COMMISSION STAFF WORKING DOCUMENT Accompanying the document REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL AND THE COURT OF AUDITORS Annual report to the Discharge Authority on internal audits carried out in 2025
Date: 2026-06-15
Institutions: European Commission, Secretariat-General
Subjects: activity report, administrative check, audit, budgetary discharge, financial year, fraud against the EU, management audit

EN 

  EN 

   EUROPEAN COMMISSION  Brussels, 15.6.2026  SWD(2026) 149 final  COMMISSION STAFF WORKING DOCUMENT     Accompanying the document REPORT FROM THE COMMISSION   TO THE EUROPEAN PARLIAMENT, THE COUNCIL AND THE COURT OF AUDITORS Annual report to the Discharge Authority on internal audits carried out in 2025 {COM(2026) 279 final}  
 
 
Contents 

PART 1 FINAL REPORTS ..................................................................................................................................................... 6 

Financial Processes ............................................................................................................................................................ 7 

Procurement (DGT) .................................................................................................................................................................................. 7 
Procurement (EISMEA)........................................................................................................................................................................... 8 
Project management and payment process for the EU4Health Programme (HaDEA) ................................. 9 
Project management and payment process of the European Defence Fund (DG DEFIS)........................ 10 
Early implementation of grants in the short-term defence instruments (DG DEFIS)................................. 11 

Simplification measures in cohesion funding in the 2021-2027 programming period (DG REGIO, 
DG EMPL) .................................................................................................................................................................................................... 12 

Horizon Europe – European Innovation Council grant agreements preparation and award 
procedures (DG RTD, EISMEA) ........................................................................................................................................................ 13 
Implementation of the Connecting Europe Facility – Transport (DG MOVE, CINEA) .................................... 15 

1.1. 
1.2. 
1.3. 
1.4. 
1.5. 
1.6. 

1.7. 

1.8. 
1.9. 

Assurance building processes and audit strategy for the 2021-2027 programming period - design 
(DG HOME) ................................................................................................................................................................................................. 17 
1.10.  Amendments of the Common Agricultural Policy national strategic plans (DG AGRI) .............................. 19 
1.11.  Design of the performance monitoring and evaluation framework for the Common Agricultural 

Policy 2023-2027 (DG AGRI) ......................................................................................................................................................... 20 

1.12.  Non-Governmental Organisations (NGO) funding under the LIFE programme (DG ENV, DG CLIMA, 

DG ENER, CINEA) .................................................................................................................................................................................... 22 

1.13.  Reliability of audit opinions on the legality and regularity of Erasmus+ expenditure declared by 

National Agencies (DG EAC) ............................................................................................................................................................ 23 

1.14. 

InvestEU Fund – methodology for key performance indicators and key monitoring indicators, 
controls over indicators and internal steering and cooperation mechanism (DG GROW) ....................... 24 
1.15.  Control results provided by partners (management declarations) (DG INTPA) .............................................. 26 
1.16.  Control results provided by partners – management declarations (DG ENEST) ............................................ 27 
1.17.  Financial management – high value procurement and contract management (DG TAXUD) ................ 28 
1.18.  Financial management – Grants (DG TAXUD) ..................................................................................................................... 31 
1.19.  Controls over aid to countries covered by a crisis declaration (DG MENA) ....................................................... 32 
1.20.  Recovery and Resilience Facility risk assessment methodology and ex post audits (DG ECFIN)........ 33 
Operational Processes.................................................................................................................................................... 36 

1.21.  Personnel selection process (EPSO) ........................................................................................................................................... 36 
1.22.  Management of childcare services (OIB, OIL) ..................................................................................................................... 37 
1.23.  Coordination between DG FISMA and European Supervisory Authorities (DG FISMA) ............................... 39 
1.24.  Management of the control data of the Common Fisheries Policy (DG MARE) ............................................. 41 
1.25.  Management of EURES and the EURES portal (DG EMPL) .......................................................................................... 43 
1.26.  Management of in-kind contributions under Horizon Europe (DG RTD) .............................................................. 44 
Support Processes ........................................................................................................................................................... 46 

Information technology (IT) governance and IT security management (DG DEFIS) .................................... 46 
1.27. 
1.28.  Arachne+ project (DG BUDG, DG EMPL/DG REGIO, DG DIGIT) ................................................................................... 47 
1.29.  Human Resources Transformation programme (DG HR) .............................................................................................. 50 

 
 
PART 2 FOLLOW-UP ENGAGEMENTS........................................................................................................................... 52 

Audits for which some recommendations remain open after IAS follow-up in 2025 () ........................ 53 

Audit on the preparedness of DG AGRI in designing the assurance building model under the new 
Common Agricultural Policy Strategic Plans ........................................................................................................................ 53 
Audit on CASE@EC project in DG COMP .................................................................................................................................. 53 
Audit on IT security management in DG EAC ....................................................................................................................... 53 

Audit on the New nuclear decommissioning and waste management programme (NDWMP) in JRC
 .......................................................................................................................................................................................................................... 54 

Audit on the protection of personal data in the Office for Administration and Payment of Individual 
Entitlements in PMO ............................................................................................................................................................................ 54 

Audit on measuring and reporting on the performance of technical support projects in DG REFORM
 .......................................................................................................................................................................................................................... 54 

Audit on protection of personal data under the responsibility of CINEA, EACEA, EISMEA, ERCEA, REA 
and the CIC ................................................................................................................................................................................................ 54 

2.1. 

2.2. 
2.3. 
2.4. 

2.5. 

2.6. 

2.7. 

2.8. 

Audit on the preparedness for closing the 2014-2020 programming period of the European 
Structural and Investment Funds by DG EMPL and DG MARE and DG REGIO ................................................ 55 
Audit on the Joint Audit Directorate for Cohesion (DAC) in DG EMPL and DG REGIO ................................ 55 

2.9. 
2.10.  Audit on Physical security of persons and assets in the Commission, HR / DIGIT / COMM / OIB / OIL

 56 

2.11.  Audit on the assessment of HR needs in the Commission at corporate level in DG BUDG, DG HR 

and SG .......................................................................................................................................................................................................... 56 

2.12.  Audit on protection of confidentiality of information at corporate level in DG HR, DG DIGIT and SG

 56 

2.13.  Audit on the management of large-scale building projects involving works in OIB and OIL ................ 57 
2.14.  Review of the Commission’s risk at payment in DG BUDG, DG EMPL, DG INTPA, DG NEAR, DG 

REGIO, DG RTD, EISMEA, ERCEA and REA ............................................................................................................................... 57 

2.15.  Audit on the External Investment Plan – European Fund for Sustainable Development (EFSD) 

Guarantee in DG INTPA and DG NEAR ...................................................................................................................................... 58 
2.16.  Audit on Intervention-level evaluations in FPI, former DG NEAR and DG INTPA ........................................... 59 
List of audits for which all recommendations were closed in 2025 ............................................................ 59 

PART 3 SUMMARY OF LONG OVERDUE RECOMMENDATIONS ............................................................................ 61 

 
 
 
 
 
List of abbreviations 

CIC: Common Implementation Centre 

CINEA: European Climate, Infrastructure and Environment Executive Agency 

DG AGRI: Directorate-General for Agriculture and Rural Development  

DG BUDG: Directorate-General for Budget  

DG CLIMA: Directorate-General for Climate Action  

DG COMM: Directorate-General for Communication  

DG COMP: Directorate-General for Competition  

DG DEFIS: Directorate-General for Defence Industry and Space 

DG DIGIT: Directorate-General for Digital Services  

DG EAC: Directorate-General for Education, Youth, Sport and Culture  

DG ECFIN: Directorate-General for Economic and Financial Affairs 

DG EMPL: Directorate-General for Employment, Social Affairs and Inclusion  

DG ENER: Directorate-General for Energy 

DG ENEST: Directorate-General for Enlargement and Eastern Neighbourhood  

DG ENV: Directorate-General for Environment  

DG ESTAT: Eurostat  

DG FISMA: Directorate-General for Financial Stability, Financial Services and Capital Markets Union  

DG HOME: Directorate-General for Migration and Home Affairs  

DG HR: Directorate-General for Human Resources and Security  

DG INTPA: Directorate-General for International Partnerships 

DG JUST: Directorate-General for Justice and Consumers  

DG MARE: Directorate-General for Maritime Affairs and Fisheries  

DG MENA: Directorate-General for Middle East, North-Africa and Gulf 

DG MOVE: Directorate-General for Mobility and Transport  

DG NEAR: Directorate-General for Neighbourhood and Enlargement Negotiations  

DG REFORM: Directorate-General for Structural Reform Support 

DG REGIO: Directorate-General for Regional and Urban Policy  

DG RTD: Directorate-General for Research and Innovation  

 
 
DG SANTE: Directorate-General for Health and Food Safety  

DG SCIC: Directorate-General for Interpretation 

DG TAXUD: Directorate-General for Taxation and Customs Union  

DGT: Directorate-General for Translation 

EACEA: Education and Culture Executive Agency  

EISMEA: European Innovation Council and Small and Medium-sized Enterprises Executive Agency 

EPSO: European Personnel Selection Office 

ERCEA: European Research Council Executive Agency  

FPI: Service for Foreign Policy Instruments  

IAS: Internal Audit Service 

HaDEA: European Health and Digital Executive Agency 

HERA: Health Emergency Preparedness and Response Authority 

IT: Information technology 

JRC: Joint Research Centre  

OIB: Office for Infrastructure and Logistics in Brussels  

OIL: Office for Infrastructure and Logistics in Luxembourg  

PMO: Office for the Administration and Payment of Individual Entitlements  

REA: Research Executive Agency  

SG: Secretariat-General  

 
 
Context of this Staff Working Document 

Part 1 of this Staff Working Document contains: 

• 

• 

• 

a summary of the 29 finalised assurance audit engagements (1) performed as part of the 2025 audit 
plan  of  the  Internal  Audit  Service  (IAS)  (i.e.  audits  for  which  the  reports  were  issued  between  1 
February 2025 and 31 December 2025) (2); 

the main recommendations (critical and very important) (3) resulting from these audit engagements; 

information  provided  by  the  directorates-general/services  on  the  actions  drawn  up  and/or 
implemented to address the IAS audit recommendations.  

Each audit engagement followed the standard professional validation procedures and contradictory procedures 
involving auditor and auditee that were applicable when the engagement was finalised. The summary of each 
engagement aims to provide an overview of the audits and their main results. 

Part 2 of this Staff Working Document includes a summary of the results of the IAS’s follow-up engagements 
performed between 1 February 2025 and 31 December 2025 (4). These include a list of audit engagements for 
which all the recommendations were assessed as having been implemented following a follow-up audit by the 
IAS. 

Part 3 provides an overview of the five long overdue very important recommendations on 31 December 2025. 

(1)   The IAS also finalised six non-assurance – advisory or insight – engagements. These are not covered in this Staff Working 

Document. 

(2)   Except for the audit on human resources management in DG FISMA. The final audit report was issued for this on 10 

March 2025 and was, exceptionally, included in the annual internal audit report for 2024. 

(3)   Important recommendations are not listed in this Staff Working Document. 
(4)   Each summary reflects the IAS’s assessment of the implementation status of audit recommendations at the end of the 
follow-up engagement. They do not take into account any further action which the auditee may have undertaken and 
reported to the IAS since the release of the IAS’s follow-up note even if that action may have had an impact on the 
status of the recommendations.  

5 

 
 
 
 
 
Part 1 
Final reports

6 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Financial Processes 

1.1. 

Procurement (DGT) 

The objective of the audit was to assess if the governance, risk management and internal control framework 
set-up by DGT for its procurement activities was adequately designed, efficient and effective and to provide 
reasonable assurance that the key internal control objectives have been achieved. 

Audit results 

Is  the  governance  framework  for  procurement  activities  adequately  designed  and  efficiently  and  effectively 
implemented? 

The governance framework established by DGT for procurement activities is adequately designed, efficiently 
and  effectively  implemented.  The  organisational  structure  in  DGT  to  deal  with  procurement  activities  is 
adequate, the roles and responsibilities of the various actors involved are clearly defined, including the required 
competencies and the ethical aspects to consider. The evaluation panels are appointed in accordance with the 
Financial Regulation and the Vademecum. 

Is the risk management framework for procurement activities adequately designed and effectively implemented? 

The risk management framework for procurement activities is overall adequately designed. DGT identified the 
risks  related  to  the  procurement  processes  and  defined  control  activities  to  mitigate  them.  However,  the 
implementation of the risk management framework is only partially effective as the IAS found some issues on 
the  internal  control  framework  (see  below)  for  which  the  control  activities  defined  by  DGT  were  not  fully 
effective to address them. 

Is  the  internal  control  framework  for  procurement  activities  adequately  designed,  efficiently  and  effectively 
implemented? 

The  internal  control  framework  for  procurement  activities  is  overall  adequately  designed.  This  covers  the 
budgetary and legal commitments, the identification of needs, the planning of the procurement procedures, the 
tendering and evaluation phases and the  preparation and adoption of the award decision. The  procurement 
process follows overall the requirements of the Financial Regulation and Vademecum. However, the IAS found 
several issues regarding the effectiveness and efficiency of the internal control framework. In particular, the 
auditors identified issues regarding: (a)  DGT’s interpretation and implementation of the legal  base/guidance 
applicable to procurement for outsourced translation (e.g. the concept of ‘subject matter’ and the estimation of 
the initial value for a framework contract); (b) the (documentation of) controls/procedures in the pre-tendering 
and tendering phases (e.g. completeness of information in some award decisions); and (c) the monitoring and 
reporting processes (e.g. no formalised monitoring of budget consumption for an inter-institutional framework 
contract). 

Audit conclusion 

The IAS concluded that although DGT has, overall, designed an adequate governance, risk management and 
internal control framework for its procurement activities, there remains a very important issue concerning its 
effectiveness and efficiency, particularly as regards the procurement approach for outsourced translation. 

Audit recommendations 

Recommendation No 1, on the procurement approach for outsourced translation, DG DGT should: 

• 

define a procurement approach for outsourced translation. 

7 

 
Additional information provided by DG DGT on the implemented measures  

DG DGT established an action plan consisting of 12 sub-actions to address all audit findings, which was 
considered as satisfactory by the IAS. Half of the sub-actions had a deadline for implementation by the 
end of the first quarter 2026 and have been implemented. These included actions such as organising 
meetings  with  DG  BUDG  on  the  correct  interpretation  of  some  legal  and  procurement  concepts, 
establishing a procedure for ensuring completeness of information in the award decision, implementing 
new rules in financial circuits. DG DGT is therefore fully on track to meet the planned implementation 
dates.  

1.2. 

Procurement (EISMEA) 

The objective of the audit was to assess if the governance, risk management and internal control framework 
set-up by EISMEA for its procurement activities are adequately designed, efficient and effective and to provide 
reasonable assurance that the key internal control objectives had been achieved. 

Audit results 

Is  the  governance  framework  for  procurement  activities  adequately  designed  and  efficiently  and  effectively 
implemented? 

The governance framework established by EISMEA for procurement activities is adequately designed, efficiently 
and effectively implemented. The centralised positioning of the procurement sector is adequate for and adapted 
to the needs of the Agency, the roles and responsibilities of the various actors in the procurement sector and 
operational units within EISMEA are clearly defined. The evaluation panels are appointed in accordance with the 
Financial Regulation and the Vademecum. However, the relation between the parent Directorates-General and 
EISMEA is not sufficiently translated into practical arrangements as regards the split of roles and responsibilities 
at operational level, which may create issues in the preparation phase of the procurement. 

Is the risk management framework for procurement activities adequately designed and effectively implemented? 

The risk management framework for procurement activities is overall adequately designed. The procurement 
sector has developed a list of risks related to the procurement processes and implemented activities to mitigate 
them.  However,  the  implementation  of  the  risk  management  framework  is,  in  some  cases,  only  partially 
effective  as  the  IAS  found:  (a)  issues  in  the  preliminary  market  analysis  and  identification  of  risks  for  the 
particular procurement procedures; and (b) three middle value procedures processed in parallel and presenting 
similarities, which may be perceived as a case of contract fragmentation. 

Is  the  internal  control  framework  for  procurement  activities  adequately  designed,  efficiently  and  effectively 
implemented? 

The internal control framework for procurement activities is overall adequately designed and efficiently and 
effectively implemented. This covers the budgetary and legal commitments, the identification of needs, the 
planning of the procurement procedures, the tendering and evaluation phases and the preparation and adoption 
of the award decision. The procurement process follows overall the requirements of the Financial Regulation 
and corporate Vademecum on procurement. The e-tendering is the default solution, and the main IT system 
(public  procurement  management  tool  -  PPMT)  for  the  procurement  process  is  overall  adequately  used. 
However,  the  IAS  found  that  in  one  case  sampled  the  Agency  and  the  parent  Directorates-General  did  not 
adequately identify a conflict-of-interest situation, and the selection and award criteria were in some cases too 
strict or not proportional. In addition, data related to procurement files, including sensitive documents are not 
always stored and handled in compliance with the Commission’s rules. 

8 

 
Audit conclusion 

The IAS concluded that, overall, EISMEA has adequately designed and efficiently and effectively implemented 
the governance, risk management and internal control framework for its procurement activities, which provides 
reasonable assurance that the key internal control objectives are achieved, except for one very important issue 
concerning the identification of the conflict of interest aspects, which EISMEA needs to reinforce, in cooperation 
with its parent Directorates-General. 

Audit recommendation 

Recommendation No 3, on the checks on (potential) conflict of interest aspects, EISMEA should: 

• 

reinforce the checks on (potential) conflict of interest aspects. 

Additional information provided by EISMEA on the implemented measures  

EISMEA accepted the recommendation and submitted an action plan to the IAS early February 2026, 
who assessed it as satisfactory. The implementation of the recommendation is on track and EISMEA is 
committed to duly implement the agreed corrective actions in 2026. 

1.3. 

Project management and payment process for the EU4Health 
Programme (HaDEA) 

The objective of the audit was to assess the effectiveness of the governance, risk management and internal 
control processes put in place by HaDEA for project management and payments of EU4Health grants (including 
anti-fraud  checks  and  corrective  mechanisms)  with  the  aim  to  achieve  the  programme’s  objectives,  in 
compliance with the applicable rules.  

Audit results 

Are the governance, risk management and internal control processes related to the project management and 
payment processes adequately implemented by competent HaDEA staff?  

HaDEA  implements  its  control  strategy  by  providing  training  and  guidance  to  its  staff  and  by  effective 
management supervision. The business continuity procedures have been defined and effectively implemented. 
In addition, HaDEA monitors the project execution through activities that are proportionate to the level of risk 
and complexity of the projects. 

Is the payment process effective and does it ensure compliance with the legal provisions? 

The  payment  process  is  overall  effective  and  ensures  compliance  with  the  legal  provisions.  The  financial 
workflows  are  efficient  and  ex  ante  controls  are  performed  in  line  with  the  requirements  of  the  Financial 
Regulation. Financial corrections are properly calculated and applied when necessary, but the audit identified 
some shortcomings in the documentation of the checks performed and the reporting about control results. 

Is the grant amendment process effective and does it ensure compliance with the legal provisions? 

The grant amendment process was effective and ensured compliance with the legal provisions. Existing controls 
ensure that the amendments comply with the provisions of the grant agreements and the rules governing the 
responsible actors and the timing of amendments are respected. 

9 

 
 
 
Audit conclusion 

The IAS concluded that the internal control system that HaDEA has put in place for the  project management 
and payment process for the EU4Health Programme (grant management and payment) is adequately designed 
and effectively implemented, in compliance with the applicable rules. 

Audit recommendations 

The IAS did not formulate any critical or very important recommendations. 

1.4. 

Project management and payment process of the European 
Defence Fund (DG DEFIS) 

The objective of the audit was to assess the adequacy of the design and effective and efficient implementation 
of  the  governance,  risk  management  and internal  control  systems  put  in  place  by  DG  DEFIS  for  the  project 
management of the European Defence Fund grants and the ex ante financial controls on their interim payments, 
in compliance with the applicable rules. 

Audit results 

Are  DG  DEFIS  governance,  risk  management  and  internal  control  systems  for  the  project  management  and 
payment process of the European Defence Fund adequately designed? 

DG DEFIS has designed adequate governance, risk management and internal control systems for the  project 
management and payment process of the European Defence Fund that include: 

• 

• 

• 

• 

• 

project  management  /  monitoring  activities  that  are  proportionate  to  the  European  Defence  Fund 
projects’ complexity / risks and are in line with the requirements of the Financial Regulation; 

clear  definition,  assignment  and  communication  of  the  roles  and  responsibilities  for  the  European 
Defence Fund project management and interim payments; 

provision of appropriate training and guidance to the staff involved in the audited process;  

adequate business continuity measures; and 

proper  management  supervision  for  the  European  Defence  Fund  project  management  and  interim 
payments. 

Has the project management process for the European Defence Fund grants been effectively implemented? 

The project management process for the European Defence Fund grants has been effectively implemented as 
the European Defence Fund project management steps have been effective, the ex ante project management 
controls for the ‘certified correct’ endorsement have been sufficient, and the documentation of the project 
management activities in system for grant management (SyGMa)/COMPASS is adequate. 

Has the payment process for the European Defence Fund grants been effectively implemented and does it 
ensure compliance with the legal provisions? 

The payment process for the European Defence Fund grants has been effectively implemented and in 
compliance with the legal provisions as: (a) the ex ante financial controls on the periodic financial reporting for 
supporting the 'certified correct' endorsement have been sufficient; and (b) the approval workflow has been 
effective and efficient, both of which ensure compliance with the legal provisions. 

10 

 
 
 
Audit conclusion 

The IAS concluded that DG DEFIS has put in place adequate governance, risk management and internal control 
systems to ensure effective and efficient project management of the European Defence Fund grants and ex 
ante financial controls on their interim payments, in compliance with applicable rules. 

Audit recommendations 

The IAS did not formulate any recommendations. 

1.5. 

Early implementation of grants in the short-term defence 
instruments (DG DEFIS) 

The objective of the audit was to assess the adequacy of design and effective implementation of DG DEFIS 
control  system for the first  phases of the management  of the  grants under  the European  defence industry 
Reinforcement through common Procurement Act (EDIRPA) and the act in support of ammunition production 
(ASAP) to effectively support the achievement of the objectives of the two instruments through the preparation 
of the work programmes. 

Audit results 

Are the controls for the preparation, and implementation of the annual work programme and for the drafting 
and publication of calls for proposals for EDIRPA and ASAP adequately designed and effectively implemented? 

The process for the preparation, and implementation of the annual work programme and for the drafting and 
publication of calls for proposals for EDIRPA and ASAP is overall effective and in accordance with the applicable 
legal provisions. However, the audit identified some shortcomings as regards the demonstration by potential 
EDIRPA  beneficiaries  specifically  how  the  Union  contribution  is  (notably  if  retroactive)  necessary  to  offset 
obstacles in common procurement during the duration of the grant action. 

Are the controls for the evaluation, ranking and selection of proposals for EDIRPA and ASAP adequately designed 
and effectively implemented? 

DG DEFIS has designed and implemented a control system for evaluating, ranking and selecting the proposals 
that is adapted to the respective specificities of EDIRPA and ASAP and is in line with applicable rules. The control 
system includes specific guidance, structures and templates/checklists that supported the evaluation, ranking 
and selection of proposals process. 

Are the controls for the preparation and approval of the grant agreements adequately designed and effectively 
implemented? 

The  DG  DEFIS  process  for  the  preparation  and  approval  of  the  grant  agreements  adequately  supports  the 
effective translation of retained proposals into grant agreements and controls in place ensure compliance with 
the applicable legal provisions. 

Audit conclusion 

The IAS concluded that the control system that DG DEFIS has put in place for the early implementation of grants 
in the short-term defence instruments for ASAP and EDIRPA was overall adequately designed and implemented 
in accordance with the applicable rules. 

Audit recommendations 

The IAS did not formulate any critical or very important recommendations. 

11 

 
1.6. 

Simplification measures in cohesion funding in the 2021-2027 
programming period (DG REGIO, DG EMPL) 

The objective of the audit was to assess if DG REGIO and DG EMPL have designed and implemented adequate 
and effective internal control processes for the capacity building, the ex ante assessment and the monitoring 
of the simplified cost options and financing not linked to costs which serve the intended objective of enhancing 
simplification in the implementation of the Cohesion Policy funds in the 2021-2027 programming period. 

Audit results 

Are the processes of capacity building, ex ante assessment and monitoring of simplified cost options simplified 
cost options and financing not linked to costs in the programming period 2021-2027 adequately designed? 

The Directorates-General, including the joint audit Directorate for Cohesion, have made significant efforts to 
establish internal networks, communities of best practice and mechanisms to build and maintain staff capacity 
to use simplified cost options and financing not linked to costs. However, the established networks lack a formal 
mandate which limits their full potential to operate for achieving (strategic) objectives. The training on simplified 
cost options and financing not linked to costs is not always tailored to the specific roles and needs, and it needs 
to be complemented by practical examples and lessons learned. Finally, there is a concentration and dependence 
on  one  contractor  which  provides  expertise  to  the  Directorates-General  on  simplification  and  results-based 
approaches.  Moreover,  this  contractor  is  also  potentially  in  a  situation  of  professional  conflicting  interests 
considering its involvement in different contracts. Such situations have not been identified and further assessed 
by the Directorates-General and they have not taken any specific mitigating measures to manage the related 
risks. 

In  the  area  of  ex  ante  assessment,  overall,  internal  procedures,  guidance  and  checklists  were  adequately 
designed.  However,  some  specific  guidance  was  lacking  on  the  process  for  the  assessment  of  adjustment 
methods of simplified cost options, on the documentation of the informal phase of programming and on the 
roles and responsibilities for the assessment of financing not linked to costs. 

The Shared Fund Management in the European Union period 2021-2027 (SFC2021) access controls, the related 
Launchpad reports and other monitoring tools were not adequately designed to meet business needs for either 
control and effective monitoring and reporting on simplified cost options and financing not linked to costs 

Are  the  processes  of  capacity  building,  ex  ante  assessment  and  monitoring  of  simplified  cost  options  and 
financing not linked to costs adequately, effectively and timely implemented?  

The Directorates-General’ capacity building initiatives reflect a positive effort to encourage knowledge-sharing 
and  collaboration.  However,  the  auditors  could  not  verify  how  the  members  of  the  various  simplification 
enablers shared their acquired knowledge with the relevant staff in the Directorates-General for effective use. 

As  regards  ex  ante  assessment,  internal  procedures  were  not  always  implemented  consistently  in  practice. 
These concern the documentation of the informal phase, the availability of the audit authority’s assessments 
for simplified cost options and the final documents for simplified cost options and financing not linked to costs 
and financing not linked to costs to run internal and inter-service consultations, the assessment of simplified 
cost options by desk officers and the assessment of simplified cost options and financing not linked to costs by 
the auditors. 

While  some  practical  tools  were  put  in  place  for  monitoring  and  reporting  on  simplified  cost  options  and 
financing  not  linked  to  costs,  they  are  not  always  reliable  as  they  require  manual  interventions  and  lack  a 
system of version control of data. 

12 

 
 
 
 
Audit conclusion 

The IAS concluded that DG REGIO and DG EMPL have designed and implemented adequate and effective internal 
control processes for the capacity building, ex ante assessment and monitoring and reporting on simplified cost 
options and financing not linked to costs to enhance simplification in the implementation of the cohesion policy 
funds in the 2021-2027 programming period, except for three very important issues concerning: (a) the ex ante 
assessment of simplified cost options and financing not linked to costs; (b) capacity building and procurement 
of services around such simplification measures; and (c) the monitoring and reporting on simplified cost options 
and financing not linked to costs. 

Audit recommendations 

Recommendations No 1 and 2, on the ex ante assessment of simplified cost options and financing not 
linked to costs, DG REGIO and DG EMPL should: 

• 

improve guidance, documentation and ex ante assessments of simplified cost options and financing 
not linked to costs. 

Recommendations No 3 and 4, on the capacity building and procurement of services for simplified cost 
options and financing not linked to costs, DG REGIO and DG EMPL should: 

• 

enhance training on simplified  cost options and financing not linked to  costs, and  monitor risks of 
concentration/dependency on external experts and their potential professional conflicting interests. 

Recommendations No 5 and 6, on the monitoring and reporting on simplified cost options and financing 
not linked to costs, DG REGIO and DG EMPL should: 

•  manage  access  rights  and  improve  monitoring  and  reporting  tools  on  simplified  cost  options  and 

financing not linked to costs. 

Additional information provided by DG REGIO and DG EMPL on the implemented measures 

DG REGIO and DG EMPL established an action plan to address all audit findings, which was considered 
satisfactory by the IAS. The implementation of the recommendations is on track to meet the deadlines 
set out in the action plan (all deadlines are in 2026). 

1.7. 

Horizon Europe – European Innovation Council grant 
agreements preparation and award procedures (DG RTD, 
EISMEA) 

The objective of the audit was to assess whether EISMEA and DG RTD designed and implemented adequate, 
effective and efficient internal control processes for the grant agreements preparation and award procedures 
under the European Innovation Council (EIC) programme, ensuring compliance with the applicable rules. 

Audit results 

Is the specific control environment of the grant agreements preparation and coordination between the grant and 
investment  component  including  the  award,  procedure  adequately  designed  within  EISMEA  and  DG  RTD  to 
address the specificities of the EIC in compliance with applicable rules? 

13 

 
EISMEA, with the support of DG RTD, has defined a specific control environment for the preparation of the EIC 
grant agreements (including the award decisions) and for the coordination between the grant and investment 
components  built  on  corporate  guidance,  procedures  and  IT  systems  and  complemented  by  manual  of 
procedures, checklists and instructions specific to the EIC.  

However, this control environment is not adequately designed and not complete, hence failing to effectively 
integrate the specificities of the EIC programme and to provide a robust framework for ensuring compliance 
with  applicable  rules.  Among  the  missing  elements,  the  IAS  observed  the  lack  of  procedures  framing  the 
implementation of the parallel preparation of the single award decisions and the grant agreement preparation 
to  avoid  that  award  decisions  are  adopted  without  completing  necessary  checks.  Additionally,  there  is  no 
harmonisation of the economic security measures between grant and investment components. 

The existing guidance is also not complete as regards specific measures for mitigating risks associated with 
beneficiaries who have weak financial capacity and criteria for assessing retroactive start date requests, funding 
holding  companies,  monitoring  the  investment  budget  under  the  EIC  Accelerator,  operational  checklists  for 
amending award decisions. 

Have  the  retained  project  proposals  been  effectively  and  efficiently  translated  into  legally  binding  grant 
agreements? 

The retained project proposals have been effectively translated into legally binding grant agreements, however 
the IAS identified inefficiencies and lapses in the implementation of some controls and processes that needs to 
be  implemented  during  the  grant  agreement  preparation  phase  for  both  the  EIC  Acceleration  and  the  EIC 
Transition grants. Specifically, EISMEA did not conduct: (a) effective financial capacity assessment checks for 
EIC  Accelerator  grants  until  June  2023  (and  even  then,  the  checks  were  not  consistently  effective);  and  (b) 
systematic  financial  capacity  checks for  EIC  Transition  grants.  EISMEA  accepted  and  signed  55%  of  the  EIC 
Accelerator grant agreements with a retroactive start date even though corporate guidance states that such 
instances should be exceptional. Moreover, no criteria were established to justify the use of retroactive start 
date.  It  also  failed  to  verify  sufficiently  the  applicants'  specific  legal  statuses  as  small  and  medium-size 
enterprises and middle-capitalisation enterprises. Lastly, the time-to-grant results for the EIC Accelerator were 
inaccurately reported and misrepresented in the 2024 Annual Activity Report.  

Are the processes and controls for the preparation and adoption of the award decision and single award decision 
(including the amending decisions) effectively and efficiently implemented, in compliance with the regulatory 
framework? 

The controls for preparing and adopting award decisions, single award decision and amending decisions, were 
not always effectively and efficiently implemented in compliance with the regulatory framework. Single award 
decisions were adopted before completing grant agreement preparation checks and in a number of cases, they 
related to projects that did not meet eligibility criteria. Additionally, one amending award decision in a holding 
company  was  made  without  performing  ex  ante  eligibility  checks.  Finally,  award  decisions  with  maximum 
indicative investment amounts exceeding the available budget by EUR 1.31 billion (+58%) were also adopted. 
In terms of efficiency, substantial delays were noted in the time-to-grant key performance indicator for the EIC 
Accelerator  scheme  that  exceeded  the  target  despite  performing  grant  agreement  preparation  and  award 
procedures simultaneously. 

Audit conclusion 

The  IAS  concluded  that  EISMEA  and  DG  RTD  did  not  adequately  design  and  implement  the  internal  control 
processes  for  the  grant  agreements  preparation  and  award  procedures  specific  to  the  European  Innovation 
Council  Accelerator  scheme,  resulting  in  cases  of  non-compliance  with  the  applicable  rules,  while  EISMEA 
partially effectively and efficiently implemented the internal control process for the European Innovation Council 
Transition and Pathfinder schemes. 

14 

 
 
 
Audit recommendations 

Recommendation No 1, on the EIC grant agreement preparation phase, EISMEA should: 

• 

reinforce the design and implementation of the controls related to the European Innovation Council 
grant agreement preparation phase. 

Recommendation No 2, on the time-to-grant: monitoring and reporting, EISMEA should: 

• 

revise the reporting on the time-to-grant indicator in the Annual Activity Report and assess the key 
root causes for delays. 

Recommendation No 3, on the award decision process, DG RTD and EISMEA should: 

• 

revise the award decision process – critical. 

Recommendation No 4, on the amending award decision process, DG RTD and EISMEA should: 

• 

revise the amending award decision process. 

Recommendation No 5, on the budget monitoring and communication of the award decisions to the 
European Investment Bank, DG RTD should: 

• 

reinforce budget monitoring and ensure formal transmission of the award decisions to the European 
Investment Bank. 

Additional information provided by DG RTD and EISMEA on the implemented measures 

DG  RTD  and  EISMEA  accepted  all  recommendations,  with  the  exception  of  one  sub-recommendation 
(only partially accepted). They submitted a joint action plan to the IAS mid-March 2026, who assessed 
it as satisfactory. The implementation of all recommendations is on track. Both services are committed 
to implement corrective actions as swiftly as possible to ensure that any potential risks are appropriately 
mitigated within a short timeframe (before third quarter 2026 for the critical recommendation, at the 
latest by the end of 2026 for the rest).  

1.8. 

Implementation of the Connecting Europe Facility – Transport 
(DG MOVE, CINEA) 

The objective of the audit  was to assess the effective and efficient implementation of the governance, risk 
management and control processes established by CINEA and DG MOVE for the implementation of Connecting 
Europe Facility (CEF) Transport (Phase II, i.e. after the award of the grant agreement), in line with the applicable 
rules. 

Audit results 

Do DG MOVE and CINEA effectively and efficiently implement their working arrangements for the implementation 
of the projects funded under CEF Transport? 

The working arrangements between DG MOVE and CINEA are implemented effectively and efficiently, with roles 
and responsibilities clearly defined in the Memorandum of Understanding of August 2021. DG MOVE provides 
policy  direction  and strategic  oversight,  while  CINEA  ensures  the  operational  management  of  CEF  Transport 

15 

 
projects, including monitoring, reporting and payments. This division of tasks is consistently applied in practice 
and supports clarity and accountability. 

Coordination mechanisms are well established and function smoothly at both the strategic and the operational 
level;  regular  meetings,  management  exchanges  and  operational  contacts  between  project  officers  ensure 
continuous alignment.  The  systematic  exchange  of  information  and  reporting  strengthens  collaboration  and 
allows issues to be addressed in a timely manner. 

The arrangements also demonstrate flexibility and adaptability. Adjustments to implementation, such as project 
amendments or extensions, are applied consistently and discussed with DG MOVE when necessary. Both parties 
consider the Memorandum of Understanding adequate, and no significant issues have been identified. Overall, 
the cooperation framework enables effective programme delivery and efficient use of resources. 

Has  CINEA,  in  cooperation  with  its  parent  Directorate-General  as  appropriate,  designed  and  implemented 
adequate processes for monitoring the implementation of the projects funded under CEF Transport? 

CINEA  has  designed  processes  to  monitor  the  implementation  of  actions  funded  under  the  CEF2  Transport 
programme. The roles and responsibilities are defined and understood, monitoring mechanisms are consistently 
applied. 

Beneficiaries are  well  informed  of  their obligations  through  a  combination  of  tools,  templates and practical 
guidance, supported by frequent communication with project officers, facilitating effective implementation. 

Monitoring and reporting arrangements provide both regular oversight and assurance on the progress of actions. 
However, certain elements of the monitoring framework are not fully proportionate to the potential risk levels 
of some actions and therefore require improvement, namely: 

• 

• 

• 

There  is  currently  no  documented  methodology  with  defined  criteria  or  red  flags  to  support  a 
consistent, risk-based decision on when to perform additional on-site visits. 

There  is limited  guidance  supporting  project  managers  in  their assessment  of  technical  reports,  in 
particular  as  regards  the  elements  that  may  be  considered  riskier  or  red  flags  and  there  was  no 
documented evidence that these external technical reports were adequately analysed. 

The CINEA procedures and guidelines lack details on the steps to be taken in case of recurrent delays 
or quality issues linked to underperformance. 

Has  CINEA,  in  cooperation  with  its  parent  Directorate-General  as  appropriate,  designed  and  implemented 
adequate controls in relation to payments? 

CINEA, in cooperation with its parent  Directorate-General where appropriate, has put  in place adequate and 
effective controls in relation to payments. The financial circuits are clearly documented (electronic Manual of 
Procedures - eMOP), and roles and responsibilities (Project Officers, Financial Officers and Heads of Sector) are 
well defined and respected, ensuring that regulatory and contractual requirements are met before any payment 
is authorised. 

Staff are provided with clear guidance and targeted training to ensure the necessary expertise for carrying out 
financial tasks. CINEA ensures that compliance checks are performed in accordance with the applicable rules 
and properly documented. No indications of double funding were identified in the reviewed sample, with checks 
performed  on  invoices  (accounting  number,  date  and  amount)  to  verify  that  costs  had  not  been  previously 
claimed. 

For  the  projects  examined,  pre-financing,  interim  and  final  payments  were  subject  to  the  required  checks 
(including the Certified Financial Statement where applicable), and in cases of project termination, recoveries 
were successfully carried out. No recurrent errors or systemic weaknesses were identified, and mechanisms 
exist  to  inform  the  parent  Directorate-General  when  needed.  Overall,  the  internal  control  framework  for 
payments is considered appropriate and effective. 

16 

 
Does CINEA effectively manage amendments, as appropriate in cooperation with DG MOVE? 

CINEA  effectively  manages  the  amendments  process,  and  its  controls  comply  with  the  grant  agreement 
provisions.  CINEA  has  prepared  detailed  process  manuals  and  procedures  to  manage  the  workflow  for 
amendments. A sample review of projects with amendments did not identify any cases where these procedures 
were not followed. The involvement of DG MOVE is limited to specific cases as described in the process manuals. 

Are the working arrangements between CINEA and DG MOVE for reporting and communicating the results of the 
projects funded under CEF Transport effectively and efficiently implemented? 

The working arrangements between CINEA and DG MOVE for reporting and communicating project results are 
effectively  implemented,  with  feedback  to  policy  aligned  with  expectations  set  out  in  the  Memorandum  of 
Understanding.  A  series  of  correspondents  have  been  established  to  facilitate  working  arrangements  and 
collaboration between CINEA and DG MOVE. DG MOVE contribution is further strengthened through the use of 
sophisticated  dashboards  and  data  visualisation  tools,  enhancing  transparency  and  supporting  oversight. 
Established key performance indicators and stakeholder feedback surveys provide insight into the performance 
of both grant management and of project officers. 

Audit conclusion 

The  IAS  concluded  that  CINEA  and  DG  MOVE  have  adequately  designed  and  effectively  and  efficiently 
implemented  processes  for  the  effective  and  efficient  implementation  of  CEF  Transport,  in  line  with  the 
applicable legal framework. 

Audit recommendations 

The IAS did not formulate any critical or very important recommendations. 

1.9. 

Assurance building processes and audit strategy for the 2021-
2027 programming period - design (DG HOME) 

The objective of the audit was to assess the adequacy of the design and set up of DG HOME’s ‘governance, risk 
management and control processes’ for assurance building of funds implemented under shared management 
in the 2021-2027 programming period. 

Audit results 

Has DG  HOME provided relevant, clear and  sufficient information  to  their staff on key  changes and features 
regarding DG HOME funds implemented under shared management in the 2021-2027 programming period? 

Overall, DG HOME has identified key features and changes to the legislative framework, impacting the provision 
of  assurance  for  its  funds  delivered  under  the  shared  management  mode.  It  has  established  a  structured 
approach towards the dissemination of information to staff and has provided training, guidance and tools to 
support. In addition, there has been an active coordination between DG HOME, the Joint Audit Directorate for 
Cohesion and other Directorates-General implementing funds under the Common Provision Regulation in setting 
up  common  guidance  and  training  materials  for  auditors  regarding  common  features  of  the  2021-2027 
programming period, which can be considered as a good practice. 

Has DG HOME provided adequate support and tools to assist Member States in the design and set up of their 
management  and  control  systems  for  funds  implemented  under  shared  management  in  the  2021-2027 
programming period? 

Through established communication procedures, IT tools and regular meetings, DG HOME has set up a structured 
dialogue  with  the  national  authorities  and  provides  support  to  Member  States  regarding  the  design  and 

17 

 
functioning of the management and control system, with specific attention to the newly established authorities 
and new aspects introduced by the regulatory framework. In this context, it was noted that DG HOME closely 
cooperates with the Joint Audit Directorate for Cohesion and other  Directorates-General implementing funds 
under the Common Provision Regulation, in providing information to Member States on topics relevant for all 
funds under the Common Provision Regulation legal framework. 

Are the single audit strategy and underpinning internal procedures adequately designed to address DG HOME 
specific risks and new elements concerning its legality and regularity processes for the 2021-27 Funds under 
shared management? 

Overall, DG HOME has set up audit arrangements based on the single audit strategy commonly developed by 
all Directorates-General covered by the Common Provision Regulation. However, for the specific aspects of the 
audit approach for the 2021-2027 programming period and the internal processes regarding preventive and 
corrective  measures,  by  the  end  of  the  fieldwork,  DG  HOME  had  not  fully  established  additional  audit 
arrangements  related  to  the  special  handling  of  documents.  Besides,  a  comprehensive  risk  assessment 
approach and audit planning incorporating fund-specific and common risk factors was at that time still under 
the  development.  Finally,  DG  HOME  still  needs  to  validate  internal  procedures  regarding  the  application  of 
preventive  measures  and  establish  a  procedure  describing  the  process  on  the  application,  monitoring  and 
reporting of financial corrections. 

Audit conclusion 

The IAS concluded that for the 2021-2027 programming period, DG HOME has, overall, adequately designed 
and  set  up  governance,  risk  management  and  control  processes  supporting  assurance  building  for  funds 
delivered  under  the  shared  management  mode,  except  for  the  HOME  fund  –  specific  audit  arrangements, 
including risk assessment and audit planning under the single audit strategy, and the internal processes for the 
preventive and corrective measures that still need to be finalised to fully set up all required elements. 

Audit recommendations 

Recommendation No 1, 2 and 3, on audit strategy, risk assessment and audit planning, DG HOME should: 

• 

• 

• 

develop additional DG HOME-specific audit arrangements for single audit strategy. 

set-up a risk assessment model for DG HOME funds. 

revise the methodology and approach for developing the audit plan. 

Recommendation No 4, on interruptions, suspensions and financial corrections processes, DG HOME 
should:  

• 

establish and finalise procedures for application of preventive and corrective measures. 

Additional information provided by DG HOME on the action plan 

DG HOME established an action plan to address all recommendations, assessed as satisfactory by the 
IAS. By the end of 2025, DG HOME reported as implemented the recommendation on the audit strategy 
and  the  recommendation  on  the  risk  assessment.  DG  HOME  considered  the  recommendation  on 
establishing and finalising the procedures for application of preventive and corrective measures to be 
implemented in the first quarter of 2026.  

The  remaining  actions  related  to  the  partially  implemented  recommendation  on  revising  the 
methodology and approach for developing the audit plan are ongoing. DG HOME continues monitoring 
the execution of the audit plan (the audits for 2025 have already been performed). In order to fully 
implement  the  recommendation,  DG  HOME  will  report  any  deviations  in  the  revised  audit  work 
programme and incorporate the results into future updates of the audit plan. 

18 

 
1.10.  Amendments of the Common Agricultural Policy national 

strategic plans (DG AGRI) 

The objective of the audit was to assess in DG AGRI the adequacy of the design and the effectiveness and 
efficiency of the implementation of the internal control processes for reviewing and approving the amendments 
to the Common Agricultural Policy national strategic plans, including the review and follow-up of notifications. 

Audit results 

Has DG AGRI adequately designed its processes for the review and approval of the Common Agricultural Policy 
strategic plans amendments? 

Overall, DG AGRI has designed adequate and detailed procedures for the review and approval of the Common 
Agricultural  Policy  amendments  and  notifications,  which  are  presented  in  its  Vademecum,  and  which  are 
updated on a regular basis. It has also designed templates for communicating with Member States. Moreover, 
DG AGRI has set up the New Consistency Board to address outstanding technical issues in the implementation 
of the Common Agricultural Policy strategic plans (including when reviewing amendment requests), ensuring 
consistent  and  coordinated  responses.  This  is  especially  important  given  the  complexity  of  the  Common 
Agricultural Policy legal framework. 

However, the mandate and rules of functioning of the New Consistency Board were not fully clear as regards 
New Consistency Board conclusions requiring formal endorsement. After the fieldwork ended, DG AGRI adopted 
a revised mandate clarifying those elements. 

In addition, there was a lack of clarity on the date of start of eligibility for approved changes in the European 
Agricultural Fund for Rural Development interventions which were previously notified but found non-compliant 
with the legal basis for notifications. For future notifications and amendments, this should be clarified, due to 
an ongoing Common Agricultural Policy Omnibus Regulation which will modify the process for amendments and 
is planned to enter into force in January 2026. In addition, DG AGRI had also not provided clear guidance to 
Member States on how to indicate in the amendments which changes were notified and at which date. 

Furthermore, there was a lack of clarity on what can be accepted in terms of deviations between the overall 
target numerators of result indicators and related outputs (in case of direct link between the two). Finally, the 
requirements to Member States for the presentation of planned outputs did not allow to identify the planned 
aggregated outputs for a group of unit amounts, in case the intervention also benefited from additional national 
financing generating outputs. 

Does DG AGRI effectively and efficiently implement its processes for the review and approval of the Common 
Agricultural Policy strategic plan amendments? 

Overall,  DG  AGRI  has  adequately  implemented  its  procedures  for  the  review  and  approval  of  the  Common 
Agricultural Policy amendments. In addition, DG AGRI effectively monitors the progress of the assessment and 
approval of amendments including through regular monitoring of deadlines and sharing of information within 
DG AGRI and with other Directorates-General involved. As a result, it has managed to approve the amendment 
requests within the legal deadline, despite the significant number of amendment requests and the large volume 
of changes included in each of them, which impose a continuous heavy workload on DG AGRI staff. 

However,  there  were  some  misalignments  between  the  procedures  prescribed  in  the  Vademecum  and  the 
practices observed with regards to the pre-consultation with other Directorates-General and the consultation 
within  DG  AGRI  during  the  assessment  of  the  amendment  request.  In  addition,  there  was  a  misalignment 
between the Vademecum and the practice as regards the use of the return for corrections. 

Furthermore,  based  on  sample  testing,  corrections  of  non-compliance  in  the  Common  Agricultural  Policy 
strategic plans identified after their approval were not always requested from the Member States. 

19 

 
Finally, there were some gaps as well as information not up to date in the documentation of the assessment 
of some of the amendment  requests reviewed. In addition, not all approved amendments and  related  ‘At a 
glance’  documents  were  published  on  time  on  the  Europa  website,  contrary  to  the  instructions  in  the 
Vademecum. 

Audit conclusion 

The IAS concluded that DG AGRI has adequately designed and effectively and efficiently implemented internal 
control  processes  for  reviewing  and  approving  the  amendments  to  the  Common  Agricultural  Policy  national 
strategic plans, including the review and follow-up of notifications, except for two very important issues which 
relate to the date of start of eligibility of European Agricultural Fund for Rural Development notified changes, 
as well as to the clarification on the acceptable deviations between result indicators and outputs and correction 
of detected non-compliances in the Common Agricultural Policy strategic plans. 

Audit recommendations 

Recommendation No 4, on the notifications and date of start of eligibility, DG AGRI should: 

• 

ensure clarity on the date of eligibility for notified changes. 

Recommendation  No  6  and  7,  on  the  errors  and  inconsistencies  in  the  Common  Agricultural  Policy 
strategic plans, DG AGRI should: 

• 

• 

request corrections on detected non-compliances in Common Agricultural Policy strategic plans. 

clarify acceptable deviations between outputs and result indicators and reinforce checks on outputs. 

Additional information provided by DG AGRI on the implemented measures 

DG AGRI accepted all recommendations and submitted an action plan, assessed as satisfactory by the 
IAS, in April 2026, to mitigate the risks identified. 

1.11.  Design of the performance monitoring and evaluation 

framework for the Common Agricultural Policy 2023-2027 (DG 
AGRI) 

The objective of the audit was to assess whether DG AGRI has adequately designed the Common Agricultural 
Policy 2023-2027 performance monitoring and evaluation framework (PMEF) in order to monitor, evaluate and 
report on the performance of the Common Agricultural Policy under the New Delivery Model. 

Audit results 

Intervention logic 

Overall, the Common Agricultural Policy strategic plan interventions, designed at Member State level, respond 
to the Common Agricultural Policy objectives and are sufficiently linked to the result and impact indicators. This 
is to a large extent thanks to DG AGRI’s advice and consistent support to Member States. 

Performance monitoring and evaluation framework indicators 

DG AGRI has prepared fiches for the performance monitoring and evaluation framework indicators, which allows 
for a uniform interpretation on how data must be collected and reported by Member States. Within DG AGRI, 

20 

 
the allocation of responsibilities regarding who is responsible on which Common Agricultural Policy indicators 
is clear. Furthermore, to cope with the challenges related to data quality, DG AGRI has put in place instructions, 
designed in-house controls and established structured communication with data providers such as Eurostat. 

Support to Member States on the implementation of the Common Agricultural Policy strategic plans and for 
monitoring their performance 

Overall,  DG  AGRI  has  put  in  place  adequate  procedures  for  providing  support  to  the  Member  States  in  the 
implementation of the Common Agricultural Policy strategic plans and for monitoring their performance, apart 
from the following very important weakness: 

While the Common Agricultural Policy regulation allows Member States to request amendments on milestones 
and  targets  for  result  indicators,  it  does  not  provide  clear  grounds  under  which  such  amendments  may  be 
rejected. In the absence of clear provisions in the basic legislation and not to undermine the effectiveness of 
the  biennial  performance  review,  DG  AGRI  has  agreed  on  an  approach  to  deal  with  such  requests  for 
amendments, which has evolved over time as the implementation of the Common Agricultural Policy strategic 
plans progressed. However, this approach remains difficult to implement in the absence of a clear legal basis 
and needs further clarification and documentation. 

Processes for evaluating and reporting on the Common Agricultural Policy 2023- 2027 

DG AGRI has put in place adequate processes to deliver the evaluations as required by the Common Agricultural 
Policy strategic plan Regulation, through the preparation of a fit for purpose multiannual plan for studies. 

In addition, DG AGRI disseminates available data on the performance monitoring and evaluation framework 
indicators through the Agri-food Data Portal (AGRIDATA portal). Preparations are ongoing for reporting on the 
performance of the new Common Agricultural Policy in the new 2024 Annual Activity Report of DG AGRI. 

However, in terms of performance reporting, the performance programme statements accompanying the draft 
budget for 2025 and annexed to the 2023 Annual Management and Performance Report for the EU budget did 
not  include  data  for  the  Common  Agricultural  Policy  2023-2027  core  indicators,  although  some  data  were 
already available for a number of indicators. 

Audit conclusion 

The IAS concluded that overall, DG AGRI has adequately designed the Common Agricultural Policy 2023-2027 
performance monitoring and evaluation framework to monitor, evaluate and report on the performance of the 
Common Agricultural Policy under the New Delivery Model, except for one very important issue relating to the 
approach for approving changes to targets and milestones for result indicators. 

Audit recommendations 

Recommendation No 1, on the approval of changes to milestones and targets for result indicators, DG 
AGRI should: 

• 

update and clarify the approach for assessing requested changes to milestones and targets. 

Additional information provided by DG AGRI on the implemented measures 

DG AGRI accepted the recommendation from the IAS and submitted an action plan that was assessed 
as satisfactory by the IAS, in June 2025, to mitigate the risks. Actions related to recommendation 1 are 
ongoing. DG AGRI continues to monitor the execution of the audit plan. 

21 

 
This recommendation was due on 31 March 2026. DG AGRI planned to implement it in two steps, as 
approved by the IAS in the action plan. 

DG AGRI considers that the first action has been implemented (the outcome of the dedicated meeting 
of  the  Expert  Group  on  the  implementation  of  the  CAP  Strategic  Plans  Regulation  was  used  for  the 
discussions on the design of the new Performance Regulation for 2028-2034 and in particular for the 
selection of the indicators). 

The second step, on the clarification of the approach for assessing requested changes to milestones 
and targets, has been discussed in the next New Consistency Board meeting on 5 June 2026. Once the 
agreement is reached, the Vademecum will be updated accordingly. DG AGRI expects by consequence 
to close the recommendation once the new version of the Vademecum has been validated. 

1.12.  Non-Governmental Organisations (NGO) funding under the LIFE 

programme (DG ENV, DG CLIMA, DG ENER, CINEA) 

The objective of this audit was to assess whether DG ENV, DG CLIMA, DG ENER and CINEA, responsible for the 
Programme for the Environment and Climate Action (LIFE), have taken effective measures to implement the 
‘Guidance on funding for activities related to the development, implementation, monitoring, and enforcement 
of  Union  legislation  and  policy’  for  the  grants  signed  after  its  issuance,  i.e.  under  the  2024  LIFE  calls  for 
proposals and onwards. The objective of the audit did not include an evaluation of the applicable legal basis 
and of the corporate guidance. 

Audit results 

Based on the work performed within the scope of the audit, the IAS assessed the measures taken to comply 
with the corporate guidance as follows: 

Have the Commission services concerned (parent Directorates-General) provided adequate guidance to CINEA, 
in alignment with the EC corporate guidelines? 

The LIFE programme parent Directorates-General took a series of measures, including providing orientation to 
CINEA on how the corporate guidance should be applied in practice, responding to specific queries and advising 
on individual cases for the proposals submitted under the LIFE 2024 calls for proposals. They also ensured a 
proper follow-up on the matter at the CINEA Steering Committee and LIFE Working Group meetings. 

For future LIFE calls, they clarified in the 2025–2027 LIFE Multi-Annual Work Programme that operating grant 
agreements  should  not  require  beneficiaries  to  undertake  specific,  detailed  activities  directly  targeting  EU 
institutions, their staff or members, or to take positions on specific policy issues. 

Additionally,  they  informed  the  non-governmental  organisations  with  whom  they  had  an  ongoing  operating 
grant, about the impact of the corporate guidance by holding meetings on 28 November 2024, 4 December 
2024, and 3 June 2025. 

Has CINEA implemented the corporate guidance effectively? 

CINEA has carried out a series of measures to implement the corporate guidance, including providing targeted 
training to external experts involved in the grant agreement preparation phase and incorporating in the text of 
the 2025 LIFE calls for proposals -– as part of the criteria for eligible activities - the requirement to ‘respect EU 
values and European Commission policy regarding reputational matters’, including a reference to the corporate 
guidance. 

22 

 
Furthermore, during the preparation of the action and operating grants awarded following the 2024 LIFE call, 
successful beneficiaries were informed, as part of the guidance note for the grant preparation phase, about the 
new compliance requirements related to the corporate guidance. In addition, beneficiaries of operating grants 
signed under the 2024 LIFE calls were informed of the reporting requirements for the implementation of their 
grant agreements, which include compliance with the corporate guidance. 

To align its internal operations with the requirements stemming from the corporate guidance, CINEA has revised 
its  procedures  for  the  evaluation  and  award  of  grants  to  non-governmental  organisations  and  updated  the 
existing checklist accordingly. CINEA performed a review of all successful proposals under the 2024 LIFE call to 
remove  from  the  work  packages  to  be  included  in  the  grant  agreements,  references  to  activities  that  they 
consider are not in line with the corporate guidance,  such as those framed as lobbying or targeting directly 
(members of) EU institutions for specific policy outcomes. A register has also been established to track proposals 
requiring adjustments during the grant agreement preparation phase. However, the experience gained by CINEA 
staff and lessons learnt from the 2024 exercise have not yet been fully consolidated for use in future calls for 
proposals. 

CINEA also reported the results of the screening of pre-2024 ongoing LIFE grants to its parent Directorates-
General and to EC central services. 

Overall, CINEA has put in place adequate measures for preventing, detecting and addressing potential conflict 
of interests for experts involved in the evaluation of proposals, as well as for evaluation committee members. 
However, based on sample testing, the auditors identified one case where the declaration of confidentiality and 
absence of conflict of interests of one  voting member of an evaluation committee was signed around four 
months after the evaluation committee had taken place. 

Audit conclusion 

The  IAS  concluded  that  the  Commission  services  responsible  for  the  LIFE  programme  have  taken  adequate 
measures to implement the ‘Guidance on funding for activities related to the development, implementation, 
monitoring and enforcement of union legislation and policy’ so that activities such as those framed as lobbying 
or targeting directly (members of) EU institutions for specific policy content or outcome, are not mandated as 
a requirement, or condition for Union financing. 

Audit recommendations 

The IAS did not formulate any critical or very important recommendations. 

1.13.  Reliability of audit opinions on the legality and regularity of 

Erasmus+ expenditure declared by National Agencies (DG EAC) 

The objective of the audit was to assess whether the  measures taken by DG EAC to ensure the reliability of 
audit  opinions  issued  by  the  independent  audit  bodies  (IABs)  on  the  legality  and  regularity  of  expenditure 
reported by the national agencies are adequately designed and effectively implemented to obtain the necessary 
assurance on the use of Erasmus+ funds. 

Audit results 

Are the minimum requirements for the controls set by DG EAC for IAB and national agencies and the assessment 
of the audit opinions on the legality and regularity of expenditures declared by the national agencies adequately 
designed, in compliance with the applicable rules? 

DG EAC has a well-established procedure for setting minimum requirements for the independent audit body’s 
work (in the form of yearly guidelines) and for assessing the independent audit opinions, including clear roles 
and responsibilities for DG EAC staff involved in the process. The yearly guidelines include a comprehensive set 

23 

 
of requirements with a recommended methodological approach, provisions on audit population reconciliation 
and  sampling,  as  well  as  indicative  audit  programmes  and  audit  opinion  templates  which  are  timely 
communicated to the national authorities and IAB. However, the requirements for the national agencies to check 
the ‘top 15%’ of beneficiaries receiving 70-75% of the budget need clarification and the monitoring of primary 
checks performed by national agencies is not fully effective. 

Is the assessment that DG EAC performs on the independent audit opinions on the legality and regularity of 
expenditure declared by the national agencies effective to ensure the necessary assurance is obtained? 

Overall, DG EAC effectively assesses the independent audit opinions on the legality and regularity of Erasmus+ 
expenditure.  However,  the  IAS  audit  identified  inconsistencies  in  verifying  the  audit  population  for  primary 
checks and deviations from the recommended sampling parameters for financial transaction testing in some 
of the sampled independent audit opinions. 

Does DG EAC follow up on the observations arising from the independent audit opinion and the actions taken 
by national agencies and national authorities in response to the observations? 

DG EAC follows up the observations reported in the independent audit opinions and their implementation by the 
national agencies on a regular basis.  However, no formalised internal  methodology exists for assessing the 
observations  and  no  action  plans  for  the  implementation  are  requested  from  the  national  agencies  and 
approved by DG EAC. 

Audit conclusion 

The IAS concluded that DG EAC has effectively implemented measures that are adequately designed to ensure 
the reliability of audit opinions issued by the IABs on the legality and regularity of expenditure reported by the 
national  agencies  to  obtain  the  necessary  assurance  on  the  use  of  Erasmus+  funds,  except  for  one  very 
important issue related to the management of observations. 

Audit recommendations 

Recommendation No 2, on the management of observations, DG EAC should:  

• 

improve the follow-up of observations. 

Additional information provided by DG EAC on the implemented measures 

DG EAC submitted an action plan addressing all audit findings in January 2026, which was assessed as 
satisfactory by the IAS. All planned measures related to this recommendation are ongoing and fully on 
track. They are expected to be fully implemented within the agreed timeframe (end of December 2026). 

1.14. 

InvestEU Fund – methodology for key performance indicators 
and key monitoring indicators, controls over indicators and 
internal steering and cooperation mechanism (DG GROW) 

The objective of the audit was to assess the adequacy of the design and the effective implementation of: (a) 
the internal steering and coordination mechanism put in place by DG GROW for the financing of the InvestEU 
Fund operations; (b) the methodology developed on indicators (key performance indicators and key monitoring 
indicators)  to  monitor  the  implementation  of  the  InvestEU  Fund;  and  (c)  the  controls  put  in  place  over  the 
operational reporting by Implementing Partners (IPs). 

24 

 
Audit results 

Is there an adequate and effective internal steering and coordination mechanism in place, allowing DG GROW 
to meet the InvestEU Fund’s objectives and to maximise its impact? 

The Commission (DG ECFIN and since February 2025 DG GROW) has established an adequate and effective 
internal mechanism that allows the participating Directorates-General to provide appropriate policy steer and 
coordination. Commission Directorates-General have access to timely and adequate data on the implementation 
of InvestEU operations. Moreover, there is a clear and comprehensive division of work, roles and responsibilities 
between the Directorates-General involved in the implementation of the InvestEU Fund. This was confirmed by 
the Directorates-General that participated in the survey launched by the IAS as part of this audit. 85% of the 
survey participants agreed that the roles and responsibilities of DG GROW and their own DG as regards the 
implementation of the InvestEU Fund are clearly defined and well understood. 

Has DG GROW established a robust methodology on performance and monitoring indicators for the financing of 
InvestEU Fund operations and is this effectively used to monitor the implementation of the Fund? 

The performance management framework for the InvestEU Fund has been defined in the InvestEU Regulation, 
which contains both key performance and key monitoring indicators. In June 2022, DG ECFIN developed the 
methodology for the calculation of InvestEU key performance and key monitoring indicators which was then 
revised in February  2024 to  include additional indicators  proposed  by the InvestEU Steering Board (such as 
indicators  on  climate  mitigation,  biodiversity  and  gender  equality)  and  to  clarify  some  of  the  calculation 
methodologies. 

When  assessing  the  performance  management  framework  put  in  place  to  track  the  progress  of  InvestEU 
towards  the  achievement  of  the  Union’s  objectives  and  evaluate  its  performance  the  IAS  found  that  the 
objectives  defined  in  the  legal  basis  are  not  ‘specific’,  the  indicators  have  no  baselines and  are  not  always 
accompanied by a target. Moreover, the approach to measure the long-term effect of the programme has not 
yet been defined. Additionally, specific indicators for digitisation and climate are not fully aligned with best 
practices set in these areas by the Commission or are not independently verified. 

As part of their control activities, DG GROW officers perform checks on the aggregate data reported by the IPs 
on a semi-annual basis and carry out monitoring visits to the IPs. However, the internal control strategy does 
not:  (a)  define  which  specific  checks  should  be  performed  during  the  monitoring  visits  to  ensure  the 
completeness  and  accuracy  of  the  data  underlying  the  aggregate  values  of  indicators  provided  by  the 
implementing partners; (b) formalise the target in terms of implementing partners to be visited each year, and 
(c)  define  the  approach  for  selecting  implementing  partners  to  be  accompanied  on  their  visits  to  financial 
intermediaries/financial beneficiaries. 

Article 8(8) of the InvestEU Regulation and the Commission Notice on the InvestEU Programme climate and 
environmental tracking guidance stipulate that the Commission, together with the implementing partners, shall 
seek to ensure a balanced distribution between the projects mainly contributing to climate mitigation priorities 
and those contributing to environmental priorities under the ‘Sustainable Infrastructure Window’ of InvestEU. 
The  analysis  carried  out  by  the  IAS  of  the  available  data  indicated  a  95%-5%  split  between  climate  and 
environmental spending for the Sustainable Infrastructure Window (by the end of 2024), which is below the 
expectations in the area. 

Audit conclusion 

The IAS concluded that overall, DG GROW has designed and implemented an adequate and effective internal 
steering and coordination mechanism for the financing of InvestEU Fund operations and has put in  place a 
robust  methodology  on  performance  and  monitoring  indicators  to  monitor  the  implementation  of  InvestEU, 
except for one very important issue related to the quality of objectives and key performance indicators and key 
monitoring indicators set in the legal basis. 

Audit recommendations 

25 

 
Recommendation No 1, on the performance management system, DG GROW should: 

• 

improve the design of the performance management system. 

Additional information provided by DG GROW on the implemented measures 

DG GROW submitted a draft action plan, which is being assessed by the IAS. Nevertheless, DG GROW 
already started the implementation of the actions it proposed in the action plan. 

1.15.  Control results provided by partners (management 

declarations) (DG INTPA) 

The objective of the limited review was to assess whether DG INTPA has designed and implements an adequate 
system that ensures that the management declarations effectively contribute to the assurance on the effective 
implementation of EU funds under indirect management with entrusted entities, as well as on the accuracy of 
financial reporting and its compliance with the Financial Regulation. 

Audit results 

Has DG INTPA designed an adequate control framework to comply with the Financial Regulation requirements 
on management declarations? 

DG INTPA has put in place a control framework for the management declarations which encompasses guidance 
and  checklists  for  the  staff  and  templates  related  to  contribution  agreements  (including  for  financial 
instruments) that the entrusted entities have to use for their management declarations. However, the IAS found 
that guidance (instructions, templates and checklists) is not accurate, complete and/or sufficiently clear on some 
important  elements  of  the  management  declaration  handling  process  which  would  enable  more  effective 
controls on the compliance of the management declaration with the requirements of the Financial Regulation. 
During the fieldwork, the IAS also found that there is no mechanism, neither at local or at corporate level, to 
collect  and  analyse  information  on  issues  encountered  with  global  management  declarations  in  view  of 
identifying and addressing systemic/ repetitive issues. 

Does DG INTPA implement its control system effectively, efficiently, and in line with the rules in place? 

The IAS found that a management declaration was available for 38 out of 39 sampled files for which it was 
required. However, the controls designed were not always implemented effectively, efficiently, and in line with 
the applicable rules. The IAS identified two major issues concerning the handling of management declarations, 
notably:  (a)  submission  deadline  and  validity  period  for  payments  and  clearings  of  global  management 
declarations was not aligned with the provisions of the Financial Regulation; (b) insufficient and/or inadequate 
checks, resulting in accepting as valid for processing payments and clearings management declarations that 
were either non-compliant with the agreements and/or templates or not accompanied by an audit opinion. The 
IAS also found that DG INTPA’s approach to preparing the Annual Activity Report does not align with the principle 
of sound financial management as the assurance relies on global management declarations from the preceding 
year rather than those pertaining to the year covered by the Annual Activity Report. 

Does DG INTPA’s reporting on management declarations in the Annual Activity Report comply with DG BUDG’s 
instructions? 

DG  INTPA  reporting  on  management  declarations  in  the  Annual  Activity  Reports  is  not  fully  in  line  with  DG 
BUDG’s  instructions  as  the  DG  does  not  collect  all  the  data  necessary  to  properly  fill  in  the  tables  on 
management declarations. 

26 

 
Audit conclusion 

The IAS concluded that the system designed and implemented by DG INTPA to ensure that the management 
declarations  contribute  to  the  assurance  on  the  effective  implementation  of  EU  funds  under  indirect 
management with entrusted entities, the accuracy of financial reporting and its compliance with the Financial 
Regulation is adequate except for two very important issues related to some aspects of the design of the control 
framework for management declarations, and the effectiveness and efficiency of management declarations as 
a control measure. 

Audit recommendations 

Recommendation No 1, on the design of the control framework for management declarations, DG INTPA 
should:  

• 

improve the control framework for management declarations. 

Recommendation No 2, on the assurance provided from global management declarations, DG INTPA 
should: 

• 

increase the effectiveness of management declarations as a control tool. 

Additional information provided by DG INTPA on the implemented measures 

INTPA  drafted  an  action  plan  that  was  accepted  by  IAS.  DG  INTPA  has  already  implemented 
Recommendation  No  2,  with  follow-up  pending  by  IAS.  Implementation  of  Recommendation  1  is 
underway. 

1.16.  Control results provided by partners – management 

declarations (DG ENEST) 

The objective of the limited review was to assess whether DG ENEST has designed and implements an adequate 
system that ensures that the management declarations effectively contribute to the assurance on the effective 
implementation of EU funds under indirect management with entrusted entities, as well as on the accuracy of 
financial reporting and its compliance with the Financial Regulation.  

Audit results 

Has DG ENEST designed an adequate control framework to comply with the Financial Regulation requirements 
on management declarations? 

DG ENEST has put in place a control framework for the management declarations which encompasses guidance 
and  checklists  for  the  staff  and  templates  that  the  entrusted  entities  have  to  use  for  their  management 
declarations. However, the IAS found issues in these elements that need to be further developed to enable more 
effective controls of management declarations.  

Does DG ENEST implement its control system effectively, efficiently, and in line with the rules in place? 

The IAS found that a management declaration was available for all 41 sampled payments and clearing files, 
for which it was required. However, the controls designed were not always implemented effectively, efficiently, 
and  in  line  with  the  rules  in  place.  Specifically,  the  IAS  identified  two  major  issues  related  to  handling 
management declarations, notably: (a) an erroneous interpretation and application of the rules related to global 
management declarations (both as regards the submission deadline, and their validity period for payments and 

27 

 
clearings);  (b)  inadequate  application  of  the  guidance  in  place  resulting  in  accepting  as valid  for  processing 
payments and clearings management declarations that were either non-compliant with the agreements and/or 
templates or not accompanied by an audit opinion. 

Does DG ENEST’s reporting on management declarations in the Annual Activity Report comply with DG BUDG’s 
instructions? 

DG ENEST reporting on management declarations in the Annual Activity Report is not fully in line with DG BUDG’s 
instructions  as  the  DG  does  not  collect  the  data  allowing  it  to  fill  in  properly  the  tables  on  management 
declarations. 

Audit conclusion 

The IAS concluded that the system designed and implemented by DG ENEST to ensure that the management 
declarations  contribute  to  the  assurance  on  the  effective  implementation  of  EU  funds  under  indirect 
management with entrusted entities, the accuracy of financial reporting and its compliance with the Financial 
Regulation is adequate except for two very important issues related to some aspects of the design of the control 
framework for management declarations, and the effectiveness and efficiency of management declarations as 
a control measure. 

Audit recommendations 

Recommendation  No  1,  on  the  design  of  the  control  framework  for  management  declarations,  DG 
ENEST should: 

• 

improve the control framework for management declarations. 

Recommendation No 2, on the assurance provided from global management declarations, DG ENEST 
should:  

• 

increase the effectiveness of management declarations as a control tool. 

Additional information provided by DG ENEST on the implemented measures 

DG ENEST accepted all recommendations and sent the action plan to the IAS on 23 January 2026. The 
IAS  accepted  the  action  plan  on  9  February  2026.  Both  very  important  recommendations  are  being 
implemented and will be finalised by 1 September 2026. 

1.17.  Financial management – high value procurement and contract 

management (DG TAXUD) 

The objective of the audit was to assess whether the internal control system set up by DG TAXUD for high value 
procurement and contract management is adequately designed, and efficiently and effectively implemented. 

Audit results 

Has  the  internal  control  environment  of  public  procurement  in  DG  TAXUD  been  adequately  designed  and 
effectively and efficiently implemented?  

DG TAXUD has defined and implemented internal roles and responsibilities for all procurement related tasks. 
DG TAXUD’s staff involved in the procurement process are made aware of their specific roles and the applicable 
rules.  

28 

 
DG TAXUD has properly reported procurement risks, and associated mitigating actions, in its risk register. The 
risks related to specific framework contracts are monitored and reported to the Public Procurement Committee. 
However,  there  is  no  consolidated  assessment  of  risk(s)  identified  in  different  steps  or  instances  of  the 
procurement process, nor a structured approach to follow up on or monitor the formulated mitigating actions 
relating to different procurement activities. 

In addition, DG TAXUD has not consolidated the control activities specific to procurement into a comprehensive, 
formalised control strategy covering the different steps of the procurement process and the related risks, as 
identified in various risk assessment exercises. 

Although DG TAXUD has designed actions to mitigate the ethics-related risk associated to public procurement, 
it  has  not  assessed  the  effectiveness  of  these  measures  in  strengthening  a  fraud-proof  procurement  and 
contract management system. 

Is the procurement planning adequately designed and effectively and efficiently implemented? 

DG TAXUD has designed and implemented a procurement planning process. However, the process shows very 
important issues which may affect the effective and efficient achievement of the Directorate-General’s 
objectives in the audited area. These weaknesses concern the design and implementation of specific steps in 
the planning process, in particular: 

a. 

b. 

c. 

the estimation of the total contract value, where DG TAXUD relied solely on historical prices 
without conducting adequate market research, 

the duration of the framework contracts, whereby the automatic renewal extended the 
contracts beyond the standard four-year limit, without sufficient documented justification, 

the preparation phase of procurement procedures. There is no evidence of a root cause analysis 
of delays stemming from the past procurement procedures enabling the DG to assess the time 
required for the planning steps. Moreover, the DG did not take specific measures to enhance 
internal cooperation and communication between Directorates to ensure a smooth completion 
of the procurement steps. 

Is the tendering and award process implemented according to the internal controls and applicable rules? 

The preparation and publication of procurement documents, and the communication with tenderers have been 
implemented according to the applicable procurement rules.  

However, the IAS identified very important issues as regards the selection and award criteria defined in the 
tender dossier and the evaluation of tenders. The award criteria defined by DG TAXUD in the tender documents 
were not sufficiently clear, detailed, or directly related to the technical specifications of the tender. In addition, 
evaluation reports highlighted weaknesses identified during the evaluation process, but they did not specify 
how  the  DG  intended  to  address them  in  the  final  selection  process,  nor  mention  of  any  specific  corrective 
measures that should be undertaken during the contract execution stage. 

Is the contract management effectively and efficiently implemented? 

DG TAXUD has established processes for contract monitoring. 

The financial and operational aspects of the IT contract’s implementation were reported periodically and timely 
to ensure the achievement of the entity’s objectives. Internal guidance was made available for the operational 
units covering the operational aspects contract management of IT contracts. 

However,  the  IAS  has  identified  very  important  issues  in  the  documentation  and/or  implementation  of  DG 
TAXUD’s  ex  ante  key  controls  on  commitments  and  payments.  These  concern  mainly:  (a)  the  design  and 
implementation of the payment checklist/workflow; (b) the documentation of ex ante operational key controls 
for an informed-based payment validation by the Authorising Officer by sub-delegation; and (c) gaps in the 

29 

 
design  and  implementation  of  early  detection  and  exclusion  system  checks.  These  issues  may  affect  the 
effective and efficient implementation of contract management by the responsible staff members.  

DG  TAXUD  has  a  contract  monitoring  control  process  in  place  allowing  to  report  issues  related  to  the 
procurement  deliverables.  Nevertheless,  DG  TAXUD  did  not  make  use  of  performance  and  retention  money 
guarantees provisions for the audited framework contracts nor the related specific contracts and did not justify 
why it did not apply these safeguards.  

The financial circuit for procurement is centralised and the financial team in the Directorate E plays a key role, 
by  providing  an  active  support  to  the  operational  units  throughout  the  procurement  life  cycle  (from  the 
identification of needs up to the final payment of the relevant contract). However, the procedural framework 
for financial circuit authorisations, budgetary and legal commitments and payments were not formally approved 
or up to date. 

DG TAXUD has ensured that contract amendments were concluded in accordance with established procedures. 
However, DG TAXUD has systematically made specific contract extensions without documenting a justification 
on the exceptional circumstances when accepting them. In addition, there is no evidence of any assessment of 
past specific contracts to determine more reasonable durations for on-demand specific contracts, that would 
provide sufficient margin to reduce the need for amendments. 

DG TAXUD retains all financial and operational documents related to the implementation of specific contracts. 
However,  commitment  and  payment  files  were  incomplete  or  inconsistent  making  it  difficult  to  retrieve 
complete documentation. 

Audit conclusion 

The IAS concluded that the internal control system set up by DG TAXUD for high value procurement and contract 
management needs to be significantly enhanced to strengthen its efficiency and effectiveness, notably with 
regard to: (a) the procurement control strategy; (b) the award criteria and evaluation process; (c) the contract 
value estimation and contract duration; (d) the early detection and exclusion system checks; and (e)  ex ante 
controls over payments. 

Audit recommendations 

Recommendation No 1, on control strategy, DG TAXUD should: 

• 

improve the DG’s risk management and develop a control strategy. 

Recommendation No 3, on award criteria and evaluation process, DG TAXUD should: 

• 

enhance the award criteria and evaluation process. 

Recommendation No 4, on contract value estimation and contract duration, DG TAXUD should: 

• 

carry out market analysis when estimating contract value and justify automatic renewal of framework 
contracts. 

Recommendation No 6, on early detection and exclusion system, DG TAXUD should: 

• 

consult the early detection and exclusion system database throughout the procurement and contact 
management lifecycle. 

Recommendation No 8, on ex ante controls on payments, DG TAXUD should: 

• 

enhance ex ante controls on payments. 

30 

 
Additional information provided by DG TAXUD on the implemented measures 

DG TAXUD submitted an action plan addressing all audit recommendations in January 2026, which was 
assessed  as  satisfactory  by  the  IAS.  All  actions  are  currently  ongoing  and  progressing  according  to 
schedule. Full implementation is expected within the agreed timeframe, with some measures due by the 
end of June 2026 and the remainder by the end of December 2026. 

1.18.  Financial management – Grants (DG TAXUD) 

The objective of the audit was to assess whether the internal control systems established by DG TAXUD for 
managing grants under the Customs Control Equipment Instrument programme are adequately designed and 
effectively implemented. 

Audit results 

Has DG TAXUD put in place an adequate control framework for the call preparation and for the management of 
its grants? 

DG TAXUD has defined clear organizational structures, roles and responsibilities for managing Customs Control 
Equipment Instrument grants and has in place: (a) internal procedures / guidelines /tools; (b) a set of guidance 
to beneficiaries; and (c) relevant trainings modules, on the spot trainings and information sessions for the staff 
involved. However, DG TAXUD has not yet developed a control strategy targeted to the specific Customs Control 
Equipment Instrument risks. Furthermore, the existing guidance (corporate and/or DG TAXUD specific) requires 
enhancement and should be centralised for easier access.  

Does DG TAXUD effectively manage the preparation, selection, and award of the Customs Control Equipment 
Instrument calls?  

DG TAXUD has: (a) prepared its calls, with improvement noted for the second call; (b) evaluated proposals timely, 
in line with applicable deadlines; (c) implemented a lessons-learned approach as regards the call preparation 
and the evaluation of proposals; and (d) prepared grant agreements in due time and in line with award decision. 

However, the IAS did not find evidence, neither in the eGrants system nor in the grant preparation report, on 
whether the shortcomings mentioned at evaluation summary report stage have been duly considered during 
the grant agreement preparation phase. 

Does  DG  TAXUD  efficiently  and  effectively  monitor  the  implementation  of  the  Customs  Control  Equipment 
Instrument grant agreements?  

Overall, DG TAXUD has in place tools and procedures for monitoring Customs Control Equipment Instrument 
grants, and effectively and efficiently implements ex ante checks on payments and on amendments. However, 
DG TAXUD does not provide enough evidence in eGrants of the continuous monitoring of the projects financed 
under  the  Customs  Control  Equipment  Instrument  and  of  the  payment  processing  (in  particular  the  checks 
preceding the certified correct). 

Audit conclusion 

The IAS concluded that overall, DG TAXUD has adequately designed and effectively implemented the internal 
control system for managing its grants activities under the Customs Control Equipment Instrument programme, 
except for two very important issues related to the Customs Control Equipment Instrument s control strategy, 
and the evidence in eGrants of the continuous project monitoring and of the payment processing. 

31 

 
 
Audit recommendations 

Recommendation No 1, on control strategy, DG TAXUD should: 

• 

develop  a  control  strategy  for  the  Customs  Control  Equipment  Instrument  and  establish  the 
methodology for the calculation of the Customs Control Equipment Instrument error rate. 

Recommendation No 4, on evidence-based grant agreement monitoring, DG TAXUD should: 

• 

clarify procedures for the certified correct and expected audit trail to document the checks performed 
for grant agreement monitoring. 

Additional information provided by DG TAXUD on the implemented measures 

DG TAXUD submitted an action plan addressing all audit recommendations in January 2026, which was 
assessed  as  satisfactory  by  the  IAS.  All  actions  are  currently  ongoing  and  progressing  according  to 
schedule. Full implementation is expected within the agreed timeframe, with some measures due by the 
end of June 2026 and the remainder by the end of December 2026. 

1.19.  Controls over aid to countries covered by a crisis declaration 

(DG MENA) 

The objective of the audit was to assess the adequacy of the design, and the effective implementation of the 
risk management and control systems put in place by DG MENA to ensure that the financial aid provided to the 
sampled countries covered by a crisis declaration is delivered following the principle of sound operational and 
financial management. 

Audit results 

Is  the  control  system  over  financial  aid  to  each  of  the  sampled  countries  covered  by  a  crisis  declaration 
adequately  designed  to  ensure  that  such  aid  is  delivered  according  to  the  principle  of  sound  financial 
management? 

The  design  of  key  controls is  overall  adequate, but  the  guidance  on  controls for crisis  contexts is scattered 
across  multiple  documents  and  not  consolidated,  leading  to  inconsistent  application  and  variable  quality  of 
justifications.  While  EU  Delegations  adapt  and  strengthen  controls  in  practice,  the  lack  of  a  single, 
comprehensive reference limits systematic risk mitigation, monitoring, and reporting. Good practices exist at 
specific EU Delegations but are not consistently shared. 

Is  the  control  system  over  financial  aid  to  each  of  the  sampled  countries  covered  by  a  crisis  declaration 
adequately implemented in practice? 

Overall, the key controls for  financial aid under crisis declarations are largely in place and functioning, with 
measures to mitigate risks such as fraud, corruption, conflict of interest, and double funding. However, their 
consistent application is affected by  varying experience levels of staff  responsible for  applying the relevant 
rules (due to staff turnover) and fragmented guidance across multiple documents. While many EU Delegations 
demonstrate good practices, such as structured evaluation committees and thorough legal and financial checks, 
some gaps persist, including incomplete verification of legal entities or eligibility criteria. Headquarters-level 
oversight remains limited, with annual reporting and coding constraints reducing the ability to systematically 
monitor flexible procedures. Consequently, although the framework is sound, its effectiveness depends heavily 
on staff knowledge and manual processing. 

32 

 
Is there effective monitoring and reporting on the effectiveness/ adequacy of key controls to ensure that financial 
aid is delivered effectively? 

The monitoring, reporting, and follow-up mechanisms for financial aid under crisis declarations remain largely 
manual, and not sufficiently structured. While a tagging system exists within the corporate IT system, it is not 
tailored to capture crisis declaration cases effectively, limiting the ability to systematically identify and track 
contracts for which flexible arrangement apply. Monitoring at Delegation level continues to rely heavily on staff 
knowledge and ad hoc checks, and reporting through tools such as External Assistance Management Reports 
and  Annual  Activity  Reports  provides  limited  and  non-consistent  insights  on  control  effectiveness  or  risk 
exposure. 

Audit conclusion 

The IAS concluded that the risk management and control systems put in place by DG MENA to ensure that the 
financial aid provided to countries covered by a crisis declaration are delivered following the principle of sound 
operational  and  financial  management  is  adequately  designed  and  effectively  implemented  except  for  the 
monitoring and reporting mechanism related to contracts concluded under flexible procedures. 

Audit recommendations 

Recommendation  No  1,  on  monitoring  and  reporting  related  to  contracts  concluded  under  flexible 
procedures, DG MENA should: 

• 

improve monitoring and reporting for flexible procedures. 

Additional information provided by DG MENA on the implemented measures 

The IAS issued the final audit report in December 2025.  DG MENA set up an action plan, considered 
satisfactory by the IAS in April 2026. DG MENA has already started working on the implementation of 
the  agreed  actions,  particularly  as  regards  upgrading  the  features  on  the  IT  systems.  No  major 
difficulties are expected for the action plan to be implemented within the planned timeframe. 

1.20.  Recovery and Resilience Facility risk assessment methodology 

and ex post audits (DG ECFIN) 

The  objective  of  the  audit  was to  assess the  risk  management  and control  processes  for  the  Recovery  and 
Resilience Facility ex post audits (i.e. audit on milestones and targets and combined system audits) and their 
compliance with the Recovery and Resilience Facility Regulation. 

Audit results 

Has DG ECFIN designed an adequate risk assessment methodology and ex post audit process?  

DG ECFIN's risk assessment methodology for selecting milestones and targets for  ex post audits is clear and 
adequate. However, the methodology has not been reviewed since it was developed to ensure that the key risk 
factors remain valid, and that the risk scoring system enables clearer comparisons of risk levels of milestones 
and targets. In addition, there are no clear instructions on how to document possible modification of risk levels 
following the application of professional judgment. 

The  design  of  the  ex  post  audit  process  is  adequate  and  well  detailed,  but  instructions  for  drafting  audit 
objectives and scope are not clear, as well as some performance indicators.  

33 

 
Is the risk assessment methodology and the ex post audits on the Recovery and Resilience Facility efficiently 
and effectively implemented by DG ECFIN? 

Overall,  the  risk  assessment  methodology  and  the  audit  process  are  implemented  as  designed.  The  risk 
assessments  files  sampled  were  well  documented,  although  with  varying  practices  across  the  teams  not 
harmonised. Ex post audits were executed, documented, and reported according to the internal procedures. Audit 
deliverables tested, such as mission planning memoranda and audit reports are of good quality. However, there 
is a long audit throughput time resulting in an extended duration of ex post audits. The main reasons for the 
long duration of audits are their complex nature and broad audit scope (combining elements of different type 
of engagements), the length of the review of  supplementary documentation,  quality assurance and internal 
consultation, deadline extensions granted to Member States for providing additional documents, as well as time 
required for official translation of draft and finals audit reports. 

Is DG ECFIN’s monitoring and reporting on Recovery and Resilience Facility ex post audits efficient and effective? 

DG ECFIN has defined four core indicators to monitor the implementation of the audit strategy, two of which 
are regularly followed up and reported in the Annual Activity Report but require further clarification.  

DG ECFIN’s reporting on the ex post audits sampled was overall efficient and effective. However, the information 
on ex post audits included in the Annual Activity Report does not provide details on their status (completed, 
reporting stage, flash report) at the cut-off date for reporting. 

Ex post audit reports and audit deliverables include the statement that audits are conducted in accordance with 
International  Standards  on  Auditing  and  in  particular  with  the  International  Organization  of  Supreme  Audit 
Institutions (INTOSAI) standard International Standards of Supreme Audit Institutions (ISSAI) 4000, however the 
current formulation is misleading as it does not clarify the degree of compliance with the standard (partially or 
in full). 

Audit conclusion 

The IAS concluded that, overall, DG ECFIN adequately designed and effectively implemented risk management 
and control processes for the Recovery and Resilience Facility risk assessment methodology and ex post audits 
on milestones and targets, in compliance with the Recovery and Resilience Facility Regulation, except for the 
two  very  important  issues  related  to  the  duration  of  audits  and  auditing  standards  and  quality  assurance 
programme 

Audit recommendations 

Recommendation No 3, on duration of audits and reporting, DG ECFIN should: 

• 

reduce delays in the ex post audit process and ensure completeness of Annual Activity Reports. 

Recommendation No 4, on auditing standard and quality assurance programme, DG ECFIN should:  

• 

clarify the framework and standards guiding the ex post audits and enhance the quality assurance 
programme. 

Additional information provided by DG ECFIN on the implemented measures 

DG ECFIN submitted an action plan, assessed as satisfactory by the IAS in December 2025. All planned 
measures are expected to be fully completed within the agreed timeframe (end of June 2026).  

The  recommendation  on  reducing  delays in  the  ex  post  audit  process and  ensuring  completeness  of 
annual activity reports is being addressed and its implementation will be reflected in DG ECFIN’s annual 

34 

 
activity  report.  The  recommendation  on  clarifying  the  framework  and  standards  guiding  the  ex  post 
audits  and  enhancing  the  quality  assurance  programme  is  being  addressed  and  some  evidence  has 
already been submitted to the IAS ahead of the implementation deadline. 

35 

 
 
 
Operational Processes 

1.21.  Personnel selection process (EPSO) 

The  objective  of  the  audit  was  to  assess  the  adequacy  of  the  governance,  risk  management  and  control 
processes set up by EPSO for the design of the new competition model for permanent staff. 

Audit results 

Is  the  framework  underlying  the  new  competition  model  adequately  designed  to  support EPSO’s  mission  as 
selection office of the EU institutions and bodies? 

EPSO  provided  evidence  of  a  stakeholder  engagement  process  when  designing  the  new  competition  model. 
However, weaknesses exist in the way EPSO identifies the needs and expectations of its clients, which includes 
a lack of a formalised set of criteria for the prioritisation of their needs and of an effective feedback mechanism 
to obtain input from all stakeholders. Also, the communication process between EPSO and its clients is ad hoc 
and reactive, rather than structured and proactive. 

Primarily explained by the fact that EPSO has been operating in continuous crisis mode since the suspension of 
the competitions in 2023, more than two years after EPSO’s Management Board decision to deploy the new 
competition  model,  EPSO  has  not  yet  adopted:  (a)  a  roadmap,  which  should  have  been  preceded  by  a  risk 
assessment to identify the risks and challenges linked with the deployment; and (b) a procedure supporting the 
new selection process. 

The new organisational structure and the roles and responsibilities of the actors involved support the overall 
objective of the recent reorganisation of EPSO which consisted of adapting its structure to the new competition 
model. However, this reorganisation needs to be completed by updating some job descriptions and carrying out, 
in due course, an impact analysis of the new competition model on EPSO resources. 

In the past few years, EPSO has faced significant challenges as indicated above and drew some lessons from 
the issues experienced, particularly with the former service provider when launching the new call for tender. 
However,  there  is  no  evidence  of  a  structured  and  comprehensive  process  to  learn  lessons  from  past 
experiences,  covering  other  areas  of  EPSO's  activities  within  the  new  competition  model.  Also,  with  a  more 
forward-looking perspective and to improve efficiency in its operations, EPSO needs to prepare well and timely 
for the use of Artificial Intelligence. 

Is the new competition model adequately designed to ensure compliance with the legal basis and achieve its 
objectives? 

The new competition model indicated above has been designed with a view to ensuring compliance with the 
Staff Regulation and its implementation rules. The objectives of the main pillars of the new competition model 
are to have ‘faster, leaner and more accessible’ competitions. However, EPSO has not yet defined adequate 
indicators to measure the achievement of these objectives. As a consequence, EPSO’s monitoring of the progress 
towards the achievement of these objectives, once the new model is fully implemented, is not adequate and 
EPSO’s senior management and the members of EPSO’s Management Board do not receive reports to oversee 
the achievement of the objectives and the progress of individual competitions. 

Audit conclusion 

The IAS concluded that the governance, risk management and control processes set up by EPSO for the new 
competition model for permanent staff are not adequately designed. 

36 

 
 
 
Audit recommendations 

Recommendation No 1, on the management of clients’ needs and communication aspects, EPSO should: 

•  manage clients’ needs and communication aspects. 

Recommendation  No  2,  on  the  roadmap  for  the  deployment  of  the  new  competition  model  and 
procedure for the selection process, EPSO should: 

• 

set-up a roadmap and a procedure and carry out an impact analysis of the new competition model. 

Recommendation No 3, on the objectives of the new competition model – indicators and monitoring, 
EPSO should: 

• 

define key performance indicators and monitor the achievement of objectives of the new competition 
model. 

Recommendation No 5, on lessons learnt, EPSO should: 

• 

analyse lessons learnt. 

Additional information provided by EPSO on the implemented measures 

EPSO established an action plan to address all audit findings, considered as satisfactory by the IAS.  

All planned measures are expected to be fully completed within the agreed timelines. Progress has been 
achieved  with  key  actions  in  their  advanced  stage  or  close  to  completion.  Notably,  the  roadmap  to 
analyse and monitor the new competition model is well advanced.  

1.22.  Management of childcare services (OIB, OIL) 

The objective of the audit was to assess the adequacy of the design of the framework and the adequacy of the 
design and the effective implementation of the control system (including IT controls over eKidWeb) put in place 
by OIB and OIL for the management of the childcare services. 

Audit results 

Have OIB and OIL designed an adequate framework for the provision of childcare services? 

OIB and OIL have established a set of operational/working procedures to regulate certain aspects of their daily 
operations and management of childcare services. However, the IAS noted that the legal basis for the provision 
of the childcare services is outdated. Additionally, there is a misalignment between the legal basis on OIL’s 
shared role and responsibilities with the European Parliament, and there is also no formal agreement with them 
for managing childcare services. 

Regarding OIB, the IAS also  notes that the large size of  the operational units of the childcare services may 
hinder effective control. Additionally, while OIB has a good practice of cooperation with one of the organisations 
specialised in the field of childcare from which it receives additional assurance on the quality of the services 
provided  by  the  external  partners,  a  comprehensive  comparative  analysis  of  the  potential  benefits  and 
drawbacks of the delivery model with external partners as opposed to the services managed internally is lacking. 

37 

 
Furthermore,  some  oversight  committees’  legal  basis  are  outdated  and  there  are  no  effective  measures  to 
ensure rotation of members or prevention of conflicts of interests.  

Finally, there are no agreements between OIB and the Parents Associations of the European Schools to clarify 
their respective roles and responsibilities regarding children's safety and security and the Offices do not have 
a complete set of Service Level Agreements with all their clients to define their respective rights and obligations 
regarding the provision of childcare services. 

Have OIB and OIL adequately designed and effectively implemented a control system for the management of 
the childcare services? 

The  IAS  found  that  both  Offices  have  established  strong  educational  and  operational  aspects  of  childcare 
services, including pedagogical policies, performance metrics and adequate training of the pedagogical staff, 
as  well  as  an  adequate  system  to  monitor  the  quality  and  receive  feedback  from  clients  and  staff  on  the 
childcare services, resulting in high satisfaction rate. 

However, the IAS identified issues in the financial aspects related to the interinstitutional budgeting and for the 
cost allocating processes, an outdated and undocumented methodology for establishing and allocating costs 
and undocumented justification of the different scales of the parental contributions for afterschool childcare in 
Brussels and Luxembourg. 

Has OIB designed adequate controls on the project management and IT security of the IT application (eKidWeb) 
used by OIB and OIL to support the provision of childcare services? 

The IAS acknowledges the efforts made by OIB and OIL to migrate and implement an IT application (eKidWeb) 
to support the provision of the childcare services but notes several issues related to project management, and 
the  IT  security  controls  of  eKidWeb.  The  IAS  found  that  the  project  management  and  change  management 
processes are not sufficiently detailed and are not fully aligned with established procedures. Additionally, OIB 
does not comply with IT security standards (e.g. use of production data, access management process). The IAS 
also  identified  weaknesses  in  logging  and  monitoring,  management  of  sensitive  information,  and  risk 
management. 

Audit conclusion 

The IAS concluded that while the Offices have overall designed an adequate framework and control system for 
the management of childcare services, there remain three very important issues in the implementation of the 
control system concerning: (a) the roles and responsibilities of the oversight committees and  external actors 
involved; (b) the establishment of the interinstitutional budget and allocation of costs and calculation of parental 
and institutional contributions; and (c) IT controls on project management and IT security of eKidWeb. 

Audit recommendations 

Recommendation  No  5 and  6, on the roles  and  responsibilities  of  the  external  actors  and  oversight 
committees involved in the provision/supervision of childcare services, OIB and OIL should: 

• 

revise  the  legal  basis  of  oversight  committees,  clarify  the  role  of  the  Parents  Associations  of  the 
European Schools and ensure a comprehensive overview of all the agreements with clients. 

Recommendation No 7 and 8, on the budget of the Childcare centre / Centre-polyvalent d’enfance and 
cost allocation, including institutional and parental contributions, OIB and OIL should: 

• 

improve the budget of the childcare centre / centre-polyvalent d’enfance and cost allocation processes, 
including the calculation of the institutional and parental contributions. 

38 

 
Recommendation No 9 and 10, on the IT controls on the project management and IT security of the IT 
application (eKidWeb) used for the provision of childcare services, OIB and OIL should: 

• 

improve the IT controls on project management and IT security of eKidWeb. 

Additional information provided by OIB and OIL on the implemented measures 

OIB and OIL established an action plan addressing all audit findings., considered as satisfactory by the 
IAS. The implementation of the recommendations has started with actions to be implemented between 
2026 and 2028. The implementation is on track to meet the planned deadlines.  

1.23.  Coordination between DG FISMA and European Supervisory 

Authorities (DG FISMA) 

The  objective  of  the  audit  was  to  assess  the  adequacy  of  the  design  and  the  effective  and  efficient 
implementation of the coordination mechanisms between DG FISMA and the European Supervisory Authorities 
(ESAs) – the European Banking authority (EBA), the European Insurance and Occupational Pensions Authority 
(EIOPA), and the European Securities and Market Authority (ESMA), to support the achievement of the respective 
key objectives. 

Audit results 

Have DG FISMA and the European Supervisory Authorities designed an adequate organisational set up for the 
overall coordination? 

DG FISMA has developed internal guidance, which formally defines roles and responsibilities of coordination 
between DG FISMA and the European Supervisory Authorities on the Single Programming Document, resources 
allocation and technical standards. Working arrangements between DG FISMA and ESAs are in place covering 
cooperation  in  the  areas  of  technical  standards  and  technical  advice,  international  matters  and  guidelines. 
However, they no longer reflect the current modalities of cooperation between DG FISMA and the European 
Supervisory Authorities and are not up to date regarding the description of the processes and procedures to be 
followed.  

The  communication  channels  in  the  framework  of  the  Standing  Committees  and  the  information  exchange 
mechanisms between DG FISMA and the European Supervisory Authorities are overall adequately designed. 

Are the coordination mechanisms between DG FISMA and the European Supervisory Authorities in the horizontal 
areas covered by the audit adequately designed and effectively and timely implemented? 

The  coordination  process  in  place  on  the  draft  Single  Programming  Document  is  adequately  designed  and 
effectively and timely implemented. However, the IAS observed recurrent comments in the Commission Opinion 
on the Single Programming Document about administrative aspects which reveal that the European Supervisory 
Authorities did  not  improve  the  Single  Programming  Document  over time.  Moreover,  the  absence  of  formal 
feedback from the European Supervisory Authorities of DG FISMA’s comment was only recently addressed. 

The  coordination  process  between  DG  FISMA  and  the  European  Supervisory  Authorities  regarding  the 
preparation  of  new  mandates  and  ad  hoc  tasks  is  overall  adequate  and  timely  implemented.  However, 
concerning the request of new services by non-partner Directorates-General, the IAS did not find evidence (for 
the  two  cases  sampled)  that  DG  FISMA  had  analysed  these  proposals  and  their  impact  on  the  European 
Supervisory Authorities’ resources before the agreement  with the other  Directorates-General was signed, as 
required in the note issued by the Secretariat General. 

39 

 
In  line  with  the  European  Supervisory  Authorities  funding  regulation,  DG  FISMA  performed  reviews  of  their 
operations, however the internal planning document has not been complemented by other instructions to drive 
the DG’ staff through the review exercise. The IAS also found that the European Supervisory Authorities’ review 
process, as per the Funding Regulation, differs from the evaluation of the EU decentralised agencies both in 
scope  and  methodology.  So  far  DG  FISMA  has  conducted  one  impact  assessment  to  evaluate  ‘the  powers, 
governance  and  funding  framework’  in  2017,  but  no  other  assessments  on  the  European  Supervisory 
Authorities’ performance have been carried out since. 

The Commission’s proposal on the new market integration package regulation adopted in December 2025 align 
the  review  clause  with  existing  evaluation  requirements  for  the  decentralised  agencies,  enabling  the 
Commission to assess the relevant aspects of ESMA's performance  

Are the coordination mechanisms between DG FISMA and the European Supervisory Authorities in the policy 
areas covered by the audit adequately designed and effectively and timely implemented? 

The coordination of drafting, amending and adoption of the technical standards is well organised and timely 
implemented. DG FISMA plans the work and leads or participates in the consultations of the various working 
groups  between  Commission  and  the  European  Supervisory  Authorities  representatives  efficiently  and 
effectively. DG FISMA effectively supports the work of these working groups. 

Concerning the  questions and answers  process design, some elements have not been defined and  mutually 
agreed  between  DG  FISMA  and  the  European  Supervisory  Authorities.  Moreover,  the  internal  guidance 
established by DG FISMA is not updated/comprehensive and the existing indicators do not enable to measure 
the performance of the process. 

In terms of the questions and answers process implementation, there is no proper monitoring of and reporting 
on the state of play of the on-going questions and answers nor an analysis of the root causes of delays. The IT 
tool used by DG FISMA does not contain reliable or consistent data to enable the DG’s senior management to 
have an overview of the files. Finally, the IAS did not  find evidence that DG FISMA has carried out a lessons 
learnt  exercise  to  further  analyse  the  issues  identified  and  to  improve  the  process  based  on  stakeholder 
feedback. 

Audit conclusion 

The IAS concluded that DG FISMA has adequately designed and effectively and efficiently implemented the 
coordination  mechanisms  with  the  European  Supervisory  Authorities,  to  support  the  achievement  of  the 
respective  key  objectives  except  for  the  three  very  important  issues  related  to  the  questions  and  answers 
process and review and evaluation. 

Audit recommendations 

Recommendation No 1, on questions and answers: process design, DG FISMA should: 

• 

enhance the questions and answers process design. 

Recommendation No 2, on questions and answers: process implementation, DG FISMA should: 

• 

enhance the implementation of the questions and answers process. 

Recommendation No 3, on review and evaluation, DG FISMA should: 

• 

improve review process design. 

40 

 
Additional information provided by DG FISMA on the implemented measures 

Following the adoption by the IAS of the final audit report in December 2025, DG FISMA submitted an 
action plan, which is being assessed by the IAS. Notwithstanding, DG FISMA has already launched the 
implementation of some actions to ensure a timely completion of the action plan.  

1.24.  Management of the control data of the Common Fisheries 

Policy (DG MARE) 

The  objective  of  the  audit  was  to  assess  whether  DG  MARE  has  adequately  designed  and  effectively  and 
efficiently implemented processes for managing the control data of the Common Fisheries Policy, in line with 
the applicable legal framework. 

Audit results 

Has  DG  MARE  put in  place  an  adequate  data  management  framework  covering  the  management of  control 
data? 

DG MARE has put in place a data management framework in line with the Commission corporate guidance. This 
framework  includes  a  data  management  strategy  covering  the  management  of  control  data  and  a  Digital 
Steering Committee, overseen at DG level, responsible for setting up and monitoring data and digital strategies 
with the support of the DG MARE data network working group and of the Integrated Fisheries Data Management 
programme Committee. 

In addition, internal coordination and dissemination of updated information on data related issues is ensured 
through the activities of the local data correspondent as well as through regular meetings of the data network 
working group and of the Integrated Fisheries Data Management Committee. Awareness events and topical 
presentations are also organised by the data management unit.  

However, in terms of implementation of the data management strategy, there are no concrete action plans or 
indicators to steer and monitor its progress. Moreover, data owners and data stewards have not been officially 
assigned, although it is required by the corporate guidance and there is a lack of back up arrangements in the 
data management unit. 

Has DG MARE put in place adequate processes to ensure that it receives data from the Member States/ third 
countries as per the legal basis? 

Overall, where there is a specific legal requirement for Member States to submit control data to the Commission, 
DG MARE has put in place adequate processes for the reception of such data. Nevertheless, Member States did 
not  systematically  send  timely  information  on  closures  of  fisheries,  in  line  with  Article  35  of  the  Control 
Regulation. The auditors found that  DG  MARE had not  put in place a process for improving  Member States’ 
compliance with their reporting obligations on closures of fisheries. 

DG MARE currently faces difficulties to access some control data (i.e. disaggregated catch data from fishing 
logbooks) from certain Member States which consider that this is not required under the current legal basis. To 
address this issue, the amended Control Regulation, mostly applicable from January 2026, clarifies the need 
for flag Member States to ‘ensure direct electronic exchange of relevant information concerning vessels flying 
its flag’ to the Commission (or the body designated by it), including fishing logbook information.  

In addition, DG MARE is continuously improving its IT environment and the functionalities of its systems and 
monitoring  tools  to  facilitate  the  submission  and  exchanges  of  fisheries  control  data,  based  on  a  universal 
standard, as well as to lessen duplication of data requirements wherever possible. DG MARE has also delivered 

41 

 
specific training events and exchanged extensively with Member States and third countries on the digitalisation 
of the EU certification scheme, resulting in a high level of preparedness for the introduction of the CATCH IT 
Tool in January 2026.  

Has DG MARE put in place processes to ensure adequate quality of control data? 

While Member States are primarily responsible for ensuring that all control data submitted or made available 
to the Commission as per the relevant regulations are accurate and complete, based on a validation system set 
up for that purpose, DG MARE has taken a number of steps to improve the quality of the control data. 

Through  expert  groups,  implementation  documents  and  guidance,  DG  MARE  has  been  working  closely  with 
Member  States  to  help  them  improve  the  quality  of  the  control  data  submitted.  Thanks  to  continuous 
improvement of its IT environment, DG MARE is enhancing automated checks on the quality of the data. Based 
on the review of the outcome of these automated checks, DG MARE follows-up on detected inconsistencies, 
which are considered most material, through bilateral exchanges with the Member States concerned, to ensure 
adequate  action  is  taken.  In  addition,  DG  MARE  conducts  verifications  and  audits,  which  may  include  data 
validation systems in their scope, and follows up appropriately the related Member State’s action plans.  

However, while the Control Regulation requires Member States to send to DG MARE updates of national plans 
on data validation systems, there is no procedure for their assessment and follow-up.  

In  order  to  further  improve  the  exchange  and  quality  of  Member  State’s  control  data,  the  revised  Control 
Regulation enables the Commission to include, in an implementing act, provisions on data quality and validation 
of data. The revised implementing act accompanying the Control Regulation is currently being finalised. It will 
include mandatory data validation rules for the Member States aiming at substantially improving the quality of 
the  data  provided.  The  adoption  is  planned  for  the  Autumn  2025,  which  will  likely  lead  to  delays  in  the  IT 
systems’ necessary updates and as a result in the implementation of the revised Control Regulation.  

Has DG MARE put in place processes to ensure adequate use and dissemination of control data? 

DG  MARE  has  established  a  comprehensive  list  of  reporting  obligations  towards  the  Regional  Fisheries 
Management Organisations and in the South-West Atlantic. This list is updated annually and sent to the Council. 
In addition, DG MARE adequately disseminates control data as per the current legal limits and published for the 
first time in 2024 aggregated catch data. In addition, DG MARE has taken steps to allow the reuse and wider 
sharing of data through the amendment of the Control Regulation, applicable as from January 2026. 

However, the following areas in the use and sharing of control data need improvement: 

•  monitoring of the consumption of fishing opportunities and of  Member State closures of fisheries; 

notification on the Commission’s website of such closures; 

• 

• 

use  of  information  received  on  alleged  illegal,  unregulated  and  unreported  fishing  activities; 
notification and dissemination of updated information relating to illegal, unregulated and unreported 
fishing activities; 

checks  on  and  transmission  of  Regional  Fisheries  Management  Organisations  lists  of  vessels  with 
fishing authorisations. 

Audit conclusion 

The  IAS  concluded  that  DG  MARE  has  adequately  designed  and  effectively  and  efficiently  implemented 
processes  for  managing  the  control  data  of  the  Common  Fisheries  Policy,  in  line  with  the  legal  framework 
applicable  at  the  time  of  the  audit,  except  for  one  very  important  issue  related  to  the  reception,  use  and 
publication of data related to fishing opportunities. 

42 

 
 
 
Audit recommendations 

Recommendation No 2, on the reception, use and publication of data related to fishing opportunities 
and closures of fisheries, DG MARE should: 

• 

improve monitoring of data on fishing opportunities and closure of fisheries. 

Additional information provided by DG MARE on the implemented measures 

DG  MARE  and  the  IAS  agreed  on  an  action  plan  in  December  2025.  The  implementation  of  the 
recommendations is ongoing and expected to be completed as planned by the end of November 2026. 

1.25.  Management of EURES and the EURES portal (DG EMPL) 

The objective of the audit was to assess the adequacy of the design and the effective implementation of the 
governance arrangements for the management of the EURopean Employment Services (EURES) and the EURES 
portal in DG EMPL. 

Audit results 

Are the governance arrangements for the management of EURES adequately designed? 

DG  EMPL  and  the  European  Labour  Authority  (ELA)  put  in  place  a  number  of  arrangements  to  govern  the 
cooperation  between  themselves  on  the  management  of  EURES.  These  include  principles  of  cooperation, 
referred to as the ‘operational agreement’, a handover note from DG EMPL, a Memorandum of Understanding, 
and other cooperation arrangements on specific areas. However, these arrangements are not always sufficiently 
detailed  or  up  to  date  in  a  number  of  areas,  including  IT  governance  and  the  mandate  of  the  IT  Steering 
Committee. In addition, there is no formal data processing agreement in place between ELA and DG EMPL. A 
EURES portal strategy 2023-2030 is in place and an overall EURES strategy is being prepared, for which the 
approval process, according to DG EMPL, needs to be aligned with the provisions set in the EURES regulation. 

Are the governance arrangements for the management of EURES effectively implemented? 

DG EMPL applies the PM2 methodology for project management, however, it is not clear how this is tailored or 
customised  to  the  EURES  project  to  cover the  artefacts  and  principles  of  this  methodology.  In  addition,  the 
system owner’s responsibilities are not clearly defined in the handover documents and operational agreement, 
particularly with regards to the regulations and standards that must be adhered to. A process is in place to 
manage business requirements between ELA and EMPL, but there is no overview of a detailed and exhaustive 
analysis  of  the  business  requirements,  including  functional,  non-functional  and  security  requirements.  As  a 
result,  ELA  does  not  have  sufficient  visibility  or  information  for  the  prioritisation  and  change  management 
processes. Furthermore, ELA does not have sufficient oversight over the technical controls provided by DG EMPL. 
Finally, ELA Cybersecurity Officer lacks direct access to crucial information and there is no formal agreement 
in place that outlines how information about the EURES portal will be shared by DG EMPL with the Cybersecurity 
Officer.  There  is  no  formal  description  of  the  management  of  the  EURES  budget  and  the  related  roles  and 
responsibilities  of  ELA  and  DG  EMPL.  Furthermore,  ELA  lacks  sufficient  visibility  on  the  budget  spent  in 
development and maintenance by DG EMPL as there is a lack of detailed information to analyse and optimise 
the IT Budget and related costs, and report to ELA management. 

Audit conclusion 

The  IAS  concluded  that  DG  EMPL  (together  with  ELA)  has  designed  and  effectively  implemented  adequate 
governance arrangements for the management of EURES and the EURES portal except for two very important 
issues concerning governance arrangements and IT project management. 

43 

 
 
 
Audit recommendations 

Recommendation No 1, on governance arrangements, DG EMPL should: 

• 

strengthen governance arrangements. 

Recommendation No 2, on IT project management, DG EMPL should: 

• 

strengthen IT project management. 

Additional information provided by DG EMPL on the implemented measures 

DG EMPL established an action plan to address all audit findings, which was considered satisfactory by 
the IAS. The implementation of the recommendations has started and is on track to meet the deadlines 
set out in the action plan (deadlines are in 2026 and in 2027). 

1.26.  Management of in-kind contributions under Horizon Europe (DG 

RTD) 

The objective of the audit was to assess whether the governance, risk management and controls for the process 
of managing in-kind contributions under Horizon Europe in DG RTD are adequately designed, are effectively and 
efficiently implemented and ensure compliance with the regulatory framework. 

Audit results 

Is the control environment for the process of management of in-kind contributions adequately designed 

DG  RTD  has  defined  clearly  the  roles  and  responsibilities  in  relation  to  the  support  provided  to  the  joint 
undertakings, in line with the Commission Decision on the coordinated implementation of Horizon Europe.  

DG  RTD  has  provided  methodological  support  to  the  joint  undertakings  for  the  management  of  the  in-kind 
contribution process. It has organised regularly technical meetings with all joint undertakings (represented at 
the level of Heads of Finance and Administration), during which the in-kind contributions were recurrent topics. 
Moreover, DG RTD provided support to the joint undertakings when they developed their in-kind contributions 
to the additional activities guidance to staff and the members and provided templates to the joint undertakings 
for reporting on the in-kind contributions in their Annual Work Programmes and Consolidated Annual Activity 
Reports.  

DG RTD developed the in-kind contributions to the additional activities IT tool to allow joint undertakings and 
partners to plan and report in-kind contributions to the additional activities inside the eGrants environment. 
However, a number of relevant functionalities in the corporate IT tool are still not in place and under analysis 
by the Common Implementation Centre. In addition, DG RTD did not develop centralised guidance documents to 
address  the  joint  undertakings’  needs,  leading  to  different  practices  at  joint  undertakings’  level  in  both  the 
monitoring and the reporting on in-kind contributions. 

Audit conclusion 

The  IAS  concluded  that  overall,  DG  RTD  has  provided  adequate  support  to  the  joint  undertakings  for  their 
management of the in-kind contributions-related processes, except for one very important issue concerning the 
IT support and the functionalities available in the IT tool. 

44 

 
 
 
Audit recommendations 

Recommendation No 2, on the IT support to the joint undertakings, DG RTD should: 

• 

finalise the development of the IT tools and improve the quality of the reports. 

Additional information provided by DG RTD on the implemented measures 

DG RTD and the IAS agreed on an action plan. As regards in-kind contributions to the additional activities 
(IKAA), the IT tool will include the automatic extraction of data. For in-kind contributions to operational 
projects (IKOP), DG RTD has concluded the design discussions with all the Joint Undertakings (JUs) and 
has planned the remaining IT improvements to simplify reporting phases by the end of the 2026. 

45 

 
 
 
Support Processes 

1.27. 

Information technology (IT) governance and IT security 
management (DG DEFIS) 

The objective of the audit was to assess the adequacy of the design, and the efficiency and effectiveness of 
the implementation of the governance, risk management and control systems put in place by DG DEFIS for IT 
governance and IT security arrangements. 

Audit results 

Are  DG  DEFIS  IT  governance  structures,  principles,  processes  and  practices  adequately  designed  and 
implemented? 

DG  DEFIS  has  made  evident  progress  in  formalising  its  strategic  alignment  by  drafting  and  having  the  DG 
approval of a first version of the IT and digital governance document in August 2025. This document outlines 
the IT strategy and roles and responsibilities, demonstrating adherence to the Commission's digital strategy 
and  cybersecurity  strategy.  However,  the  implementation  was  not  yet  fully  completed  at  the  end  of  the 
fieldwork. An IT and Digital Management Board had been designed but still needed formal launch and approval 
of  the  governance  document  at  its  first  meeting  (expected  in  December  2025).  Furthermore,  there  was  no 
implementation plan to translate the Commission's digital strategy into concrete, measurable objectives specific 
to DG DEFIS. 

Are IT (including security) risks defined, identified, communicated and managed appropriately to mitigate their 
effects on the DG DEFIS strategic objectives? 

DG  DEFIS  has  performed  regular  risk  assessments  according  to  EC  policies  (IT  Security  Risk  Management 
Methodology - ITSRM2), registered risks in the governance risk control tool. System owners are actively involved 
in defining security plans, and residual risks are assessed and mitigated in line with defined risk level objectives. 
Despite these managed processes, a few issues exist, notably regarding the reporting on security measures 
(e.g.,  delayed  mandatory  penetration  testing  for  DEFEND-S)  which  is  not  formally  reported  to  the  local 
information  security  officer  or  management,  insufficient  assurance  on  security  measures  applied  by  third 
parties or follow-up on exceptions. 

Are  there  well-designed,  effective  and  efficient  processes  in  place  to  optimise  the  value  contribution  of  IT 
processes, services and systems? 

The  overall  effectiveness  and  efficiency  of  IT  processes  are  considered  satisfactory,  as  the  audit  found  no 
significant issues in IT governance and security management. DG DEFIS actively pursues the reuse of solutions 
in  its  digital  investments.  However,  an  area  for  improvement  identified  is  the  ability  to  monitor  IT  services 
effectively  to  measure  the  return  on  investment.  In  particular,  the  absence  of  specific  performance  metrics 
hinders the ability to assess the value derived from IT expenditure. 

Is there an effective and efficient process in place for the IT portfolio management, to properly evaluate and 
prioritise IT projects, systems and services? 

DG  DEFIS  utilises  the  required  centralised  tool,  Governance  Information  System  (GovIS2),  for  IT  portfolio 
management of both projects and operational systems. The information is kept accurate and complete. The use 
of the Commission’s project management methodology (PM²) for all IT projects, with the required deliverables, 
is  a  key  strength.  DG  DEFIS  also  benefits  from  having  an  IT  portfolio  manager  function  to  ensure  good 
coordination and communication between the business and IT functions. However, issues have been identified 
in the practical implementation of performance monitoring including a lack of defined metrics for operational 
performance of IT systems, such as answer times, availability, or the time taken to implement change requests. 

46 

 
Are the available resources assessed and optimised? 

The IT competencies and qualifications are appropriate and maintained. DG DEFIS has limited IT staff resources 
but  provides  staff  backup.  The  concentration  of  responsibilities  and  tasks  among  the  same  people  in  key 
governance roles poses a risk and requires the reconsideration of role assignments. Having only two members 
dedicated to the Information Resource Management presents a challenge to optimise resource management 
and ensure operational continuity, particularly when key personnel are unavailable. 

Has DG DEFIS designed and implemented a comprehensive IT security management framework? 

DG DEFIS shows significant maturity in its security posture, achieving a ‘low risk, high maturity’ label in the 
cybersecurity  maturity  yearly  assessment  done  by  DG  DIGIT  in  both  2023  and  2024.  The  inventory  and 
ownership of IT assets are satisfactorily managed using GovIS2, and eight out of ten IT systems have up-to-
date security plans. Roles, responsibilities and processes are effectively implemented to control and monitor 
the  implementation  and  operation  of  information  security  within  the  DG.  Despite  these  strengths,  the 
governance framework remains incomplete. There is a lack of a formal procedure for handling security incidents 
specifically at  the DG  DEFIS  level. At the time of the audit, there was no  process in  place for performing a 
business impact assessment to determine system security classification, which is essential for defining security 
needs. The audit found that IT security plans were not always updated upon major changes, that the maximum 
tolerable period of disruption was misaligned with the availability levels of systems in the sample and mitigating 
measures may not be implemented or may be delayed without residual risk being reported to management. 

Audit conclusion 

The IAS concluded that, overall, the governance, risk management and control system put in place by DG DEFIS 
with regard to IT governance and IT security arrangements is adequately designed and efficiently and effectively 
implemented except for one very important issue related to aligning business needs and recovery expectations, 
maintaining IT security plans and formalising processes about incident and user access management. 

Audit recommendations 

Recommendation No 4, on the IT security management framework, DG DEFIS should: 

• 

strengthen IT security management framework. 

Additional information provided by DG DEFIS on the implemented measures 

DG DEFIS and the IAS agreed on an action plan in January 2026. The implementation is ongoing with 
tentative  completion  by  September  2026.  It  entails:  a)  performing  business  impact  assessments  to 
define business criticality and recovery objectives; b) a review of system availability classification, and 
an update of the IT security plans to ensure alignment with business requirements; c) establishing a 
process to review the security plans annually, and for ad-hoc updates following major system changes; 
d) defining a DG system-specific incident management and escalation procedure; e) the implementation 
of a systematic process for the regular review and revocation of user access rights for all DG DEFIS-
owned systems, with particular focus on critical systems. 

1.28.  Arachne+ project (DG BUDG, DG EMPL/DG REGIO, DG DIGIT) 

The objective of the audit was to assess whether DG BUDG, DG EMPL/DG REGIO (Joint Audit Directorate DAC) 
and DG DIGIT had put in place appropriate governance, risk management and control processes to:  

• 

deliver the Arachne+ project - phase 2 effectively,  

47 

 
• 

• 

achieve the strategic objectives and business expectations within the allocated time and resources, 
and  

be in compliance with the Commission’s security and personal data protection framework. 

Audit results 

Were adequate governance and risk management processes and structures in place for the management of the 
Arachne + project, phase 2, including planning, managing resources, risks and changes, monitoring and reporting 
of project performance? 

Governance roles, responsibilities, key processes and high-level objectives had been established for Arachne+ 
through a project charter and other supporting documents. However, even though the Steering Committee had 
regular meetings, the Supervisory Board had never met. The staffing of the project team was not aligned with 
the project plan and no  dedicated cross-cutting  group to  validate business requirements and to support the 
project owner had been established.  

Though project scope, objectives and success criteria were defined at a high level, and more detailed business 
requirements had  been  defined  for  phase  2,  these  were  not  specific  enough.  This  was  primarily  due  to  the 
absence of an established baseline for phase 2, clear requirements, acceptance criteria and criteria for the IT 
system ‘go-live’. Additionally, the ongoing process for collecting needs lacked appropriate prioritisation of the 
work  remaining  to  be  performed,  taking  into  account  the  impact  on  the  business.  There  was  also  a  lack  of 
appropriate  involvement  and  approval  of  all  relevant  internal  and  external  stakeholders.  Although  several 
registers (requirements traceability documents) had been created to support the definition and monitoring of 
the requirements for implementation, it was not possible for the auditors to trace and link all the requirements 
through these registers.  

Besides, whilst the risks were being regularly discussed in the Steering Committee meetings, a complete and 
up-to-date log of risks, changes, issues and decisions had not been established. As a result, there was no formal 
and documented discussion and decision for certain changes.  

Finally, although the project progress (in terms of achievements and ongoing activities) was reported in every 
governance or operational meeting, this reporting did not allow to assess the progress made compared to the 
established baseline (planned vs remaining), which is necessary to be able to identify potential risks of delay.  

Were adequate controls in place to support the effective IT project management and software development for 
Arachne + phase 2? 

In general, IT project management and software development practices had been established. However, many 
artefacts were either insufficiently documented or not created at all, and some defined processes were only 
partially implemented or not implemented at all (e.g. the user acceptance testing process lacked test cases, and 
quality management practices were not implemented as defined).  

Regarding  IT  security,  the  Arachne+  team  had  performed  the  business  impact  assessment  and  the  risk 
assessment  in  line  with  the  established  Commission  framework.  However,  the  business  impact  assessment 
results were not adequately supported by sufficient information to provide for a more fact-based assessment. 

Audit conclusion 

The IAS concluded that the governance, risk management and control processes put in place by DG BUDG, as 
system owner, with the support of DG EMPL/DG REGIO (DAC) and DG DIGIT, were not appropriate to deliver the 
Arachne+ project phase 2 effectively and to achieve the strategic objectives and business expectations for the 
overall  project  within  the  allocated  time  and  resources.  IT  security  and  personal  data  protection  control 
processes were compliant with the Commission’s process steps, though significant improvements are necessary 
as regards the quality of IT security artefacts. 

48 

 
Audit recommendations 

Recommendation No 1, 2 and 3, on project governance, monitoring and reporting:  

•  DG BUDG should strengthen project governance, monitoring and reporting. 

•  DG  EMPL/DG  REGIO  should  continue  support  to  project  owner  to  strengthen  project  governance, 

monitoring and reporting throughout phase 2. 

•  DG DIGIT should support project owner from the solution provider’s perspective. 

Recommendation  No  4  and  5,  on  management  of  the  project  scope,  requirements,  acceptance  and 
success criteria, DG BUDG should:  

• 

• 

review of project scope, requirements, and go-live criteria; 

improve/advance the management of requirements, acceptance and success criteria. 

Recommendation No 6 and 7, on IT security management,  

•  DG BUDG should improve the IT security risk management study. 

•  DG DIGIT should implement the defined IT security measures and ensure risk acceptance criteria have 

been satisfied. 

Additional  information  provided  by  DG  BUDG,  DG  EMPL/DG  REGIO  and  DIGIT  on  the 
implemented measures 

DG BUDG considers it has strengthened governance, a formal escalation procedure has been developed, 
and human resources have been reviewed and reinforced.  

DG BUDG considers it has prioritised work based on business impact, ensured continuous stakeholder 
involvement, and defined and met clear Service Activation criteria, covering IT security, onboarding, data 
protection and testing validation. It also considers to have updated the requirement traceability matrix 
and strengthened data protection compliance. 

DG BUDG has reported as fully implemented the update of business impact assessment, the IT security 
risk assessment and the IT Security Plan. 

DG EMPL/DG REGIO have been actively and continuously supporting DG BUDG throughout Phase 2 in 
strengthening project governance, execution and follow up of User Accepting  Testing, monitoring and 
reporting. 

DG DIGIT has been supporting DG BUDG from the solution provider’s perspective and, together with DG 
BUDG, is implementing enhanced reporting on the progress of the project towards its delivery. 

DG DIGIT with the support of DG BUDG, has reported that it has implemented and tested all defined IT 
security measures before Arachne+ Service Activation. 

The IAS has not yet confirmed the adequate implementation of the recommendations. 

49 

 
1.29.  Human Resources Transformation programme (DG HR) 

The  objective  of  the  audit  was  to  assess  whether  DG  HR  has  put  in  place  appropriate  governance,  risk 
management and control processes to execute the Human Resources Transformation programme effectively 
so as to achieve the strategic objectives and business expectations within the allocated time and resources, and 
in compliance with the Commission’s internal security standards. 

Audit results 

Are adequate governance and risk management processes and structures in place for the management of the 
programme,  including  planning,  managing  resources,  risks and  changes,  monitoring  and reporting  of  project 
performance? 

While the Human Resources Transformation programme governance structure and processes are overall well 
set up, certain elements need further definition or are missing. The programme management team and the 
project  management  Board  did  not  yet  have  a  consolidated  update  about  the  progress  of  the  projects  and 
working  groups at  programme  level.  The  programme  level  relies on  project  team meetings,  project  steering 
committee meetings and programme coordination meetings, to identify issues and take remedial actions but, 
quality checks in key areas were not performed.  

Additionally, risk management activities are performed both at project and programme level, but the auditors 
noted weaknesses in the formal mechanism and process. 

Are adequate controls in place to support the effective achievement of the main business and security objectives 
of the Human Resources Transformation programme? 

The Human Resources Transformation programme Charter identified expected outcomes and benefits, along 
with metrics to help identify if the benefits are achieved. However, for a number of those ‘identified benefits’ 
the auditors observed that they are not specific and measurable, certain metrics are not directly related to the 
benefits and no baseline values were set. 

No service level agreement had been established between DG DIGIT and the HR family defining the services 
provided  through  the  IT  platform,  including  the  functionalities,  performance,  maintenance  and  operational 
arrangements, and security controls. The existing service level agreement between DG HR and other European 
Institutions,  bodies and  agencies about  the  HR  services  has been  extended  with  the  new  Human  Resources 
Transformation services but, the supplier-customer relationship is not adequately reflected in the agreement – 
especially relating to the detailed definition of services and the provision of assurance on IT security.  

Are adequate controls in place to support the effective execution of the selected projects and the security of the 
respective systems (pre-selection, onboarding)? 

Projects are established, their business requirement definitions are managed well, and the projects efficiently 
apply  the  ‘minimum  viable  product’  approach.  However,  in  the  domain  of  IT  security,  the  Human  Resources 
Transformation programme  did not have  sufficient expertise and resources both at programme and  project 
levels.  

Moreover, the necessary security measures were not timely and fully implemented. 

Audit conclusion 

The  IAS  concluded  that  although  Human  Resources  Transformation  programme  governance  structure  and 
processes are overall well set up, a very important issue related to IT security management processes remains 
which  may  affect  the  achievement  of  the  Programme’s  strategic  objectives  and  compliance  with  the 
Commission’s internal security standards. 

Audit recommendations 

50 

 
Recommendation  No  3,  on  the  management  of  IT  security,  DG  HR  should  improve  the  IT  security 
management processes. 

Additional information provided by DG HR on the implemented measures 

DG HR submitted an action plan, assessed as satisfactory by the IAS in June 2025. All planned measures 
are expected to be fully completed within the agreed timeframe (September 2026), ensuring a robust, 
systematic,  and  well-governed  approach  to  IT  security  across  the  Human  Resources  Transformation 
Programme. Significant  progress has already  been achieved, with key actions either completed or in 
their final stages. Notably, the implementation of IT Security Plans is periodically monitored and formally 
approved by the Steering Committee. 

51 

 
 
 
Part 2 
Follow-up 
engagements

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Audits for which some recommendations 
remain open after IAS follow-up in 2025 (5)  

2.1. 

Audit on the preparedness of DG AGRI in designing the 
assurance building model under the new Common Agricultural 
Policy Strategic Plans 

Follow-up performed in DG AGRI  

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented: 

• 

• 

Recommendation No 1 (very important): design of the assurance framework under the New Delivery 
Model. 

Recommendation No 4 (very important): decision on how to report on assurance for expenditure under 
the Common Agricultural Policy Strategic Plan in the Annual Activity Report not yet in place. 

2.2. 

Audit on CASE@EC project in DG COMP 

Follow-up performed in DG COMP 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 2 (very important): IT security arrangements. 

2.3. 

Audit on IT security management in DG EAC 

Follow-up performed in DG EAC 

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was 
adequately and effectively implemented: 

• 

Recommendation No 1 (very important): data classification. 

(5)   This  section  only  lists  audit  engagements  where  a  follow-up  was  performed  on  critical  and/or  very  important 

recommendations.  

53 

 
 
 
2.4. 

Audit on the New nuclear decommissioning and waste 
management programme (NDWMP) in JRC 

Follow-up performed in JRC 

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was 
partially implemented: 

• 

Recommendation No 2 (downgraded from very important to important): JRC internal organisation of 
NDWMP responsibilities. 

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was 
adequately and effectively implemented: 

• 

Recommendation No 5 (very important): NDWMP budget flexibility needs. 

2.5. 

Audit on the protection of personal data in the Office for 
Administration and Payment of Individual Entitlements in PMO 

Follow-up performed in PMO 

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was 
adequately and effectively implemented: 

• 

Recommendation No 1 (very important): accountability, roles and responsibilities. 

2.6. 

Audit on measuring and reporting on the performance of 
technical support projects in DG REFORM 

Follow-up performed in DG REFORM 

Based on the results of the follow-up audit, the IAS concluded that the recommendation below was adequately 
and effectively implemented: 

• 

Recommendation No 1 (very important): performance measurement methodology. 

2.7. 

Audit on protection of personal data under the responsibility 
of CINEA, EACEA, EISMEA, ERCEA, REA and the CIC 

Follow-up performed in DG RTD (CIC) 

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was partially 
implemented: 

• 

Recommendation No 3 (downgraded from very important to important): controllership of the Funding 
and Tenders Portal. 

54 

 
2.8. 

Audit on the preparedness for closing the 2014-2020 
programming period of the European Structural and 
Investment Funds by DG EMPL and DG MARE and DG REGIO 

Follow-up performed in DG EMPL 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 2 (very important): planning of the closure exercise. 

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was partially 
implemented: 

• 

Recommendation No 6 (downgraded from very important to important): financial settlement at closure 
of programmes. 

Follow-up performed in DG MARE 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented: 

• 

• 

Recommendation No 3 (very important): planning of the closure exercise. 

Recommendation No 7 (very important): financial settlement at closure of programmes. 

Follow-up performed in DG REGIO 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 1 (very important): planning of the closure exercise. 

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was partially 
implemented: 

• 

Recommendation No 5 (downgraded from very important to important): financial settlement at closure 
of programmes. 

2.9. 

Audit on the Joint Audit Directorate for Cohesion (DAC) in DG 
EMPL and DG REGIO 

Follow-up performed in DG EMPL 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 5 (very important): IT project management for the Management of (all) Audit 
Processes, Activities and Resources system (MAPAR) and  the Management of (all) Audit Processes, 
Activities and Resources Compass Corporate system (MAPAR CC). 

55 

 
2.10.  Audit on Physical security of persons and assets in the 

Commission, HR / DIGIT / COMM / OIB / OIL 

Follow-up performed in DG COMM 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation  No  4  (important):  risk  management  framework  for  physical  security  at  the 
Commission. 

2.11.  Audit on the assessment of HR needs in the Commission at 

corporate level in DG BUDG, DG HR and SG 

Follow-up performed in DG HR 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 1 (very important): support from the corporate services for the assessment of 
HR needs at local level. 

Follow-up performed in DG BUDG 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 2 (very important): support from the corporate services for the assessment of 
HR needs at local level. 

Follow-up performed in the SG 

• 

Recommendation No 3 (very important): support from the corporate services for the assessment of 
HR needs at local level. 

2.12.  Audit on protection of confidentiality of information at 

corporate level in DG HR, DG DIGIT and SG 

Follow-up performed in DG HR 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented: 

• 

• 

Recommendation No 7 (very important): IT controls to ensure protection of sensitive non classified 
information. 

Recommendation No 9 (very important): process for managing information security incidents. 

56 

 
 
 
 
Follow-up performed in DG DIGIT 

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was partially 
implemented: 

• 

Recommendation  No  6  (downgraded  from  very  important  to  important):  IT  controls  to  ensure 
protection of sensitive non-classified information. 

Follow-up performed in the SG  

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 8 (very important): IT controls to ensure protection of sensitive non-classified 
information. 

2.13.  Audit  on  the  management  of  large-scale  building  projects 

involving works in OIB and OIL 

Follow-up performed in OIB  

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was  not 
adequately and effectively implemented and reopened: 

• 

Recommendation  No  8  (very  important):  management  of  large  -  scale  projects  –  approach  and 
procurement activities. 

Follow-up performed in OIL 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation  No  9  (very  important):  management  of  large  -  scale  projects  –  approach  and 
procurement activities. 

2.14.  Review of the Commission’s risk at payment in DG BUDG, DG 
EMPL, DG INTPA, DG NEAR, DG REGIO, DG RTD, EISMEA, ERCEA 
and REA 

Follow-up performed in DG BUDG 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 9 (very important): analysis and (internal) reporting of the root causes of errors 
in relation to the European Court of Auditors’ findings. 

57 

 
 
 
Follow-up performed in DG EMPL 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 7 (very important): analysis and (internal) reporting of the root causes of errors 
in relation to European Court of Auditors’ findings. 

Follow-up performed in DG ENEST 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 2 (very important): analysis and (internal) reporting of the root causes of errors 
in relation with the European Court of Auditor’s findings. 

Follow-up performed in DG INTPA 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 1 (very important): analysis and (internal) reporting of the root causes of errors 
in relation with the European Court of Auditor’s findings. 

Follow-up performed in DG REGIO 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 8 (very important): analysis and (internal) reporting of the root causes of errors 
in relation with the European Court of Auditor’s findings. 

2.15.  Audit on the External Investment Plan – European Fund for 

Sustainable Development (EFSD) Guarantee in DG INTPA and 
DG NEAR 

Follow-up performed in DG INTPA 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 2 (very important): assurance building. 

Based on the results of the follow-up audit, the IAS concluded that the following recommendations was not 
adequately and effectively implemented and reopened: 

• 

Recommendation No 4 (important): guarantee agreement clauses. 

58 

 
 
 
2.16.  Audit on Intervention-level evaluations in FPI, former DG NEAR 

and DG INTPA 

Follow-up performed in ENEST 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was  not 
adequately and effectively implemented and reopened: 

• 

Recommendation No 11 (very important): implementation of the evaluation process. 

Follow-up performed in FPI 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was  not 
adequately and effectively implemented and reopened: 

• 

Recommendation No 12 (very important): implementation of the evaluation process. 

Follow-up performed in DG INTPA 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 13 (very important): periodic review of the evaluation process. 

List of audits for which all recommendations 
were closed in 2025  

Based on the results of the follow-up engagements performed in 2025, the IAS concluded that the audits listed 
below could be closed as all the recommendations were assessed as implemented. 

AUDITS IN DGs 

2.1. Audit in DG BUDG - Limited review of SUMMA in preparation for ‘going live’ 

2.2. Audit in DG CLIMA – Limited review of the security plan and associated security measures of the EU 
emissions trading system information system managed by DG CLIMA 

2.3. Audit in DG COMP – Human resources management 

2.4. Audit in DG DEFIS - Preparedness for the management and control systems for the 2021-2027 Space 
programme implementation 

2.5. Audit in DG DIGIT - Public procurement 

2.6. Audit in EACEA - Performance of the management of experts for proposal evaluation 

2.7. Audit in DG ECFIN - Human resources management 

2.8 Audit in DG ECFIN - Limited review of the Recovery and Resilience Facility control and audit strategies 

59 

 
2.9. Audit in DG ECFIN - Ex ante controls of the Recovery and Resilience Facility payment requests 

2.10. Audit in DG ESTAT - Effectiveness and efficiency of Eurostat’s performance management system 

2.11. Audit in DG GROW - Performance of the treatment of stakeholders’ complaints concerning the internal 
market 

2.12.  Audit  in  DG  HOME  -  Preparedness  for  closing  actions  and  programmes  funded  under  the  Internal 
Security  Fund  (ISF)  and  the  Asylum,  Migration  and  Integration  Fund  (AMIF)  through  direct  and  shared 
management 

2.13. Audit in DG SANTE - TRAde Control and Expert System (TRACES) 

2.14. Audit in DG SANTE - Information technology (IT) security– findings on the medical device regulation’s 
European database on medical devices (MDR EUDAMED) IT system 

2.15. Audit in SCIC - Procurement 

2.16.  Audit  in  the  SG  -  Information  technology  governance  and  project  management,  including  software 
development 

MULTI – DGs AUDITS 

2.17. Audit in DGs CLIMA and CINEA - Implementation of the Innovation Fund 

2.18. Audit in DGs DIGIT, DG HR and the SG - Management of public cloud services 

2.19. Audit in DG HOME - Coordination between DG HOME and the EU decentralised agencies 

2.20. Audit in DGs JUST and EACEA - Preparedness of the management and control systems regarding the 
implementation of Citizens, Equality, Rights and Values (CERV) and Justice programmes 

2.21. Audit in DGs REGIO, DG EMPL and DG MARE - Interruptions, suspensions and financial corrections for 
European Structural and Investment Funds 2014-2020 

2.22. Audit in DGs SANTE, HERA and HaDEA - Early implementation of grants in the EU4Health Programme 

60 

 
 
Part 3 
Summary of 
long overdue 
recommendations 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
At the end of the reporting period, 31 December 2025, there were five very important long overdue recommendations, overdue by more than six months compared to the 
original expected completion dates set in the auditees’ initial action plans.  

No. 

Entity 

Audit title 

Recommendation title 

I 

FPI  

IAS.C4-2022-Y ENT-001: 
Allocation of human resources 
in EU Delegations 

Design and implementation 
of the workload 
assessment in EU 
Delegations (WLAD) 

Final report 
date 

Original agreed 
completion date 

Revised expected 
completion date 

Expected 
delay 

4.11.2024 

30.4.2025 

30.6.2026 

1  year  and  2 
months 

The  issues  identified  in  the  design  and  implementation  of  the  workload  assessment  in  EU  Delegations  (WLAD)  has  a  partial  impact  on  their  effectiveness.  The  IAS 
recommended the agreement on a methodology that allows for comparisons of EU Delegations at global level, and to select the subset of key indicators that will contribute 
to the workload assessment, to improve the efficiency of the data collection process. FPI accepted the recommendation but highlighted that they would retain the sub-set 
of indicators from the audited WLAD exercise – staff/contract/million managed – for future exercises. Any change would not adequately reflect the FPI operating model 
that is not based on a ‘country’ model but on a regional network of staff deployed in five Regional Teams worldwide.  

FPI further postponed the target date from 31 December 2025 to 30 June 2026. DG INTPA is in the lead for the implementation of this action for the whole external action 
family. DG INTPA has already taken steps to define the methodology and indicators, including workload, reflecting the specificities of international cooperation sections in 
delegations (including cooperation & finance, contracts & audit), allowing for a more detailed analysis of differences in EU Delegations workloads. However, the methodology 
must also take into account the roll-out of the modernisation of the EU Delegations’ network to be implemented in 2026.  

62 

 
 
 
 
 
 
No. 

Entity 

Audit title 

Recommendation title 

II 

OIB 

IAS.B4-2022-Y COMM-005: 
Management of large-scale 
building projects involving 
works in OIB and OIL 

Management of large-scale 
projects - approach and 
procurement activities - OIB 

Final report 
date 

Original agreed 
completion date 

Revised expected 
completion date 

Expected 
delay 

1.12.2023 

31.12.2024 

31.1.2026 

1 year and 1 
month 

According to OIB, significant progress has been made on the implementation of these three remaining points since the IAS first follow-up in August 2025. On 28 January 
2026, OIB marked the three outstanding points as ‘ready for review’: (1) define the concept of ‘structural renovation’ to ensure a  consistent implementation between 
projects and compliance with the Financial Regulation; (2) establish a proportionate mechanism which identifies and takes into consideration all clients’ specific needs, as 
soon as possible in the early stages of the project and at key moments during implementation; (3) define in its internal procedures which works have to be managed as a 
stand-alone project in compliance with the adopted Project Management Methodology (PM2) and in which situations a simplified methodology can be applied by exception. 

No. 

Entity 

Audit title 

Recommendation title 

Final report 
date 

Original agreed 
completion date 

Revised expected 
completion date 

Expected 
delay 

III 

DG EAC 

IAS.C2-2019-EAC-001: 
Effectiveness of the protection 
of personal data of 
beneficiaries of and 
participants in the Erasmus+ 
and European Solidarity Corps 
programmes managed by DG 
EAC 

Transfer of personal data 
to third countries 

28.1.2021 

15.12.2021 

31.3.2026 

4 years and 
3 months 

63 

 
 
 
 
The IAS recommended that DG EAC should analyse, with the support of the data protection officer (DPO), how compliance of its programmes with the internal data protection 
regulation (IDPR) concerning international transfers of data can be ensured in the context of the order ( 6) and the announced guidance of the European Data Protection 
Supervisor (EDPS). The DG reported that it analysed with DG JUST, the Legal Service and the DPO different possibilities to ensure compliance of the transfers to third 
countries with the IDPR. A suitable transfer tool (i.e. adequate and robust safeguard measures that protect the rights and freedoms of the data subjects) has been identified 
and the EDPS has been consulted formally on this solution  - as requested by the IDPR. Agreement  with the EDPS has been reached at working  level but pending the 
appointment of the new EDPS, the formal agreement is still outstanding. 

No. 

Entity 

Audit title 

Recommendation title 

Final report 
date 

Original agreed 
completion date 

Revised expected 
completion date 

Expected 
delay 

IV 

DG HR 

IAS. Physical security of 
persons and assets in the 
Commission 

Risk management 
framework for physical 
security at the Commission 

4.10.2022 

31.12.2023 

31.3.2026 

2 years and 
3 months 

While the IAS acknowledged that significant progress has been made in the implementation of the action plan, the recommendation has not been fully implemented as 
one point related to the implementation of a new IT platform for risk management remains outstanding. The delay was mainly due to data protection issues linked to the 
platform initially chosen by the Secretariat-General. 

(6)  On 14 October 2020, the EDPS gave all European institutions a formal order to a) perform a mapping exercise to provide information concerning processing operations that involve international 
transfers of data and b) report to it any identified risks and gaps, in accordance with the order. The EDPS also asked the European institutions to perform, in a second phase, a case-by-case 
‘transfer impact assessment’ to identify the level of protection provided by the third country of destination of the data. To facilitate this assessment, the EDPS will provide in due time specific 
guidance. 

64 

 
 
 
 
 
 
No. 

Entity 

Audit title 

Recommendation title 

Final report 
date 

Original agreed 
completion date 

Revised expected 
completion date 

Expected 
delay 

V 

DG HR 

IAS. B4-2021-Y COMM-002: 
Physical security of persons 
and assets in the Commission 

Governance framework and 
organisational 
arrangements for physical 
security at the Commission 

4.10.2022 

31.12.2023 

30.6.2026 

2 years and 
6 months 

The formalisation and validation of a comprehensive security strategy was delayed, pending a decision at political level (beyond DG HR’s control) on the organisation of 
internal/ corporate security and on the scope of the internal security strategy, but it is now well on track for adoption in the first semester 2026. In addition, the 
agreement clarifying the security governance and competences with regard to the JRC sites was delayed by the ongoing revision of JRC security governance, but it is near 
finalisation. 

65