole. 

Other directorates/departments 

81 The Directorate of the Presidency (DOP) is responsible for the ECA budget line 
covering communication and interinstitutional relations. In 2024 it had an initial 
budget of €275 000 (0.15 % of the total ECA budget) and final appropriations of 
€225 000. The Legal Service manages the budget line for legal costs and damages, 
which came to €100 000 in the initial budget (0.05 % of the total ECA budget) and the 
same amount in final appropriations. Internal controls did not reveal any significant 
errors on these budget lines. 

82 The remaining ECA directorates/departments do not manage any expenditure 
and are mainly responsible for the authorisation by sub-delegation of mission costs, 
for which the corresponding directors and heads of cabinet provide declarations of 
assurance to the Secretary-General. 

Conclusion regarding the efficiency and effectiveness of 
internal control systems 

83 The programme of ex ante and ex post controls for 2024 showed that the 
Secretariat-General’s internal control systems were effective and functioned 
efficiently, and that its directorates were able to manage financial and non-financial 
risks. Only non-material errors were identified, as was the need to revise some 
procedures. 

84 The allocated resources were targeted to ensure that the main internal control 
systems (effectiveness, efficiency and economy of operations; reliability of reporting; 
prevention, detection, correction and follow-up of fraud and irregularities) were 

 
 
29 

achieved, and ultimately to help fulfil the business performance indicators shown in 
Table 2. 

85 The total estimated cost of controls in terms of the volume of allocated resources 
was 23.8 full-time equivalents (FTEs) in the case of the three Secretariat-General 
directorates, and 2.5 FTEs in that of other ECA directorates and departments4. The 
total financial cost (based on the weighted average annual basic salary of the staff 
carrying out the controls) was approximately €1.91 million in the case of the three SG 
directorates, and €0.22 million in that of other ECA directorates/departments5. These 
figures are deemed reasonable, given the overall mix of control activities mentioned in 
this report. 

86 This conclusion also demonstrates the robustness of the management system, 
which is based on integrated software and includes a significant number of automatic 
controls, combined with the experience of the staff implementing and checking the 
ECA budget. 

4  These totals are the sum of 22.1 FTEs for ex ante controls and 1.7 FTEs for ex post controls 
by the three SG directorates, and 2.4 FTEs for ex ante controls and 0.1 FTEs for ex post 
controls by other ECA directorates/departments. 

5  The estimated total euro equivalent amount is the sum of around €1.77 million for ex ante 

controls and €0.14 million for ex post controls by the three SG directorates, and 
€0.20 million for ex ante controls and €0.02 million for ex post controls by other ECA 
directorates/departments. 

 
 
 
 
 
30 

Accountability 

Overview of the ECA budget 

87 The ECA is financed under the administrative expenditure heading of the EU 
budget. The ECA’s budget share represents around 1.5 % of the EU’s total 
administrative spending, and less than 0.1 % of all EU expenditure. 

88 In 2024, this gave the ECA a budget of approximately €185.7 million (6.05 % 
more than in 2023). The overall budget execution rate was high: 97.65 % of final 
appropriations (2023: 98.04 %), and payments of €171 309 655 representing 94.49 % 
of commitments (2023: €161 910 247 and 94.34 %). An overview of the 
implementation of the 2024 budget is presented in Table 7, and a comparison with 
2023 is in Table 8. 

89 In 2024, the utilisation rate for appropriations under Title 1 “People working 
with the institution” was 97.71 % (2023: 98.20 %). For staff missions, representing 
51.45 % of final appropriations from Chapter 16 “Other expenditure relating to 
persons working for the institution”, the utilisation rate was 88.54 %. The ECA takes all 
necessary steps to ensure that mission appropriations are used strictly in accordance 
with the principles of economy, efficiency and effectiveness. 

90 The 2024 utilisation rate for Title 2 “Buildings, movable property, equipment 
and miscellaneous operating expenditure” appropriations was 97.13 % (2023: 
96.84 %), including appropriations carried over by decision. While most chapters show 
a relatively high utilisation rate, the rate for Chapter 25 “Meetings and conferences” 
was somewhat lower. This can be explained by an increase in the use of internal 
resources for interpretation during audit missions, as well as fewer than expected 
meetings and events. 

 
 
31 

Table 7 – Implementation of the 2024 budget (euros) 

2024 FINANCIAL YEAR 

Initial 
budget 

Appropriations 
(final) 

Commitments 

% use 
(commitments/ 
appropriations) 

Payments 

Title 1: People working 
with the institution 
10 – Members of the 
institution 
12 – Officials and 
temporary staff 
14 – Other staff and 
external services 
162 – Missions 
161 + 163 + 165 – Other 
expenditure relating to 
persons working for the 
institution 

Subtotal Title 1 
Title 2: Buildings, movable 
property, equipment and 
miscellaneous operating 
expenditure 
20 – Immovable property 
210 – IT&T 
212 + 214 + 216 – Movable 
property and associated 
costs 
23 – Current 
administrative expenditure 
25 – Meetings and 
conferences 
27 – Information and 
publishing 

12 528 000 

12 163 000 

11 558 501 

95.03 

11 448 292 

140 377 000 

139 527 000 

137 138 231 

98.29 

137 138 231 

10 101 360 

9 463 360 

9 027 579 

95.40 

8 838 210 

2 590 000 

2 590 000 

2 293 093 

88.54 

2 030 093 

2 441 000 

2 444 000 

2 371 617 

97.04 

1 942 630 

168 037 360 

166 187 360 

162 389 021 

97.71 

161 397 456 

4 809 530 
8 895 000 

6 256 530 
9 480 000 

6 256 087 
9 480 000 

99.99 
100.00 

2 900 388 
5 151 560 

933 000 

1 156 000 

1 101 925 

95.32 

516 754 

630 000 

695 000 

590 997 

85.04 

436 889 

516 000 

416 000 

146 491 

35.21 

107 241 

1 835 000 

1 465 000 

1 333 798 

91.04 

799 367 

Subtotal Title 2 

17 618 530 

19 468 530 

18 909 298 

97.13 

9 912 199 

Total ECA 

185 655 890 

185 655 890 

181 298 318 

97.65 

171 309 655 

 
 
 
 
 
Table 8 – 2024 vs. 2023 comparative budget figures (euros) 

2024 FINANCIAL YEAR 

2024 

2023 

32 

Title 1: People working 
with the institution 
10 – Members of the 
institution 
12 – Officials and 
temporary staff 
14 – Other staff and 
external services 
162 – Missions 
161 + 163 + 165 – Other 
expenditure relating to 
persons working for the 
institution 

Subtotal Title 1 
Title 2: Buildings, movable 
property, equipment and 
miscellaneous operating 
expenditure 
20 – Immovable property 
210 – IT&T 
212 + 214 + 216 – Movable 
property and associated 
costs 
23 – Current administrative 
expenditure 
25 – Meetings and 
conferences 
27 – Information and 
publishing 

Subtotal Title 2 

12 528 000 

11 777 000 

140 377 000 

131 876 422 

10 101 360 

2 590 000 

9 779 000 

2 452 500 

2 441 000 

2 601 000 

168 037 360 

158 485 922 

4 809 530 
8 895 000 

933 000 

630 000 

516 000 

1 835 000 

17 618 530 

4 274 000 
8 452 325 

893 675 

588 000 

580 000 

1 786 000 

16 574 000 

Total ECA 

185 655 890 

175 059 922 

Note: All figures in this table relate to the initial budget. 

 
 
 
 
 
 
33 

External audit 

91 The ECA’s annual accounts are audited by an independent external auditor. 

92 The external auditor – ACG Auditing & Consulting Group S.r.l. – published its 
report on the ECA accounts for the 2024 financial year on 30 April 2025, issuing a clean 
opinion. 

External auditor’s opinions – 2024 financial year 

Regarding the ECA’s financial statements: 

“In our opinion, the financial statements give a true and fair view of the financial 
position of the Court as at December 31 2024, and of the results of its operations, 
its cash flows and the changes in net assets for the year then ended, in accordance 
with Regulation (EU, Euratom) 2024/2509 of the European Parliament and of the 
Council of 23 September 2024, (OJ L, 2024/2509, 26.9.2024).” 

Regarding the ECA’s use of resources and control procedures: 

“Based on the work described in this report, in our opinion, the Court has complied, 
in all material respects, with the criteria described above: 

o 

o 

The resources assigned to the Court have been used for their intended 
purposes; 

The control procedures in place provide the necessary guarantees to 
ensure the compliance of financial operations with the applicable rules 
and regulations.” 

 
 
 
 
 
34 

Declaration by the authorising officer 
by delegation 

93 I, the undersigned, Secretary-General of the European Court of Auditors, in my 
capacity as authorising officer by delegation, hereby: 

o 

o 

declare that the information contained in this report is true and accurate; and 

state that I have reasonable assurance that: 

— 

— 

the resources assigned to the activities described in this report were used for 
their intended purpose and in accordance with the principles of sound 
financial management; 

the control procedures in place provide the necessary guarantees concerning 
the legality and regularity of the transactions underlying the accounts and 
ensure that allegations of fraud, or suspected fraud, are handled 
appropriately; and   

— 

the costs and benefits of controls are proportionate. 

94 This assurance is based on my judgment and on the information at my disposal, 
such as the reports and declarations of the authorising officers by sub-delegation, the 
reports of the internal auditor and the reports of the external auditor for previous 
financial years. 

95 I confirm that I am not aware of anything not reported here which could be 
detrimental to the interests of the institution. 

Luxembourg, June 2025 

Zacharias Kolias 
Secretary-General 

 
 
 
 
 
35 

Annexes 

Annex I – The ECA’s internal control framework 

Introduction 

01 As the guardian of the European Union’s finances, the ECA has significant public 
responsibility, which requires it to ensure that there is no legal or ethical infringement 
of the rules in the course of its activities (internal operations). In this connection, the 
ECA has adopted various internal rules that apply to the processes managed by its 
directorates and other departments. This ensures both that there is sufficient 
separation of tasks in the processing of individual transactions and that overall 
internal controls are effective. Fraud risk is dealt with as an integral part of the overall 
risk management and internal control framework. 

02 The ECA’s internal control framework supplements its legal framework. Its 
purpose is to align the legal framework with the globally recognised integrated 
internal control rules (known as the COSO framework). It is designed to provide 
reasonable assurance regarding the legality, regularity, and sound financial 
management of all financial transactions, and helps each directorate achieve its 
operational objectives. 

03 A total of 17 internal control principles are targeted to ensure that the main 
internal control system objectives (i.e. effectiveness, efficiency and economy of 
operations; reliability of reporting; prevention, detection, correction and follow-up of 
fraud and irregularities) are achieved, and ultimately to help fulfil the business 
performance indicators. For example, principle number 8 of the ECA’s internal control 
framework states that “the ECA considers the potential for fraud in assessing risks to 
the achievement of objectives”. 

04 Even though the control principles and characteristics are straightforward, the 
actual implementation of the internal control framework, and therefore also assessing 
its implementation, are likely to vary for audit and non-audit activities. 

 
 
36 

05 Effective implementation of the ECA’s internal control principles is assessed using 
many sources of evidence: business process reviews, an exception register, reporting 
of internal control weaknesses through ex ante and ex post controls, management 
supervision and ad hoc verification, surveys and interviews, management self-
assessment, audit reports, and stakeholder feedback. 

Internal control systems 

06 The Financial Regulation states that the budget must be implemented in 
compliance with effective and efficient internal control. The Secretariat-General and 
operational management are responsible for demonstrating that internal controls are 
in place and that they mitigate potential risks. 

07 The ECA must carry out regular and specific assessments to ascertain whether the 
internal control systems and components thereof are in place and functioning 
properly. It must assess the design and functioning of all internal control components 
at least once a year. 

08 Below is a summary of the five high-level components of the internal control 
systems designed and implemented by the Secretariat-General. These are taken into 
account by the authorising officers by sub-delegation for their annual declarations of 
assurance (including to prevent and detect internal fraud). 

 
 
37 

The 5 components of the Secretariat-General’s internal control systems 

Component 

Description 

Legal basis and procedures: all legislation, ECA decisions, and internal 
rules and procedures that frame the activity of the Secretariat-General. 
Information systems: all IT systems supporting the activity of the 
Secretariat-General. 
Operational checks of expenditure: ex ante checks to minimise potential 
errors. Carried out by the initiating, verifying and authorising officers of 
each budget line. 
Processes: procedures and structures to maximise effectiveness in the 
Secretariat-General’s activities. 
• Budget lines are examined to determine the level of risk (low, 
medium, high). 
• Controls focus on medium and high-risk activities. 
• Checks are also made ex post (following payments or events) to 
detect and correct errors that might not have been detected ex ante, as 
well as weaknesses in the design of operational controls. 
• Checks to address the medium and high risks detected are planned 
every year as part of the annual control programme. 
• The results of each check are summarised in control reports and 
consolidated in the report accompanying each directorate’s declaration 
of assurance. 
• Management is informed of the errors identified, and the action plans 
/ system improvement recommendations are shared with all staff. 
Monitoring takes the form of follow-up of the results of ex ante and 
ex post checks. 

I. Control 
environment 

II. Risk 
assessment 

III. Control 
activities 

IV. Information 
and 
communication 

V. Monitoring 

09 The controls in the ECA’s internal control framework are designed to provide 
reasonable assurance on the achievement of the objectives defined in the Financial 
Regulation regarding: 

(a)  effectiveness, efficiency, and economy of operations; 

(b)  reliability of reporting; 

(c)  safeguarding of assets and information; 

(d)  prevention, detection, correction and follow-up of fraud and irregularities; 

(e)  adequate management of the risks relating to the legality and regularity of the 

underlying transactions. 

10 Financial business processes are managed using SAP software, which allows a 
proper “four-eyes principle” (approval by at least two staff members) and separation 
between initiation, verification and validation by authorising officers. The system 
covers budgetary management, fund reservations, commitments, purchase orders, 

 
 
 
38 

and contract and invoice control, all of these in accordance with the Financial 
Regulation and the ECA’s internal rules and procedures. It also provides automated 
checks to prevent errors when processing financial data. Staff who initiate processes 
and carry out checks use specific checklists to assess compliance with the procedure 
for budgetary commitments and payment orders. 

11 New auditors are given an introductory course on how to deal with suspected 
fraud and this is offered twice a year. All ECA staff and Members must attend training 
to raise awareness about ethical guidelines and the ECA’s code of conduct. 

Fraud risk assessment 

12 Assessment of fraud risk is an integral part of the risk management process. The 
assessment covers monitoring risk incidents, a description of their impact, the internal 
checks put in place, and measures to reduce the likelihood of risk incidents and lessen 
their impact if they do occur. Where relevant, risk management action plans are drawn 
up and these are taken into account when designing and implementing ex ante and 
ex post checks. 

13 Each directorate or department undergoes an annual risk assessment covering all 
risk categories. This includes the risk of certain types of fraud (e.g. incorrect requests 
for payments or reimbursements as a result of staff not following the rules, or 
incorrect authorisations in the ECA’s systems), which, if it came about, could lead to 
financial loss, reputational damage or legal action against the ECA. A control 
programme with a series of checks is also planned every year and may focus on fraud 
issues, depending on the context at the time. 

14 There are no material weaknesses associated with the spending of the ECA’s 
operational budget. The use of standard and framework contracts significantly reduces 
the risk of fraud, errors and undetected conflicts of interest, and confirms the 
robustness of the management system, which is based on integrated software and 
includes a significant number of automatic checks, combined with the experience of 
the staff implementing and checking the ECA budget. 

15 Well-established and well-documented financial circuits (initiation, verification 
and authorisation of financial transactions) and sub-delegations (responsibilities) 
ensure that ex ante checks are adequate. Ex post checks are carried out in both 
financial and non-financial areas covering topics such as missions of ECA staff and 
Members (e.g. authorisations, timeliness of approvals, consistency of working time 

 
 
39 

arrangements); leave, absences and time management (e.g. teleworking limits when 
recording working time, availability during core hours); and personal files (e.g. the 
presence and completeness of essential documents and updates). 

16 The calculation and management of financial rights and salaries of Members and 
staff, and the payment of mission expenses, have been externalised to the Paymaster’s 
Office of the Commission (PMO). The PMO is the authorising officer by delegation for 
the payroll, the management of retirement and survivors’ pensions, and invalidity 
allowances. All these activities together represent approximately 85 % of the ECA 
budget, and this arrangement makes any form of collusion that could lead to fraud 
much more difficult. 

17 The ECA’s anti-fraud strategy primarily focuses on training and awareness-raising. 
However, another important aspect is maintaining the highest level of ethical and 
organisational values amongst ECA staff and Members, in particular ethical conduct, 
integrity, avoiding conflicts of interest, preventing fraud and reporting irregularities. 

18 Whilst recognising that it is not possible to prevent fraud entirely, the ECA is 
firmly committed to applying a zero-tolerance approach towards fraud. Once there are 
indications that fraud may have occurred, the case will be immediately prioritised for 
further action. 

Internal audit 

19 The ECA’s Internal Audit Committee plays a crucial role in the internal governance 
and oversight of the institution. This committee is structured to ensure independence 
and objectivity when assessing the ECA's internal controls and risk management 
processes. Its members are selected from both within and outside the ECA, ensuring 
an internal and external perspective in its work. Committee members include internal 
auditors and often external experts with audit and financial management experience. 

20 The committee has a clearly defined mandate which includes reviewing and 
monitoring internal audit activities, assessing the effectiveness of internal control 
systems, and reviewing risk management procedures. The committee meets regularly 
to discuss internal audit reports, assess compliance with previous recommendations 
and plan future internal audits. In addition, the committee has the authority to request 
additional information and conduct specific investigations if necessary. 

 
 
40 

21 The work of the Internal Audit Committee focuses on assessing the efficiency and 
effectiveness of the ECA's internal controls, making sure that processes and 
procedures are adequate to mitigate risks and ensure the integrity of financial 
operations. The committee conducts periodic audits and ad hoc reviews to identify 
areas for improvement and ensure that recommendations are effectively 
implemented. The committee's reports highlight the strengths and weaknesses of 
internal controls, providing a sound basis for continuous improvement. 

22 The outcomes of ECA Internal Audit Committee work are reflected in improved 
management and control processes at the ECA. The committee's reports and 
recommendations contribute to strengthening internal governance and improving 
transparency and accountability. By implementing the committee's recommendations, 
the ECA can reduce risks, improve operational efficiency, and ensure that public 
resources are managed effectively and accountably. Ultimately, the work of the 
Internal Audit Committee helps to maintain confidence in the ECA's ability to fulfil its 
mission of auditing the European Union's finances in a rigorous and objective manner. 

 
 
 
 
Annex II – Report on budgetary and financial management for 
2024 
Please click here to access the document. 

41 

 
 
COPYRIGHT 

© European Union, 2025 

The reuse policy of the European Court of Auditors (ECA) is set out in ECA Decision 
No 6-2019 on the open data policy and the reuse of documents. 

Unless otherwise indicated (e.g. in individual copyright notices), ECA content owned by 
the EU is licensed under the Creative Commons Attribution 4.0 International 
(CC BY 4.0) licence. As a general rule, therefore, reuse is authorised provided 
appropriate credit is given and any changes are indicated. Those reusing ECA content 
must not distort the original meaning or message. The ECA shall not be liable for any 
consequences of reuse. 

Additional permission must be obtained if specific content depicts identifiable private 
individuals, e.g. in pictures of ECA staff, or includes third-party works. 

Where such permission is obtained, it shall cancel and replace the above-mentioned 
general permission and shall clearly state any restrictions on use. 

To use or reproduce content that is not owned by the EU, it may be necessary to seek 
permission directly from the copyright holders. 

Software or documents covered by industrial property rights, such as patents, 
trademarks, registered designs, logos and names, are excluded from the ECA’s reuse 
policy. 

The European Union’s family of institutional websites, within the europa.eu domain, 
provides links to third-party sites. Since the ECA has no control over these, you are 
encouraged to review their privacy and copyright policies. 

Use of the ECA logo  

The ECA logo must not be used without the ECA’s prior consent. 

PDF 

ISBN 978-92-849-5327-1 

ISSN 2811-7875 

doi:10.2865/1208288  QJ-01-25-034-EN-N 

 
 
 
 
 
 
 
 
HOW TO CITE 

European Court of Auditors, 2024 – Activity report of the authorising officer by 
delegation, Publications Office of the European Union, 2025.