Source: EURLEX
Language: en
Format: md

|  |  |  |  |
| --- | --- | --- | --- |
| 6.12.2017 | EN | Official Journal of the European Union | C 417/194 |

---

REPORT

on the annual accounts of the European Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) for the financial year 2016, together with the Agency’s reply

(2017/C 417/31)

INTRODUCTION

|  |  |  |
| --- | --- | --- |
|  | 1. | The European Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA), hereinafter ‘the Agency’, which is located in Tallinn, Strasbourg and St. Johann im Pongau, was established by Regulation (EC) No 1077/2011 of the European Parliament and of the Council[(1)](#ntr1-C_2017417EN.01019401-E0001). The core mission of this Agency is to fulfil the operational management tasks for the Second Generation Schengen Information System (SIS II), the Visa Information System (VIS) and the European System for the comparison of fingerprints (Eurodac). |

|  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | 2. | The table presents key figures for the Agency[(2)](#ntr2-C_2017417EN.01019401-E0002).  Table  Key figures for the Agency   |  |  |  | | --- | --- | --- | |  | 2015 | 2016 | | Budget (million euro)[(3)](#ntr3-C_2017417EN.01019401-E0003) | 71,7 | 82,3 | | Total staff as at 31 December[(4)](#ntr4-C_2017417EN.01019401-E0004) | 134 | 144 | |  | | | |

INFORMATION IN SUPPORT OF THE STATEMENT OF ASSURANCE

|  |  |  |
| --- | --- | --- |
|  | 3. | The audit approach taken by the Court comprises analytical audit procedures, direct testing of transactions and an assessment of key controls of the Agency’s supervisory and control systems. This is supplemented by evidence provided by the work of other auditors and an analysis of management representations. |

|  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| OPINION   |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | |  | 4. | We have audited:   |  |  | | --- | --- | | (a) | the accounts of the Agency which comprise the financial statements[(5)](#ntr5-C_2017417EN.01019401-E0005) and the reports on the implementation of the budget[(6)](#ntr6-C_2017417EN.01019401-E0006) for the financial year ended 31 December 2016; and |  |  |  | | --- | --- | | (b) | the legality and regularity of the transactions underlying those accounts; |   as required by Article 287 of the Treaty on the Functioning of the European Union (TFEU). |   Reliability of the accounts  Opinion on the reliability of the accounts   |  |  |  | | --- | --- | --- | |  | 5. | In our opinion, the accounts of the Agency for the year ended 31 December 2016 present fairly, in all material respects, the financial position of the Agency at 31 December 2016, the results of its operations, its cash flows, and the changes in net assets for the year then ended, in accordance with its Financial Regulation and with accounting rules adopted by the Commission’s accounting officer. These are based on internationally accepted accounting standards for the public sector. |   Legality and regularity of the transactions underlying the accounts  Revenue  Opinion on the legality and regularity of revenue underlying the accounts   |  |  |  | | --- | --- | --- | |  | 6. | In our opinion, revenue underlying the accounts for the year ended 31 December 2016 is legal and regular in all material respects. |   Payments  Opinion on the legality and regularity of payments underlying the accounts   |  |  |  | | --- | --- | --- | |  | 7. | In our opinion, payments underlying the accounts for the year ended 31 December 2016 are legal and regular in all material respects. |   Responsibilities of management and those charged with governance   |  |  |  | | --- | --- | --- | |  | 8. | In accordance with Articles 310 to 325 of the TFEU and the Agency’s Financial Regulation, management is responsible for the preparation and presentation of the accounts on the basis of internationally accepted accounting standards for the public sector and for the legality and regularity of the transactions underlying them. This responsibility includes the design, implementation and maintenance of internal controls relevant to the preparation and presentation of financial statements that are free from material misstatement, whether due to fraud or error. Management is also responsible for ensuring that the activities, financial transactions and information reflected in the financial statements are in compliance with the authorities which govern them. The Agency’s management bears the ultimate responsibility for the legality and regularity of the transactions underlying the accounts. |  |  |  |  | | --- | --- | --- | |  | 9. | In preparing the accounts, management is responsible for assessing the Agency’s ability to continue as a going concern, disclosing, as applicable, matters related to going concern and using the going concern basis of accounting. |  |  |  |  | | --- | --- | --- | |  | 10. | Those charged with governance are responsible for overseeing the entity’s financial reporting process. |   Auditor’s responsibilities for the audit of the accounts and underlying transactions   |  |  |  | | --- | --- | --- | |  | 11. | Our objectives are to obtain reasonable assurance about whether the accounts of the Agency are free from material misstatement and the transactions underlying them are legal and regular and to provide, on the basis of our audit, the European Parliament and the Council or other respective discharge authorities with a statement of assurance as to the reliability of the accounts and the legality and regularity of the transactions underlying them. Reasonable assurance is a high level of assurance, but is not a guarantee that an audit will always detect a material misstatement or non-compliance when it exists. These can arise from fraud or error and are considered material if, individually or in the aggregate, they could reasonably be expected to influence the economic decisions of users taken on the basis of these accounts. |  |  |  |  | | --- | --- | --- | |  | 12. | An audit involves performing procedures to obtain audit evidence about the amounts and disclosures in the accounts and the legality and the regularity of the transactions underlying them. The procedures selected depend on the auditor’s judgment, including an assessment of the risks of material misstatement of the accounts and of material non-compliance of the underlying transactions with the requirements of the legal framework of the European Union, whether due to fraud or error. In making those risk assessments, internal controls relevant to the preparation and fair presentation of the accounts and legality and regularity of underlying transactions, are considered in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of internal controls. An audit also includes evaluating the appropriateness of accounting policies used and the reasonableness of accounting estimates made by the management, as well as evaluating the overall presentation of the accounts. |  |  |  |  | | --- | --- | --- | |  | 13. | For revenue, we verify the subsidy received from the Commission and assess the Agency’s procedures for collecting fees and other income, if any. |  |  |  |  | | --- | --- | --- | |  | 14. | For expenditure, we examine payment transactions when expenditure has been incurred, recorded and accepted. Advance payments are examined when the recipient of funds provides justification for their proper use and the Agency accepts the justification by clearing the advance payment, whether in the same year or later. |  |  |  |  | | --- | --- | --- | |  | 15. | In preparing this report and Statement of Assurance, we considered the audit work of the independent external auditor performed on the Agency’s accounts as stipulated in Article 208(4) of the EU Financial Regulation[(7)](#ntr7-C_2017417EN.01019401-E0007). | |

|  |  |
| --- | --- |
| 16. | The comments which follow do not call the Court’s opinion into question. |

COMMENTS ON THE LEGALITY AND REGULARITY OF TRANSACTIONS

|  |  |  |
| --- | --- | --- |
|  | 17. | In 2016 the Agency received and accepted supplies amounting to 2,8 million euro without having budget and legal commitments (contracts) in place. These were made retroactively in order to regularise the purchases. |

COMMENTS ON INTERNAL CONTROLS

|  |  |  |
| --- | --- | --- |
|  | 18. | In its audit report of July 2016, the Commission’s Internal Audit Service (IAS) concluded that the overall design and practical implementation of processes ensures that eu-LISA operates the SIS II, VIS and Eurodac IT systems in a way that allows the continuous and uninterrupted exchange of data between the national authorities using them. Although the IAS did not highlight any very important issues, it considered that there is room for improving the efficiency of the processes in relation to configuration management and change management, release and test management, problem management, as well as service and incident management. The Agency and the IAS agreed on a plan to take corrective actions. |

COMMENTS ON BUDGETARY MANAGEMENT

|  |  |  |
| --- | --- | --- |
|  | 19. | Appropriations carried over under Title II (administrative expenditure) are high with 5 million euro, i.e. 63 % of committed appropriations (2015: 9 million euro, i.e. 50 %). They mainly concern building maintenance and consultancy services to be delivered in 2017. Such high level of carry-overs to cover next year’s activities is in contradiction with the budgetary principle of annuality. |

COMMENTS ON SOUND FINANCIAL MANAGEMENT AND ON PERFORMANCE

|  |  |  |
| --- | --- | --- |
|  | 20. | In June 2015, the Agency signed a construction contract for its premises in Strasbourg for an amount of 21,5 million euro. Stage payments were agreed as the main payment method. However, in order to increase budget consumption, the Agency amended the contract in July 2015 to make advance payments the preferred method. By November 2016 the Agency had paid the full contract amount although less than half of the works had been completed. |

|  |  |  |
| --- | --- | --- |
|  | 21. | In one of its meetings held in 2016 the Commission’s representative in the Agency’s Management Board addressed the issue of the increasing maintenance costs. While there are several arguments to explain this, such as the continued development and increased functionalities of the systems, the Court identified procurements where the Agency did not check for the most economical solution. For example, the Agency purchased a new software licence for an amount of 4,6 million euro under a framework contract (FWC) without checking that the framework contractor, who acted as an intermediary between the Agency and potential software suppliers, had found the best price. |

|  |  |  |
| --- | --- | --- |
|  | 22. | In May 2016 the Agency signed a FWC with a Consortium for 194 million euros for the further development and maintenance of the Visa Information System (VIS) and of the Biometrics Matching System (BMS) for a maximum period of six years. The contract was awarded through a public procurement procedure. One main requirement for tenderers to be accepted was having commercial access to the BMS technology. However, since the company that developed the BMS technology was not contractually obliged to grant commercial access to any interested tenderer, there was a potential risk for the competiveness of the procedure. |

|  |  |  |
| --- | --- | --- |
|  | 23. | An external evaluation of the Agency was carried out on behalf of the Commission from March to December 2015 and results were presented in the final evaluation report in March 2016. The evaluation concluded that the Agency contributes to the operational management of large-scale IT systems in the area of freedom, security and justice and effectively fulfils its tasks. In order to improve operational management further, the evaluators made 64 recommendations, seven of which are considered to be critical and 11 very important. The Agency has prepared a plan to address the recommendations that is under implementation. |

FOLLOW-UP OF PREVIOUS YEARS’ COMMENTS

|  |  |  |
| --- | --- | --- |
|  | 24. | An overview of the corrective action taken in response to the Court’s comments from previous years is provided in the Annex. |

This Report was adopted by Chamber IV, headed by Mr Baudilio TOMÉ MUGURUZA, Member of the Court of Auditors, in Luxembourg at its meeting of 19 September 2017.

For the Court of Auditors

Klaus-Heiner LEHNE

President

---

[Top](#document1)