REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL AND THE COURT OF AUDITORS Annual report to the Discharge Authority on internal audits carried out in 2025
Date: 2026-06-15
Institutions: European Commission, Secretariat-General
Subjects: activity report, administrative check, audit, budgetary discharge, financial year, fraud against the EU, management audit

EN 

  EN 

   EUROPEAN COMMISSION  Brussels, 15.6.2026  COM(2026) 279 final  REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL AND THE COURT OF AUDITORS                    Annual report to the Discharge Authority on internal audits carried out in 2025 {SWD(2026) 149 final}  
 
 
Table of contents 

OBJECTIVE AND SCOPE OF THE REPORT............................................................................................................ 2 

THE INTERNAL AUDIT SERVICE .............................................................................................................................. 2 

OVERVIEW OF THE AUDIT WORK .......................................................................................................................... 4 

OVERALL RESULTS BASED ON THE AUDIT WORK PERFORMED IN 2025 ................................................. 6 

Overall results on performance ........................................................................................................................................................... 6 
Overall conclusion on the Commission’s financial management .................................................................................... 9 
ACTIONS TAKEN BY AUDITEES ............................................................................................................................ 11 

CONSULTATION WITH THE COMMISSION’S FINANCIAL IRREGULARITIES PANEL ............................... 12 

 
 
 
 
 
Objective and scope of the report 

This report informs the European Parliament and the Council about internal audits carried out in 2025 by 
the  European  Commission’s  Internal  Audit  Service  in  51  organisational  entities:  directorates-
general, services,  EU offices, and executive agencies (1). It is an input to the discharge procedure and 
contains: (a) a summary of the number and type of internal audits carried out; (b) a synthesis of the principal 
recommendations  made;  and  (c)  the  actions  taken  on  those  recommendations.  In  accordance  with  Articles 
118(8)  and  253  of  the  Financial  Regulation  (2),  the  Commission  is  forwarding  the  report  to  the  European 
Parliament  and to  the  Council.  It  is based  on  the  report  drawn  up  in  accordance  with  Article  118(4)  of  the 
Financial  Regulation  by  the  Commission’s  Internal  Auditor  on  Internal  Audit  Service  audits  and  other 
engagement reports completed in 2025 (3). 

Furthermore,  as  required  by  Article  118(5)  of  the  Financial  Regulation,  the  report  focuses  on  the  overall 
compliance with the principles of sound financial management and performance by providing the overall results 
on performance and an overall conclusion on financial management (Section 4) (4) and highlights any systemic 
problems detected by the Commission’s financial irregularities panel (Section 5).  

The Internal Audit Service 

The  Internal  Audit  Service  is  an  independent  service  in  the  Commission  and  is  led  by  the  Commission’s 
Internal Auditor.  

Under its mandate stemming from the Financial Regulation, the Internal Auditor advises the Commission on 
dealing with risks, by assessing:  

• 

• 

• 

the suitability and effectiveness of internal management systems; 

the performance of departments in implementing policies, programmes and actions; 

the  efficiency  and  effectiveness  of  the  control  and  audit  systems  applicable  to  all  budget 
implementation operations. 

The mission of the Internal Audit Service is to strengthen the Commission's ability to create, protect, and 
sustain  public  value  –  as  a  modern,  accountable  and  performance-oriented  institution  –  by  providing 
independent, risk-based, and objective assurance, advice, insight, and foresight. 

(1)  The report does not cover the European External Action Service, the European Data Protection Supervisor, the European 
Public  Prosecutor’s  Office,  the  European  Peace  Facility,  decentralised  EU  agencies,  EU  joint  undertakings  or  other 
autonomous bodies that are audited by the Internal Audit Service. They receive separate reports where relevant. 
(2)  Regulation (EU, Euratom) 2024/2509 of the European Parliament and of the Council of 23 September 2024 replacing 

Regulation (EU, Euratom) 2018/1046 (Article 247). 

(3)  The audit reports finalised between 1 February 2025 and 31 December 2025 are included in this report, except for the 
audit  on  human  resources  management  in  the  Directorate-General  for  Financial  Stability,  Financial  Services,  and 
Capital Markets Union for which the final audit report was issued on 10 March 2025 and was exceptionally included in 
the Annual Internal Audit report for 2024. 

(4)  A summary of the assurance provided by the Internal Audit Service is published in parallel to this report in the Annual 

Management and Performance Report on the EU budget. 

2 

 
 
 
 
 
To this end, the Internal Audit Service provides: 

• 

• 

independent assessments of the effectiveness of the governance, risk management, and control 
processes for operations, activities and financial transactions (‘assurance services’); and 

advice, insight and foresight (‘non-assurance services’). 

The  main  deliverables  are  internal  audit  reports  that  contain  independent  opinions  on  the  quality  of 
management and control systems as well as recommendations for improving operations and promoting sound 
financial management. 

In 2025, the Commission adopted a recast mission charter (5), marking a significant update to the Internal 
Audit  Service's  legal  and  operational  framework.  The  Charter  ensures  full  alignment  with  the  2024  recast 
Financial Regulation and the new Global Internal Audit Standards (6). By guaranteeing the Internal Auditor’s 
independence and granting full and unlimited access to the information and personnel required for their work, 
the Charter provides the necessary safeguards for the service to operate effectively. The 2021 external quality 
assessment,  which  is  valid  for  five  years,  confirmed  the  Internal  Audit  Service’s  conformance  with  the 
Standards and the Code of Ethics in force at that time. 

The  Internal  Audit  Service  adopted  its  2025-2029  Audit  Strategy  in  2025.  This  is  aligned  with  the 
Commission's  new  political  mandate  and  aims  to  drive  improved  performance  and  accountability  in  the 
Commission and other EU entities, as well as to provide value-added services to stakeholders.  

In  conformance  with  Article  8(2)  of  the  mission  charter,  the  Internal  Auditor  fulfils  a  number  of  annual 
reporting obligations to the Audit Progress Committee. The Audit Progress Committee assists the College 
in fulfilling its obligations under the Treaties, the Financial Regulation and other statutory instruments. Its role, 
which is established under Article 123 of the Financial Regulation, is to ensure the independence of the Internal 
Audit Service, monitor the quality of the internal audit work and ensure that recommendations are taken into 
account and followed up by the Commission, its executive agencies and other bodies.  

In her annual declaration to the Audit Progress Committee, the Internal Auditor confirmed that the Internal 
Audit  Service  preserved  full  organisational  independence  in  2025  and  was  free  from  interference  or 
limitations in the conduct of its audit work; and that there were no impairments to individual objectivity in fact 
or in appearance.  

The Internal Auditor ensured that the resources available in 2025 were sufficient and were effectively deployed 
to  optimise  the  achievement  of  the  approved  internal  audit  plan.  The  resources had  an  appropriate  mix  of 
knowledge, skills and other competences.  

The Internal Audit Service does not audit Member States’ systems of control over EU funds. Such audits reach 
down to the level of individual beneficiaries, and are carried out by Member States’ internal auditors, national 
audit  authorities,  other Commission  directorates-general  and the  European  Court  of  Auditors.  However,  the 
Internal  Audit  Service  does  audit  measures  taken  by  the  Commission  to  supervise  and  audit:  (a)  bodies  in 
Member States; and (b) other bodies that are responsible for disbursing EU funds.  

(5)  Commission Decision (EU) 2025/2570 of 18 December 2025 establishing the mission charter for the Internal Audit 

Service of the Commission. 

(6)   The Global Internal Audit Standards, promulgated by the Institute of Internal Auditors (IIA) effective as from 9 January 
2025, guide the worldwide professional practice of internal auditing and serve as a basis for evaluating and elevating 
the  quality  of  the  internal  audit  function.  The  Global  Internal  Audit  Standards  replace  the  2017  International 
Professional Practices Framework of the Institute of Internal Auditors which was applicable in 2024. 

3 

 
 
 
 
Overview of the audit work  

2025 was the first year of the implementation of the Internal Audit Service’s 2025-2029 Audit Strategy, which 
is aligned with the Commission's new political mandate, priorities and objectives.  By the cut-off date of 31 
December  2025  (7), the  Internal  Audit  Service  had  completed  a  total  of  35  engagements  (29  assurance 
audits, and 6 non-assurance engagements) in the Commission’s directorates-general and services. The Internal 
Audit Service delivered 100% of the assurance reports planned in the 2025 audit plan for the Commission. 
One audit report was finalised in March 2025 and included in the annual internal audit report for 2024 (8).  

In accordance with its charter and with global auditing standards, the Internal Audit Service plans its audit work 
on the basis of a risk assessment and a capacity analysis. The aim is to draw up an audit plan that covers the 
highest risk areas, thereby maximising its added value, as well as helping to ensure the best use of resources 
and the efficient and effective implementation of the audit plan. The Internal Audit Service regularly monitors 
the implementation of the audit plan and adjusts it as necessary. 

In 2025, the Internal Audit Service issued 33 reports (final audit reports and insight notes) and two internal 
reports.  

The chart below shows the contribution of the assurance engagements to the achievement of the general 
objectives included in the Commission’s 2025-2029 strategic plan. 

Contribution to the Commission's general objectives 

(7)  The 2025 audit plan is a transition year to the new cut-off date of 31 December 2025. Until 2024, the reference period 

for the audit plans was 1 February n to 31 January n+1.  

(8)  This  audit  report  related  to  the  audit  on  human  resources  management  in  the  Directorate-General  for  Financial 
Stability, Financial Services, and Capital Markets Union. The final audit report for this audit was issued on 10 March 
2025.  

4 

2865332A new plan for Europe’s sustainable prosperityand competitivenessA modern, high-performing andsustainable European CommissionDelivering together and preparingour Union for the futureA global Europe–leveraging our power and partnershipsSustainingour quality of life: food security, water and natureA new era for European defenceand securitySupporting people, and strengthening our societies and our social models 
 
 
  
Source: European Commission, Internal Audit Service 

The Internal Audit Service issued 123 recommendations stemming from its 2025 audit work. As illustrated 
below, 2% of these recommendations were rated as critical, 52% as very important and 46% as important.  

Recommendations by rating 

Source: European Commission, Internal Audit Service 

In 2025, the auditees accepted 118 recommendations  and partially accepted 5 recommendations. For all 
(partially  accepted)  recommendations,  the  auditees  drafted  action  plans.  The  Internal  Audit  Service  then 
assessed them as being satisfactory or requested a revised action plan. For the recommendations that were 
partially not accepted, the auditees accepted the residual risk. All the assurance reports were submitted to the 
Commission’s Audit Progress Committee together with the action plans. 

5 

2(2%)64(52%)57(46%)CriticalVery importantImportant123 
 
 
 
 
Overall results based on the audit work 
performed in 2025 

Overall results on performance  

To support the Commission’s performance-based culture and emphasis on value for money, the Internal Audit 
Service  finalised  29  audit  engagements  focused  on  performance  aspects.  For approximately  80%  of  these 
engagements, the Internal Audit Service identified high residual risks in the areas or processes audited  that 
gave  rise  to  very  important  recommendations.  One  audit  report  issued  a  critical  recommendation  to  two 
entities, noting very high residual risks. Various strengths and good practices were also noted. 

In line with its methodology and good practices, the Internal Audit Service audits performance in an indirect 
way. It assesses the  performance of the Commission’s  departments in implementing  policies, programmes, 
and  actions,  by  reference  to  the  risks  associated  with  them.  With  this  approach,  it  aims  to  ensure  that 
directorates-general  and  services  have  developed  robust  performance  frameworks,  adequate  performance 
measurement tools, and comprehensive monitoring systems; and that they use them to manage performance 
and risks. 

The  Internal  Audit  Service’s  2025  engagements  indicate  that  the  Commission’s  financial  management, 
operational and support processes remain robust, though certain areas require attention to ensure compliance 
and long-term effectiveness.  

While financial management systems are generally effective (see the Overall Conclusion), some vulnerabilities 
in procurement and grant management, notably assurance and audit strategies, require to be addressed. Audits 
of funding programmes revealed a need for greater consistency in performance measurement, where clearer 
indicators and streamlined processes could enhance transparency and impact, in particular in view of the move 
towards performance-based delivery models. Similarly, the operational performance would benefit from clearer 
definition of roles and responsibilities and from the sound management of risks related to the support systems, 
mainly  IT.  Finally,  considering  the  reliance  of  the  Commission  on  human  and  technological  resources,  the 
systems for selection and recruitment of staff, for IT project management and for cybersecurity management 
require strengthening as key founding blocks for a modern public administration.  

The following sections present the conclusions of the Internal Audit Service on the various performance aspects 
assessed in its 2025 audits.  

Financial processes 

The Internal Audit Service’s audits provided assurance to the College, as well as to the  directorates-general 
and  services,  that  internal  controls  on  financial  management  were  being  efficiently  and  effectively 
implemented (see also the overall conclusion on financial management in Section 4.2).  

Five audits carried out by the Internal Audit Service did not reveal any major weaknesses in the control 
systems  under  examination.  The  other  13  audits  revealed  a  need  for  improvements  and  led  to  the 
issuance of critical and very important recommendations. 

In the field of grant management, the Internal Audit Service identified two cases where the entities under 
examination needed to improve the processes in place.  

Five audits carried out by the Internal Audit Service on grant management ended in unqualified audit 
conclusions: (a) non-governmental organisations (NGO) funding under the Programme for the Environment 
and Climate Action (LIFE); (b) implementation of the Connecting Europe Facility; (c) project management and 
payment process for the EU4Health Programme; (d) project management and payment process of the European 
Defence Fund; and (e) early implementation of grants in the short-term defence instruments European Defence 
Industry  Reinforcement  through  common  Procurement  Act  (EDIRPA)  and  the  Act  in  Support  of  Ammunition 
Production (ASAP). 

6 

 
An audit on the European Innovation Council’s grant agreements preparation and award procedures 
resulted in a negative opinion and a critical recommendation concerning the need for the Directorate-General 
and the executive agency concerned to revise the award decision process specific to the European Innovation 
Council  Accelerator  scheme  in  line  with  the  applicable  rules.  The  audit  also  resulted  in  very  important 
recommendations  to  both  auditees  for  reinforcement  of  the  controls  related  to  the  grant  agreement 
preparation; revision of the reporting on the time-to-grant indicator in the Annual Activity Report and assessing 
the key root causes of delays; revision of the amending award decision process; and reinforcement of budget 
monitoring, and ensuring formal transmission of the award decisions to the European Investment Bank. 

In another audit carried out on grants, the internal control system for managing grants under the Customs 
Control Equipment Instrument programme was found to be adequately designed and effectively implemented, 
except  for  two  issues  related  to  the  instrument’s  control  strategy,  and  for  documenting  of  the  project 
monitoring and payment processing in the eGrants tool. 

The Internal Audit Service carried out two audits in the field of  programme  management for the current 
programming period.   

In the first of these two programme management audits, with a view to simplifying the implementation of the 
cohesion  policy  funds  in  the  2021-2027  programming  period,  adequate  and  effective  internal  control 
processes had been designed and implemented for capacity building, ex ante assessment and monitoring and 
reporting on simplified cost options and financing not linked to costs. However, related guidance, documentation 
and  ex  ante  assessments  need  to  be  improved.  In  addition,  training  needs  to  be  enhanced  and  risks  of 
dependency  on  external  experts  need  to  be  monitored.  Finally,  the  directorates-general  need  to  improve 
monitoring and reporting. 

In  the  second  of  these  two  programme  management  audits,  the  Internal  Audit  Service  concluded  that  the 
internal control processes for reviewing and approving the amendments to the Common Agricultural Policy 
(CAP) national strategic plans, had been adequately designed and implemented. However, there was a lack of 
clarity  on  the  starting  date  of  eligibility  for  approved  changes  in  the  European  Agricultural  Fund  for  Rural 
Development interventions which had been previously notified but found to be non-compliant with the legal 
basis for notifications. In addition, a very important weakness was identified regarding the clarification on the 
acceptable deviations between result indicators and outputs and correction of detected non-compliances in the 
CAP Strategic Plans. 

In the thematic area of assurance building and audit strategy the Internal Audit Service identified cases 
where the entities under examination needed to improve the processes in place.  

In  a  programme  covered  by  the  Common  Provisions  Regulation  for  the  2021-2027  programming 
period, the audited directorate-general had set up audit arrangements based on the Single Audit Strategy but 
by the end of the  audit fieldwork it had not fully established additional audit arrangements  for the special 
handling  of  documents, a  comprehensive  risk  assessment  approach  and audit  planning  incorporating  fund-
specific and common risk factors.  

In  another  audit,  risk  management  and  control  processes  for  the  Recovery  and  Resilience  Facility  risk 
assessment methodology and ex post audits on milestones and targets in compliance with the Recovery and 
Resilience Facility Regulation had been adequately designed and effectively implemented, except for two very 
important issues related to: (a) the duration of audits; and (b)  the auditing standards and quality assurance 
programme. 

As regards the reliability of audit opinions on the legality and regularity of Erasmus+ expenditure declared 
by  national  agencies,  the  audited  directorate-general  had  effectively  implemented  measures  that  were 
adequately designed to ensure the reliability of audit opinions issued by the independent audit bodies to obtain 
the necessary assurance, except for one issue related to the management of observations. 

To ensure that financial aid provided to the countries covered by a crisis declaration is delivered in 
accordance  with  the  principle  of  sound  operational  and  financial  management,  the  risk  management  and 
control systems put in place were found to be adequately designed and effectively implemented, except for 
the monitoring and reporting mechanism related to contracts concluded under flexible procedures. 

7 

 
The Internal Audit Service also carried out limited reviews on control results provided by partners. These 
reviews concluded that the systems designed and implemented by the responsible directorates-general in the 
area  of  external  relations  to  ensure  that  the  management  declarations  contribute  to  the  assurance  on  the 
effective implementation of EU funds under indirect management with entrusted entities are adequate, except 
for  issues  related  to  some  aspects  of  the  design  and  to  the  effectiveness  and  efficiency  of  management 
declarations as a control measure. 

As regards the performance monitoring and evaluation framework, the Internal Audit Service identified 
cases where the entities under examination needed to improve the processes in place: 

An audit on the InvestEU programme confirmed an adequate and effective internal steering and coordination 
mechanism  for  the  financing  of  InvestEU  Fund  operations  and  a  robust  methodology  on  performance  and 
monitoring indicators to monitor the implementation has been put in place. However, it identified shortcomings 
in the objectives that are defined in the relevant legal basis and in the indicators used to monitor and evaluate 
the achievement of the programme’s objectives. 

An audit on the design of the performance monitoring and evaluation framework for the 2023-2027 Common 
Agricultural  Policy,  found  that  it  was  adequately  designed  to  monitor,  evaluate  and  report  on  the 
performance  of  the  CAP  Strategic  Plans.  However,  the  approach  for  approving  changes  to  targets  and 
milestones for result indicators needed  further clarifications in the absence of clear  provisions in the  basic 
legislation. 

Concerning procurement and contract management the Internal Audit Service identified three instances 
where the entities under examination needed to improve the processes in place.  

One audit identified one very important issue regarding the effectiveness and efficiency of the  procurement 
approach followed for outsourced translations. Another audit identified one very important issue concerning 
the identification of (potential) conflict-of-interest aspects, which the responsible executive agency needs to 
reinforce, in cooperation with its parent directorates-general. 

In an audit on high value procurement and contract management, the internal control system set up needs to 
be significantly enhanced to strengthen its efficiency and effectiveness. The  Internal Audit Service identified 
five very important issues concerning: (a) the risk management and control strategy; (b) award criteria and the 
evaluation process; (c) contract value estimation and contract duration; (d) the early detection and exclusion 
system; and (e) ex ante controls on payments. 

Operational processes 

The Internal Audit Service performed six audits that focused on specific activities or programmes. 

An audit on the management of EURopean Employment Services (EURES) and the EURES portal found 
that the responsible directorate-general and the affiliated decentralised agency had put in place a number of 
arrangements  to  govern  their  cooperation.  However,  these  arrangements  had  not  always  been  sufficiently 
detailed or kept up to date in a number of areas, including IT governance and the mandate of the IT Steering 
Committee.  

An audit carried out on the coordination mechanisms  related to financial supervision found that the 
responsible  directorate-general  had  adequately  designed  and  effectively  and  efficiently  implemented  the 
coordination mechanisms with the three supervisory authorities except for issues related to the questions and 
answers process, and review and evaluation. 

Another audit found that processes for managing the control data of the Common Fisheries Policy had 
been  adequately  designed  and  effectively  and  efficiently  implemented,  in  line  with  the  legal  framework 
applicable at the time of the audit, except for one issue related to the reception, use and publication of data 
related to fishing opportunities. 

An  audit  on  the  selection  process  in  the  European  Personnel  Selection  Office  concluded  that  the 
governance, risk management and control processes set up by the Office responsible for the new competition 
model for permanent staff was not adequately designed. The identified issues included the management  of 

8 

 
clients’ needs and related communication aspects; the roadmap for the deployment of the new competition 
model and procedure for the selection process; and the indicators and monitoring for assessing the achievement 
of the objectives of the new competition model. 

An audit carried out on the management of childcare services found that the offices in charge had, overall, 
designed an adequate framework and control system. However, issues were identified in the implementation 
concerning  the  roles  and  responsibilities  of  the  oversight  committees  and  external  actors  involved;  the 
establishment  of  the  interinstitutional  budget  and  allocation  of  costs  and  calculation  of  parental  and 
institutional contributions; and IT controls on project management and the IT security of the relevant IT tool. 

An audit on the management of in-kind contributions under Horizon Europe concluded that overall, the 
responsible directorate-general had provided adequate support to the joint undertakings, except for one very 
important issue concerning IT support and the functionalities available in the IT tool. 

Support processes 

Human resource management 

An  audit  carried  out  on  the  Human  Resources  Transformation  Programme  concluded  that  although  the 
programme’s governance structure and processes had been well set up overall, a very important issue relating 
to  the  IT  security  management  processes  remained  that  may  affect  the  achievement  of  the  programme’s 
strategic objectives and compliance with the Commission’s internal security standards. 

Information technology (IT) governance, IT project management and IT security management 

The Internal Audit Service carried out two audits in this area. 

An audit carried out on IT governance and IT security management in one directorate-general revealed that, 
overall, the governance, risk management and control system put in place  for IT governance and IT security 
arrangements  was  adequately  designed  and  efficiently  and  effectively  implemented,  except  for  one  issue 
related to aligning business  needs and recovery expectations, maintaining IT security  plans and formalising 
processes about incident and user access management. 

For  the  Arachne+  project,  the  governance,  risk  management  and  control  processes  put  in  place  by  a 
directorate-general, as system owner, with the support of other directorates-general, were not appropriate to 
deliver phase 2 of the project effectively and to achieve the strategic objectives and business expectations for 
the overall project within the allocated time and resources. IT  security and personal data protection control 
processes were compliant with the Commission’s process steps, but significant improvements were necessary 
as regards the quality of IT security artefacts. 

Additionally, a number of other audits looked at the IT aspects of audited processes and identified in 
different cases adequate controls or weaknesses.  

Overall conclusion on the Commission’s financial management 

As  required  by  its  mission  charter,  the  Internal  Audit  Service  issues  an  annual  overall  conclusion  on  the 
Commission’s financial management. This is based on the audit work in the area of financial management in 
the Commission carried out in the past three years (2023 to 2025). It also takes into account information from 
other sources, namely the reports of the European Court of Auditors. The overall conclusion is issued at the 
same time as this report and covers the same year. 

Based  on  this audit  information,  the  Internal  Auditor  considered  that  in  2025  the  Commission  put  in  place 
governance, risk management and internal control procedures which, taken as a whole, are adequate to give 
reasonable assurance over the achievement of its financial objectives, with the exception of those areas  of 

9 

 
financial  management  over  which  authorising  officers  by  delegation  have  expressed  reservations  in  their 
declaration of assurance. 

Without further qualifying the overall conclusion for 2025, the Internal Auditor  draws attention to the need 
to ensure that the control and assurance framework remains robust, proportionate and effective 
to manage risks to an acceptable level, especially in the context of concurrent priorities and continuous 
pressure on resources. This is particularly pertinent in view of the need to accelerate implementation and ensure 
a timely closure of the current programmes while preparing for the upcoming multiannual financial framework, 
which will introduce further innovative instruments and delivery models. 

The challenging socio-economic and political environment and need to respond to the various crises during the 
past  few  years  required  rapid  mobilisation  of  unprecedented  amounts  of  resources  and  funding,  and  the 
creation of novel performance-based instruments. Delays in finalising and implementing the control and 
audit  strategies  for  the current  programming  period, as a result of the necessary adaptations to the 
revised delivery models, should be given due attention. At the same time, the Commission has to continue the 
simplification efforts to ensure that EU funding remains accessible and delivers results while ensuring sound 
financial management. 

In  the  context  of  a  major overhaul  of  funding  and  delivery  models under  the  next  multiannual  financial 
framework,  the  Commission  should  make  use  of  the  lessons  learned  from  the  current  7-year  period  and 
ensure that the assurance model is defined from the outset, in order for control strategies for individual 
instruments to be developed in good time before implementation starts. 

The continued shift towards performance-based delivery models will require a revised approach to enable 
the  Commission  to  provide  assurance  on  the  legality  and  regularity  of  expenditure,  including  where 
necessary support to the Member States, adjustments to the organisation of the audit function and revision of 
traditional legality and regularity indicators, such as the error rate. 

Continued  attention  needs  to  be  paid  to  proportionate  and  effective  controls  for the  oversight  of  budget 
amounts implemented by the Member States and/or third parties, considering the increased reliance 
the Commission places on them. 

In addition, the expanding financial operations of the Union highlight the importance of a robust and well-
integrated risk management framework and strong oversight of loans, budgetary guarantees and 
financing through the issuance of debt securities. 

Finally, to ensure delivery of its objectives relating to accountability, sound financial management and protection 
of the  EU budget, the Commission should continue efforts and seize opportunities to optimise the  use  of 
limited resources and to adjust its organisation, processes and operations. The design of new assurance 
models  and  the  individual  control  strategies  should  be  accompanied  by  a  definition  of  adequate  human 
resources,  in  numbers,  skills  and  timing,  and  a  strategy  for  effectively  leveraging  appropriate  technological 
means, while carefully managing the risks they introduce. 

10 

 
 
Actions taken by auditees 

The impact of the internal audit work on improving the Commission’s performance and accountability depends 
on the implementation of its recommendations. To enable oversight by the governing bodies, the Internal Audit 
Service carries out follow-up audits when the audited entity has reported the recommendation as ready for 
review. The Internal Audit Service also provides regular information to the Audit Progress Committee on the 
status of implementation of its recommendations. 

The Internal Audit Service followed up on 50 previous audit engagements to review the implementation 
of recommendations and issued 82 (9) follow-up notes to the respective directorates-general and services. As 
a result, for 22 engagements, all recommendations were closed (10), while for the other 28 engagements, one 
or more recommendations remained open by the cut-off date (11).  

As  illustrated  below,  at  the  cut-off  date  of  31  December  2025,  out  of  a  total  of  773  (partially)  accepted 
recommendations  (12)  made  by  the  Internal  Audit  Service  in  2021-2025,  525  (68%)  were  assessed  by  the 
auditees as implemented (13). This leaves a total of 248 recommendations (32%) that remain open. 

Source: European Commission, Internal Audit Service 

(9)  Some audit engagements were followed up more than once and some follow-up notes covered more than one audit 

engagement. 

(10)  Section 2.2 of the Staff Working Document contains the list of audits that were closed after a follow-up was performed.  
(11)   Section 2.1 of the Staff Working Document contains a list of audits that remained open after a follow-up was performed 

on critical and/or very important recommendations.   

(12)   Out  of 777  recommendations  issued  in  2021-2025,  763  recommendations  were  fully  accepted,  10  were  partially 

accepted and four were rejected.  

(13)   The chart shows the rating of the recommendations on the cut-off date. This may differ from the rating in the original 
audit report because, in a follow-up audit, the Internal Audit Service may assess that the actions taken by the auditee 
partly mitigated the risks that were initially identified and may therefore downgrade the rating of the recommendation. 

11 

248(32%)525(68%)No of acceptedrecommendationsissuedin 2021-2025 by status(basedon the auditeesassessment)OpenImplemented7732(1%)112(45%)134(54%)No of open recommendationsby ratingCriticalVery importantImportant248 
 
 
 
 
Of the 248 recommendations that remained open on the cut-off date, two were rated as critical, 112 
(45%) as very important, and 134 (54%) as important. 

Of the open recommendations, 43 were overdue (i.e. not implemented by the originally agreed date). These 
overdue recommendations represented 5.6% of the (partially) accepted recommendations.  

Of the overdue recommendations, four very important recommendations issued in 2021-2025 were classified 
as long overdue (i.e. open for more than six months after the original implementation date), compared to six 
recommendations in the previous year. These long overdue very important recommendations represented 0.5% 
of the total number of (partially) accepted recommendations in 2021-2025 (in line with the previous reporting 
period). Additionally, there is one  very important long overdue recommendation that was issued before the 
2021 audit plan, increasing the total number at the cut-off date to five very important recommendations.  

Delay of overdue recommendations by rating 

(Issued in 2021-2025) 

Source: European Commission, Internal Audit Service 

Overall, the Internal Audit Service considers the implementation of its recommendations to be satisfactory and 
comparable  with  previous  reporting  periods.  This  shows  that  Commission  services  have  been  diligent  in 
implementing the critical and very important recommendations, thus mitigating the risks highlighted by the 
Internal Audit Service. 

Part 3 of the Staff Working Document accompanying this report summarises these very important long overdue 
recommendations. 

Consultation with the Commission’s financial 
irregularities panel  

The panel set up under Article 145 of the Financial Regulation did not report any systemic problems in 2025, 
when it gave its opinion referred to in Article 93 of the Financial Regulation. 

12 

7229167161890 < 6 months6 - 12 months> 12 monthsVery importantImportant