Source: EURLEX
Language: en
Format: md

![european flag](./../../../images/eclogo.jpg)EUROPEAN COMMISSION

Brussels, 21.9.2018

SWD(2018) 429 final

COMMISSION STAFF WORKING DOCUMENT

Summary of Executive summaries. Internal audit engagements finalised by the IAS in 2017

Accompanying the document

Report from the Commission to the European Parliament and the Council

Annual report to the Discharge Authority on Internal audits carried out in 2017

{COM(2018) 661 final}

Contents

Content of this Staff working document:
   

PART 1: Final reports
   

1.
   Horizontal audits
   

1.1.Audit on management of recovery orders for competition fines (incl. guarantees for competition fines) and for recovery orders in the context of the Commission's 'corrective capacity' – Phase I (Directorates-General CONNECT, ENER, LS, EACEA)

1.2.Audit on HR management and staff allocation in Directorate-General HOME and Directorate-General JUST

1.3.Audit on amendments of 2014-2020 OPs in Directorates-General REGIO, EMPL and MARE

1.4.Audit on the Commission's framework/arrangements for the estimation, assessment and reporting on the cost-effectiveness of controls (Directorates-General BUDG , NEAR, REGIO, RTD)

1.5.Audit on the Commission's supervision of the implementation of CEF financial instruments in Directorate-General ENER and Directorate-General MOVE

1.6.Audit on the Commission’s governance/oversight arrangements concerning risk management, financial reporting and the ex-post verification/audit function (Secretariat-General and Directorates-General AGRI, BUDG, DEVCO, REGIO, RTD)

1.7.Audit on the production process and the quality of statistics not produced by Eurostat (ESTAT and Directorates-General ENER, FISMA, GROW and JUST)

2.
   Agriculture, natural resources and health
   

2.1.Audit on Directorate-General AGRI's management of agricultural market crises

2.2.Audit on Directorate-General AGRI's implementation of RDPs

2.3.Audit on Directorate-General AGRI's control strategy for the CAP 2014-2020

2.4.Audit on CHAFEA's management and control system for the implementation of the measures for the promotion of agricultural products

2.5.Audit on LIFE + phasing out in Directorate-General ENV

2.6.Audit on monitoring and enforcement of EU environmental law in Directorate-General ENV

2.7.Audit on Directorate-General SANTE’s food safety crisis preparedness

3.
   Cohesion
   

3.1.Audit on policy and funding for youth employment in Directorate-General EMPL

3.2.Audit on monitoring the implementation and performance of FEAD OPs in Directorate-General EMPL

3.3.Audit on major projects in Directorate-General REGIO

4.
   RESEARCH ENERGY AND TRANSPORT
   

4.1.Audit on H2020 project management in Directorate-General CONNECT

4.2.Audit on procurement in DG CONNECT

4.3.Audit on closure of FP7 projects in ERCEA

4.4.Audit on grant management - phase 2: project management and payments for CEF in INEA

4.5.Audit on HR management in INEA

4.6.Audit on scientific project management in JRC

4.7.Audit on HR management – recruitment of scientists in JRC

4.8.Audit on the effectiveness of the set-up and supervision of Shift2Rail by Directorate-General MOVE

4.9.Audit on closure of FP7 projects in REA

4.10.Audit on HR management in Directorate-General RTD

5.
   EXTERNAL ACTIONS
   

5.1.Audit on management of investment facilities (financial instruments) in Directorate-General DEVCO

5.2.Audit on Directorate-General ECHO’s grant management in response to the Syrian crisis in the Middle East (Headquarters and Field Offices)

5.3.Audit on procurement under Instrument for Pre-Accession (direct management and indirect management with beneficiary countries) – phase II in Directorate-General NEAR

5.4.Limited review of grant and procurement procedures in the EU Delegation of Armenia – Directorate-General NEAR

5.5.Audit on preparedness for the mid-term review of ENI and IPA Regulations in Directorate-General NEAR

6.
   EDUCATION AND CITIZENSHIP
   

6.1.Consulting report on Directorate-General EAC's process to granting full financial autonomy to the EIT

6.2.Audit on Erasmus+ and Creative Europe – grant management phase 1 (from the call to the signature of contracts) in EACEA

6.3.Audit on HR management in EACEA

7.
   ECONOMIC AND FINANCIAL AFFAIRS
   

7.1.Audit on enforcement of the EU antitrust policy in Directorate-General COMP: cooperation with EU national competition authorities and national courts

7.2.Audit on financial management of procurement contracts and grants in Directorate-General COMP

7.3.Audit on the governance and operational organisation of the Investment Plan for Europe in Directorate-General ECFIN

7.4.Audit on HR management in EASME

7.5.Audit on H2020 project management in EASME

7.6.Audit on evaluation in Directorate-General ECFIN

7.7.Audit on financial management of procurement and grants in Directorate-General FISMA

7.8.Limited review of the calculation and the underlying methodology of the residual error rate for the 2016 reporting year in Directorate-General GROW

7.9.Audit on the accuracy of information on the Internal Market in Directorate-General GROW

7.10.Audit on the supervision of the implementation of the Copernicus programme in Directorate-General GROW – phase 1: control strategy on ESA entrusted budget

7.11.Audit on internal processes supporting trade policy negotiations in Directorate-General TRADE

8.
   GENERAL SERVICES
   

8.1.Audit on the procurement process in DIGIT

8.2.Audit on the charge-back of services in Directorate-General HR

8.3.Audit on ethics in OLAF

8.4.Audit on the procurement process in PO

8.5.. Consulting engagement on the efficiency of the workflow for parliamentary questions in SG

8.6.Audit on the financial management of the SRSS

9.
   IT AUDITS
   

9.1.Audit on corporate IT governance framework and portfolio management (DIGIT, SG)

9.2.Audit on management of IT security in DIGIT

9.3.Audit on security of IT applications supporting nuclear accountancy and inspection processes in Directorate-General ENER

9.4.Audit on IT programme and project management in the HR family (DIGIT, HR, EPSO, PMO)

9.5.Audit on IT logical security controls in OLAF

9.6.Audit on supervision of outsourced IT operations in Directorate-General TAXUD

PART 2: Follow-up engagements (summarised)
   

1.Follow-up audit on the management of intra-muros contractors

2.Follow-up audit on the new Better Regulation (BR) agenda in the Commission

3.Follow-up audit on effectiveness of the management of absenteeism in the Offices (OIB, OIL and Directorate-General HR)

4.Follow-up audit on early implementation of the ESIF control strategy in Directorates-General REGIO, EMPL and MARE

5.Follow-up audit on information security governance in the Commission

6.Follow-up audit on the Participant Guarantee Fund for FP7 and Horizon 2020 in Directorate-General RTD, Directorate-General ECFIN and ERCEA

7.Follow-up audit on Directorate-General AGRI's management and control system for Voluntary Coupled Support (VCS)

8.Follow-up audit on the management of grants under 2014-2020 consumer and health programmes in CHAFEA

9.Follow-up audit on public procurement in Directorate-General CLIMA

10. Follow-up audit on Human Resources management in Directorate-General CNECT

11.Follow-up audit on strategic planning and programming/ activity based management (SPP/ABM) in JRC

12.Follow-up audit of the ex-IAC audit on document management in JRC

13.Follow-up audit of the ex-IAC audit on nuclear decommissioning and waste management programme in JRC

14.Follow-up audit of former IAC recommendations in Directorate-General JRC

15.Follow-up audit on H2020 grant management in the REA

16. Follow-up audit on H2020 grant management in Directorate-General RTD: from the preparation of the work programme to the signature of the grant agreements

17.Follow-up audit on the set up of the Common Support Centre (CSC) for H2020

18.Follow-up audit on grant management in Directorate-General JUST

19.Follow -up audit on the management of the African Peace Facility in Directorate-General DEVCO

20.Follow-up audit of the limited review of Directorate-General NEAR’s residual error rate (RER) methodology and calculation

21.Follow-up audit on control strategy in Directorate-General NEAR

22.Follow-up audit on the effectiveness and efficiency of Erasmus+ control strategy in the Education, Audio-visual and Culture Executive Agency (EACEA) and in National Agencies (Directorate-General EAC)

23.Follow-up audit on financial management and grant processes in Directorate-General ECFIN.

24.Follow-up audit on former IAC recommendations in ESTAT

25.Follow-up audit on the procurement process in Directorate-General COMM

26.Follow-up audit on former IAC recommendations in PMO

27.Follow-up audit on business continuity management in OP

28.Follow-up audit on management of European Commission Authentication Service - ECAS

29.Follow-up audit on the management of the security of EU ETS IT system

30.Follow-up audit on management of local IT in Directorate-General COMP

31.Follow-up audit on management and supervision of contracts for outsourced IT services (IT contract management) in DIGIT

32.Follow-up audit on effectiveness of measures to handle manual interventions in ABAC

List of follow-up audits performed in 2017 for which all recommendations have been closed after the follow-up

PART 3: Summary of long outstanding recommendations as at 31 January 2018
   

  

Content of this Staff working document:

Part 1 of this Staff Working Document contains the objective and scope, key findings and the critical and very important recommendations of the Internal Audit Service engagements which were part of the 2017 Internal Audit Service audit plan (cut-off date for the exercise: 31 January 2018). Important and desirable recommendations are not reproduced in this Staff Working Document. The information contained in this Staff Working Document reflects the state of play when the audit engagements were finalised as stated in the executive summary of the audit report
[1](#footnote2)
. The executive summary of each audit underwent the applicable standard professional validation and contradictory procedures between auditor and auditee at the time of the finalisation and aims to provide a quick understanding of the audits and their main results. Following the Internal Audit Service audits, the DGs/services have developed action plans which have been implemented or which are in the process of being implemented. Additional information on the measures defined and/or implemented by the DGs/services is provided at the end of each section of the audit concerned. The effective implementation of the actions taken by the Commission’s DGs/Services will be assessed by the Internal Audit Service in due course, in accordance with its follow-up policy.

Part 2 of this Staff Working Document contains a summary of the Internal Audit Service follow-up engagements conducted in the period from 1 February 2017 to 31 January 2018
[2](#footnote3)
.

Part 3 provides a summarised overview of the 12 long overdue very important recommendations as at 31 January 2018.

PART 1: Final reports

1.Horizontal audits

1.1. Audit on management of recovery orders for competition fines (incl. guarantees for competition fines) and for recovery orders in the context of the Commission's 'corrective capacity' – Phase I (Directorates-General CONNECT, ENER, LS, EACEA)

Audit objectives and scope

The objective of the audit was to assess whether the Commission has put in place an effective and efficient control system for the management of the recovery orders in the context of the Commission's 'corrective capacity' both at the central and the operational level.

The audit was conducted under a phased approach in order to manage a perceived conflict of interest situation:

Phase I of the audit assessed the efficiency and effectiveness of the system put in place for the management of recovery orders in the three sample-Directorates-General CONNECT, ENER and EACEA. It also assessed timeliness and efficiency of the enforced recovery process performed by the LS, as well as support and guidance offered by that service to Authorising Officers by Delegation (AOD).

Phase II of the audit will start during the second half of 2018 to take into account the "cooling-off period" as prescribed by IPPF standard 1130 A.1 (internal auditors must refrain from assessing specific operations for which they were previously responsible), due to the arrival of the Internal Audit Service Director-General from the Directorate-General Budget. It will cover the efficiency and effectiveness of the system put in place for the management of recovery orders in Directorate-General COMP and of the corporate framework for the management of the recovery process put in place by the Directorate-General Budget. It will also assess the efficiency and effectiveness of the pre-litigation phase managed by the Directorate-General Budget and the management of the credit risk of provisionally cashed fines and the financial guarantees provided in the context of competition fines.

Given the distinct responsibilities of the actors involved in the recovery process, the scope of the audit covered/will cover:

·At the central level, for the Directorate-General Budget (in 2018) and LS (in 2017), whether the current framework put in place for this process supports Authorising Officers by Delegation in carrying out effective and efficient recovery procedures. It will also examine the control systems of the Directorate-General Budget and the LS for their own distinct areas of responsibility, including the pre-litigation and enforcement phases, managed by the Directorate-General Budget and LS, respectively.

·At the operational level, a sample of Directorates-General/EAs (in 2017) to assess the efficiency and effectiveness of the management of recovery orders. The entities sampled were 
  
Directorate-General ENER, Directorate-General CONNECT, Directorate-General COMP (in 2018) and EACEA.

There were no observations/reservations in the 2016 Annual Activity Reports of the LS, 
  
Directorate-General CONNECT, EACEA or Directorate-General ENER that relate to the area/process audited.

The fieldwork was finalised on 27 June 2017. All observations and recommendations relate to the situation as of that date.

Strengths (CONNECT)

The auditors recognised the ongoing efforts made by Directorate-General CNECT in order to develop and improve the recovery process at their level. In particular, the auditors identified the following strengths:

a)
   Centralisation of the recovery monitoring activity with unit R2

Unit R2's mandate is to monitor the overdue recovery orders issued by the Directorate-General as well as to liaise with operational Directorates, the Directorate-General Budget and LS. Therefore, the roles and responsibilities of each actor for the recovery orders process within Directorate-General CNECT are clearly established and the audit did not identify overlaps among the tasks assigned to the services intervening in the process.

b)
   Customised IT tools used

Directorate-General CNECT uses an appropriate IT tool to support the recovery orders process (iFlow), which automates some of the controls (for example, recovery orders coming from implementation of ex-post controls are encoded as Irregularities by default).

c)
   Checklists used by unit R2

Directorate-General CNECT uses detailed checklists for the recovery orders, including necessary steps, guidance and actors involved in the process.

d)
   Pro-activeness in searching for off-setting possibilities

Directorate-General CNECT proactively searches for offsetting possibilities with other Directorates-General, in particular for Horizon 2020. When Directorate-General CNECT identifies upcoming payments to the same beneficiaries in other Directorates-General (by using the Corda application available at Commission level), it contacts the other Directorates-General to inform them of the existence of recovery orders. Directorate-General CNECT also informs the Directorate-General Budget in order to ensure that the offsetting is processed.

Strengths (EACEA)

The auditors recognised the ongoing efforts made by EACEA in order to develop and improve the recovery process at their level. In particular the auditors identified the following strengths:

a)
   Monitoring of the Recovery Order process

The monitoring of the recovery orders process in EACEA enables it to follow-up the recovery orders (ROs) assigned to the Authorising Officer responsible. This is especially important as the recovery orders process is highly decentralised in the Agency:

- Ten Operational Units who identify the ROs, encode ROs, send pre-information letters, send debit notes and prepare files for enforced recoveries;

- This is complemented by the central Unit R2 "Finance Accounting Programming" which verifies waivers, cancellations of recovery orders, the files for enforced recoveries, monitors the workload of the Executive Agency regarding recoveries and sets priorities for the Operational Units based on appropriate criteria.

b)
   Measurement of the performance of the Recovery Order process

The Agency has defined an appropriate objective, with indicators and targets to measure the performance of the Recovery Order process across the Agency. These are presented to the management of the Agency as part of a monthly dashboard.

c)
   Analysis of the performance of the Recovery Order process

The Finance Coordinators within the Central Unit R2 provide the Accounting Sector with an analysis of the quarterly targets and also identify the root causes in case of not achieving the quarterly targets. This explanation is provided to the Director of EACEA and also to the relevant actors in the Operational Units.

Strengths (ENER)

The auditors recognised the ongoing efforts made by Directorate-General ENER in order to develop and improve the recovery process at their level. In particular, the auditors identified the following strengths:

a)
   Use of checklist

Directorate-General ENER has developed and uses a detailed checklist that includes the necessary steps, guidance and actors involved in the recovery order process.  

b)
   Roles and responsibilities are well defined

The roles of each actor, as well as the related responsibilities, are clearly established. The audit did not identify overlaps among the tasks assigned to the Directorates-General/Services intervening in the process, or aspects not covered.

Strengths (LS)

The auditors recognised the ongoing efforts made by the Legal Service in order to develop and improve the recovery process at their level. In particular, the auditors identified the following strengths:

a)
   Procedures and guidelines

Procedures for the enforcement of recovery orders are well established and defined, and supported by the Guide to the enforced recovery of Commission entitlements, information on BUDGWEB and case law.

b)
   IT tools

The Legal Service uses a number of IT tools (RECO database, Base contentieux and NAT) to support the process of enforcement of recovery orders.

Major audit findings

Following on from Phase 1, the Internal Audit Service did not identify any critical or very important issues in Directorate-General CONNECT, Directorate-General ENER, EACEA or the LS.

1.2. Audit on HR management and staff allocation in Directorate-General HOME and Directorate-General JUST

Audit objectives and scope

The objective of the audit was to assess whether Directorate-General HOME and Directorate-General JUST have put in place adequate governance, risk management and internal control processes for allocating and managing its human resources (HR), enabling the Directorates-General to deliver on their policy priorities, objectives and core tasks.

The scope of the audit did not include the allocation of establishment plan posts to the Directorates-General at corporate level or an in-depth assessment of the Commission's new HR management (HRM) delivery model.

There were no observations/reservations in the 2016 Annual Activity Reports of Directorate-General HOME or Directorate-General JUST that relate to the area/process audited.

The fieldwork was finalised on 22 September 2017. All observations and recommendations relate to the situation as of that date.

Strengths (HOME)

The auditors recognised the ongoing efforts made by Directorate-General HOME to:

a)
   assess and communicate to the corporate level its staff needs for responding to its new tasks and responsibilities;

b)
   align its organisational structure to its priorities;

c) 
   follow up on the 2016 Staff Survey results with a detailed Action Plan;

d)
   support the corporate initiative on the prevention of psychosocial risks at the workplace through its participation in Directorate-General HR's pilot project on that topic.

Strengths (JUST)

The auditors recognised the ongoing efforts made by Directorate-General JUST to:

a)
   provide a quick and effective response to a number of areas for improvement identified in the 2016 Commission Staff Survey. In particular, the Directorate-General has taken effective measures to increase the efficiency and effectiveness of its business processes in three priority areas;

b)
   involve and engage its staff in an open dialogue with senior management through regular staff consultation on key areas and in particular through consultation and communication activities aimed at making the reorganisation as transparent and as democratic as possible.

Major audit findings

The Internal Audit Service identified two very important issues for Directorate-General HOME and one very important issue for Directorate-General JUST:

Directorate-General HOME's strategic approach to HRM

The Internal Audit Service found that HR management in Directorate-General HOME is not supported by a comprehensive HR strategy or policy. The Directorate-General had not yet put in place an established framework defining its main challenges related to HRM, its main objectives, the measures that it intends to take to achieve its goals, and the tools through which it plans to ensure the effective implementation of HR measures, including monitoring mechanisms. Furthermore, important strategic HRM processes had not yet been defined in sufficient detail, in particular on internally matching human resources to needs and on increasing staff performance through sustainable people management measures. The Internal Audit Service also underlined the inherent link between HRM and the Directorate's-General broader organisational culture.

Allocation of HR (for both Directorate-General HOME and Directorate-General JUST)

The Internal Audit Service found that neither of the Directorates-General had put in place a robust and transparent system for taking HR allocation decisions. More specifically, staff allocation decisions did not adequately take into account the Directorates’-General core tasks and priorities; the workload affecting different parts of the organisation; and information on existing talents and special competencies of the workforce. Furthermore, the Directorates-General had not yet put in place an established system or mechanism that would facilitate closing the gaps between identified needs and available resources, in particular through measures of flexible and rapid redeployment of existing staff to areas where they are most needed.

Recommendations

Directorate-General HOME's strategic approach to HRM

Directorate-General HOME should establish an HR strategy/policy that brings together existing HRM processes and measures into a comprehensive framework, sets out the Directorate's-General main HRM related objectives, identifies key HR challenges/risks and mitigating measures/actions, and defines the arrangements for monitoring its implementation. The Directorate-General should also strengthen its organisational culture by addressing key weaknesses in communication between senior management and staff, leadership style, respect, fair treatment and development of the workforce.

Allocation of HR

Both Directorates-General should strengthen their HR allocation system by establishing a structure/mechanism for identifying HR needs and for rapidly deciding on solutions to close gaps. HR allocation decisions should be supported by relevant information on (1) tasks, priorities and resources attached to them; (2) workload affecting the Directorate's-General units; and (3) skills and competencies of staff; and should be made more transparent and objective through the use of quantifiable data and objective criteria. Finally, the Directorates-General are encouraged to establish a process for prioritising work (including the identification of negative priorities) in order to use their existing workforce in the most efficient manner.

Additional information provided by Directorates-General HOME and JUST on the measures defined and/or implemented following the Internal Audit Service audit

The two recommendations to be followed regarding DG HOME's strategic approach to human resource management (recommending the development of a Human Resources strategy or plan, and strengthening the DG's broader organisational culture), and to the allocation of human resources (recommending the establishment of a structure / mechanism for identifying human resources needs in both Directorates-General), as well as one recommendation relating to sustainable people management are being followed up by DG HOME in accordance with the Action Plan which was considered satisfactory by the Internal Audit Service. Most of the actions will be implemented by the end of 2018.

In accordance with DG JUST’s action plan, preparatory research has been carried out to seek corporate guidance and identify best practices. Furthermore, different possible data to provide objective criteria for assessing workloads have been considered and discussed with senior management (including overtime and sick-leave). Talent management initiatives have been studied and the first measure in the form of an internal expression of interest to change post within the DG has been launched. Further improvements are expected after full deployment of ATLAS, a centralised IT tool for human resources.

1.3. Audit on amendments of 2014-2020 OPs in Directorates-General REGIO, EMPL and MARE

Audit objectives and scope

The objective of the audit was to assess whether the design of the Directorates'-General internal control systems for approving requests for European Structural and Investment Fund (ESIF) Operational Programme Amendments (OPA) is adequate and is effectively implemented in a consistent and timely manner at this early stage of OP implementation. The Internal Audit Service addressed this objective by assessing whether the design of the OPA process is adequate in order to ensure an effective, timely, and consistent assessment and approval of the amendment requests submitted by Member States (MS), in compliance with the Common Provisions Regulation (CPR) and Fund-specific rules, and whether the implementation of the OPA process is effective, timely, and consistent.

There were no observations/reservations in the 2016 Annual Activity Reports of the three Directorates-General that relate to the process audited.

The fieldwork was finalised on 20 April 2017. All observations and recommendations relate to the situation as of that date, except in relation to the new procedure on issuing observations on OPAs. The inter service consultation relating to this new procedure closed after the Internal Audit Service had finalised the fieldwork (19 May 2017).

Strengths

The auditors recognised the ongoing efforts made by the audited Directorates-General to ensure a coordinated approach to processing OPA requests. During the audit, the Internal Audit Service identified the following strengths:

a)
   The guidance in place at the three Directorates-General was coordinated jointly between the ESIF Directorates-General by the Stock-Taking Group, which meets on a weekly basis to coordinate common positions between the ESIF Directorates-General.

b)
   There is joint legal interpretation of the applicable regulations by ESIF Directorates-General. Answers on questions from MS and Desk Officers (DOs) on regulatory matters are available on Directorate-General REGIO's SharePoint ''Interpretation site'', and on the REGIO wiki.

c)
   At Directorate-General EMPL, upstream work on the analysis of an OPA request is performed and documented prior to the official submission through SFC2014 (System for fund management for the 2014-2020 programming period). This is formalised and is part of the OPA process.

d)
   Internal coordination meetings at the 3 Directorates-General:

- At Directorate-General REGIO, the monthly "Implementation Network" is a forum for discussion among Geographical Units (GUs) and coordination and policy units, and Directorate-General REGIO's hierarchy on topics concerning fund programming and implementation.

- At Directorate-General EMPL, ESF Coordination Support Group (CSG) meetings take place on a monthly basis. The CSG's mission is to provide guidance on ESF and policy related issues, and is a forum for discussion among the GUs and coordination and policy units, and Directorate-General EMPL hierarchy.

- At Directorate-General MARE, the EMFF Coordination Group takes place twice per month, with the objective of enhancing efficiency and ensuring consistency across units in policy development and implementation.

e)
   Existence of a strategy towards a more performance based culture, and evaluation strategy in Directorates-General REGIO and EMPL.

Major audit findings

The Internal Audit Service identified one very important issue:

Consistency, effectiveness, and timeliness of the OPA process

OP amendment requests submitted by the MS may require significant changes to the funding priorities of the OP and therefore need to be analysed thoroughly before adoption by the Commission. The deadlines prescribed by the regulation for issuing observations and adopting OP amendments means that the process is very time pressured, with little or no margins for delay on the part of the Commission. This time pressure has been further compounded by the Legal Service's opinion that observations on OP amendments need to be adopted by Commission Decision, which was not envisaged by the Directorates-General when proposing the 2014-2020 CPR. Directorate-General REGIO in particular has faced considerable delays in adopting OP amendments within the regulatory deadline of three months, whereas delays were less pronounced at Directorate-General EMPL and at Directorate-General MARE. To gain time, the Directorates-General made use of "technical observations" as a way of making observations on OP amendments (instead of by Commission Decision), even though these often involved substantive rather than routine issues. More recently, the Directorates-General adopted a new procedure of issuing observations by "service letter" signed by the Director-General.

Recommendation

The process of issuing observations should be strengthened, including their timing and monitoring by management, and putting in place a framework to guide the desk officers decision-making process when deciding at what level observations should be sent to MS (either as "technical observations", as a service level letter signed by the Director-General, or as a Commission Decision). In addition and looking forward to the preparation of the post 2020 programming period legislation, the Directorates-General need to propose realistic deadlines for making observations on OPAs and clarify the level at which these need to be approved (Commission Decision or service letter). Improvements are also needed for the coordination of multi-fund OPs and in formalising the upstream work done by desk officers in Directorate-General REGIO and Directorate-General MARE as part of the OP amendment procedure.

Additional information provided by Directorates-General REGIO, EMPL and MARE on the measures defined and/or implemented following the Internal Audit Service audit

Since the issuance of the corresponding final report by the Internal Audit Service, and according to the agreed Action Plan, actions have been carried out by Directorate-General REGIO in order to better define, strengthen and streamline the working arrangements related to the processing of Operational Programme Amendments so as to ensure the respect of the regulatory deadline for issuing observations and adopting the amendments. In this regard, among other measures, the upstream work by desk officers in processing Operational Programmes modifications requests has been formalised. As for internal methodology and horizontal aspects of the Operational Programme Amendment process, targeted efforts have been made to improve the related process workflow and guidance, as well as to harmonise them among the concerned DGs.

In response to the Internal Audit Service recommendations, DG EMPL has undertaken the following actions:

·DG EMPL has set up a monitoring system in the Rural Development Information System. It has closely monitored the Operational Programme Amendments resulting from the Youth Employment Initiative increase and the Technical Adjustment and reported any risks and delays in the Dynamic Diversified Growth Funds Management Meeting (as well as in the Stock-taking group for the multi-fund Operational Programmes). As a result, despite the tight deadlines, all Operational Programme Amendments were adopted on time by the end of 2017.

·The Operational Programme Amendments report in the Rural Development Information System monitors the use of observations. In addition, the Operational Programme Amendment Roadmaps now include new guidance on use of observations.

·Geographical units assess the associated risks when making the Operational Programme Amendment analysis using the quality assessment checklist.

·DG EMPL's Roadmaps and Rural Development Information System instruct the units to specify the question they want to raise as well as their own preliminary assessment if they consider that there may be a particular issue.

·DG EMPL monitors the regulatory and internal process/task deadlines through the Rural Development Information System. The Rural Development Information System team is collecting a log of ’issues’ and how they were resolved/addressed. Based on the regular monitoring the coordination unit identifies the potential problematic elements/bottlenecks of the processes and follows them up with the Senior Management of DG EMPL, and with the Cabinet and Stock-taking group if needed.

·DG EMPL continue cooperating closely to ensure that IT systems are in line with the processes agreed in the Stock-taking group and internally.

·The coordination unit disseminates information and changes through regular 'info flash' emails to geographical units; in the monthly European Social Fund newsletter; and in the 6-weekly meetings with geographical units in the context of the Coordination Support Group.

·In addition, when there is a need, DG EMPL organises ad-hoc trainings. Since the Internal Audit Service audit, DG EMPL has organised two trainings of geographical units on Operational Programme Amendments resulting from the Youth Employment Initiative increase and the Technical adjustment.

·DG EMPL has set up a Rural Development Information System helpdesk and accepts direct calls, offering immediate support and assistance on this information system and the processes covered to DG EMPL geographical units.

·The dedicated Operational Programme Amendments space on the Intracomm is updated when necessary.

·DG EMPL has prepared the update of the Partnership Agreements amendment process to be put in place following the Omnibus Regulation’s adoption. The topic has been discussed with the other Directorates-General dealing with the European Structural and Investment Fund in the Stock-taking group.

·DG EMPL continues to cooperate with DG REGIO on updating and streamlining the Operational Programme Amendment process in the Stock-taking group and bilaterally.

·The Rural Development Information System Support Team updates the access to IT tool WAVE for DG EMPL staff dealing with multi-fund programmes.

·The instructions in the Rural Development Information System include the list of documents that are mandatory for each task as specified in the related roadmaps.

·The Commission has proposed realistic deadlines for making observations on amendments in the next post-2020 programming period - in Article 19(2) of the Proposal for a Regulation COM(2018) 375 the Commission proposes that the deadline for making observations on a programme amendment requested by a Member State is extended from 1 month to 3 months.

·The proposal also provides clarity on the level at which observations need to be approved (Commission Decision or service letter). Article 19 of the Proposal concerning amendment of programmes removes the obligation for the Commission to adopt an amendment ‘provided that any observations made by the Commission have been adequately taken into account’ (current Article 30(2) of Common Provisions Regulation). This means that observations will be sent by the Commission services, as the Commission itself is no longer bound by the observations to adopt the amendment.

·In addition, compared to the current Common Provisions Regulation, the scope of Article 3 of the Proposal on calculation of time limits for Commission actions is extended to cover not only Commission decisions but all Commission actions. Thus, it covers observations sent as service letters.

Directorate-General MARE considers that the issues relating to 2014-2020 and pertaining to its remit have been implemented. Internal guidance has been updated and endorsed within MARE and training organised thereafter for desk officers. Directorate-General MARE considers that there is no impact on its internal control systems. The two recommendations were sent for review to the Internal Audit Service, which will follow-up once all DGs will have sent their recommendations for review as well.

The implementation by Directorates-General REGIO, MARE and EMPL is ongoing and the related action plans for the recommendations will be completed in 2018.

1.4. Audit on the Commission's framework/arrangements for the estimation, assessment and reporting on the cost-effectiveness of controls (Directorates-General BUDG, NEAR, REGIO, RTD)

Audit objectives and scope

The objective of the audit was to assess whether the Commission has put in place an appropriate corporate framework that enables Authorising Officers by Delegation (AODs) to reliably estimate, assess and report annually in the Annual Activity Reports (AAR) on the cost-effectiveness of controls. Furthermore, it assessed if such an initiative met its objectives, as laid down in the draft guidance issued by the Directorate-General Budget, and if it adds value to the Commission's initiative on a budget focussed on results (BFOR).

Given the distinct responsibilities at central and local level, the audit was planned around two pillars, as follows:

·At the corporate level the audit covered the Directorate-General Budget and assessed whether the current framework put in place for this process enables Authorising Officers by Delegation to reliably estimate, assess and report on the cost-effectiveness of controls in line with the Financial Regulation and use this information in making decisions (adjusting control systems, influencing Commission proposals for legislative initiatives);

·At the local level the audit covered a sample of Directorates-General (Directorates-General RTD, REGIO and NEAR), comprising all budget management modes (shared, indirect, direct). The audit assessed the actual implementation of the corporate framework on the estimation, assessment and reporting of the cost-effectiveness of controls in their Annual Activity Reports.

There were no observations/reservations in the 2016 Annual Activity Reports of all the Directorates-General audited that relate to the area/process audited.

The fieldwork was finalised on 22 June 2017. All observations and recommendations relate to the situation as of that date.

Major audit findings

The Internal Audit Service identified one very important issue:

Achievement of the objectives of the framework

The objectives initially set by the Directorate-General Budget for the exercise to estimate, assess and report on the cost-effectiveness of controls were, from the outset, very challenging with the result that, overall, most were only partly met in practice.

Definition of the key concepts and implications for the methodology

·The definition of "controls" was very wide, which resulted in uncertainty and misinterpretation in the Directorates-General charged with actually applying the concept in practice. Furthermore, in principle, Directorates-General were required to report on the costs of controls in Member States (shared management) or at the level of entrusted entities (indirect management). However, there are practical limitations on how much they can do. In addition, the concept of "benefits" was mainly built on the understanding that the bodies responsible for exercising controls would be similar to "profit centres", whereby quantifiable benefits, such as financial corrections and recoveries, could be calculated. In practice, however, the objectives of a Directorate's-General control functions, such as those in Directorates-General NEAR, REGIO and RTD are more about providing assurance on whether the internal control systems of the bodies managing EU funds are working well or not and as such the extent to which any real benefits can be readily quantifiable is limited.

Added value of the reporting on the cost-effectiveness of controls and link to other on-going initiatives

·The Directorates-General did not actually make significant use of the information generated through this process, either as a tool for management or to support policy development. Instead, they relied on existing tools and measures.

Guidance and support for the reporting on cost-effectiveness of controls

The Internal Audit Service also identified scope for providing strengthened guidance and support to the Directorates-General in order to arrive at a more consistent estimation of the cost of controls across the Commission.

Recommendation

The Directorate-General Budget should redesign the existing framework by better distinguishing between a narrower operational dimension on the one hand, and a wider policy dimension on the other (The 'policy dimension' refers to the phase of developing the legislation that sets the boundaries within which the Commission have to operate. The 'operational dimension' refers to the actual implementation phase.). For the operational dimension, the methodology for estimating the costs should be simplified by at least adopting a narrower and more realistic definition of the term "control", inspired by the Synergies and Efficiency Review initiative for financial management, and which should be the basis for the annual Annual Activity Report reporting exercise.

For the purpose of the policy dimension, the current (broader) definition of the term "control" could still be used, but it would also need to incorporate the Member States and entrusted entities, where it is feasible and cost-efficient, in order to provide policy makers with an estimate of the "cost to control EU spending" which could in turn be used as part of the legislative debate.

For reporting on information on cost of controls at Member State level in shared management and entrusted entity level in the Annual Activity Report, where feasible and cost-efficient, the Directorate-General Budget should modify its guidance by either requesting that Directorates-General no longer report on them or, at least, in the interests of transparency, to present them separately from those of the Commission. The source of these figures and how they were estimated should be explained clearly.

Furthermore, Directorate-General BUDG should initiate and facilitate a debate on a case-by-case basis on defining the way forward regarding the materiality threshold in the context of the specific legislative procedures.

For both dimensions, and to complement any quantitative analysis, the Directorate-General Budget should steer Directorates-General by encouraging them to explain the benefits of controls and to assess whether costs can be lowered (i.e. by adopting a “cost centre” approach).

The Directorate-General Budget should set achievable objectives for the exercise to estimate, assess and report on cost-effectiveness of controls and provide strengthened guidance to the Directorates-General. It should also take on a more active role in steering Directorates-General to apply the guidance in a more consistent way.

Additional information provided by Directorate-General BUDG on the measures defined and/or implemented following the Internal Audit Service audit

At this stage the recommendation has been partly implemented – a corporate guidance to calculate the cost-effectiveness of controls has been partially revised for the 2017 Annual Activity Report exercise, and to be completed for the 2018 Annual Activity Report exercise.

1.5. Audit on the Commission's supervision of the implementation of CEF financial instruments in Directorate-General ENER and Directorate-General MOVE

Further to the note announcing the launch of the audit on the Commission's supervision of the implementation of Connecting Europe Facility (CEF) financial instruments, the Internal Audit Service conducted a preliminary survey with the aim of gaining a better understanding of the activities and the related risks and in order to define the objectives and scope of the engagement.

The preliminary survey confirmed that the main risk in this area relates to the ineffectiveness of the supervisory activities that should be performed by Directorates-General ENER and MOVE on how the European Investment Bank (EIB) implements and manages CEF financial instruments. This corroborates the results of the Internal Audit Service risk assessment performed in 2015 and 2016 in the context of the preparation of the Internal Audit Service annual audit plans.

However, during the preliminary survey it became clear that to date there had been a very low rate of implementation of financial instruments under CEF. Only one specific agreement with one subsequent transaction with a final beneficiary had been signed and one payment made to EIB in this respect (for EUR 37 500 000). Moreover, according to the latest work programmes of Directorates-General ENER and MOVE, the majority of the budget originally allocated to CEF financial instruments (EUR 2.43 billion) was re-allocated to CEF grants budget lines. Consequently, until 2020 only EUR 296 million will be available for CEF financial instruments.

The low implementation (and the decision to reallocate to the grants budget lines) is partially due to the fact that as far as Directorates-General ENER and MOVE projects are concerned, the eligibility criteria of the CEF financial instruments and of the European Fund for Strategic Investments (EFSI) largely overlap and potential CEF eligible projects have in fact been financed by EFSI as it has greater political priority and a larger remit.

Given the low implementation of CEF financial instruments to date, the effective exercise of the supervisory role of the Directorates-General cannot be satisfactorily audited. For this reason, the Internal Audit Service decided to close the audit after the preliminary survey.

1.6. Audit on the Commission’s governance/oversight arrangements concerning risk management, financial reporting and the ex-post verification/audit function (Secretariat-General and Directorate-General Budget)

Audit objectives and scope

The objective of the audit was to assess whether the Commission has put in place appropriate governance/oversight arrangements at corporate level on (1) risk management, (2) financial reporting and (3) ex-post verifications/audits, which enable the College to take its political responsibility for the management of the EU budget (by the Authorising Officers by Delegation - AOD).

The scope of the audit covered the governance/oversight arrangements for the three areas indicated above. It also covered certain general aspects on the current 'Governance set-up' as regards the political responsibility for the management of the EU budget taken by the College through the adoption of the Annual Management and Performance Report (AMPR), the role of the Central Services, the working arrangements between the Commissioners and the Directorates-General and the role and functioning of key corporate bodies (i.e. two oversight bodies, namely: the Audit Progress Committee (APC) and the Corporate Management Board (CMB) and one corporate body with no oversight function, namely the Group of Resources Directors (GDR)). Governance and oversight arrangements referring to performance, ethics, better regulation and openness and transparency were out of the scope of this audit.

There were no reservations that relate to the area/process audited in the 2016 Annual Activity Reports (AAR) of the Directorates-General under the scope of this audit (i.e. the Secretariat-General, the Directorate-General Budget and the operational Directorates-General AGRI, DEVCO, EMPL, REGIO and RTD). However, the Secretariat-General and the Directorate-General Budget reported on the European Court of Auditors' (ECA) observations included in the special report N° 27/2016 on 'Governance at the European Commission – best practice?'.

The fieldwork was finalised on 14 July 2017. All observations and recommendations related to the situation as of that date with the exception of the revised Governance Statement, which was adopted on 11 October 2017 (i.e. after the end of the audit fieldwork) and was taken into consideration in the audit report.

Strengths

The Internal Audit Service noted a number of strengths as regards the Commission's current governance arrangements.

Decentralised model – accountability and assurance building process

The Commission uses a decentralised model for financial management with clearly framed and well understood accountability instruments at the Directorate-General level through the Annual Activity Report and at the College level through the AMPR. It has a robust assurance building process, the cornerstone of which is the Authorising Officers' by Delegation Declarations of Assurance, which has developed over time into a very mature and well-understood process and demonstrates in a very transparent fashion the extent to which they are held accountable.

Working arrangements Directorate-General – Commissioner'

There is a clear and well established vertical reporting process, supported by working arrangements, whereby the Directorate-General informs on a timely basis its responsible Commissioner on matters which may call into question his/her responsibility or that of the College as a whole.

EU consolidated accounts

The process for preparing the EU consolidated accounts is mature and well established within the Commission under the lead of the Directorate-General Budget. In particular, the respective roles and responsibilities are well understood, the instructions and guidance provided by the Directorate-General Budget are clear, quality checks are carried out and there is a proper analysis of the various assurance sources, including certificates and Management Representation Letters provided by the consolidated entities. The European Court of Auditors has issued a clean opinion on the reliability of the accounts since 2007.

Major audit findings

The Internal Audit Service identified two very important issues:

Risk management

Effective risk management is about identifying and ensuring an appropriate response to issues which can threaten the Commission's ability to achieve its objectives and which could severely damage its reputation. This is the responsibility of management and constitutes an organisation's first line of defence (in the 'Three Lines of Defence' model
[3](#footnote4)
). A second line of defence aims to support or steer this process through the provision of frameworks and guidance. At the corporate level in the Commission, this role is exercised by the Central Services, the Secretariat-General and the Directorate-General Budget. As a third line of defence, the Internal Audit Service provides independent audit assurance and advice. While neither the second nor the third line of defence can or should dilute the primary responsibility of management (i.e. the first line of defence) to address adequately those risks, corporate or central oversight of these practices can improve their effectiveness and help to provide assurances to the College that those processes are well-managed in practice. This is particularly important given that, in recent years, Internal Audit Service audits of the Commission's risk management processes have found them to be still lacking in maturity.

However, oversight on risk management is currently mainly embedded in the vertical reporting lines between individual Authorising Officers by Delegation and their respective Commissioners. The Corporate Management Board only takes note of the cross-cutting critical risks and coverage of risk management is not explicitly embedded in its mandate. The Central Services identify cross-cutting critical risks among the critical risks reported by the Directorates-General and bring them to the attention of the Corporate Management Board, but this does not include any risks identified by Directorates-General, which are not cross-cutting, but critical at Directorate-General level including those operational risks at Directorate-General level which are linked to individual actions contributing to the "Juncker priorities". As regards the Audit Progress Committee, its oversight on risk management is limited to the risks identified by the Internal Audit Service through its risk-based audit planning process and through the audit reports themselves. For the Audit Progress Committee, this means that currently it is not in a position to cross-check the Internal Audit Service’s audit risk assessment and audit plan to management's risk assessment. Consequently, it does not have an overall view on the extent to which the risks of the Commission (as assessed by management as well as by the Internal Audit Service) are being adequately addressed by management and/or through Internal Audit Service or European Court of Auditors audits in practice.

From the central coordination perspective, the Secretariat-General and the Directorate-General Budget provide guidance and instructions to support the Directorates'-General risk management process. However, the Internal Audit Service has found that there is scope for improving the guidance and the process in key areas: the application of 'Risk Tolerance' and 'Materiality' concepts when reporting critical risks, the need for a more differentiated/risk-based approach when supporting Directorates-General and the role envisaged in Directorates-General for the 'Director in charge of risk management and internal control' as created under the revised Internal Control Framework.

Governance set-up

Corporate (oversight) bodies

Apart from the College, which is the ultimate decision-making body within the Commission, currently there are three main corporate bodies for the areas within the scope of this audit: two oversight bodies, namely the Audit Progress Committee and the Corporate Management Board and one corporate body with no oversight functions, namely the Group of Resources Directors.

While the Audit Progress Committee has no decision-making power it is a key oversight body in the Commission and provides valuable advice to the College. It has a unique composition with both internal and external, independent members
[4](#footnote5)
 and the Internal Audit Service welcomes the positive evolution as regards the functioning and composition of the APC. Currently, its mandate does not include risk management and neither does it include the EU consolidated accounts. The Internal Audit Service acknowledges that the Audit Progress Committee was never originally conceived to be a fully-fledged audit committee in the conventional sense. Its mandate was deliberately limited to ensuring, inter alia, the proper follow-up of the Internal Audit Service and ECA audit recommendations. This practice is in line with the new legal requirement, which has been introduced following the recent revision of the Financial Regulation. Recognised professional standards/frameworks allow certain flexibility. However, both areas (i.e. risk management and the EU consolidated accounts) would be typically covered by modern-day audit committees.

Despite the Audit Progress Committee's limited role, the audit has found that implementing this can be challenging in practice within the current set-up. In particular, although the Audit Progress Committee mandate includes the follow-up of European Court of Auditors audit recommendations, European Court of Auditors reports were until recently only very rarely discussed and follow-up work was limited, mainly due to inadequate information on the state of play in implementing these recommendations. Also, it is clear that it is largely the agenda-setting and steering briefings prepared by the Audit Progress Committee secretariat under the supervision of the Audit Progress Committee Preparatory Group (PG) Chair as well as input of the external members which drive the discussions during the Audit Progress Committee Preparatory Group meetings. The internal Preparatory Group members, who come from the respective Cabinets, are often constrained by the time they can devote to preparing and attending meetings and their expertise in the areas covered by the Audit Progress Committee varies. There is also the inherent risk of potential conflicts of interest, although there are some mitigating measures in place to avoid this. In addition, there is an inherent potential conflict of interest in having the Audit Progress Committee secretariat administratively linked to the Internal Audit Service. Finally, despite the key roles of both the Audit Progress Committee and the Corporate Management Board in the Commission's governance structure, there is no systematic flow of information between both bodies.

Although the Corporate Management Board is expected to play a central role in the corporate governance of the Commission as per the 2017 Commission's Governance Statement, its role and added value do not seem to be entirely clear for a number of the interviewees selected by the Internal Audit Service and as noted above, its oversight role on risk management is limited in practice to just the cross-cutting critical risks. Furthermore, its mandate has not been updated since 2007. Although Corporate Management Board documents are shared with all Cabinets, there is no systematic reporting from the Corporate Management Board to the College on the results of its work, which would be comparable to the reporting mechanisms of the Audit Progress Committee.

The Group of Resources Directors mandate has yet to be updated to reflect the results of the report on the 'Evolution of the Group of Resources Directors'. As indicated above, the Group of Resources Directors has no oversight function and has no decision making powers. It is mainly a platform to share information and knowledge amongst Resources Directorates. Members of the group have expressed concerns about the lack of formal reporting lines, insufficient use being made of its members' experience and instances when it was mainly a vehicle for sharing information on decisions already taken rather than actually contributing to those decisions in the first instance. This may be explained by a misperception about the role of the Group of Resources Directors, which calls for the need to clarify/update its mandate.

Governance statement

On 11 October 2017, the Commission adopted the Communication on Governance in the European Commission. The Internal Audit Service welcomes this positive step. Given the importance of this document, it is key to raise awareness within the Commission. Furthermore, the Governance Statement will need to be updated to reflect necessary changes resulting from implementing the accepted recommendations of this report (e.g. as regards the mandates of the Audit Progress Committee and/or the Corporate Management Board).

Role of the Central Services in the Authorising Officer by Delegation decentralised model

Following the 'Three Lines of Defence' model and bearing in mind the Commission's decentralised structure, the 2nd line of defence in the Commission exists both at the local Directorate-General level and the corporate level. The Central Services contribute to the 2nd line of defence from the corporate point of view by advising/supporting and monitoring the effective implementation of prescribed frameworks. It is a question of finding the right balance between taking a more hands-on, directional approach and a more hands-off, facilitating approach. Getting this balance is a perennial challenge, particularly in the Commission where the basic principle of decentralised Authorising Officer by Delegation responsibility is key, but also in terms of their role in helping the College to take its political responsibility. However, the audit found that whilst the Central Services are generally very much appreciated by the Directorates-General and Services, there is scope for strengthening their roles in key areas such as Risk Management.

Recommendations
[5](#footnote6)

Audit Recommendation on risk management

1.1 The Commission should strengthen its corporate oversight on risk management, including critical risks which are not cross-cutting.

As suggested by professional reference frameworks, the corporate oversight role on risk management should be exercised by an Audit Committee or an equivalent body. In the Commission's environment, this role could be exercised either by the Audit Progress Committee alone ('Option A') or by the Corporate Management Board ('Option B').

Currently, the Commission's Audit Progress Committee has a limited mandate. An expansion of the Audit Progress Committee's mandate to include risk management ('Option A') would represent a considerable strengthening of its oversight role, particularly given that external members are independent from the Commission's management. However, the Audit Progress Committee already faces a number of challenges to exercising its existing mandate to the full within the limitations of the present set-up and resourcing, and an expanded mandate would only serve to compound these. Therefore, while this would be more in line with the reference frameworks, the success of an expanded mandate would require the Audit Progress Committee to be adequately equipped to deal with the increased responsibilities. With this in mind, the Internal Audit Service sets out in Recommendation no 4 proposals aimed at reinforcing the Audit Progress Committee function in order to strengthen the oversight exercised by the Audit Progress Committee.

If this strengthened oversight role were to be exercised by the Corporate Management Board ('Option B'), this would require expanding the Corporate Management Board's current oversight on the cross-cutting critical risks to include also the (Directorate-General-specific) critical risks which are not cross-cutting. There would need to be clear procedures allowing the Board to invite the responsible Directorate-General for discussions on their response to critical risks while ensuring that the responsibility for managing the risk continues to lie with the specific Directorate-General and their responsibility is not shifted to the oversight body. For this alternative scenario to be effective, the Corporate Management Board should also provide the Audit Progress Committee with meaningful, consolidated information on the critical risks as assessed by management to allow the Audit Progress Committee to make a cross-check to the Internal Audit Service's audit risk assessment and in turn to the audit plan to identify possible gaps between the two sources.

1.2Central Services (Secretariat-General and Directorate-General BUDG) should reinforce their role on risk management.

The Central Services should facilitate the sharing of best practices on risk management and provide support to those Directorates-General with less mature processes. More guidance should be provided to Directorates-General on cross-cutting risks and how to apply the concepts of 'risk tolerance' and 'materiality' when identifying and reporting critical risks, to guide Directorates-General on how to better link operational risks to the achievement of the Directorate's-General objectives and, in particular, where the latter are contributing to the Juncker priorities
[6](#footnote7)
. In addition, there needs to be guidance to support the new role envisaged under the revised Internal Control Framework for the 'Director in charge of Risk Management and Internal Control'.

The Central Services should establish a list of all critical risks. This list should be based on the critical risks reported by the individual Directorates-General and should be prepared in cooperation with the operational Directorates-General. The critical risks linked to the Juncker Priorities should be specifically identified. The resulting information should be reported to the Corporate Management Board and the Audit Progress Committee should have access to this information.

It is essential that the reinforced role of the Central Services is not perceived by the Authorising Officer by Delegation as diluting the responsibility of the Directorate-General responsible for managing the risk. Therefore, the Central Services should build in the necessary safeguards to ensure this, for example, by drawing attention to this fact in meetings, guidelines and minutes.

Audit Recommendation on Governance set-up

4.1 The APC should exercise greater oversight on the follow up of ECA audits, in line with its current mandate.

The Audit Progress Committee should exercise greater oversight on the follow up of European Court of Auditors audits, in line with its current mandate, but for this to happen the Directorate-General Budget should continue improving its reporting to the Audit Progress Committee on the follow-up of European Court of Auditors recommendations.

The Internal Auditor takes note that the Audit Progress Committee has recently started to examine the follow-up of the European Court of Auditors recommendations. In this context, the Directorate-General Budget prepared for the Audit Progress Committee Preparatory Group meeting on 27 September 2017 a more refined report on the follow-up of European Court of Auditors recommendations. It was concluded that further actions will be decided by the Audit Progress Committee in due time. It should be noted that the Directorate’s-General Budget role is to provide the relevant overview reports to the Audit Progress Committee while the responsibility for the follow-up and implementation of the recommendations lies with the Directorates-General.

4.2 The APC function should be further reinforced in order to provide more effective oversight.

To be more effective in its current advisory role and to be better prepared to accommodate any future changes, the Internal Audit Service recommends that the Audit Progress Committee function is further strengthened through either one or a combination of the following two options:

Option 1: A reinforcement of the Audit Progress Committee Secretariat through the addition of technically skilled and experienced EU officials drawn from across the Commission services. A reinforced Secretariat would contribute to the quality and quantity of the oversight needed, provide a tailored support service for external members and Cabinet members of the Preparatory Group and Commissioners, whilst ensuring the support capacity needed to enable the Audit Progress Committee to both fulfil all the tasks in its Charter and take on the additional tasks referred to in this report.

Option 2: A change in the basic structure of the Audit Progress Committee’s Preparatory Group, but at the same time retaining the current composition and Chair of the Audit Progress Committee itself in order to maintain the vital link to the College. As regards the composition of the Audit Progress Committee’s Preparatory Group, the secondment of a number of appropriately skilled, experienced Commission officials alongside externally-recruited experts to play a standing role as Preparatory Group members (the chair of the Audit Progress Committee’s Preparatory Group would be one of the seconded officials) should be considered. Cabinet members of Commissioners designated as Audit Progress Committee members would be debriefed after each Preparatory Group session to ensure transparency and to enable them to prepare their Commissioners for the meetings of the Audit Progress Committee.

Beyond this, consideration could be given to increasing the number of external members from three to four, a measure, which would be in line with the existing Audit Progress Committee Charter.

4.3 The mandates of the corporate (oversight) bodies should be updated

The respective mandates of the Audit Progress Committee (APC), the Corporate Management Board and the Group of Resources Directors (GDR) should be updated. For the Audit Progress Committee and the Corporate Management Board, this should be based on a decision of the College, in line with the Internal Audit Service recommendations. This should include clarifying the reporting mechanisms of the Corporate Management Board and the reporting lines of the Resource Directors Group.

4.4 The APC secretariat should be both administratively and functionally independent of the Internal Audit Service.  

To address the potential conflicts of interest in having the Audit Progress Committee’s secretariat located in the Internal Audit Service, the secretariat should be both administratively and functionally independent of the Internal Audit Service .

4.5 The Commission's 'Governance Statement' of October 2017 should be amended to reflect any changes resulting from implementing the accepted recommendations and communicated.

The revised Governance Statement should be amended to reflect necessary changes resulting from implementing Internal Audit Service recommendations contained in this report.

Once the 2017 'Governance Statement' is updated, Central Services should raise awareness within the Commission, including the College, on these governance arrangements.

In parallel, the Directorate-General Budget should adapt the 'Implementation guide' of the new Internal Control Framework to clearly reflect in section II ("Roles and Responsibilities in the implementation of Internal Control Framework in the Commission") in the Chart as well as in the text that:

- The 2nd line of defence in the Commission exists both at the local Directorate-General level and the central level

- The Central Services contribute to the 2nd line of defence from the corporate point of view by advising/supporting and monitoring the effective implementation of prescribed frameworks.

4.6 SG, Directorate-General BUDG and Internal Audit Service should cooperate more effectively in sharing knowledge and identifying best practices, while respecting each other's roles and in particular the independence of the Internal Audit Service.

Cooperation and coordination should, in particular, be further strengthened during the planning phase of the Internal Audit Service audit plan by sharing more actively knowledge on risks and during the Peer review exercise by coordinating more efficiently the comments on the Directorates'-General Annual Activity Reports.
[7](#footnote8)

Additional information provided by the Secretariat-General and the Directorate-General Budget, on the measures defined and/or implemented following the Internal Audit Service audit

The Secretariat-General and the Directorate-General Budget accepted all recommendations and developed an action plan in response to this audit which was assessed as satisfactory by the Internal Audit Service. The action plan incorporated, where applicable, the advice the Audit Progress Committee provided when discussing the follow-up to those recommendations which directly touch on its role and work. Some actions will require the endorsement of the College of Commissioners.

For several recommendations, follow-up action has already been taken or will be implemented shortly.

Notably, as regards the very important recommendations:

Risk management

The central services (Secretariat-General and Directorate-General Budget) will continue to provide risk management guidance to the Directors in charge of risk management and internal control (‘RMIC’). This will include: 1) facilitating the share of best practices; 2) providing support to DGs with less mature risk management processes; and 3) updating, where needed, the Risk Management Implementation Guide (e.g. on the application of concepts such as ‘cross-cutting’ risks, ‘risk tolerance’ and ‘materiality’ of critical risks).

The oversight and approach on risk management will be reinforced through the organisation of peer reviews to examine the critical risks identified by the Directorates-General. Where needed, meetings will be organised by families of DGs. In accordance with the decentralised governance structure of the Commission, Authorising Officers by Delegation will remain fully responsible for the identification and management of their critical risks.

Also the oversight role of the Corporate Management Board will be strengthened. It will review the list of critical risks and decide on a case-by-case basis on the need to invite the responsible Directorates-General for discussions of their response to the critical risks identified.

There will also be more extensive sharing of information on risk management with the Internal Audit Service and the Audit Progress Committee. The latter can use this information when assessing the audit plan of the Internal Auditor.

Governance set-up

The current Governance document was updated in the course of the audit in anticipation of this recommendation (C(2017)6915 of 11.10.2017). When appropriate, the Secretariat-General and the Directorate-General Budget will (1) propose future updates of the Governance document to the College and (2) raise awareness within the Commission on the Governance document.

The Secretariat-General and the Directorate-General Budget will submit for adoption by the College in the coming months a revised Communication on the Commission’s governance arrangements, proposing to review and update the mandates of the Commission’s corporate governance bodies (for example the Corporate Management Board and Group of Resource Directors).

As regards the Audit Progress Committee:

An updated charter of the Audit Progress Committee will be submitted for approval by the College reflecting the improvements identified to address the IAS recommendations.

- The Audit Progress Committee’s practice of examining the state of play of the implementation of the recommendations issued by the European Court of Auditors is expected to continue. The Directorate-General Budget will continue to make available for the Audit Progress Committee a report on the follow-up of the European Court of Auditors recommendations.

- The Audit Progress Committee Secretariat will be appropriately reinforced with technically skilled and experienced staff to ensure the effectiveness of the Audit Progress Committee and reinforce its oversight in key areas, namely through the work on the follow up of the recommendations of the European Court of Auditors related to the reliability of the 'EU consolidated accounts'.

- Adequate working arrangements will be put in place between the Internal Audit Service, the Audit Progress Committee Preparatory Group Chair and the Head of the Audit Progress Committee Secretariat, in cooperation with the Secretariat-General and the Directorate-General for Human Resources, to ensure that the identified risk of conflicts of interest is appropriately mitigated.

1.7.Audit on the production process and the quality of statistics not produced by Eurostat (ESTAT and Directorates-General ENER, FISMA, GROW and JUST)

Audit objectives and scope

The objective of the audit was to assess whether the Commission has in place an effective process to ensure the quality of statistics not produced by Eurostat (i.e. produced or acquired, and used, by Directorates-General and Services) to support its key policies.

The audit assessed in particular (1) Eurostat coordination role and the provision of support, advice and guidance to the services; and (2) the designed and implementation of adequate processes at the level of individual Directorates-General/Services for the production/acquisition and dissemination of statistics.

The audit was conducted in Eurostat (for it central role in the process) as well as in four operational Directorates-General ENER, FISMA, GROW and JUST.

There were no observations/reservations in the 2016 Annual Activity Reports of the audited Directorates-General that relate to the area/process audited.

The fieldwork was finalised on 18 December 2017. All observations and recommendations relate to the situation as of that date.

Strengths

(1)At corporate level

(2)Eurostat has developed "Methodological Guidelines to Commission Directorates-General to produce reliable estimates from sample surveys outsourced to private companies" for Directorates-General/Services, which are available to the operational services together with the Inventory.

(3)The need for Other Statistics are discussed between Eurostat and the operational Directorates-General in the context of the Annual Hearings;

(4)Eurostat manages and monitors the use of the methodological framework contracts for outsourced statistical methodological support, which are then used by Eurostat and other Commission Directorates-General and services.

(5)When requested by Directorates-General/Services, Eurostat provides methodological guidance and support (e.g. on the development of statistical surveys, for the preparation of the Terms of Reference for external acquisition of statistics and on data source issues).

(6)A dedicated Task Force "Statistical Products and Services" was established in 2017 with the aim of creating a "Service Catalogue" listing the statistical services offered by Eurostat to the Commission. The Task force will develop a service delivery model (including monitoring and customer satisfaction evaluation) and establish a service management model (including governance and funding aspects).

(7)In March 2017, Eurostat launched a new project on "Rationalisation of purchasing data from external sources", which is designed to achieve synergies in the Commission.

(8)At operational Directorate-General level

(9)The Internal Audit Service identified a number of good practices at the level of the operational Directorates-General audited, which could be adopted by other Directorates-General/Services to further improve the quality of the processes for planning, producing or acquiring, and disseminating statistics not produced by Eurostat. While those best practices are described for each of the Directorates-General audited in their respective Annex 4 of the Final Audit Report, the Internal Audit Service wishes to highlight the following:

(10)Some operational Directorates-General have developed internal expertise in data analytics, which is used (to various degrees depending on the Directorate-General) when producing and acquiring statistics. In one case, experts from the Directorate-General regularly participated in the evaluation committees for tender procedures for provision of statistics launched by other Directorates-General.

(11)One Directorate-General systematically included the following disclaimer statement when publishing statistics not produced by Eurostat: "This report (…) aims at enhancing public access to information […..]. Our goal is to keep this information timely and accurate. If errors are brought to our attention, we will try to correct them. However, the Commission accepts no responsibility or liability whatsoever with regard to the information contained in this publication."

(12)One Directorate-General included a footnote for each graph/chart with a description of the data source, as well as a reference to methodological notes used in its reports.

Major audit findings

The Internal Audit Service identified three very important issues at corporate level and one very important issue at operational Directorate-General (Directorate-General GROW) level:

ESTAT

Framework for statistical production in the Commission and Eurostat's coordination role in the development and production of statistics by other Commission services

The current framework for statistical production in the Commission, as established by the 2012 Commission Decision, does not define a quality assurance framework for statistics not produced by Eurostat and does not provide a specific role for Eurostat in this respect. Furthermore it does not set clear obligations for the Directorates-General to inform Eurostat about their statistical production. Finally, Eurostat does not coordinate the development and production of the statistics in the Commission effectively.

Completion of the Statistical Inventory and Masterplan

The Statistical Inventory, maintained by Eurostat and updated by operational Directorates-General, does not provide a complete and reliable overview of the statistics that are produced or acquired and disseminated by the Commission Services. Since it is not complete and not always fully correct, Eurostat cannot effectively steer the planning and coordination of statistical activities as required by the 2012 Commission Decision. In addition, Eurostat had not implemented a Statistical Masterplan including the statistics produced by Eurostat as well as the Other Statistics.

Referencing and use of a disclaimer when publishing Other Statistics

Eurostat has not issued guidance or instructions to the Directorates-General on how to reference the statistics used in official publications and how to use a disclaimer when presenting statistics for which the Directorates-General cannot guarantee the accuracy. In addition, there were inconsistent practices at Directorate-General level in terms of referencing and use of a disclaimer.

GROW

Management of the statistical process by DG GROW

Unit 01 of Directorate-General GROW has not been formally identified as a 'knowledge and competence centre' in statistical matters, responsible for coordinating and monitoring the statistical production and acquisition process at Directorate-General level as well as for the providing advice. Moreover, the Directorate-General has not issued specific guidance/instructions for the staff in the operational units which are involved in the collection of data, production and dissemination of statistics. Finally, there is no systematic use of the expertise available within Eurostat and no specific training path for developing the expertise of the staff in operational units.

Recommendations

Framework for statistical production in the Commission and Eurostat's coordination role in the development and production of statistics by other Commission services

Eurostat should address the limitations of the 2012 Commission Decision and to take the necessary steps to coordinate effectively the development and production of statistics in the Commission and to prepare a quality framework for the statistics different from the European ones.

Completion of the Statistical Inventory and Masterplan

Eurostat should revise the structure of the database, establish a formal and effective review process and define the purpose and format of the Statistical Masterplan and its integration into Eurostat's planning process.

Referencing and use of a disclaimer when publishing Other Statistics

Eurostat should prepare and provide guidance to the Directorates-General on how to clearly reference statistics and explain which disclaimer has to be used if the Directorates-General cannot guarantee the accuracy.

Directorate-General GROW 

Directorate-General GROW should define a process for statistics management with clear central responsibility for coordinating the delivery of activities in this domain, provide guidelines/instruction to the units involved in the statistical production/ acquisition, ensure that the available expertise, in house or in Eurostat, is adequately exploited and promote attendance at specific training courses to increase the expertise of staff involved in the statistical production.

Additional information provided by ESTAT and Directorate-General GROW on the measures defined and/or implemented following the Internal Audit Service audit

Eurostat already established a portfolio of statistical services and published them in a transparent and easy-to-access online catalogue available to all Commission Directorates-General. Furthermore, Eurostat will establish a reference quality framework for other Directorates-General for "Other Statistics" that includes guidance and checklists on production and acquisition procedures, methodologies and characteristics of data produced /acquired.

Eurostat will elaborate, in cooperation with the network of DGs statistical correspondents, a clear and easy-to-use definition of statistics, clear and detailed instructions on the types and nature of items to be included or excluded from the Statistical Inventory, including those related to future needs not yet covered by current production or acquisition. Furthermore, Eurostat will develop clear instructions on how to fill in the different fields of the statistical inventory, including those related to financial and contractual information and to the end year.

Eurostat already started to develop guidance on referencing statistical data, coming from Eurostat or from other sources. Additionally Eurostat will develop guidance on types of disclaimer DGs could use for warning users about quality aspects of the statistical data presented.

Directorate-General GROW will take by end 2018 the following actions:

- Directorate-General GROW 01 will be reaffirmed in its role of the official liaison unit between Directorate-General GROW and Eurostat (a so called “mirror unit”). For that purpose, a note will be prepared by GROW 01 in which its role and responsibility will be explained with regard to different Eurostat related activities (Inventory, annual hearings, production of data, acquisition of data etc.).

- Directorate-General GROW will prepare guidelines that will set out the methodological framework for assuring the quality of the statistics produced/acquired by Directorate-General GROW. These guidelines will include contact points within GROW and Eurostat and instructions on when specific expertise is needed from GROW.01 or Eurostat in the context of the procurement process or assessment of contractual deliverables.

- GROW 01 will create a dedicated page on GROWNet for statistics where the above mentioned guidelines will be available as well as presentations on data/statistics and good practice examples will be shared

- Directorate-General GROW will deliver twice a year a full day training course on Introduction to Statistics and Indicators.

2.Agriculture, natural resources and health

2.1.Audit on Directorate-General AGRI's management of agricultural market crises

Audit objectives and scope

The objective of the audit was to assess whether Directorate-General AGRI has put in place adequate processes for managing agricultural market crises. In particular, the audit assessed whether Directorate-General AGRI has developed systems to a) forecast and/or prevent agricultural market crises to the extent possible, b) be able to react effectively and in a timely manner to crises and c) monitor the effects of measures taken to address crises and draw lessons for the future.

The audit covered Directorate-General AGRI's processes for managing agricultural market crises. As the legislator has not defined what an agricultural market crisis is in the Regulation establishing a common organisation of the markets in agricultural products, (Regulation (EU) 1308/2013), for the purpose of the audit, "agricultural market crisis" refers to severe market disturbances that have led but are not limited to the adoption of temporary "exceptional measures". This is in contrast to regular market management measures that are taken following normal market movements.

It covered the following processes:

·Directorate-General AGRI's approach and internal processes for forecasting market crises and reacting on a timely basis (e.g. use of market monitoring tools, risk management process, rationale for proposing mitigating measures);

·Directorate-General AGRI's ability to adequately support the decision making process in the event of a crisis, in terms of procedures, availability of necessary staff, knowledge and budget.

·Directorate-General AGRI's arrangements following a crisis to move into the phasing-out period, monitor the markets and draw lessons for the future.

Directorate-General AGRI's 2015 Annual Activity Report contains a reservation relating to temporary exceptional support measures in the fruit and vegetables sector and concerns Poland.

The fieldwork was finalised on 4 April 2017. All observations and recommendations relate to the situation as of that date.

Strengths

The auditors acknowledged the efforts made by Directorate-General AGRI in responding to the agricultural market crises experienced since mid-2014. The audit identified the following strengths in particular:

a)
   Responding to crises situations implies a certain pressure on Directorate-General AGRI's staff to react on time to tight deadlines and those involved in the management of the dairy, livestock and fruit and vegetable markets in particular have demonstrated high levels of commitment and have worked under considerable pressure for a long time, including working during the normal holiday periods.

b)
   Directorate-General AGRI has put in place a variety of monitoring tools. These include dashboards presenting key data relating to particular agricultural markets, market observatories that gather together experts from the field and which disseminate market data and short-term analysis, including the minutes of the meetings of their various economic boards. This information is publicly available and regularly updated on the Europa website.

c)
   During the period audited, Directorate-General AGRI prepared comprehensive information notes for the Commissioner, backed up by extensive analyses (including graphs and historical data) of available information for the sectors and measures concerned. These notes, together with the reports of the meetings held at cabinet level, are duly handled in accordance with document management rules.

Major audit findings

The Internal Audit Service identified one very important issue:

Risk management and performance follow-up in the context of agricultural market crises

To address crisis situations Directorate-General AGRI has used a range of instruments available under the Common Agricultural Policy (CAP). However, certain measures pose particular management and control risks as they do not sufficiently target the actual problem/product or because they allow very high levels of flexibility in defining the exact scope and design of the aid to their farmers. These measures can also have a knock-on effect on other sectors or policies. The Internal Audit Service acknowledged that the final design and adoption of the crisis packages is ultimately influenced by political decisions that are largely outside the control of Directorate-General AGRI. However, operational and management considerations can help to inform these political decisions. In this respect, the Internal Audit Service found that in practice Directorate-General AGRI has made only very limited analyses of the management implications of the various crisis packages implemented to date and that the related risks have not been adequately reflected in Directorate-General AGRI's risk management process. Moreover, the follow-up given to crisis measures has so far concentrated more on reporting the uptake of the measures involved and on the main sectors impacted, but is lacking in terms of the analysis on the potential broader impact including on other sectors/policies.

Recommendation

Directorate-General AGRI should ensure that risks stemming from the adopted measures for its management and control system are properly taken into account in its risk management process. In addition, in following up the implementation of crisis measures, it should analyse the role of all CAP tools used and their structural impact, including their impact on other farming sectors and policies. This should help Directorate-General AGRI to propose adjustments or to discontinue existing measures or even propose policy changes. Finally, it should undertake an evaluation of the prevention and management of crises aimed at assessing the appropriateness of the methods, tools and measures used as soon as possible.

Additional information provided by Directorate-General AGRI on the measures defined and/or implemented following the Internal Audit Service audit

In response to the Internal Audit Service recommendations, Directorate-General AGRI has undertaken several actions to enhance the coordination inside Directorate-General AGRI to better react to future crises including preparing a guide of procedures and setting up of a task force. A guide of procedures has been adopted at the end of 2017. It established (1) a taskforce ready-to-act in case of new agricultural market crises with large economic impact and (2) a periodical review mechanism (every six months) of the different exceptional measures in place for market reasons and of the main risk scenarios identified for agricultural markets. This periodical review mechanism will report to the RMIC of DG AGRI (who leads the above mentioned taskforce) and will feed the annual risk assessment exercise of DG AGRI In addition, a study on “improving crisis prevention and management criteria and strategies in the agricultural sector” is currently on-going. It aims at providing a critical review of all aspects related to the crisis prevention and management mechanisms in the Common Agricultural Policy.

2.2.Audit on Directorate-General AGRI's implementation of RDPs

Audit objectives and scope

The objective of the audit was to assess whether Directorate-General AGRI's internal processes for monitoring the implementation of Rural Development Programmes (RDP) are well designed and consistently implemented, whether they ensure that weaknesses in RDP implementation are detected and addressed in time and whether they reduce (as much as possible) the risks of errors and/or poor performance.

The audit covered Directorate-General AGRI's management processes for monitoring the implementation and performance of RDPs.

The audit took place during the initial phase of the implementation period and focused on the processes Directorate-General AGRI has put in place to ensure its supervisory role for the implementation of the Rural Development (RD) policy under shared management. It did not cover the ex-post audit processes, which were included in the scope of a separate Internal Audit Service audit on the Directorate's-General control strategy.

In Directorate-General AGRI's 2016 Annual Activity Report, a reservation was issued in respect of significant weaknesses in the underlying transactions (legality and regularity) of RD expenditure (ABB 04) for 20 Paying Agencies, comprising 19 Member States.

The fieldwork was finalised on 28 November 2017. All observations and recommendations relate to the situation as of that date.

Strengths

The Internal Audit Service recognised the ongoing efforts made by Directorate-General AGRI to improve their internal processes for monitoring the implementation of RDPs. In particular, the audit identified the following strengths:

a)
   Directorate-General AGRI has invested in knowledge management in RD policy and programming:

The internal IT knowledge management tool, RD Wiki, which is accessible to all Directorate-General AGRI staff, has been subject to further development. It contains the applicable legislation as well as any related legal interpretations. Guidance documents and technical explanations are posted in RD Wiki to share knowledge and ensure a consistent approach. The Directorate-General also organises regular thematic training sessions on specific issues (“Q&A sessions”) for RD staff.

Directorate-General AGRI has drafted guidance documents for Member States (MS) that are shared online. It also organises seminars and/or networking events on a regular basis that bring together MS representatives. 

b)
   Directorate-General AGRI has designed specific tools and mechanisms to strengthen its internal monitoring and supervision of the RDP implementation:

The responsible geographical desk officer prepares a working document in English and/or French summarising the main points of an amendment, which in turn helps to facilitate the consultation process.

Once the Annual Implementation Report have been received and analysed, annual overview meetings are held for each MS. They bring together the geographical units and the responsible director and are chaired by the Deputy Director-General responsible for rural development policy. They aim to take stock of the progress of RDP implementation to prepare the Annual Review Meetings (ARM) with the MS that take place every autumn.

Major audit findings

The Internal Audit Service did not identify any critical or very important issues.

2.3.Audit on Directorate-General AGRI's control strategy for the CAP 2014-2020

Audit objectives and scope

The objective of the audit was to assess whether Directorate-General AGRI has adequately designed and implemented its control strategy to be able to provide assurance on the implementation of the Common Agricultural Policy (CAP) 2014-2020 budget in compliance with EU rules.

The audit focused on the following processes:

·Processes for handling Member State (MS) reporting requirements related to their management and control system;

·Processes for managing conformity clearance audits/inquiries, as well as audits/inquiries in the context of the financial clearance procedure;

·Processes for following up deficiencies identified in the management and control system of the MS and ensuring remedial action (including financial corrections).

The fieldwork was finalised on 13 October 2017. All observations and recommendations relate to the situation as of that date, except for some limited additional testing which was performed following Directorate-General AGRI's comments to the findings validation table.

Strengths

The Internal Audit Service recognised the efforts and commitment made by Directorate-General AGRI to design and implement a robust system for the control strategy for the CAP 2014-2020. The Internal Audit Service noted that the processes have significantly improved compared to what it had observed in its audits of Directorate-General AGRI's control strategy for the CAP 2007-2013. In particular, the Internal Audit Service identified the following strengths:

a)
   Directorate-General AGRI has adopted an audit strategy for the CAP 2014-2020 which details the audit approach and sets objectives for the audit activities as well as indicators to follow-up their implementation.

b)
   Directorate AGRI-H "Assurance and Audit" has developed detailed procedures for the implementation of the audit activities, which are set out in a comprehensive audit manual and regularly updated. In December 2015 it also put in place a quality assurance policy.

c)
   Directorate AGRI-H's procedures include a strong monitoring of the audit activities which has allowed it to:

- implement the audit work programme as planned;

- tackle the backlog of conformity inquiries which had accumulated in the past. By the end of 2016, all contradictory procedures related to audits conducted in 2013 or before had been closed;

- prepare the Commission decisions adopting the financial corrections in a timely manner.

d)
   Directorate AGRI-H has a Financial Correction Board which examines all the proposals of the audit units before the closing of the contradictory procedure in order "to ensure that they are legally sound, proportionate and in line with the established administrative practices of the Directorate and consistent with other cases." Detailed minutes of the Financial Correction Board are prepared recording its decision and recommendations regarding each inquiry.

Major audit findings

The Internal Audit Service identified one very important issue:

Financial corrections

The Internal Audit Service identified a number of weaknesses in the process for calculating financial corrections and at the time of the fieldwork, Directorate-General AGRI was not in a position to confirm that these are not systemic in nature. In one of the cases examined, Directorate-General AGRI did not apply the financial correction to all the expenditure concerned. This was due to a technical error caused by modifications in 2016 in the matches of budget codes and audit fields attached to the audits in the IT system used by Directorate-General AGRI (COMBO). The checks that Directorate-General AGRI had put in place did not detect the error. Subsequent to the Internal Audit Service’s finding, Directorate-General AGRI found three other similar errors. The calculation for offsetting overlapping financial corrections also contained a number of errors, including one case where the offsetting was significantly larger than it should have been. All detected errors are either corrected or under correction.

Directorate-General AGRI informed the Internal Audit Service that it had set up internal working groups to look into these issues. Their work was still ongoing when the fieldwork was finalised.

Recommendation

Based on the outcome of the working groups' analysis, Directorate-General AGRI should strengthen its procedures for the calculation of financial corrections and update the audit manual where necessary.

Additional information provided by Directorate-General AGRI on the measures defined and/or implemented following the Internal Audit Service audit

By the time the audit report was finalised, Directorate-General AGRI had made significant efforts to address these issues. With one exception that was not material, all errors detected had been either corrected or were under correction. In addition, Directorate-General AGRI had set up internal working groups to further analyse the issue and Directorate-General AGRI's audit Directorate is looking at how to strengthen its procedures to address such matters.

The internal working groups established by DG AGRI have already presented their analysis and tabled proposals for addressing the issues (including guidelines, checklists, training and IT solutions). These proposals are currently being implemented.

2.4.Audit on CHAFEA's management and control system for the implementation of the measures for the promotion of agricultural products

Audit objectives and scope

The objective of this audit, which took place at an early stage of CHAFEA taking over the management of the promotion activities, was to assess the design and implementation of CHAFEA's control system and management processes for implementing promotion measures for agricultural products to ensure that the proposals selected best meet the objectives of the promotion policy and to ensure the legality and regularity of the financial transactions.

This audit covered, in particular:

·The design and implementation of controls regarding the preparation of calls for proposals – from the adoption of the annual work programme to the publication of the calls up to the submission deadline (i.e. including guidance to applicants), for calls launched in 2016 and 2017;

·The design and implementation of controls regarding the selection and evaluation process from reception of the proposals up to communication of the ranking lists to Directorate-General AGRI and the communication of selected proposals to Member States (for simple programmes) or up to the signature of grant agreements (for multi programmes);

·The design and implementation of controls for pre-financing payments for selected multi programmes in the 2016 call;

·The design of the controls for the interim and final payments of the programmes, as well as the monitoring of the implementation for multi programmes;

·The design and implementation of the controls for procurement procedures related to the 2016 high-level mission to South East Asia and the preparation of the 2017 high level mission to Canada, as well as payment procedures for the former;

·CHAFEA's preparations for the replacement of the current framework contract for the organisation of high-level missions and participation in trade fairs;

·The design and implementation of cooperation and reporting arrangements between CHAFEA and Directorate-General AGRI as set out in the Memorandum of Understanding.

The fieldwork was finalised on 23 June 2017. All observations and recommendations relate to the situation as of that date.

Strengths

The auditors identified the following specific strengths:

a)
   Even though the unit was built from the ground up, starting in August 2015 (before the unit was officially established), with one person and has grown since then to 10 posts by 
  
31 December 2016, it quickly became fully operational, largely due to the skills and commitment of the staff concerned. The publication and management of the first calls took place as planned.

b)
   CHAFEA AGRI Unit has been proactive in drawing lessons from their experience from the first campaign of calls for proposal in 2016. On the basis of shortcomings identified, CHAFEA AGRI Unit has corrected the guidance documents and methods put in place to manage the 2017 campaign.

Major audit findings

The Internal Audit Service did not identify any critical or very important issues.

2.5.Audit on LIFE + phasing out in Directorate-General ENV

Audit objectives and scope

The objective of the audit was to assess the adequacy of the design and the efficiency and effectiveness of the governance, risk management and control process put in place by 
  
Directorate-General ENV for the management of the phasing out of LIFE+ projects.

More specifically, the audit assessed whether the Directorate's-General internal control system put in place for the audited processes provided reasonable assurance for achieving the following objectives:

·Economy, efficiency and effectiveness of operations;

·Adequate management of risks related to legality and regularity of underlying transactions, taking into account the nature of the payments concerned.

The audit covered 2016 financial transactions, in particular:

The effectiveness of the internal control processes in ensuring the legality and regularity of the financial transactions and the roles of the different actors in the financial circuit as regards:

·Mid-term pre-financing payments;

·Final payments;

·Additional payments;

·Recovery orders: recovery of pre-financing at the final payment stage and recovery of amounts as a result of the implementation of ex post audits;

·De-commitments;

·The management of amendments to the grant agreement leading to an extension of the project duration and their compliance with the applicable legal and contractual provisions;

·The monitoring and reporting on the progress of the phasing out of LIFE+ projects and the archiving of closed files.

Strengths

The auditors recognised the ongoing efforts made by Directorate-General ENV to manage the phasing out of the programme LIFE+ in the context of an increasing workload linked to the current staff reduction. A number of strengths have been identified in the course of the audit, in particular:

a)
   Directorate-General ENV has made significant efforts to limit payment delays: in 2016, 3.92% of all Directorate-General ENV's payments were paid late in comparison with legal deadlines. This represents a considerable improvement compared to a figure of 12.5% in 2013.

b)
   The yearly detected error rate resulting from the sampled LIFE project submitted to ex-post audits has gradually decreased from 2.27% in 2012 to 0.44% in 2016.

Major audit findings

The Internal Audit Service identified one very important issue:

Recovery orders and recovery context

The audit identified a number of weaknesses in the implementation of the recovery order process: inconsistencies were noted in the time given to beneficiaries to reply to the pre-information letter, there were delays at key stages in the treatment of recovery orders and a lack of effective monitoring and follow-up. Moreover, the auditors found deficiencies in the encoding of specific information related to recovery orders in ABAC.

Recommendation

Directorate-General ENV should provide beneficiaries consistently and equitably with sufficient time for replying to pre-information letters. Moreover, Directorate-General ENV should strengthen the monitoring of the recovery process to ensure that recovery orders are treated promptly. Finally, Directorate-General ENV should implement the Directorate’s -General Budget instructions on encoding the recovery context.

Additional information provided by Directorate-General ENV on the measures defined and/or implemented following the Internal Audit Service audit

The recommendations made on this audit have been addressed and a follow-up audit by the Internal Audit Service is planned in July 2018.

New procedures have been introduced in order to strengthen the monitoring of the recovery process, which is also followed through IT tools. In addition, the financial officers of the LIFE unit have been put into disposal at ENV.A5, ENV's Finance Unit, to ensure close collaboration between financial actors on the remaining LIFE legacy files and their proper closure. This involves the finalisation of all LIFE+ grant agreements established, the final payments that need to be done and the respective de-commitments when needed. Finally, trainings have been organised on the "recovery context", while the Directorate-General ENV accountant is further monitoring this.

Directorate-General Environment is progressively implementing the agreed with the Internal Audit Service action plans and taking measures to assure the mitigation of any residual risks that could potentially affect one or several internal control principles and/or components.

2.6.Audit on monitoring and enforcement of EU environmental law in Directorate-General ENV

Audit objectives and scope

The objective of the audit was to assess whether Directorate-General ENV has put in place an adequate internal control system that ensures effective and efficient monitoring and enforcement of EU environmental law.

The scope of the audit included a review of the range of procedures, guidance, arrangements and mechanisms used by Directorate-General ENV to monitor the timely, correct and complete implementation and enforcement of EU law. It notably covered the internal organisation of Directorate-General ENV related to the handling of complaints and infringements procedures. The audit focussed on the general processes exercised by Directorate-General ENV to ensure the effective application of EU environmental law.

There were no reservations in Directorate-General ENV's 2016 Annual Activity Report that relate to the processes audited.

The fieldwork was finalised on 20 March 2017. All observations and recommendations relate to the situation as of that date.

Strengths

The Internal Audit Service found that Directorate-General ENV has a proactive approach to supporting the proper transposition of environmental law, though a combination of preventive and corrective actions. The Internal Audit Service also recognised the ongoing efforts made by Directorate-General ENV to improve the treatment of complaints and infringements. In particular, the audit identified the following strengths:

a)
   Creation of Task Forces: As early as 2005, Directorate-General ENV put in place thematic Task Forces composed of representatives from legal and technical/policy units, which contributed to improving the internal coordination and the setting of a strategic overview in key environmental sectors.

b)
   Horizontal infringement cases: In order to be more effective in the handling of infringements, Directorate-General ENV gives priority to tackling structural problems in Member States by grouping together cases concerning the same subject matter and then launching "horizontal cases" addressing systemic implementation problems. This has helped to reduce the number of open infringements.

c)
   Package Meetings: These are meetings between Directorate-General ENV and Member States' representatives. They take place annually and involve the Management of Directorate-General ENV (legal Director and legal and/or technical Heads of Units) and technical experts at national level. They discuss the main complex on-going complaints, EU Pilot and infringement cases. Overall, these meetings are considered to be very effective in promoting a faster and easier resolution of cases when compared to cases which are referred to the Court of Justice.

Major audit findings

The Internal Audit Service identified two very important issues:

Complaints handling

Directorate-General ENV continues to experience considerable difficulties in respecting the Commission deadline of 15 working days for the acknowledgement of receipt of a complaint and the 12-month benchmark for the closure of the complaint and/or issuance of a formal notice. Currently, there is no formal, internal operational guidance tailored to Directorate-General ENV's specific needs explaining how complaints should be handled, in particular in order to facilitate the distinction between systemic and individual complaints. There is also no repository of individual complaints not followed up at the time of their submission, but which could, through repetition, lead to structural cases. Moreover, in terms of organisation, the handling of complaints is still only partially centralised and needs to be streamlined further. Finally, there are no quantitative indicators aimed at helping to measure Directorate-General ENV's performance on the achievement of key targets.

Enforcement of EU environmental law

The Internal Audit Service identified weaknesses regarding the measurement and reporting of Directorate-General ENV internal performance, including case handlers' workload and the work and results of the Task Forces. Furthermore, the current mandate and working modalities of the Task Forces do not sufficiently reflect their key coordination and knowledge building roles. Finally, the Internal Audit Service noted that due to the difficulties in finding staff with the necessary skills, Directorate-General ENV had to use Seconded National Experts (SNEs) on legal cases involving their own country of origin. 

Recommendations

Complaints handling

Taking into account the recent Commission communication, Directorate-General ENV should develop a complaints handling internal procedure that includes criteria aimed at helping identify potentially systemic issues. It should also extend the use of more targeted complaint forms (subject to clarification from the Secretariat-General) and further streamline case handling administrative tasks (such as monitoring of acknowledgements of receipt). Moreover, Directorate-General ENV should reinforce the monitoring and reporting on complaints handling by developing appropriate Key Performance Indicators and reporting more regularly on the state of play. Finally, Directorate-General ENV should ensure that key information on cases that are not pursued at the time, is kept centrally so this can be easily retrieved in order to help identify structural cases.

Enforcement of EU environmental law

Directorate-General ENV should strengthen its monitoring and reporting on the enforcement of EU law by defining internal quantitative targets to measure progress towards the achievement of corporate targets and consider reporting these in its management documents. It should also periodically report the results of the coherence exercise to the Management Board and strengthen the monitoring of the case handler workload to help avoid potential bottlenecks.

Directorate-General ENV should review the mandate and working modalities of the Task Forces to better reflect their coordinating and knowledge building roles. This should include the need to periodically analyse the cases examined by the Task Forces, including sensitive or complex cases as well as those cases highlighted in the coherence exercise calling for urgent steps to be taken. The results of the work of the Task Forces should be communicated to senior management at least once a year. Directorate-General ENV should also avoid using SNEs to handle legal matters in situations where they are working alone when dealing with their country of origin.

Additional information provided by Directorate-General ENV on the measures defined and/or implemented following the Internal Audit Service audit

Actions to address the two recommendations rated as "very important" have now been fully put in place and are being implemented by Directorate-General ENV. A number of supporting documents have been submitted to the Internal Audit Service to demonstrate the implementation and for Internal Audit Service follow-up and assessment. The actions carried out include:

a) Complaints forms are available on Directorate-General ENV internet.

b) An updated mandate for the implementation and working modalities that apply to task forces has been prepared.

c) Discussions with the hierarchy and Commissioner/Cabinet are being scheduled regularly for each sector/Task Force.

d) The most relevant benchmarks and statistical elements have been selected, and internal quantitative and qualitative KPIs have been prepared, which will be used to internally monitor the performance of work. These KPIs can be used for assessing performance in the context of the semester 'coherence meetings' and for reporting to the Directorate-General Management and/or Commissioner.

Following the audit, SNEs are no longer handling legal matters alone or un-supervised in cases where they would be dealing directly with their country of origin.

Within the specificities of its legal framework, DG ENV further improved its handling of complaints and streamlined the administrative tasks relating to complaints handling.

2.7.Audit on Directorate-General SANTE’s food safety crisis preparedness

Audit objectives and scope

The objective of the audit was to assess whether Directorate-General SANTE has put in place adequate processes for its preparedness to react to food safety crises.

In particular the audit assessed whether Directorate-General SANTE:

·Has a "general plan" for crisis management and supporting procedures that provide the necessary specifications to react to and manage a food crisis,

·Maintains the "general plan" and supporting procedures to ensure that they are fit for purpose;

·Coordinates adequately with stakeholders.

The audit covered the following processes:

·Directorate-General SANTE's "general plan" for food crisis and (related) supporting (standing) operating procedures for crisis preparedness and management as well as the processes for reviewing them;

·Directorate-General SANTE's arrangements for maintaining the "general plan" and supporting procedures in Directorate-General SANTE as fit for purpose;

·Directorate-General SANTE's internal coordination processes and those with other stakeholders in relation to food crisis preparedness and management as well as with respect to the potential impact of such a crisis to other EU policies.

The scope of this audit also included some actions that were considered as not fully implemented in the Internal Audit Service follow up on the ex-IAC "Audit on business continuity in Directorate-General SANTE".

There were no reservations in the 2016 Annual Activity Report of Directorate-General SANTE that relate to the process audited.

The fieldwork was finalised on 15 November 2017. All observations and recommendations relate to the situation as of that date.

Strengths

The auditors identified the following strengths in relation to Directorate-General SANTE's preparedness for a food safety crisis. In particular:

a)
   Directorate-General SANTE's crisis management team is composed of competent and committed colleagues who have gained experience in managing prior incidents that included handling situations involving certain pressure and requiring coordination with other stakeholders.

b)
   In March 2015 Directorate-General SANTE produced an overview report on emergency preparedness following a series of fact-finding missions carried out in five Member States (MS). They were able to identify good practices and lessons learned which come from real cases in the MS.

Major audit findings

The Internal Audit Service identified two very important issues:

Adequacy of the "general plan" and related mechanisms to respond to food safety crises

The Internal Audit Service found that that the "general plan" for food crisis and the related procedures and arrangements have not been updated on a regular basis. As a result, there were some inconsistencies in the roles of staff involved in food safety crises in Directorate-General SANTE and in the associated business continuity and crisis management procedures. Furthermore, there were only two staff members directly responsible for managing food-related incidents and related crises, which might be insufficient in the event of prolonged and/or simultaneous crises situations. The Internal Audit Service also found gaps in the method for communicating food safety crises as well as ensuring consistency and complementarity with related actions that are under the responsibility of EU Agencies (EFSA and ECDC). Also, the list of MS crisis coordinators had not been updated since November 2014 and these crisis coordinators do not meet on a regular basis to exchange ideas and promote understanding of their role. Finally, Directorate-General SANTE lacked the necessary procedures to allow its food safety crisis management team to better use the information contained in MS contingency plans to be able to, if appropriate, propose harmonised rules.

Exercising the "general plan" in practice

Although Directorate-General SANTE has gained experience in managing serious food safety incidents since the establishment of the "general plan" in 2004, the arrangements for crisis management have been tested only once since then (in 2013). Even then, this exercise did not actually involve the majority of the main stakeholders responsible for crisis management at MS and Commission levels. In addition, pending what is already a significantly delayed revision of the "general plan", at the time of the audit Directorate-General SANTE had no concrete plans in place for exercising the "general plan" (together with its related procedures).

Recommendations

Adequacy of the "general plan" and related mechanisms to respond to food safety crises

In order to ensure that Directorate-General SANTE is effectively and efficiently prepared for a food safety crisis, it should:

·Update the relevant operating procedures for crisis management, without delay, and communicate them to all Directorate-General SANTE staff involved; update the relevant staff job descriptions and set up redeployment arrangements in line with existing business continuity procedures. Request MS to update the list of crisis coordinators (including alternates) and remind them of their role in crisis management;

·In parallel with the on-going revision of the "general plan", define the communication tasks of the crisis coordinators and issue guidelines on how and what to communicate in the event of a food/feed safety crisis situation. Clarify with the European Food Safety Authority and the European Centre for Disease Prevention and Control how the specific arrangements for rapid outbreak assessments would be applied in cases of food safety crises;

·As part of the business continuity procedures, ensure that staff involved in food/feed crisis management receive relevant training and participate in business continuity exercises to acquire and maintain high levels of competence in implementing the business continuity procedures;

·Encourage MS to share information on their contingency plans. Design internal working arrangements to ensure that the food safety crisis management team is able to make use of the information regarding those plans so that Directorate-General SANTE may propose harmonised rules when appropriate. In addition, follow up instances of potential non-compliance with the applicable legislation, as identified in MS contingency plans.

Exercising the "general plan" in practice

Directorate-General SANTE should develop a multi annual plan for exercising and maintaining the "general plan". This plan should be based on identified needs and involve key stakeholders as appropriate in function of their roles and responsibilities.

Additional information provided by Directorate-General SANTE on the measures defined and/or implemented following the Internal Audit Service audit

Directorate-General SANTE accepted all recommendations and produced an action plan in January 2018. Most of the actions are already on-going and are expected to be completed in 2018.

As regards the adequacy of the "general plan" and related mechanisms to respond to food safety crises, Directorate-General SANTE is in the process of preparing a Commission Decision on a general plan for crisis management in the field of the safety of food and feed. The external consultation with Member States and EFSA on the draft Commission Decision is expected to be launched in the first half of 2018. Subsequently, the existing Standard Operating Procedures will be adapted to experience learnt. In addition, the next meeting of crisis coordinators will address the role of Member States crisis coordinators.

As regards the exercise of the "general plan" in practice, Directorate-General SANTE plans to conduct an exercise in late 2018, will identify the needs on the basis of lessons learned and discussions with the Member States crisis coordinators. The needs analysis will feed into the design of subsequent exercises to address emerging issues as well as the timing and frequency of such exercises.

3.Cohesion

3.1.Audit on policy and funding for youth employment in Directorate-General EMPL

Audit objectives and scope

The objective of the audit was to assess whether Directorate-General EMPL has put in place effective mechanisms that ensure consistency between policy initiatives and objectives and EU funding in the area of youth employment.

The audit focused on the following three areas:

·The adequacy of the processes for youth employment policy design and for youth employment funding to ensure that policy design and budget implementation in these areas are adequately aligned so that they support and reinforce each other;

·The adequacy of the alignment between the processes for coordinating and monitoring policy and funding in the area of youth employment so that they support and reinforce each other;

·The effectiveness of current mechanisms for reprogramming or reallocation of funds in the area of youth employment.

The 2016 Annual Activity Report of Directorate-General EMPL contains a reservation on the management and control systems for three European Social Funds (ESF) / Youth Employment Initiative (YEI) operational programmes (OPs) in Bulgaria, Croatia and Italy for the 2014-2020 programming period. The reason for the reservation was due to deficiencies in the management and control systems set up for the Common Provisions Regulation (CPR) for the European Structural and Investment Funds (ESIF).

The fieldwork was finalised on 4 December 2017. All observations and recommendations relate to the situation as of that date.

Strengths

The auditors recognised the ongoing efforts made by Directorate-General EMPL to strengthen the link between funding and policy activities related to youth employment. More specifically:

a)
   Coordinated approach to youth employment policy

Since 2013, the link between youth employment policy and EU funding has been significantly strengthened through the Youth Guarantee policy recommendation, supported by the YEI as a dedicated funding resource, which is considered to be an innovative approach. The youth employment policy is further supported through policy coordination and surveillance in the context of the European Semester, including policy recommendations to the Member States (MS) (Country Specific Recommendations – CSRs). Various units across Directorate-General EMPL, including Unit A1 (European Semester), Unit B1 (Employment Strategy), Unit F1 (ESF policy) and Geographical Units (GUs) work together to achieve the youth employment policy objectives.

b)
   Country teams

In the context of the European Semester, Directorate-General EMPL has established country teams bringing together Desk Officers (DOs) from GUs, who have the best knowledge of the situation in each MS, and Policy Officers (POs) from Policy and Analytical Units, who have the economic or policy expertise. The Internal Audit Service audit team attended the first country team meetings for the European Semester (ES) 2017/18 for Romania and Spain as observer and witnessed very active exchanges between DOs and POs on funding and policy issues. Moreover, CSRs in Directorate-General EMPL are drafted by the same DOs who monitor the implementation of ESF OPs on the ground which is an important advantage in terms of linking policy and funding issues.

c)
   Organisational structure

On 1 November 2015, Directorate-General EMPL was reorganised with the aim to improve the link between the Directorate's-General policy and its funding activities. Previously all GUs for shared management funds were located in two Geographical Directorates. In the new structure, the GUs are attached to the different thematic policy Directorates, which are organised according to the Juncker priorities: employment, social affairs, labour mobility and skills. The Internal Audit Service acknowledged that Directorate-General EMPL's new structure serves to encourage coordination between its policy and funding activities.

d)
   Skills mapping

Unit E5 has carried out a mapping exercise to determine which actions of the New Skills Agenda (NSA) are not covered under the current ESF OPs and which changes are needed to align the OPs with the NSA. The skills mapping has already resulted in changes in the Poland's ESF OP and is part of the negotiations that are currently ongoing to amend the Czech Republic's ESF OP. The mapping exercise helps detect funding gaps and is the first step for aligning new policy initiatives with existing EU funding. This analysis can be used at different stages of the policy/funding cycle: (1) at policy preparation to demonstrate how the new policy will be financed in concrete terms; (2) in the framework of an OP amendment request by MS (which is the context in which Unit E5 carried out this exercise) or (3) in the context of the ES.

e)
   Your first Eures job

Your first Eures job (YfEj) is the only dedicated pan-European scheme to supporting intra-EU job mobility. YfEj supports young jobseekers looking for a job in another MS by providing information and financial support to help reduce mobility obstacles such as travel expenses for job interviews or relocation costs. YfEj is managed by Unit D1 under the EU Programme for Employment and Social Innovation programme. A total of seven projects have already been financed to date, with a combined target of around 6700 work placements. Despite its small size, a recent study has highlighted the benefits of this programme and its clear EU added value with respect to other EU programmes.

Major audit findings

The Internal Audit Service identified three very important issues:

Policy preparation

Directorate-General EMPL did not prepare an impact assessment (IA) for the Youth Guarantee (YG) and the New Skills Agenda, and the justifications for not doing so were not documented in sufficient detail. In addition, when preparing policy and funding initiatives, the Directorate-General did not fully consider the implications of the delivery mechanism chosen. Furthermore, Directorate-General EMPL did not sufficiently consider certain key aspects relevant to youth unemployment challenges when preparing new initiatives, such as the extent to which eligibility criteria used to allocate EU funding address social challenges or how best to support mobility at the EU level. In addition, the involvement of the GUs in the early stages of policy design was limited.

Implementation of funding for youth employment

Although the YEI was meant to deliver results quickly, the implementation on the ground is very slow in those MS with the highest levels of youth unemployment and young people not in education, employment or training. In addition, the indicators used for monitoring the YEI have a number of shortcomings, which limit their usefulness in demonstrating the results achieved.

Reprogramming (Article 23.1 CPR)

Directorate-General EMPL did not undertake the formal and systematic assessment of relevant CSRs after their adoption by the Council in order to determine whether any reprogramming is needed under Article 23.1(a) of the CPR. In fact, no reprogramming requests on the basis of Article 23.1 (a) have actually been made in practice. In reality, the mechanism set out in this article is not sufficiently flexible to facilitate reprogramming when needed to react to new or urgent policy priorities. There are a number of obstacles to the practical implementation of reprogramming requests, such as resistance from the MS, complex procedures, resources constraints in the GUs to manage reprogramming requests and a mismatch between the ESF and the Multi-annual Financial Framework in terms of relevant time window (annual vs multi-annual cycles) and relevant levels of government in the MS (national vs regional OPs).

Recommendations

Policy preparation

When preparing new policy and funding initiatives, Directorate-General EMPL should:

·Perform and document an assessment of the need to carry out an IA and ensure the related decision is endorsed by senior management;

·Ensure that the supporting analytical documents for new initiatives properly address key aspects such as policy objectives, the financing implications, consideration of alternative delivery mechanisms and potential impacts. Also, to involve GUs as soon as possible in preparation stages;

·For the post 2020 programming period, take into account criteria for allocating funding to address social challenges and their impact on mobility (internal and at the EU level) and consider including incentives for MS to invest through their ESF/YEI OPs in measures supporting labour mobility at EU level.

Implementation of funding for youth employment

Directorate-General EMPL should:

·Monitor closely MS with a high risk of decommitment of YEI funds, in order to mitigate the risk that these MS approve low EU added-value projects with the purpose of funds absorption;

·Ensure that YG and YEI indicators are taken into account by GUs and unit B1 when analysing the information reported on the YEI and the YG respectively;

·Carry out a fully-fledged evaluation of the YEI once MS submit their second evaluation of the YEI OPs;

·For post 2020:

oPropose a simplification of the monitoring system with a view to reducing the number of indicators, having up-to-date information on implementation on the ground and placing more emphasis on the sustainability of the measures financed;

oPropose to better align the incentives of the MS under shared management programmes for achieving timely results that produce EU added value (i.e.: payment for results, application of the N+2 rule, etc.);

oPropose a clear rule in the legal base for the calculation of decommitment and how to take into account refunded pre-financing.

Reprogramming (Article 23.1 CPR)

Directorate-General EMPL should:

·Prepare a formal analysis, after the CSRs have been adopted by the Council, to identify cases where reprogramming of ESIF may be needed under Article 23.1;

·Use OP amendments proposed by MS themselves to request additional elements to be included in the OPs based on the Commission assessment.

·For the post 2020 programming period, based on the experience of the current programming period, develop proposals for a more flexible mechanism which, together with measures to further simplify the programming architecture, would allow the Commission to initiate the redirection of EU funds in an efficient and effective manner to urgent needs or new policy priorities.

Additional information provided by Directorate-General EMPL on the measures defined and/or implemented following the Internal Audit Service audit

In response to the Internal Audit Service recommendations DG EMPL has undertaken the following actions:

·In accordance with the Better Regulation Guidelines and the Better Regulation Toolbox DG EMPL carried out an Impact Assessment to accompany the proposals for adoption of new legislation.

·For the new initiatives for which an impact assessment is not prepared, DG EMPL have ensured that the supporting analytical documents properly address key aspects such as the policy objectives, the financing of the new initiatives in concrete terms, alternative delivery mechanisms and potential impacts.

·Geographical units are involved at the earliest stage of preparation of new major policy initiatives, taking into account their time constraints, through task forces focusing on specific themes in order to contribute to the shaping of the new initiatives.

·The policy unit in charge of youth employment organised a discussion with Youth Guarantee coordinators on the role of mobility in the implementation of the Youth Guarantee to collect ideas for future initiatives on youth mobility.

·Concerning finalisation of the staff efficiency review for geographical units, it was decided at senior management level that due to limitations in increasing of staff, possible staff changes can only be done by internal moves. However, general simplification measures in the management of the European Social Fund/Youth Employment Initiative will be considered, mostly within the DG EMPL internal processes.

·In order to avoid inconsistencies between geographical units, internal coordination improved.

·DG EMPL has continued to monitor decommitment risk through the ongoing work by the geographical units and through their discussions on operational programme implementation progress in the context of annual review meetings.

·For the preparation of youth employment policies and initiatives in the next post-2020 programming period, DG EMPL took into account criteria for allocating funding to address social challenges and their impact on mobility (at internal and at the EU level).

·The European Social Fund+ proposal includes incentives for Member States to invest in mobility measures through their European Social Fund/Youth Employment Initiative Operational Programmes, for example, recital 15 of the proposal states that “Synergies with the Erasmus programme, notably to facilitate the participation of disadvantaged learners in learning mobility, should be supported within this context.”

·The Commission’s proposal also includes a simplification of the monitoring system with a view to having fewer indicators and an up-to-date information on implementation on the ground, for example Article 27 of the Commission’s proposal for the post 2020 Common Provisions Regulation obliges Managing Authorities to submit data six times a year electronically, which will allow the Commission to have a clear view of progress on the ground.

·The Commission’s proposal also includes many measures to simplify the programming architecture including a midterm review (Article 14 of the Common Provisions Regulation proposal) which is a more flexible mechanism to allow the Commission to initiate the redirection of EU funds in an efficient and effective manner to urgent needs or new policy priorities.

·The proposed rules on decommitment are much clearer (chapter IV of the Common Provisions Regulation proposal.

·Efforts have also been made in the proposals to better align the incentives of the MS under shared management programmes for achieving timely results that produce EU added value for example through financing not linked to costs (Article 89) and the application of the N+2 rule (Article 99).

  

3.2.Audit on monitoring the implementation and performance of FEAD OPs in Directorate-General EMPL

Audit objective and scope

The objective of this audit was to assess whether Directorate-General EMPL monitors effectively the implementation and performance of FEAD (Fund for European Aid to the most Deprived) Operational Programmes (OPs) in the early stages of the 2014-2020 programming period.

The scope of the audit focused on the following three areas:

·The appropriateness of the legal base, together with the monitoring arrangements put in place by Directorate-General EMPL, to provide a sound basis to monitor the implementation and performance of FEAD OPs;

·The appropriateness of the adopted FEAD OPs to provide a sound basis for monitoring their implementation and performance;

·The effectiveness of Directorate-General EMPL’s monitoring activities of the implementation and performance of FEAD OPs.

The 2015 Annual Activity Report of Directorate-General EMPL contains a reservation on the FEAD OP for France due to material deficiencies in some key elements of the management and control systems set up in relation to the FEAD regulation, as well as legality and regularity issues revealed by an audit of Directorate-General EMPL.

The fieldwork was finalised on 15 December 2016. All observations and recommendations relate to the situation as of that date.

Strengths

The Internal Audit Service acknowledged the efforts made by Directorate-General EMPL to set up a new fund for the 2014-20 programing period, which builds on the previous food distribution programme managed by Directorate-General AGRI, but with a broader scope which includes social inclusion objectives. More specifically:

a)
   The FEAD is implemented across Europe through large PO such as Food Banks or the Red Cross and also by smaller PO staffed by volunteers who deliver food to the end recipients. Without the dedicated support of thousands of volunteers, Directorate-General EMPL would face an even greater challenge in ensuring the effectiveness of the fund in practice. During the fieldwork the audit team visited one of the food bank distribution centre and noted the professionalism and dedication of the volunteers.

b)
   Directorate-General EMPL has put in place a number of initiatives, including the FEAD network, annual meetings with stakeholders at EU level and consulting POs in the preparation of the Annual Work Programme for the FEAD operational technical assistance. The purpose of these initiatives is to support cooperation and engagement with organisations at the European level to help improve performance on the ground. The audit team participated in three meetings of the FEAD network and witnessed very active exchanges of experiences and good practices in initiatives tackling poverty and social exclusion between a wide range of stakeholders. These meetings also allow the Directorate-General to gather valuable information on implementation on the ground.

c)
   Recognising that the aim was to keep the rules simple to limit the administrative burden for the beneficiaries and the underlying legislation only requires Member States (MS) to provide limited financial information to the Commission, Directorate-General EMPL has applied a pragmatic approach to monitoring the implementation of the fund, including requesting periodic payment forecasts from MS on a voluntary basis, which about 75% of the MS do in practice.

Major audit findings

The Internal Audit Service identified one very important issue:

Performance measurement and reporting

The FEAD regulatory framework lacks key elements of a performance measurement framework, such as milestones and targets for common indicators or specific objectives for type I programmes. Also, the indicators and data reported for the FEAD have a number of inherent limitations, such as non-comparability of data or incomplete reporting for common indicators, which makes them less useful for reporting on the overall performance of the fund. Moreover, the legal basis lacks mechanisms to monitor the uptake of accompanying measures, namely specific indicators and data on participants. Finally, information on implementation on the ground is currently not received on a regular basis to facilitate the effective monitoring of the programme.

Recommendation

Directorate-General EMPL should strengthen the plausibility checks for the indicator data/information reported by MS in the Annual Implementation Reports and ensure, to the extent possible, the comparability of data included in the Summary Report (or explain the limitations of the data used). The report should be presented on a timely basis. It should also work with MS to obtain, on a voluntary basis, information on the implementation of the OPs on the ground.

Going forward, for the post 2020 programming period, the Directorate-General should propose the basic elements of a performance measurement system, including those relating to accompanying measures, to be included in the legal base. In addition, it should assess the need to include a provision requiring MS to submit information on the implementation on the ground on a regular basis. Finally, it should assess the need to have a more flexible approach for accompanying measures and ensure these are more closely linked to the European Social Fund.

Additional information provided by Directorate-General EMPL on the measures defined and/or implemented following the Internal Audit Service audit

In response to the Internal Audit Service recommendations, Directorate-General EMPL has undertaken several actions. In the area of monitoring and evaluation, DG EMPL:

  

·Ensured that Desk Officers assess and confirm the plausibility of the indicators reported, including through requesting key supporting information from the Member States on data sources and/or estimation methodologies where relevant. DG EMPL have also developed plausibility checks at the aggregate level to the extent possible taking into account the differences between Operational Programmes. These assessments are documented to allow consistency checks.

·Ensured that the summary report to the European Parliament and the Council is accurate, based on comparable data and is presented before the end of the year following the reporting period (N+1); if there are shortcomings in the data reported or reliable data cannot be obtained for some indicators, DG EMPL will include an explanation on the limitations of the data reported.

·Explored the possibilities to request the Member States to submit, on a voluntary and more regular basis, key information on the implementation of the Operational Programmes. However, taking into account how the operations financed from the Fund for European Aid to the Most Deprived are implemented, it was considered that such request for further data would not have any added value and would imply unnecessary additional burden to authorities.

·Ensured that accompanying measures are covered in the performance checklist for the review of the Annual Implementation Report, monitor their uptake taking into account the proportionality principle and recommend corrective measures to Member States if necessary.

·Introduced in the acceptance letter of Annual Implementation Reports a reminder about the obligation of Managing Authorities to make public a summary of the content of the report.

·Ensured that the relevant stakeholders are invited to participate in Annual Review Meetings for Operational Programme I.

·Ensured that the relevant geographical units in DG EMPL s are copied on questions sent by MS and the replies given, in particular those submitted in the context of the different expert groups, and that relevant questions directly addressed to the geographical units s and their answers are adequately filed.

·Put in place coordination mechanisms at the operational level to ensure consistency in the management of the Fund for European Aid to the Most Deprived by the geographical units and to share best practices/implementation problems. This has been done by organising periodic meetings and exchanging views, coordinating and taking decisions on relevant matters within the Dynamic Diversified Growth Funds Management meeting.

·Further promoted the participation of geographical units in Expert Group meetings.

·Monitored tightly the timely submission of the Annual Implementation Report by the MS.

·Introduced additional automated controls in the electronic data exchange system SFC2014 for the areas identified by the Internal Audit Service and encouraged the use of SFC2014 web services to link it to Member States' IT systems.

·Improved the access to existing documents by making all final guidance, ‘Questions and Answers’ and regulations available to Member States in a user-friendly environment using existing IT resources.

·Further developed guidance to Member States on flat rates in particular with regard to the methodologies used for the calculation of flat rates and the related audit trail and guidance to Desk Officers on Annual Review Meetings.

·In order to promote complementarity with the European Social Fund, the Commission Proposal for the next programming period (2021-2027- ESF +) envisages the merger of the Fund for European Aid to the most Deprived with the European Social Fund, also as a response to the findings of the Fund for European Aid to the most Deprived mid-term evaluation.

·The proposal for the legal base post 2020 sets out the basic elements of a performance measurement system, namely objectives, targets and where relevant baselines and milestones and still ensures that a simplified system will be applied for ex-FEAD operations. To this effect, provisions and derogations have been inserted in the proposals, notably the ones concerning the new specific objective addressing material deprivation.

·The proposal includes also the take up of stakeholder discussions (Open Consultation) and findings of the mid-term evaluation as regards accompanying measures.

3.3.Audit on major projects in Directorate-General REGIO

Audit objectives and scope

The objective of the audit was to assess compliance with the applicable regulatory framework and the efficiency and effectiveness of the controls put in place by Directorate-General REGIO for the approval and early monitoring of major projects (MPs) in the new programming period (PP).

The scope of this audit included a review of the processes and controls put in place by Directorate-General REGIO to approve and monitor MP in the 2014-2020 PP.

Given the role of the Joint Assistance to Support Projects in the European Regions (JASPERS) Independent Quality Review (IQR) team in the overall appraisal process, the Internal Audit Service also carried out:

·A review of the governance arrangements, processes and controls put in place by 
  
Directorate-General REGIO to supervise the activities of the JASPERS IQR team;

·An assessment of the efficiency and effectiveness of the use of the JASPERS IQR team as outlined in the 2014-2020 legal framework. This included an assessment of whether the completeness and quality checks carried out by JASPERS IQR of MP are adequately performed and whether these procedures resulted in a faster appraisal of MP applications compared to the past.

Scope limitation on JASPERS

Even though JASPERS IQR was not our main auditee and was very cooperative overall in providing documents and explanations on its working methods, which allowed us to carry out our review, it should be noted that the Internal Audit Service was refused full access to JASPERS IQR internal procedures, files and systems. Specifically, the Internal Audit Service was not provided access to information contained in the European Investment Bank's (EIB) IT platform, where JASPERS IQR stores project documentation, internal working notes and benchmark data. Neither was full access granted to the internal manual of procedures. As a result, the Internal Audit Service could not obtain reasonable assurance on the audit trail of project appraisals and on the adequacy of the internal procedures, including on the management of conflicts of interest between JASPERS IQR, JASPERS Advisory (which is a separate department in JASPERS in charge of providing support to the Member States (MS) for preparing MPs) and the EIB's lending activities.

Reservations were made in Directorate-General REGIO's 2016 Annual Activity Report concerning serious deficiencies in the management and control systems of OPs for the 2007-2013 PP by MS. These deficiencies covered inter alia, the compliance with public procurement rules, state aid rules, revenue generated by projects and eligibility rules, including MP. For the 2014-20 PP, reservations were made on management and control systems of specific OPs, but MP are not specifically mentioned.

The fieldwork was finalised on 28 April 2017. All observations and recommendations relate to the situation as of that date.

Strengths

The centralisation of the approval of MP in the newly created (March 2016) 'Closure & Major Project' unit (F1) in Directorate-General REGIO has contributed to the streamlining of the processes in this area. Furthermore, the delegation of the MP appraisals to JASPERS IQR during the current PP, with dedicated JASPERS staff/experts carrying out the qualitative appraisals of MP applications, has contributed to the implementation of a common and consistent approach. MP assessments are carried out against the quality criteria that are included in the relevant EU Regulations.

JASPERS IQR has contributed to a drop in the average approval times, under Article 102(2) of the Common Provisions Regulation (CPR), from 340 calendar days (including interruptions) in the 2007-2013 period to approximately 112 calendar days (including interruptions) as at the time of the completion of the fieldwork. The share of MP where the appraisal process was interrupted was significantly reduced from 82% in the previous PP to 22 % in the current PP up until the date of the audit. In the majority of the files tested by the Internal Audit Service, JASPERS submitted the post submission appraisals (PSA) reports within the 30-calendar days' deadline and prepared the IQR reports (for which no formal deadlines are set out in the regulation) within a reasonable time.

The modified role and increased responsibilities of JASPERS in the MP process has been counter-balanced by closer and more systematic cooperation between the Commission and JASPERS. The following measures have been put in place in the new PP to ensure that a coherent approach is followed:

•
   For the first time, the main principles of the Cost Benefit Analysis (CBA) methodology were enshrined in the Commission Implementing Regulation N° 2015/207 and in the Delegated Regulation N° 480/2014. These principles need to be followed by all MS submitting MP applications. A CBA guidance document on investment projects was published in December 2014.

•
   Creation of a CBA Forum, where the Commission, JASPERS and the MS discuss methodological issues linked to the application of the CBA of the projects.

•
   Establishment of an MP matrix in Directorate-General REGIO, which is a network of desk officers meeting periodically to discuss issues of concern.

•
   Tripartite meetings between the Member States, JASPERS and the Commission have been organised for all MS with a large number of MP and for a selected number of other MS.

•
   Annual stakeholders meetings are organised, presenting a unique opportunity for the Commission, EIB, and Managing Authorities to meet together to exchange experiences and opinions about how the Commission led technical assistance can meet their needs.

•
   JASPERS has been given full access to the IT platform SFC2014 used for the exchange of information between MS and the Commission and has been provided with updates on the latest CBA and MP guidance available on ESIF (European Structural and Investment Funds) Questions & Answers. In addition, a CBA working group between JASPERS and Directorate-General REGIO meets regularly to discuss all issues that are subject to interpretation.

Major audit findings 

The Internal Audit Service identified one very important issue:

Governance: JASPERS contractual and supervision arrangements

Directorate-General REGIO is ultimately responsible for the management and adoption of MPs and therefore needs to effectively supervise the appraisal activities that are performed by JASPERS IQR. However, the Commission's access rights to audit and supervise the appraisal activities that are carried out by JASPERS IQR are not well defined in the relevant contractual arrangements. Moreover, the role and tasks entrusted to JASPERS IQR in the current period are not clearly explained in the contractual arrangements, particularly for the PSA that are performed under Article 102(2) of the Common Provisions Regulation (CPR). Furthermore, Directorate-General REGIO has not yet defined a strategy, for carrying out supervisory checks of JASPERS IQR's internal procedures and appraisal documentation.

Also, the dual role of JASPERS both as an advisor to MS and as the IQR of project applications submitted by MS raises questions concerning potential conflicts of interest between its Advisory and IQR Divisions, which have not been adequately addressed by the quality checks performed by Directorate-General REGIO when adopting projects.

Recommendation

Directorate-General REGIO should use its powers as a partner in JASPERS to:

For the 2014-2020 period:

·Strengthen its supervision of JASPERS IQR activities by, where appropriate, carrying out documentary and on-the-spot checks of JASPERS IQR internal procedures and appraisal documentation and by reviewing key documents on the functioning of the JASPERS internal control system;

·Plan and launch a mid-term evaluation of JASPERS as required by Article 2.4 of the framework partnership agreement (FPA) and ensure that there will be adequate access to JASPERS records and IT tools to facilitate this evaluation;

·Clarify the Commission's access rights to JASPERS IQR within the contractual arrangements between the Commission and the EIB, in particular the access rights to information systems, documents and records for performing supervisory checks;

·Improve the contractual arrangements with respect to the PSA function by specifying the role and key tasks of JASPERS IQR in the FPA and/or specific grant agreement, and the methodological requirements to be followed by JASPERS IQR when appraising the MP applications that are submitted under Article 102(2) of the CPR;

·Analyse actual and perceived conflicts of interest between JASPERS IQR, JASPERS Advisory and EIB lending activities and develop appropriate mitigating measures if necessary.

For the post-2020 period:

If MPs will be part of the post-2020 legislative proposals, propose that any legislative proposal for the streamlining of technical facilities clarifies the Commission's supervisory arrangements over JASPERS IQR.

Additional information provided by Directorate-General REGIO on the measures defined and/or implemented following the Internal Audit Service audit

Since the issuance of the corresponding Internal Audit Service final report, and according to the agreed action plan, targeted actions have been carried out by Directorate-General REGIO, in close cooperation with JASPERS, in order to strengthen the governance of the management and adoption of Major Projects, in particular to better define the contractual arrangements and the Commission's access rights to audit/supervise JASPERS’ appraisal of projects, as well as to further reduce any risk of potential conflicts of interest between JASPERS IQR, JASPERS Advisory and EIB lending activities. At the same time efforts have been made, in cooperation with JASPERS, in order to improve the planning and reception of Major Projects applications as well as the monitoring of MPs physical and financial implementation.

4.RESEARCH, ENERGY AND TRANSPORT

4.1.Audit on H2020 project management in Directorate-General CONNECT

Audit objectives and scope

The objective of the audit was to assess whether Directorate-General CONNECT has put in place an effective project management process to ensure that H2020 projects are effectively implemented by the beneficiaries in line with the grant agreement.

The audit covered:

·The monitoring approach (desk or on the spot checks or reviews, using internal or external expertise, including frequency of review) in line with the inherent risks of the projects;

·Assessment of the activities of the projects based on deliverables and reports;

·Selection of the appropriate course of action for underperforming projects;

·Amendments to the grant agreements.

The audit assessed how Directorate-General CONNECT ensures that project activities were carried out as agreed and that the project deliverables are produced as envisaged. Existing automated controls were considered as part of the audited process.

Regarding the Strategy for an effective dissemination and exploitation of Horizon 2020 research results, the audit fieldwork only covered the aspects of dissemination to be addressed during the assessment of the periodic reporting, i.e. mainly the assessment of the publishable summary and the review of the progress reached in the implementation of the project dissemination plan.

There were no observations/reservations in Directorate-General CONNECT's 2016 Annual Activity Report that relate to the area/process audited.

The fieldwork was finalised on 9 June 2017. All observations and recommendations relate to the situation as of that date.

Strengths

The auditors recognised Directorate-General CONNECT's ongoing efforts to implement the H2020 programme in the context of an increasing workload. The Internal Audit Service identified the following strengths:

a)
   Central point of contact with the Common Support Centre (CSC): unit CNECT.R5 acts as a single point of contact with the CSC to discuss issues relating in particular to guidance and IT functionalities, and with the Directorate-General CONNECT Project Officers (POs) to actively collect good practices and know-how.

b)
   Amendments: in the management of project amendments, detailed comments, justifications and additional checks related to the approval process are recorded in the IT system COMPASS.

Major audit findings

The Internal Audit Service identified one very important issue:

Addressing the risk of irregularities and fraud

Concerning the detection and management of plagiarism cases, there is no adequate operational solution available for its POs enabling them to perform effective plagiarism checks of project deliverables. Consequently, the POs can perform only limited manual checks on deliverables. Furthermore, the current IT system SyGMa/COMPASS does not immediately notify the POs that a beneficiary participating in a project under their responsibility has been flagged in the Early Detection and Exclusion System (EDES) for plagiarism in other projects. Finally, Directorate-General CONNECT's anti-fraud strategy and related action plan do not define the course of actions to be followed when a beneficiary participating in several projects is flagged in EDES.

Recommendation

Directorate-General CONNECT should ensure that adequate solutions for performing effective plagiarism checks are available and are regularly used by the POs. The Directorate-General should also ensure that the POs are immediately notified once an EDES flag is entered in the SYGMA/COMPASS system. Moreover, the Directorate-General should update its anti-fraud strategy/action plan to address the risk of plagiarism involving a beneficiary who participates in several projects financed by the Directorate-General.

Additional information provided by Directorate-General CONNECT on the measures defined and/or implemented following the Internal Audit Service audit

DG CONNECT considers that this recommendation has been partially implemented.

A new anti-plagiarism tool is available to the Project Officers since late 2017. Dedicated anti-fraud training sessions have been organised for the project officers. New guidance to project officers and operational units on performing plagiarism checks was issued. This guidance explains the concept, the workflow and the use of the software tool for detection of plagiarism in deliverables as well as the actions and follow-up to take in positive cases.

The EDES guidance was updated and now clearly mentions that Directorate-General CONNECT notifies the concerned project officers as soon as an EDES flag is entered on the grounds of plagiarism.

The action plan linked to Directorate-General CONNECT anti-fraud strategy was updated to address the risk of plagiarism.

Finally, DG CONNECT has performed plagiarism checks on a sample of projects and will perform further checks by September 2018.

4.2.Audit on procurement in Directorate-General CONNECT

Audit objective and scope

The objective of the audit was to assess whether the internal control system in place in 
  
Directorate-General CONNECT is effective in ensuring the legality and regularity of procurement and of the underlying transactions managed by Directorate-General CONNECT.

In particular, the audit assessed whether the internal control system provides reasonable assurance regarding compliance with the Financial Regulation, its Rules of Application and the relevant specific legal basis.

The scope of the audit covered the procurement process, from the identification of the needs to the contract execution.

There were no observations/reservations in the 2016 Annual Activity Report of 
  
Directorate-General CONNECT that relate to the area/process audited.

The fieldwork was finalised on 9 November 2017. All observations and recommendations relate to the situation as of that date.

Strengths

The Internal Audit Service identified the following strengths:

a)
   Directorate-General CONNECT's Single Centre of Procurement (SCP) provides proactive support to the operational units: the SCP in CNECT.R2 acts as a centralised sector treating consistently all procurement files and supporting all operations dealing with procurement. The nine operational units interviewed expressed satisfaction with the SCP service and appreciation for its work. The SCP has been very reactive to auditors' preliminary findings and has already addressed a number of issues found during the fieldwork.

b)
   Studies approved by management are clearly identified: the SMART tool (Studies Management And Retrieval Tool) developed in Directorate-General CONNECT allows to clearly identify all the studies planned in an effective manner, and to ensure that all studies procured have been validated at Director-General level.

Major audit findings

The Internal Audit Service did not identify any critical or very important issues.

4.3.Audit on closure of FP7 projects in ERCEA

Audit objectives and scope

The objective of the audit was to assess the effectiveness of the processes for closing ERCEA's FP7 projects.

The audit covered the monitoring and reporting on the closure of FP7 projects, the management of the final distribution report, de-commitments, document management and archiving of project information, extensions of project duration, beneficiaries' complaints, and the implementation of ex-post audit results.

There were no observations and/or reservations in ERCEA's 2016 Annual Activity Report relating to the area/process audited.

The fieldwork was finalised on 2 March 2017. All observations and recommendations relate to the situation as of that date.

Strengths

The Internal Audit Service acknowledged the ongoing efforts made by ERCEA in ensuring the effective and timely closure of FP7 projects. In particular, the auditors noted the following strengths:

a)
   ERCEA has a robust system for implementing audit results in an appropriate and timely manner. Exception-based management is established for occasional cases necessitating delays and/or deviations from the auditors' recommendations, with the involvement of ERCEA's ex-post control unit and the final decision of the Agency's director.

b)
   The archiving process ensures that project files are complete and appropriately safeguarded. Only the necessary documentation is kept, which results in an efficient use of storage space.

Major audit findings

The Internal Audit Service did not identify any critical or very important issues.

4.4.Audit on grant management - phase 2: project management and payments for CEF in INEA

Audit objective and scope

The overall objective of the audit was to assess if INEA has put in place project management and payment processes for the Connecting Europe Facility (CEF), which provide reasonable assurance to the Authorising Officer by Delegation on the effectiveness of operations and the legality and regularity of the underlying transactions.

The audit engagement focused on the internal controls in place for the following stages in the grant management cycle:

·Grant amendments;

·Pre-financing;

·Project monitoring;

·Intermediate and final payments.

The scope focused on projects for which payments were made in 2016.

There were no observations/reservations in the 2016 Annual Activity Report of INEA that relate to the area/process audited.

Strengths

The Internal Audit Service recognised the continuous efforts made by INEA to ensure a correct and effective CEF grant management. The following strengths were specifically identified during the audit:

a)
   INEA has developed a complete guide on amending CEF grant agreements, which provides information on the principles governing amendments, when and how to amend a grant agreement and a description of the process and tips to avoid common mistakes.

b)
   INEA has developed detailed guidance for the assessment of the Action Status Reports enabling a harmonised approach for monitoring the implementation of the projects.

c)
   INEA has a robust risk-based ex-ante control strategy building on good practices gained under TEN-T (predecessor Agency of INEA). It ensures a balance between cost of controls and available resources with regard to the level of ex-ante controls (frequency and intensity). INEA has translated this strategy into detailed internal guidelines.

Major audit findings

The Internal Audit Service did not identify any critical or very important issues.

4.5.Audit on HR management in INEA

Audit objective and scope

The objective of the audit was to assess if INEA designed and implemented an adequate Human Resource (HR) management process to deploy a competent (knowledgeable) and engaged workforce in order to deliver its priorities and core business.

In particular, the audit assessed the effectiveness of the following processes:

·The design and implementation of the HR strategy;

·The HR planning process, including workload assessment and staff allocation;

·Selection, recruitment and retention of staff;

·Knowledge management (learning and development, competence management, and coaching);

·Monitoring and reporting on HR.

There were no observations and/or reservations in the 2016 Annual Activity Report of INEA that relate to the area/process audited.

The fieldwork was finalised on 16 October 2017. All observations and recommendations relate to the situation as of that date.

Strengths

The Internal Audit Service acknowledged the ongoing efforts made by INEA in ensuring the effective and efficient operation of the HR function. In particular, the Internal Audit Service highlighted the following strengths:

a)
   Strong control environment

As noted in previous Internal Audit Service audits, INEA benefits from a strong control environment, which represents a solid foundation for the internal control system as a whole and ensures the effective management of resources.

b)
   Human resources strategy

INEA established a comprehensive and coherent multi-annual human resources strategy for the period 2016-2020. The INEA HR strategy links the HR strategic objectives to the agency's business objectives and priorities. It also highlights the current and future challenges for HR and establishes a multi-annual action plan with concrete actions and precise deadlines.

c)
   Service-oriented approach

The HR team in INEA has adopted a service-oriented approach, providing valuable and timely support to the operational units: all the heads of units and heads of departments interviewed during the audit were positive about the support received from the HR team.

Major audit findings

The Internal Audit Service did not identify any critical or very important issues.

4.6.Audit on scientific project management in JRC

Audit objective and scope

The objective of this audit was to assess whether the management and control systems put in place by the JRC for its scientific project management activities are adequately designed and effectively implemented.

The scope included the overall JRC's set-up for managing its scientific work packages (WPKs) as well as all phases of the WPKs' life cycle, namely: (1) planning; (2) execution and monitoring; (3) closure and the management of their results.

There were no observations or reservations in JRC's 2016 Annual Activity Report related to the audited processes.

The fieldwork was finalised on 8 November 2017. All observations and recommendations relate to the situation as of that date.

Strengths

The auditors recognised the ongoing efforts made by the JRC to continuously improve its scientific project management practices and highlighted the following good practices, which contribute to effective operations of the audited process:

a)
   All former scientific institutes were ISO 9001:2008 certified. This gave structure and coherence to JRC's work as each institute developed its own documentary framework (quality manual, procedures and work instructions, templates) to support its activities, appointed a quality manager and in some cases a quality officer per unit. This structure has been maintained after the re-organisation, thus ensuring a smooth transition from the former site-based scientific institutes to the current thematically formed scientific directorates.

b)
   In 2012 JRC launched the development of the Integrated Management System (IMS), an integrated framework of processes intended to enable the Directorate-General to work as a single entity and to achieve its unified objectives. After several years of slow progress, recently its development has gathered pace. The JRC has finalised the IMS manual, the updated process map, and the updated list of the process owners. Other documents, like the scientific knowledge production and management process description are in the pipeline.

Major audit findings

The Internal Audit Service identified one very important issue:

Monitoring of scientific projects' and WPKs' execution

The JRC has no complete and sufficiently detailed guidance on monitoring of scientific projects and WPKs. Moreover, the actual monitoring of the WPKs' execution is not adequate and the system in place results in overstating the deliverables’ completion rate.

There is no regular and accurate overview of the actual time spent by the scientists on the WPKs as the time spent on the institutional WPKs is not monitored against the plan. In addition, the time reported as spent on the contractual WPKs does not always correspond to the actual time worked (in order to match what was agreed in the Administrative Arrangements).

Recommendation

JRC should improve the monitoring of the WPK execution by: (1) designing and implementing adequate project management monitoring practices for the WPK execution as part of the new scientific project management methodology and guidance implementation; and (2) providing a JRC-wide guidance for monitoring at WPK, unit and scientific directorate levels.

Additional information provided by the JRC on the measures defined and/or implemented following the Internal Audit Service audit

The JRC action plan was approved by the Internal Audit Service on 9 March 2018. The JRC is in the process of setting up a Working Group to address the audit recommendations and provide the JRC management with concrete suggestions for reviewing the Scientific Project Management in the DG. The draft 'Terms of Reference' of the working group are available and have been distributed to different categories of stakeholders and interested parties within the JRC in order to have as many parties informed and involved in the business process improvement activities of this working group. The Working Group is expected to start its activities in September 2018.

4.7.Audit on HR management – recruitment of scientists in JRC

Further to the note announcing the launch of the audit on HR management- requirement of scientists in JRC, the Internal Audit Service conducted a preliminary survey with the aim of gaining a better understanding of the activities and the related risks and in order to define the objectives and scope of the engagement. At the end of the preliminary review, the Internal Audit Service postponed the audit to the end of 2017 as at that time the HR process in the JRC was under significant transformation and both the future interactions among the actors (JRC, Directorate-General HR) and JRC’s working practices, underlying procedures and communication channels were not yet fully defined.

Meanwhile Directorate-General HR had announced that the pilot phase of the new HR delivery mode will continue in 2018 and is foreseen to be concluded mid-2018.

Given these developments and after discussion with the Director JRC.A, the Internal Audit Service decided to close the audit and to include the audit topic in the planning for 2018.

4.8.Audit on the effectiveness of the set-up and supervision of Shift2Rail by 
  
Directorate-General MOVE

Audit objective and scope

The objective of the audit was to assess if the set-up of the Shift2Rail (S2R) Joint Undertaking (JU) and Directorate-General MOVE's supervision ensure that the JU's activities contribute to the achievement of the policy objectives of Directorate-General MOVE and Directorate-General RTD and that the internal control objectives for the indirectly managed funds are achieved.

The audit focused on the following processes:

·The set-up of S2R (including governance, internal control system and initial operations, organisational structure and staffing) and whether this enables the JU to perform the entrusted tasks;

·The supervision strategy of Directorate-General MOVE (including the monitoring and steering of performance, the assurance building process and reporting) and the coordination with Directorate-General RTD;

·The organisation and procedures in Directorate-General MOVE supporting the supervision strategy.

There were no observations/reservations in the 2016 Annual Activity Report of Directorate-General MOVE relating to the area/process audited.

The fieldwork was finalised on 8 September 2017. All observations and recommendations relate to the situation at that date.

Strengths

The Internal Audit Service recognised the efforts made by Directorate-General MOVE to ensure the effective set-up of S2R and the supervision of its activities. In particular, the Internal Audit Service identified the following strengths:

a)
   Directorate-General MOVE staff involved in S2R supervision are competent, experienced and motivated. They collaborate effectively with the staff of S2R and Directorate-General RTD. Moreover, MOVE/ENER Shared Resource Directorate (SRD) is setting up a team to be in charge of coordinating and supporting the supervision strategy and activities for the decentralised agencies and JUs.

b)
   Directorate-General MOVE has a good understanding of its role and responsibilities in the S2R Governing Board and carries out this function effectively.

Major audit findings

The Internal Audit Service identified one very important issue:

Supervision strategy: design and implementation

Directorate-General MOVE has not established a formalised, consolidated, risk based supervision strategy for S2R which sets out the Directorate's -General supervision objectives and how the different supervision tools contribute to building assurance on achievement of policy objectives and adequate protection of the financial interests of the Union. Except for the "Procedure to define the Commission position within the Governing Board of S2R JU", there is no formal allocation of tasks between MOVE.C4 (operational unit) and SRD.3 (finance and administration) and no formal division of supervisory tasks between Directorate-General MOVE and Directorate-General RTD. Moreover, Directorate-General MOVE has not carried out a formal mapping exercise of the S2R-related tasks and corresponding estimation of the resources needed.

Recommendation

Directorate-General MOVE should establish a comprehensive, risk based supervision strategy, describing how the available supervision tools and control mechanisms will be used and including a formal allocation of tasks. The Directorate-General should also carry out a mapping exercise of the tasks related to the supervision of S2R and estimate the resources necessary for performing them.

Additional information provided by Directorate-General MOVE on the measures defined and/or implemented following the Internal Audit Service audit

 As regards the Internal Audit Service recommendation on "Supervision strategy: design and implementation", Directorate-General MOVE's strategy on its relations with Decentralised Agencies and Joint Undertakings was adopted by Directorate-General MOVE's Control Board on 4 December 2017 and was followed by immediate implementation and monitoring. Further actions to be implemented aim at formal clarification of allocation of the supervision activities within Directorate-General MOVE and between Directorate-General MOVE and Directorate-General RTD; development of formal guidelines for the participation of Directorate-General MOVE in the different governing bodies; and identification and assessment of risks that could impair the achievement of main objectives.

4.9.Audit on closure of FP7 projects in REA

Audit objective and scope

The objective of the audit was to assess the effectiveness of the process for the closure of REA's FP7 projects.

The audit covered the monitoring and reporting on the closure of projects and the management of the final distribution report, de-commitments, archiving and document management, amendments, complaints and the implementation of ex-post audit results.

As regards FP7, there were two reservations in REA's 2016 Annual Activity Report:

Reservation concerning the rate of the residual errors with regard to the accuracy of cost claims impacting on granted EU funding for Space and Security themes of the Cooperation Specific Programme financed under FP7.

Reservation concerning the rate of the residual errors with regard to the accuracy of cost claims impacting on granted EU funding for Research for the benefit of SMEs actions of the Capacities Specific Programme financed under FP7.

The fieldwork was finalised on 9 March 2017. All observations and recommendations relate to the situation as of that date.

Strengths

REA has implemented a robust monitoring system for the financial aspects of the implementation of FP7 projects, which covers the most sensitive areas such as invoice ageing, de-commitments, closed and terminated projects with open budget amount (RAL), and projects with expired final dates of implementation . The controls are performed by the verifying sector throughout the year, as part of the corporate accounting quality exercise. This allows to timely identify any potential abnormal situations and whenever necessary to send queries to the operational units for the appropriate follow-up.

Major audit findings

The Internal Audit Service did not identify any critical or very important issues.

4.10.Audit on HR management in Directorate-General RTD

Audit objectives and scope

The objective of the audit was to assess the effectiveness of Directorate-General RTD's Human Resource Management (HRM) system to ensure that it responds effectively to the changing business environment and supports the Directorate-General in achieving its objectives while promoting staff engagement and motivation.

The scope of the audit covered:

·The design and implementation of the strategic and operational HRM process;

·HRM support for the decision making process on the organisational changes;

·The knowledge sharing initiatives aimed to address HRM challenges;

·The actions taken to improve staff engagement and satisfaction.

There were no observations/reservations in the 2016 Annual Activity Report that relate to the area/process audited.

The fieldwork was finalised on 13 September 2017. All observations and recommendations relate to the situation as of that date.

Strengths

a)
   Continuous efforts made by Directorate-General RTD to develop a non-linear approach to the distribution of staff reduction requirements between the Directorates which is based on the projected reduction of the programme management related activities.

b)
   Introduction, in 2014, of an annual task mapping exercise based on the Unit HR report for the previous year. This provides Directorate-General RTD with a sound picture of the human resource allocation (in Full Time Equivalent) to the activities of the Directorate-General.

c)
   Development of a workload assessment methodology in use since 2014 to i) identify the number of staff needed to manage the framework programmes and ii) to balance the workload between the Directorates. This approach proved to be effective in identifying the staffing levels needed for the activities related to the implementation of the framework programmes.

d)
   Recognition of the importance of knowledge management (KM) by explicitly including it in the mission of unit RTD.R.1 (former RTD.R.5) and by setting up a KM Steering Committee led by Directorate-General RTD senior management.

Major audit findings

The Internal Audit Service did not identify any critical or very important issues.

5.EXTERNAL ACTIONS 

5.1.Audit on management of investment facilities (financial instruments) in Directorate-General DEVCO

Audit objectives and scope

The objective of the audit was to assess the adequacy and effectiveness of the part of the management of the investment facilities falling within Directorate-General DEVCO's remit. This audit focussed on three facilities (LAIF - Latin America Investment Facility, IFCA - Investment Facility for Central Asia and AfIF - African Investment Facility) and on the whole blending cycle, from the identification/preparation phase till the payment schedule of projects. The audit covered blending operations launched in the period 2010 to 2016.

The fieldwork was finalised on 25 January 2018. All observations and recommendations relate to the situation as of that date.

Major audit findings

The Internal Audit Service identified the following two very important issues:

Blending project cycle: post-contract signature phase – monitoring project implementation

Directorate-General DEVCO does not systematically monitor the International Financial Institutions' (IFIs) operational performance and the key aspects of the blending operations it has to report on annually to the European Parliament and the Council. Moreover, the reports submitted by the IFIs at the level of the EU Delegations (EUD) are of a varying quality. Hence, the EUD does not always have relevant information to supervise appropriately the operational and financial aspects of the projects.

Pre-financing

Due to unavailability of the declaration of expenses incurred by the IFIs, Directorate-General DEVCO clears pre-financing for blending operations at a very late stage (up to ten years after the last payment). Moreover, the amounts of pre-financing paid, remain unused for a long period.

Recommendations

Blending project cycle: post-contract signature phase – monitoring project implementation

Directorate-General DEVCO should (1) improve the monitoring at Headquarter level regarding financial and operational performance of the IFIs, (2) improve the quality of the monitoring database, (3) set up measures to ensure that reporting from the IFIs is appropriately and timely produced, analysed, commented upon and used, and (4) ensure that the contractual clauses are appropriately enforced.

Pre-financing

Directorate-General DEVCO should address the root causes leading to pre-financing exceeding the needs by ensuring that the new provisions are adequately implemented. Moreover, it should adapt the reporting requirements for the IFIs to obtain timely the necessary information for the clearing of pre-financing for all types of blending operations. Finally, the Directorate-General has to ensure timely clearing of the pre-financing.

Additional information provided Directorate-General DEVCO on the measures defined and/or implemented following the Internal Audit Service audit

DEVCO management has been regularly informed on the results regarding financial and operational performance of projects/IFIs through established mechanisms: the EAMRs (External Assistance Management Reports), the monitoring results of the Results Oriented Monitoring (ROM) System, the results of the aggregated analysis carried-out by the relevant unit on the state of play of projects shared in the frame of the Blending Steering Committees. The blending project cycle and guidance provided to our implementing partners (IFs) have already strengthened project monitoring in the new blending framework. DEVCO will continue applying ongoing measures and systems to ensure the quality and timeliness of the reports submitted by the IFIs.

In this respect, both recommendations will be addressed through the update of the guidelines on EU blending operations.

Furthermore, a number of additional actions will be taken. A pilot exercise on screening blending projects through the ROM system has been launched in 2018. Following its outcome, (i) a revised version of the methodology will be adopted; (ii) a ROM consolidated report on blending projects will be made available to DEVCO Management yearly. Besides, (iii) an annual report based on the traffic lights of the EAMRs at blending level, as well as (iv) a consolidated report integrating all above and other information, will be produced and presented yearly to DEVCO Management from 2019 onwards.

In the meantime, as a safeguard measure, (v) a note will be issued with a view to stressing the need to ensure proper follow up of IFIs’ reporting and the enforcement of contractual clauses, the need to avoid pre-financing exceeding the needs and to clear pre-financing of blending projects in a reasonable time in order to reduce the clearing periods.

  

5.2.Audit on Directorate-General ECHO’s grant management in response to the Syrian crisis in the Middle East (Headquarters and Field Offices)

Audit objectives and scope

The objective of the audit was to assess whether Directorate-General ECHO selects and monitors effectively the actions it funds in order to achieve its humanitarian aid objectives in response to the Syrian crisis in the Middle East.

The specific objectives included an assessment of:

·The analysis and selection of grant proposals submitted by the partners of Directorate-General ECHO for actions to be handled through Remote Management and Exceptional Extreme Operational Conditions (RM/EEOC);

·The monitoring of and reporting on the implementation of the actions, both under normal monitoring arrangements and under RM/ EEOC, including the assessment of their final results.

The audit covered grants with activities ending in 2015, 2016 and 2017.

There were no observations/reservations in the 2016 Annual Activity Report of Directorate-General ECHO that relate to the area/process audited.

Strengths

The auditors recognised the ongoing efforts made by Directorate-General ECHO to enhance the selection and management of grants in order to ensure the selection of the most relevant projects and hence, the achievement of Directorate-General ECHO's humanitarian objectives. In particular, the Internal Audit Service noted the following strengths:

a)
   Thorough assessment of the grant proposals for actions to be implemented under RM or EEOC against Directorate-General ECHO’s eligibility criteria.

b)
   Robust monitoring system for the implementation of Directorate-General ECHO’s funded operations based on different monitoring tools,(e.g. field monitoring visits of the Field Experts (FEs) and Desk Officers (DOs), analysis of the Interim Reports and Final Reports submitted by partners, regular discussions, meetings and correspondence with the partners and the national authorities, analysis of the post-distribution reports and evaluation reports for lessons learnt).

c)
   High quality documentation of the monitoring and appraisal process carried out by the DOs and FEs in one centralised tool, called Fiche Operationelle ("FichOp").

d)
   Specialised knowledge and expertise (e.g. health, food, protection, wash and shelter) provided by the Regional Sectorial Experts to the Field Offices.

e)
   Close cooperation and sharing of information between the DOs (ECHO HQ) and the Field Offices.

f)
   High level of professionalism and commitment shown by the DOs and the Field Offices.

g)
   Effective cooperation between the Regional Support Office and the Field Offices.

Major audit findings

The Internal Audit Service did not identify any critical or very important issues.

5.3.Audit on procurement under Instrument for Pre-Accession (direct management and indirect management with beneficiary countries) – phase II in Directorate-General NEAR

Audit objectives and scope

The objective of the audit was to assess whether the control system put in place for the management of procurement under indirect management with beneficiary countries (IMBC) is adequate and effectively implemented to ensure the legality and regularity of operations carried out by Turkey under IMBC with ex ante and ex post controls.

The specific objectives included an assessment of:

·The design by NEAR Headquarters (HQ) of the control system under IMBC;

·The coordination, planning and monitoring by the EU Delegation (EUD) to Turkey of procurement process under the Instrument for Pre-Accession Assistance (IPA) with ex-ante control;

·The implementation by Directorate-General NEAR staff in the EUD of ex-ante controls on procurement procedures managed by Turkey under IMBC with ex ante control;

·The conduct of ex-post controls on procurement procedures by Directorate-General NEAR staff in the EUD.

The audit covered:

·Directorate-General NEAR control system under IMBC including the guidance on the reduction of ex-ante controls;

·The performance by the EUD's staff of ex-ante and ex-post controls on procurement procedures managed under IMBC by the Turkish Central Contracting and Financing Unit (CFCU) (the only Turkish contracting authority for which the reduction of ex-ante controls has started);

·The audit focused primarily on the activity of the EUD.

There were no observations/reservations in Directorate-General NEAR's 2016 Annual Activity Report that relate to the area/process audited.

The fieldwork was finalised on 14 June 2017. All observations and recommendations relate to the situation as of that date.

Strengths

The Internal Audit Service identified the following strengths in the EUD:

a)
   Operational and financial staff involved in the implementation of IPA is knowledgeable about the subject and can in general efficiently manage their files in the often complicated political context.

b)
   Systematic and accurate use of checklists and project lifecycles generated from the Management Information System (MIS).

c)
   Systematic registration of "Transmission Notes" (documentation submitted by the CFCU, e.g. for ex ante approval) and "Annexes to Transmission Notes" (EUD's replies) in Ares.

d)
   Regular drafting of a "Note to the file" which represents a valuable source of information for staff members in case of an absence or a permanent departure of the desk officer responsible from the EUD.

Major audit findings

The Internal Audit Service identified one very important issue:

Implementation of control plans by the EUD to Turkey

Ex-ante and ex-post controls performed by the EUDs are an important building block to provide reasonable assurance on the procurement activities. Although the controls implemented in the EUD to Turkey were in most cases able to identify deficiencies and non-compliance, the Internal Audit Service found procurement files where the ex-post controls failed to detect issues, in particular during the evaluation phase of the procurement procedures. Moreover, the Internal Audit Service noted that in some cases ex-ante controls detected irregularities that were overruled (mainly due to the necessity to comply with the time to contract) but such exceptions were not always properly documented.

Recommendation

Directorate-General NEAR should follow up with the EUD to Turkey on the findings resulting from the Internal Audit Service' transaction testing by taking appropriate actions to address the issues identified and verify, via transaction testing during supervisory missions, if they have been adequately addressed.

Additional information provided by the Directorate-General NEAR on the measures defined and/or implemented following the Internal Audit Service audit

The implementation by Directorate-General NEAR of this recommendation is in progress. A supervision mission was carried out to the EU Delegation to Turkey in January 2018 where one of the issues which was discussed was the implementation of ex-ante and ex-post controls in IMBC (Indirect Management with Beneficiary Countries). A follow-up mission was carried out to the EU Delegation to Turkey at the end of April 2018, where the management of the ex-ante and ex-post controls in the EU Delegation were further analysed with the purpose to clarify and strengthen the Directorate-General NEAR guidelines on ex-ante and ex-post controls. An instruction note will be issued to all staff in the EU Delegation to clarify some of the internal procedures to be followed and to remind staff to respect and follow all procurement procedures

5.4.Limited review of grant and procurement procedures in the EU Delegation of Armenia – Directorate-General NEAR

Audit objectives and scope

The objective of the limited review was to assess whether procurement and grant award procedures under European Neighbourhood Partnership Instrument (ENPI) / European Neighbourhood Instrument (ENI) are managed by the EU Delegation (EUD) to Armenia in accordance with the applicable procedures and guidelines (Financial Regulation, the Procurement and Grants for European Union external actions – A Practical Guide (PRAG)).

The limited review covered selected elements of grant and procurement procedures, from drafting the guidelines for applicants/ terms of reference to the signature of the grant agreement/ contract and its amendments.

Major audit findings and recommendations

No formal audit report was addressed to Directorate-General NEAR. The consolidated findings and recommendations (including inter alia those related to the EUD to Armenia) will be presented in the final report for the Audit on the implementation of ENI which will be completed in 2018.

5.5.Audit on preparedness for the mid-term review of ENI and IPA Regulations in Directorate-General NEAR

Further to the note announcing the launch of the audit on preparedness for the mid-term review of the European Neighbourhood Instrument (ENI) and the Instrument for Pre-Accession Assistance (IPA) II Regulations in Directorate-General NEAR, the Internal Audit Service conducted a preliminary survey with the aim of gaining a better understanding of the activities and the related risks and in order to define the objectives and scope of the engagement.

The Internal Audit Service noted that at the time of the preliminary survey the mid-term review of the ENI and IPA Regulations was ongoing and had reached an advanced stage. Consequently, the original scope of the audit (i.e. Directorate-General NEAR preparedness for the mid-term review) was obsolete and would be of limited value for Directorate-General NEAR.

The Internal Audit Service analysed the remaining phases of the process until the end of the year (i.e. the finalisation of the evaluation and its consolidation into a Staff Working Document):

(1) governance, (2) monitoring, (3) contractual set up, (4) supervision of the consultant's work, and (5) compliance with the Better Regulation package and noted that the main risks under Directorate-General NEAR's control in these areas are either not very significant or that mitigating actions have already been implemented.

Consequently, the Internal Audit Service decided to close the audit.

6.EDUCATION AND CITIZENSHIP

6.1.Consulting report on Directorate-General EAC's process to granting full financial autonomy to the EIT

Objectives and scope

The objective of the consulting engagement was to review the methodology applied and the procedures and processes followed by Directorate-General EAC to grant full financial autonomy to the European Institute of Innovation and Technology (EIT) and provide advice to Directorate-General EAC on how it could improve its methodology to make it fit for purpose.

The scope of the consulting engagement covered the key elements and phases of the readiness assessment, notably:

·The methodology used by Directorate-General EAC to assess if all conditions for delegating the budget implementation (Article 60 of the Financial Regulation) and for granting full financial autonomy to the EIT are fulfilled;

·The processes and procedures followed by Directorate-General EAC to implement the methodology;

·Directorate-General EAC's analysis of open issues from the 2011 decision to grant partial financial autonomy as well as the state of play of the implementation of European Court of Auditors, Internal Audit Service and the EIT's IAC audit findings.

Issues for consideration

The consulting engagement resulted in a number of issues for consideration. As this was a consulting engagement and not an audit, the Internal Audit Service will not follow-up on these issues.

6.2.Audit on Erasmus+ and Creative Europe – grant management phase 1 (from the call to the signature of contracts) in EACEA

Audit objectives and scope

The objective of the audit was to assess the adequacy of the design and the effectiveness of EACEA's internal control system for the first phase (from call to contract) of the grant management process for Erasmus+ and Creative Europe under the 2014-2020 programming period.

In particular, the audit assessed whether:

·The controls that are in place provide reasonable assurance regarding compliance with the relevant legal framework;

·The calls for proposals effectively support the achievement of the programmes' objectives;

·The processes in place ensure that the highest quality projects are selected and translated into grant agreements, in compliance with the applicable rules.

There were no reservations in the 2016 Annual Activity Report of EACEA that relate to the audited area.

The fieldwork was finalised on 21 September 2017. All observations and recommendations relate to the situation up to this date.

Strengths

The Internal Audit Service recognised the ongoing efforts made by EACEA to perform a timely selection of grant proposals. Despite significant workload and time pressure, the Agency effectively reacted to requests from applicants throughout the submission process and provided the necessary information, thus facilitating the application process for potential applicants. The Agency continuously provided information and clarifications to the external experts using a dedicated electronic platform (Ning) to ensure they acquire an in-depth understanding of the policy objectives of the evaluated actions.

Major audit findings

The Internal Audit Service identified one critical and eight very important issues:

Control environment (one very important issue)

A comprehensive risk analysis for the financial circuits for the current programming period had not been performed and in addition, procedures and guidance documents were incomplete, outdated, inconsistent or not adequately approved.

Evaluation process (one critical and three very important issues)

The critical issue concerned the lack of evidence that the evaluation committees had actually performed their evaluations as stipulated by the Financial Regulation, i.e. had based their final conclusions on reviews and deliberation of all the proposals and not by simply endorsing the work of external experts who assist them.

The three very important issues relate to the lack of an appropriate evaluation methodology for each individual call, no checks for conflict of interest with the experts as well as confusion between selection and award criteria. Moreover, the award decisions taken by the Agency did not contain the names of the rejected candidates and the reason for their rejection.

Contracting phase (three very important issues)

Adjustments to the grant proposals were made without the required recommendations by the evaluation committee, there were derogations from the non-retroactivity principle applicable to grants and application of a wrong methodology for calculating the time to grant.

MEDIA sub-programme (one very important issue)

The Internal Audit Service found deficiencies specific to the implementation of actions under the Creative Europe Media programme. In particular, non-appointment of an evaluation committee for the evaluation of reinvestment proposals, adjustments to proposals based on criteria not announced to applicants, as well as weaknesses in the performance of eligibility checks.

Recommendations

Control environment

EACEA should perform a comprehensive risk analysis to assess which financial circuits model(s) would be the most appropriate for the current programmes that the Agency is managing. In addition, the Agency should (1) update and complete its guidance on grants management and ensure they are approved in line with the formal requirements, (2) update its procedures for registering exceptions in line with the corporate requirements, and ensure that all instances of overriding controls or deviations from established processes and procedures are duly documented and reported and (3) update its anti-fraud strategy.

Evaluation process

Role of the evaluation committee

The Agency should ensure that the evaluation committees form final conclusive opinions on all the grant applications based on review and deliberations as required by the legal framework. As a minimum, the evaluation committees should review all the consolidated assessments from the external experts assisting them. Furthermore, the evaluation reports produced by the evaluation committees should contain for all the evaluated applications an assessment of their quality (justification).

Organisation of the evaluation process

The Agency should develop an evaluation methodology and ensure that it is effectively applied by the evaluation committees. It should also ensure the use of an evaluation report template that contains the minimum information the Authorising Officer needs to be able to take an informed decision when signing the award decision. Moreover, the Agency should establish a procedure for systematically collecting and analysing feedback from the external evaluation experts, which should serve to improve the design and the implementation of the evaluation process. Implementation of these corrective actions should be regularly monitored.

External Experts

As mitigating measures, the Agency should establish a methodology for performing checks aimed at timely detecting and addressing problems with the reliability of the declarations of conflicts of interests of experts evaluating proposals. In addition, the EACEA should structure and harmonise the tasks performed by its staff to monitor the quality of the experts' work, document this monitoring and share the results with the members of the evaluation committee.

Effectiveness of the evaluation process

The Agency should ensure that (1) call documents and the ensuing evaluation clearly distinguish between selection criteria and award criteria; (2) the electronic grant management system is used consistently for eligibility checks and appropriate checklists are drawn up for each call; (3) the award decisions contain the names of the rejected applicants and the reasons for their rejection; and (4) rejected applicants are notified in line with the procedure adopted by the parent Directorates-General.

Contracting phase

Actions preceding the award decision

EACEA should modify its guidance on adjustments to grant proposals and ensure that adjustments to grant proposals are only proposed on the basis of recommendations of the evaluation committee. Furthermore, EACEA should review its processes to ensure that contracts are not signed with organisations for which the Participant Identification Code has not been validated.

Non-retroactivity principle

EACEA should consult the Directorate-General Budget on the legality of derogating from the principle of non-retroactivity applied so far for Erasmus+ and Creative Europe and, based on their advice, revise its related internal procedures accordingly. The Agency should also ensure that derogations from the principle of non-retroactivity are duly justified and formally adopted as required by Article 130(1) of the Financial Regulation and the basic act and do not go beyond the cases permitted by the legislation.

Calculation of the Time-to-Inform (TTI) and Time-to-Contract (TTC)

EACEA should apply the Commission guidance for calculating the time-to-grant, basing the calculation at call level on the time when the last applicant has been informed and the last grant agreement has been signed. It should also report in the Annual Activity Report the percentage of the applications for which the deadlines/targets have been met.

MEDIA sub-programme

Distribution schemes under the MEDIA sub-programme

EACEA should systematically set up an evaluation committee to assess the eligibility and award criteria for the second phase of the Automatic scheme (re-investment). In addition, the Agency should strictly apply the pre-announced award criteria when evaluating applications.

Additional information provided by the EACEA on the measures defined and/or implemented following the Internal Audit Service audit

The Agency has put in place an action plan, which has been accepted by the Internal Audit Service. Whilst the present audit is limited to the Erasmus+ and Creative Europe programmes, EACEA applies the action plan to all delegated programmes.

Concerning the critical recommendation, the Agency has revised the relevant procedures, guidelines and templates on the evaluation/selection process and applied them to all the new calls of the year 2018.

The Internal Audit Service conducted a limited follow-up in March 2018 to assess the progress in the implementation of the action plan.

Following the above mentioned limited follow up audit, the critical recommendation (very high risk) was downgraded to 'very important' (high risk) level.

Concerning the other recommendations, the Agency has in particular updated and adopted:

- its General Grant Management Procedures;

- Guidelines to prepare an award decision and on providing feedback to applicants;

- Guidelines on recording exceptions and non-compliance events;

- the Anti-Fraud Strategy;

- the Internal Review System to ensure a fair and transparent procedure to deal with complaints challenging the rejection of grant applications;

- Guidelines on governance of documents.

The risk assessment on financial circuit will be completed by mid-2018.

In addition, the rules to calculate "time to inform" and "time-to-contract" KPIs have been updated, in line with Directorate-General BUDG guidance and already used to calculate the 2017 AAR KPIs. The Internal Audit Service checked them in the limited follow-up audit and the related recommendation was downgraded from 'very important' (high risk) to 'important' (medium risk) level.

Furthermore, for the Creative Europe/MEDIA programme, the Agency has issued instructions to assure that derogations to the non-retroactivity principle are duly justified and formally adopted. In addition, the sampling on eligibility checks has been abolished, an evaluation committee for the second step of evaluation (for Automatic Scheme) has been already nominated and the call guidelines have been updated to ensure transparency (all criteria are now published in the call). The recommendation related to Distribution Schemes under the MEDIA sub-programme was downgraded from 'very important' (high risk) to 'important' (medium risk) level following the Internal Audit Service limited follow up audit.

Beyond the measures included in the action plan, the Agency put in place further actions, such as the dedicated training of all staff involved in the selection process, additional ex-ante controls and information sessions by the Agency's Director and the RMIC, aimed at raising awareness among the staff over the importance of the action plan.

All the Internal Audit Service recommendations stay open for the time being, while waiting for a full Internal Audit Service follow up audit in the second half of 2018. At that time, a critical mass of finalised calls, evaluation reports and award decisions will allow for a complete opinion on the level of implementation of the action plan.

6.3.Audit on HR management in EACEA

Audit objectives and scope

The objective of the audit was to assess if EACEA designed and implemented an adequate Human Resource (HR) management process to deploy a competent (knowledgeable) and engaged workforce in order to deliver its priorities and core business.

In particular, the audit assessed the effectiveness of the following processes:

·The design and implementation of the HR Strategy;

·The HR planning process, including workload assessment and staff allocation;

·Selection, recruitment and retention of staff;

·Knowledge management (learning and development, competence management and coaching);

·Monitoring, reporting and communication on HR.

There were no observations and/or reservations in the 2016 Annual Activity Report of EACEA that relate to the area/process audited.

The fieldwork was finalised on 16 October 2017. All observations and recommendations relate to the situation as of that date.

Major audit findings

The Internal Audit Service identified three very important issues:

Strategic HR management (HR strategy, monitoring and reporting on HR objectives)

The various components of the HR strategic framework (HR strategy, Learning and Development Framework and Knowledge Management Strategy) are not fully coherent. Moreover, the strategic objectives are not accompanied by specific indicators and targets to enable monitoring and reporting on the progress made toward their achievement. Finally, the Agency has not translated its HR-related strategies into an annual HR plan presenting the short-term operational activities that need to be implemented in order to respond to HR challenges and to contribute to the achievement of the overall strategic HR goals.

Organisational structure

The organisational structure in place in the Agency, where sectors are created in each unit, is not formally reflected in SYSPER2. Consequently, the delegation of HR-related tasks from the Head of Unit to the Head of Sector (management of leave and absences, annual appraisal exercise) are not encoded in the system and thus the tasks are managed manually which is both inefficient and prone to error. Additionally, job descriptions are not harmonised across the agency and the internal guidelines on establishing job objectives do not cover all the job profiles currently present in the Agency.

Selection process for contract agents

The selection process for contract agents as designed and implemented in the Agency does not always ensure the respect of the principles of transparency, objectivity and fairness. The Internal Instructions do not cover important steps of the selection process and do not assign clear responsibilities to the key actors, in particular the Selection Committee and its members. Moreover, the selection procedures sampled do not always comply with the existing instructions/guidance and are not adequately documented.

Recommendations

Strategic HR management (HR strategy, monitoring and reporting on HR objectives)

The Agency should complete the HR strategy ensuring that the priorities and strategic objectives are well identified and translated into short to medium term actions in an HR annual plan where indicators and target are set in order to measure the progress toward the achievement of these objectives. The current HR dashboard should also be reviewed and enhanced with additional data in order to serve as a performance monitoring tool.

Organisational structure

The Agency should update the organisational structure in SYSPER2 by formally creating sectors within the units and assigning staff to them so that delegated powers can be officially recognised and used within the system. Additionally, EACEA should review the existing job profiles, titles, descriptions and objectives and on this basis develop standardised ones for the whole Agency.

Selection process for contract agents

The Agency should revise, update and consistently implement its Internal Instructions for the selection of Contract Agents, clearly define the roles, responsibilities and obligations of the main actors of the process (including reporting on conflict of interest and adhering to the principle of confidentiality) and better document the selection process, including the approval decision taken by the Director.

Additional information provided by EACEA on the measures defined and/or implemented following the Internal Audit Service audit

The Agency has put in place a detailed action plan including the actions presented (as per 21/6/2018) below.

- Regarding the recommendation N°1, a revised HR Strategy has been prepared, which aligns the HR policies with the EACEA strategic objectives. Stemming from this revised HR Strategy document, an Annual HR Plan including operational objectives and actions with KPIs and clear target dates, responsible actors and progress status, has been finalised. A reviewed HR dashboard, complemented by additional statistics, has been prepared and is being presented to the Management meeting on a quarterly basis.

- Concerning the recommendation N°2, the Agency has tabled the validation of the current organisational structure at the first Steering Committee meeting of 2018 (26/02/2018); the validated organisational structure has been subsequently encoded in SYSPER2 in collaboration with the parent DGs, with entry into effect as of 01/04/2018 . Existing job titles, job descriptions and objectives have been reviewed in order to ensure harmonisation across the Agency and the updated catalogue covering all Agency's functions have been endorsed by the Management meetings of 31/01/2018 and 07/06/2018.

- Regarding recommendation N° 3, Internal instructions concerning Selection procedures for Contract agents have been fully reviewed and updated taking into account all audit recommendations and the new Implementing Rules on employment conditions of contract staff which entered into force for the EACEA on 1 January 2018.

7.ECONOMIC AND FINANCIAL AFFAIRS

7.1.Audit on enforcement of the EU antitrust policy in Directorate-General COMP: cooperation with EU national competition authorities and national courts

Audit objectives and scope

The objective of the audit was to assess the arrangements put in place by Directorate-General COMP to ensure an effective cooperation with the EU national competition authorities and national courts in order and to enable a consistent enforcement of the antitrust policy at EU level.

The audit covered Directorate-General COMP's activities contributing to the consistent application of the EU antitrust policy, including the operational procedures underlying the cooperation with the EU national competition authorities and the national courts, and the Commission's initiative to foster cooperation.

This audit focused on the process under the responsibility of Directorate-General COMP.

There were no observations/reservations in Directorate-General COMP's 2016 Annual Activity Report that relate to the area/process audited.

The fieldwork was finalised on 26 January 2017. All observations and recommendations relate to the situation as of that date.

Strengths

a)
   Support beyond the formal obligations under Regulation 1/2003. Directorate-General COMP not only provides a formal assessment of the envisaged decisions on antitrust drafted by the national competition authorities, but also provides informal comments and support, with the aim of establishing a trusting and respectful relationship. In addition, Directorate-General COMP coordinates a large network of Working Groups, to ensure knowledge sharing and to enhance consistency. These two activities go beyond the formal obligations under Regulation 1/2003 and have been positively assessed by the main stakeholders in the 2014 survey on 'EU competition policy'.

b)
   Effective management of cooperation with National Competition Authorities and National Courts. Directorate-General COMP succeeded in establishing an effective relationship with its counterparts in the Member States. In particular, the Internal Audit Service observed the following, in terms of Directorate-General COMP's performance:

1.
   Commission's time-to-reply in 2016 to the envisaged decisions of the national competition authorities: on average, within the threshold of 30 days defined under Art. 11(4) Regulation 1/2003;

2.
   Commission's time-to-reply to the information or opinion requests of the national courts during the last 5 years: on average, more than 8 days lower than the thresholds defined under art. 22 and 28 of the Commission Notice 2004/C 101/04 (four months for the opinion requests, and one month for the information requests);

3.
   Compliance rate of national judgments measured against Commission replies to requests for opinions (2015): 100%;

4.
   Compliance rate of national judgments with Commission 'amicus curiae' briefs (2015): 100%;

5.
   Acceptance rate of the national competition authorities' final decision with the comments provided by Commission (2015): 90%.

Major audit findings

The Internal Audit Service identified one very important issue:

Cooperation with the national courts

The Commission has not received complete information from some Member States on the content of the national judgments related to the enforcement of EU antitrust law, as required by Regulation 1/2003. The Internal Audit Service observed that the Commission has never performed an adequate evaluation of the root-causes for non-cooperation, such as assessing whether appropriate procedural rules were adopted by the Member States, as required by Commission Notice 2004/C 101/04.

Recommendation

Directorate-General COMP should perform an assessment of the root causes of the limited cooperation from the national courts. Based on the results of this assessment, Directorate-General COMP should take appropriate actions to enhance cooperation.

Additional information provided by Directorate-General COMP on the measures defined and/or implemented following the Internal Audit Service audit

In response to the audit finding by Internal Audit Service, Directorate-General COMP developed an action plan that the Internal Audit Service assessed as satisfactory.

7.2.Audit on financial management of procurement contracts and grants in  Directorate-General COMP

Audit objectives and scope

The audit assessed the adequacy of Directorate-General COMP's management of grants, procurement and the related financial transactions. In particular, it reviewed the design and implementation of the controls in place to assess whether they ensure the legality and regularity of the financial procedures and transactions and whether they are effective and efficient.

The audit covered the controls carried out on procurement and grants procedures completed in 2016 and on the financial transactions executed in 2016.

There were no observations or reservations in Directorate-General COMP’s 2016 Annual Activity Report that relate to the audited process.

The fieldwork was finalised on 9 June 2017. All observations and recommendations relate to the situation as of that date.

Strengths

Overall, Directorate-General COMP's management of grants, procurement and the related financial transactions complies with the applicable rules and regulations. Directorate-General COMP manages the calls for proposals and tenders effectively and has in place adequate controls to review, report and monitor the expected results.

In particular, the audit team identified the following good practices:

a)
   Grants:

·A dedicated team in Unit A4, composed of three staff members, manages the grant process, from the publication of the call to the closing of the grant;

·The staff members attended appropriate training from the Directorate-General Budget on management of grants and are adequately trained;

·The finance Unit (Unit R2) provides an active support to Unit A4, responsible for the grants management, and acts as a quality reviewer for the preparation of the calls for proposals, the evaluation and awarding process and the financial management of the grants along their lifecycle.

b)
   Procurement:

·The financial circuit for procurement is centralised and the financial team in Unit R2 plays a key role. The members of the financial team have a very good expertise and a long experience in procurement management and in Directorate-General COMP and provide an active support to the operational units throughout the procurement life-cycle (from the identification of needs through the drafting of the tender documents up to the final payment and closing of the procurement procedure);

·All purchase, renting, move of IT equipment and IT services must be requested through ABAC Assets Forms of Directorate-General DIGIT. Each request follows the workflow in ABAC Assets, which includes a number of controls and validation checks.

c)
   Financial Management:

·A strong ex-post control strategy and reporting is in place, with a combination of risk-based and random sampling, and a clear description of the control approach and of the test results;

·Pre-financing (as a percentage of total funding) allocated for grants was reduced from 80% to 50% in 2011 to avoid recoveries and to encourage beneficiaries to reduce delays of submission of their final deliverables.

Major audit findings

The Internal Audit Service did not identify any critical or very important issues.

7.3.Audit on the governance and operational organisation of the Investment Plan for Europe in Directorate-General ECFIN

Further to the note announcing the launch of the audit on the Governance and operational organisation of the Investment Plan for Europe, the Internal Audit Service conducted a preliminary survey with the aim of gaining a better understanding of the activities and the related risks and in order to define the objectives and scope of the engagement.

During the preliminary survey phase, the Internal Audit Service was in close contact with the European Court of Auditors which was performing a performance audit on the European Fund for Strategic Investments, for which it plans to publish a Special Report in 2018. It was confirmed that the scope of the Internal Audit Service audit will be covered by the audit work planned by the European Court of Auditors. In order to avoid overlaps with the European Court of Auditors' work, the Internal Audit Service decided to close the audit.

7.4.Audit on HR management in EASME

Audit objectives and scope

The objective of the audit was to assess the effectiveness of the Human Resource (HR) management process in EASME. In particular:

·The design and implementation of the HR strategy;

·The HR planning process, including workload assessment and staff allocation;

·Selection, recruitment and retention of staff;

·Knowledge management (competency management, learning & development and coaching);

·Monitoring and reporting on HR.

There were no observations/reservations in the 2016 Annual Activity Report of EASME that relate to the area/process audited.

The fieldwork was finalised on 24 March 2017. All observations and recommendations relate to the situation as of that date.

Strengths

The Internal Audit Service recognised the continuous efforts made by EASME to ensure that all posts are filled with qualified staff. The following strengths were specifically identified during the audit:

a)
   Service oriented support. All the staff interviewed during the audit gave a positive assessment of the support given by the HR sector.

b)
   Learning and Development. All operational Heads of units/sector interviewed gave positive feedback about the newcomer integration programmes, learning and development strategy, organisation of training sessions and well-being actions.

c)
   IT tools. Development of a local monitoring and reporting tool HERO used to report on HR indicators, and the use of the Cornerstone IT tool to overcome the problems with EPSO CAST (Contract Agents Selection Tool) database.

Major audit findings

The Internal Audit Service did not identify any critical or very important issues.

7.5.Audit on H2020 project management in EASME

Audit objective and scope

The objective of the audit was to assess the effectiveness of the project management process in EASME.

In particular, the audit assessed whether:

·The internal control system related to the project management process was adequately designed (for the parts which are specific to the Agency and not defined centrally by the Common Support Center) and effectively implemented;

·EASME was effectively monitoring project implementation by the beneficiaries;

·The grant amendment process was effective and ensured compliance with the legal provisions;

·The existing procedures ensured effective monitoring of the dissemination and exploitation activities and identification of the projects with potential for communication by the Commission.

There were no reservations in the 2016 Annual Activity Report of EASME that relate to the audited area.

The fieldwork was finalised on 12 December 2017. All observations and recommendations relate to the situation up to this date.

Strengths

The Internal Audit Service identified the following strengths:

a)
   Representatives of EASME participate in different working groups of the Common Support Centre, which enables EASME to put forward the specificities of its sub-programmes. This also confirms EASME's efforts for the continuous improvement of its processes.

b)
   There is good cooperation between the operational units and the central financial unit, with the financial team providing active support to the operational units throughout the grant life-cycle.

c)
   The project officers attended appropriate training courses on grant management and are adequately qualified and experienced.

d)
   For the management of project amendments, detailed comments, justifications and additional checks related to the approval process are recorded in the IT system COMPASS.

Major audit findings

The Internal Audit Service did not identify any critical or very important issues.

7.6.Audit on evaluation in Directorate-General ECFIN

The objective of the audit was to assess if Directorate-General ECFIN is carrying out evaluations in compliance with the Better Regulation requirements and if the evaluation process is effective and efficient.

The audit covered the key controls designed and implemented for the evaluation process in Directorate-General ECFIN, including the internal organisation of the process as well as the monitoring and reporting activities related to it.

The audit engagement covered evaluations finalised by Directorate-General ECFIN during 2015 and 2016 as well as ongoing evaluations as at the end of July 2017 (i.e. only evaluations performed completely or at least partially, which are based on the Better Regulation framework that entered into force in May 2015).

There were no observations/reservations in the 2016 Annual Activity Report of Directorate-General ECFIN that relate to the area/process audited.

The fieldwork was finalised on 23 October 2017. All observations and recommendations relate to the situation as of that date.

Strengths

The Internal Audit Service acknowledged the improvements made in the internal evaluation procedures following the entry into force of the Better Regulation. In particular:

a)
   The evaluation function was moved to unit A1 (responsible for policy and economic surveillance) and was better integrated into the policy development cycle as a consequence.

b)
   The Directorate-General modified its internal "Evaluation Charter" which is fully aligned with the Better Regulation requirements.

In addition, Directorate-General ECFIN's evaluation sector is actively represented in the Inter Service Steering Groups (ISGs); staff of the Directorate-General actively participates in the discussions within the ISGs by providing valuable expertise and thus influencing the efficiency and effectiveness and the timely completion of evaluations in the Commission.

Major audit findings

The Internal Audit Service did not identify any critical or very important issues.

7.7.Audit on financial management of procurement and grants in Directorate-General FISMA

The objective of the audit was to assess the adequacy of the design and the effective implementation of Directorate-General FISMA's internal control systems for the management of the grant and the procurement process and the effectiveness and efficiency of the related financial circuits.

This audit covered the following processes:

·The procurement process, from the determination of the needs and planning to the effective implementation of the contract;

·The grants process, from the grant agreement to the management reporting and the closure of the grant;

·The financial circuits for the processing of the transactions under grants, procurement, and administrative expenditure (commitments, payments, de-commitments and recovery orders),

·The corrective capacity of the Directorate-General (design and implementation of the capacity of the Directorate-General to detect, correct and recover any undue payment).

The audit focussed specifically on controls carried out on the financial transactions executed by Directorate-General FISMA in 2016-2017 and procurement and grants procedures completed in 2016 and up to 15 May 2017.

The engagement covered all types of transactions directly managed by Directorate-General FISMA, i.e. for which the Director-General of Directorate-General FISMA acts as Authorising Officer by Sub delegation.

There were no observations/reservations in the 2016 Annual Activity Report of Directorate-General FISMA that relate to the area/process audited.

The fieldwork was finalised on 16 November 2017. All observations and recommendations relate to the situation as of that date.

Strengths

a)
   Directorate-General FISMA has put strong controls in place for the entire financial management cycle and thereby ensures sound financial management in the Directorate-General.

b)
   Over the last few years, Directorate-General FISMA has developed a set of standardised and comprehensive procedures and related checklists for the management of both procurement and grants. They are completed, when necessary, by targeted guidance notes in specific areas of concern (e.g. factsheets on sensitive and key procurement related subjects as well as guidance notes on the management of study contracts). These procedures are available on the Directorate's -General intranet and supported by staff training.

c)
   To create an efficient audit trail for financial management, Directorate-General FISMA uses dedicated monitoring tools for example for procurement procedures and the follow-up of studies procured externally.

Major audit findings

The Internal Audit Service did not identify any critical or very important issues.

7.8.Limited review of the calculation and the underlying methodology of the residual error rate for the 2016 reporting year in Directorate-General GROW

Audit objectives and scope

The objective of this limited review was to examine the calculation and underlying methodology of the residual error rate (RER) reported by Directorate-General GROW in its (draft) 2016 Annual Activity Report (AAR), and in doing so, help the Directorate-General mitigate the discharge risk by enabling it to take appropriate actions, if any, before their disclosure in the final Annual Activity Report and Annual Management and Performance Report (AMPR).

The review covered the following aspects:

·The process and methodology for the calculation of the RER of the different programmes managed by Directorate-General GROW;

·The calculated RERs;

·The presentation of the RERs in the draft and final versions of the Annual Activity Report;

·The compliance with the Directorate’-General Budget instructions for the 2016 Annual Activity Report.

The Internal Audit Service reviewed the draft 2016 Annual Activity Report and the preliminary RER calculations available on 20/02/2017, as well as its amended version dated 24/02/2017. It also reviewed the final 2016 Annual Activity Report (dated 31/03/2017) to check whether the issues detected and reported to Directorate-General GROW during the fieldwork were correctly addressed.

The limited review fieldwork was finalised on 17/03/2017. All observations and recommendations relate to the situation as of that date.

Strengths

The Internal Audit Service recognised the on-going efforts made by Directorate-General GROW to improve its error rate calculation methodologies, despite the high turnover of staff, which made the exercise this year particularly challenging for the Directorate-General.

Major audit findings

The Internal Audit Service identified two very important issues:

Methodological guidance, planning and organisation

Directorate-General GROW had not established written procedures and tools to guide the process to calculate the RER for all the different programmes (i.e. defining roles and responsibilities of the different actors, methodologies to be applied in the calculation of the error rate for all programmes and monitoring arrangements to ensure the quality of the results disclosed in the Annual Activity Report).

Error rate for space-delegated programmes

Directorate-General GROW used a non-statistical sampling methodology for its ex-post audits and calculated the error rate as a ratio between the detected error and the total population (and not the audited amount). Moreover, Directorate-General GROW estimated that the RER is equal to zero due to the correction of errors in the framework of the clearing of pre-financing. However, the correction (cleaning) only applies to errors in the audited population, while the non-audited amounts, if affected by errors, will not be cleaned. Consequently, it cannot be assumed that the residual error for the whole population is nil and therefore the figure shown by the Directorate-General is underestimated. However, the Internal Audit Service recalculation of the RER for 2016 did not result in any material difference impacting the declaration of assurance.

In addition, Directorate-General GROW calculated a consolidated error rate covering all the individual programmes implemented by the European Space Agency (ESA), irrespective of the different underlying and related controls systems. For space programmes implemented by other delegated bodies than ESA, the Annual Activity Report did not mention the elements that support Directorate-General GROW's estimated error rate.

As a result of the discussions during the fieldwork with the Internal Audit Service and the Directorate’-General Budget, Directorate-General GROW decided to disclose an error rate for the space-related programmes of 0.5% in its final 2016 Annual Activity Report.

Recommendations

Methodological guidance, planning and organisation

Directorate-General GROW should establish a comprehensive Directorate-General-level plan, a calendar and a comprehensive procedure for the RER calculation in the context of the preparation of the Annual Activity Report. In particular, the Directorate-General should clarify roles and responsibilities of the actors involved in the process and the methodologies to be followed for calculating error rates for each of the programmes managed.

Error rate for space delegated programmes

Directorate-General GROW should ensure the completeness, correctness and consistency of the information disclosed in the Annual Activity Report with regard of the methodology used for the calculation of the detected and residual error rates for the space-related programmes and the conclusion drawn in terms of assurance.

Additional information provided by Directorate-General GROW on the measures defined and/or implemented following the Internal Audit Service audit

The actions related to the limited review of the calculation and underlying methodology of the residual error rate for the 2016 reporting year in Directorate-General GROW have been postponed to begin 2018.

  

Directorate-General GROW took the following actions in the first quarter of 2018:

- Directorate-General GROW R1 documented in guidelines the procedure for the calculation of the residual error rates (RER) of the programmes managed by Directorate-General GROW. In the context of the AAR preparation, the document presented the calendar for the RER calculation, including the process, clarifying the roles and responsibilities, and the calculation of the RER on the different programmes. Directorate-General GROW still needs to detail more the sampling methodology in the process of transactions' testing.

- In the 2017 AAR, the error rate detected was indicated per programme as well as the reasons supporting the declaration of assurance. Directorate-General GROW disclosed separate error rates per programme in the body of the AAR.

7.9.Audit on the accuracy of information on the Internal Market in Directorate-General GROW

Further to the note announcing the launch of the audit on the accuracy of the information on the Internal Market in Directorate-General GROW, the Internal Audit Service conducted a preliminary survey with the aim of gaining a better understanding of the activities and the related risks and in order to define the objectives and scope of the engagement.

Given the overlap between this engagement and the multi-Directorate-General audit on non-European statistics, the Internal Audit Service decided to close the audit.

7.10.Audit on the supervision of the implementation of the Copernicus programme in Directorate-General GROW – phase 1: control strategy on ESA entrusted budget

The objective of the audit was to assess if Directorate-General GROW had defined and implemented an adequate control strategy to enable it to obtain assurance about the legality and regularity of the budget implemented by the European Space Agency (ESA).

In particular, the audit covered the control activities performed by Directorate-General GROW Units I.2, 0.2 and R.1 for the period from 2014 (signature of the Delegation Agreements (DA)) to 2017 (end of the fieldwork), with a focus on:

·The design of the control strategy for the budget entrusted to ESA;

·The effectiveness of the implementation of the control strategy, including the use of the control tools provided for by the DA to monitor ESA's activities (i.e. the Procurement Board, the EU-ESA Copernicus Board, the high level monthly meetings and the planning documents and regular reports submitted by ESA);

·The controls on Directorate-General GROW's payments to ESA and the clearings.

Major audit findings

The Internal Audit Service did not identify any critical or very important issues.

7.11.Audit on internal processes supporting trade policy negotiations in Directorate-General TRADE

Audit objectives and scope

The objective of the audit engagement was to assess if the internal processes supporting trade policy negotiations are effective and efficient across the Commission.

In particular, the audit covered:

·The corporate structure: roles, responsibilities and tasks of the Commission actors involved in trade negotiations (Directorate-General TRADE and other Directorates-General);

·The strategy for trade negotiations: awareness, translation into specific objectives and concrete actions, and monitoring;

·The internal organisational and operational processes and procedures: planning, monitoring, reporting, Human Resource and quality assurance aspects;

·Communication and information flows around trade negotiations, within the Commission and towards external stakeholders;

·Security and confidentiality.

The main auditees were Directorate-General TRADE's horizontal units in Directorate A, Trade Strategy unit G1, selected geographical and sectorial units and a sample of other Directorates-General involved in trade negotiations (Directorates-General AGRI, GROW, TAXUD, SANTE and COMP).

There were no observations or reservations in the 2016 Annual Activity Report of Directorate-General TRADE that relate to the area/process audited.

The fieldwork was finalised on 12 July 2017. All observations and recommendations relate to the situation as of that date.

Strengths

The Internal Audit Service recognised the ongoing efforts made by Directorate-General TRADE to manage trade negotiations, in particular:

a)
   In October 2015, the Commission adopted a new strategy called "Trade for all – Towards a more responsible trade and investment policy" which encompasses concrete actions to achieve the Commission trade objectives. The first progress report on the implementation of the Strategy was issued on 13 September 2017 and in this context Directorate-General TRADE took stock of recent events and evaluated their impact on future trade policy.

b)
   In January 2016, Directorate-General TRADE set up three Working Groups to identify ways to improve efficiency around trade negotiations. One of the outcomes of the Working Groups was the creation in June 2016, of Directorate-General TRADE's Senior Management Group on Free Trade Agreements Coordination and Coherence (hereinafter referred to as FTA Coordination Group). It has the twofold mandate of ensuring a) resource prioritisation (by assessing at tactical and operational level the political objectives and changing priorities) and b) internal coherence in trade negotiations and agreements. It has met on a regular basis since its creation and has already taken some concrete actions resulting in efficiency gains, notably:

-
   The creation of a rolling Negotiations Calendar for all ongoing trade and investment negotiations, which contains the dates of upcoming rounds for all negotiations planned for the next three to six months.

-
   The establishment of a baseline of two negotiating rounds per year, in order to handle increasing workload as well as staff constraints. This approach also enables the negotiators to have more time to prepare the rounds and analyse the proposals. This results in more in-depth discussions during the rounds.

-
   Development of policy standardised templates for the different chapters of the agreements to be used during negotiations, which ensure a consistent approach for chapters across negotiations, improves the legal quality of the texts already in an early stage of the negotiation, facilitates the legal 'scrubbing' process and supports the optimisation of resources.

Major audit findings

The Internal Audit Service did not identify any critical or very important issues.

8.GENERAL SERVICES 

8.1.Audit on the procurement process in DIGIT

Audit objectives and scope

The objective of the audit was to assess the adequacy of the design and the effective implementation of DIGIT's internal control systems for the management of the procurement process and the effectiveness and efficiency of the related financial circuits.

During the audit, the Internal Audit Service tested the key controls embedded in the procurement process, from the identification and planning of the needs through to the signature of the contract, including commitments. In addition, the Internal Audit Service reviewed a sample of payments, including amendments of contracts and, if applicable, price revisions.

Furthermore, the Internal Audit Service reviewed DIGIT's preparations for managing a new framework contract to procure IT services for an estimated amount of EUR 1 200 million.

There were no observations/reservations in the 2016 Annual Activity Report of DIGIT that relate to the area/process audited.

The fieldwork was finalised on 20 November 2017. All observations and recommendations relate to the situation as of that date.

Strengths

The Internal Audit Service recognised the ongoing efforts made by DIGIT to create a strong control environment. In particular, the Internal Audit Service identified the following good practices in relation to high value procurement procedures:

a)
   DIGIT prepares appropriate strategy papers before the procedure is launched. These take into account the lessons learned from previous contract(s) and the analysis of the different procurement options that exist on the market for acquiring the goods/service needed.

b)
   DIGIT holds debriefing meetings with unsuccessful tenderers, aimed at obtaining feedback in order to consider any suggestions for improvement for future procurement procedures. In addition, DIGIT sends letters to potential contractors, inquiring as to why they did not participate.

c)
   DIGIT's Procurement Board ensures that the procurement strategy is followed. The Board also monitors the implementation of the high value procurement procedures at different key stages (Orientation Document and Evaluation report).

d)
   For the new framework contract that the Internal Audit Service reviewed to assess DIGIT's preparedness to manage it, the Internal Audit Service welcomed that a working group was set up to analyse in depth the risks associated with this procedure. Different possibilities/solutions were proposed and weighed up, and representatives from Directorate-General BUDG.D3 were involved for the financial aspects.

Major audit findings

The Internal Audit Service did not identify any critical or very important issues

8.2.Audit on the charge-back of services in Directorate-General HR

Audit objectives and scope

The objective of the audit was to assess the effectiveness and efficiency of the design and implementation of the charge-back process within Directorate-General HR for the services provided to the Commission's internal and external clients. The audit also assessed compliance with the fundamental principles as laid down in the corporate guidance.

The audit covered the 2016 financial period (i.e. revenue credited in 2016 for the services delivered in 2015). However, for the catalogue of services and the costing model, and in order to be more forward-looking, the Internal Audit Service reviewed the current draft catalogue and Directorate-General HR's future costing model to assess their compliance with the recently adopted corporate guidelines.

The audit scope covered the roles and responsibilities of the various actors within Directorate-General HR (e.g. operational units, finance units). It included all types of services provided by Directorate-General HR that are subject to the charge-back mechanism. It also covered the cost recovery mechanism that Directorate-General HR uses for charging costs to its clients.

There were no observations/reservations in the 2016 Annual Activity Report of Directorate-General HR that relate to the area/process audited.

The fieldwork was finalised on 10 November 2017. All observations and recommendations relate to the situation as of that date.

Strengths

Directorate-General HR anticipated the implementation of the new provisions on the charge-back of services, in particular as regards the revision of its cost model. Although the corporate guidelines on the provision of services to other institutions, agencies and bodies were only adopted in March 2017, Directorate-General HR had already taken important steps to align its cost model with the principle of full cost recovery and to prepare a comprehensive service catalogue. This was done on the basis of the principles already defined in 2014 in the guidelines on the charge-back of services within the Commission. Thus, by March 2017, Directorate-General HR had already identified the services to be included in the new service catalogue as from 2018 and prepared draft underlying costing fiches that determine the price for each service based on a full cost methodology.

Directorate-General HR also set-up an internal cross-cutting Working Group on service-level agreements (SLAs), with the purpose to coordinate internally, harmonise practices and smoothly incorporate the provisions of the guidelines into its process. It revised the text of the SLAs to be signed with agencies and harmonised them in line with the corporate guidelines.

Major audit findings

The Internal Audit Service identified one very important issue:

Future cost model

Generally, the draft costing fiches, which underlie the future cost model, did not include the details necessary to provide a sufficient audit trail as required by the Financial Regulation. It was not clear when they were last updated, what the main assumptions and the source of the data were and whether they still reflected the latest state of play. Furthermore, some draft costing fiches still included data from 2015 and were therefore obsolete at the time of the fieldwork.

Moreover, for some services, the calculation of prices was erroneous, as it did not make reference to the correct number of working days per year, the number of working hours per day or did not convert man days into Full Time Equivalent correctly.

A survey conducted during the audit showed that Directorate-General HR's external clients are concerned by a possible significant increase in cost to be borne by them, as the new corporate guidelines require Directorates-General to apply a full cost model. However, Directorate-General HR has not yet made a comprehensive impact analysis of the new prices in order to increase the transparency of the process and to smooth the transition to the new costing model. This is relevant as, according to the information collected by the Internal Audit Service during interviews and based on Directorate-General HR's informal estimations, the increases are expected to be less than those cited by its clients in the survey.

Finally, there is no coherent policy across Directorate-General HR on the frequency of the update of the costing fiches in the future to ensure that that the parameters continue to be valid and, where necessary, prices are updated.

Recommendation

Directorate-General HR should review the draft costing fiches to ensure that the most recent available data is used and that calculation errors identified by the Internal Audit Service during the audit are corrected. Furthermore, the costing fiches should clearly document the assumptions made and identify the source of data and other criteria used in the various calculations. Moreover, Directorate-General HR should offer to its clients the possibility to receive an impact analysis of the price changes and discuss as necessary with them any potential implications for the SLAs. Finally, Directorate-General HR should perform annual updates of the costing model on the basis of an assessment of the main cost drivers for all services provided.

Additional information provided by Directorate-General HR on the measures defined and/or implemented following the Internal Audit Service audit

The necessary actions to implement the recommendations have been adopted and validated by the Internal Audit Service. All actions are set to be achieved by the deadlines defined in the action plan.

So far the actions undertaken have already resulted in the development of a new costing model incorporating the needs identified during the audit. Together with new procedures guiding staff through the new costing and invoicing process, this new model has already been presented to all DG HR staff involved in the process. Staff have also been informed of the requirement to update/validate this costing model. The progress in both recommendations issued gives sufficient assurance the deadlines will be met as agreed with the Internal Audit Service.

8.3.Audit on ethics in OLAF

Audit objectives and scope

The objective of the audit engagement was to assess if OLAF has adequately designed and effectively implemented an ethics framework in compliance with the applicable rules to ensure that it serves the EU interest, complies with ethical principles defined in the Commission's internal control framework and in the Staff Regulations and ensures that its staff behaves ethically.

In particular, the audit covered:

·The overall control environment for ethics in OLAF;

·How OLAF ensures that its activities comply with ethical standards and rules including regarding its sensitive activities and in its relations with the public;

·How OLAF ensures that staff comply with ethics rules regarding their behaviour at work and their individual obligations including their relations with public.

There were no observations or reservations in the 2016 Annual Activity Report of OLAF that relate to the audited process.

The fieldwork was finalised on 26 September 2017. All observations and recommendations relate to the situation as of that date.

Strengths

Overall, the Internal Audit Service recognised the ongoing efforts made by OLAF to ensure a solid ethics framework. In particular:

a)
   In April 2014, OLAF adopted an "Ethics and Conduct Guide for OLAF staff" (hereafter, "OLAF's Ethics Guide"), which underlines the importance of ethics in OLAF. For the areas of gifts and hospitality, this guide establishes stricter rules (zero tolerance) than the standard for the Commission, in order to avoid any reputational risk resulting from the appearance of loss of impartiality. OLAF has also developed detailed instructions to staff on how to deal with requests and contacts from the media.

b)
   The compulsory induction course for OLAF's newcomers includes a module on ethics, which covers both the standard Commission rules and OLAF's specificities.

c)
   Trainees joining OLAF have to sign a statement on ethics. OLAF has been using similar statements on ethics and security of information since 2017 for the "intra-muros" service providers (who represent approximately 16% of OLAF's headcount and are not bound by the Staff Regulations).

Major audit findings

The Internal Audit Service identified one very important issue:

Use of social media and contacts with interest groups

Regarding the use of social media, just less than half (48%) of the respondents to the survey the Internal Audit Service conducted during this audit provided correct answers on the type of opinions that a staff member can post in a blog. Furthermore, the Internal Audit Service found three examples of OLAF staff members commenting on investigations or providing the details of their "missions" in social media.

Concerning contacts with lobbyists and interest groups, 20% of the respondents to the Internal Audit Service survey had an unclear understanding of the applicable rules. Moreover, both OLAF's Ethics Guide and the information available on OLAF's intranet do not refer to the Commission's guidelines on contacts with interest groups.

Recommendation

OLAF should urgently remind its staff of the mandatory rules and principles on how to use the social media. OLAF should increase staff awareness on the Commission Guidelines on the use of social media and contacts with interest groups, and include guidance on this in its Ethics Guide and training courses on ethics and conduct.

Additional information provided by OLAF on the measures defined and/or implemented following the Internal Audit Service audit

All the actions foreseen in the comprehensive action plan endorsed by OLAF management regarding the use of social media and the contacts with interest groups have been implemented, except the update of OLAF's ethics guide as the deadline is fixed for October 2018. The Director-General has reminded all staff members, via a message on the Intranet, on OLAF's policy on the use of social media. A specific training course has been organised for all OLAF staff on the use of social media as well as a lunchtime debate on contacts with interests groups. The Commission guidelines on the use of social media and on the guidelines on contacts with interests groups have been made more visible on OLAF's Intranet.

A reference to these guidelines has also been added in the Newcomers package. The Commission training on how to use of social media is now part of the training path of the investigators.

8.4.Audit on the procurement process in the Publications Office

Audit objectives and scope

The objective of the audit was to assess the adequacy of the design and the effective implementation of the Publications Office's (OP) internal control systems for the management of the procurement process and the effectiveness and efficiency of the related financial circuits.

This audit tested the key controls as well as management and monitoring controls throughout the procurement process, from the identification and planning of the needs through to the signature of the contract, including amendments and price revisions, where applicable.

There were no observations/reservations in the 2016 Annual Activity Report of the PO that relate to the area/process audited.

The fieldwork was finalised on 6 October 2017. All observations and recommendations relate to the situation as of that date.

Strengths

The Internal Audit Service recognised the ongoing efforts made by the OP to create a strong control environment. In particular, the following elements were identified as good practices:

a)
   The principle of segregation of duties and the OP's financial circuit were followed in all transactions examined. The Internal Audit Service did not find any cases of non-compliance with sub-delegations.

b)
   The processing of payment transactions is very efficient and the audit did not identify any late payments in the sample. Generally, the OP processes payments well before the contractual deadlines.

The OP has a standardised system for the attribution of titles and references for each payment file in ARES, which enables the documents to be retrieved quickly. Equally, the procurement files tested were complete and well organised because of this standardised document management system.

Major audit findings

The Internal Audit Service did not identify any critical or very important issues

8.5.Consulting engagement on the efficiency of the workflow for parliamentary questions in the Secretariat-General

Audit objectives and scope

The objective of the engagement was to assess the efficiency of the workflow for written parliamentary questions (PQs) within the Commission.

The scope of the engagement covered the workflow of the PQs within the Commission and Regulatory Agencies. The scope also included BASIL, the corporate IT tool used to manage the PQ workflow. More specifically, the Internal Audit Service assessed whether this IT tool meets the business needs, in particular the approval workflow and the reporting functions.

Major audit findings

The consulting engagement resulted in a number of issues for consideration. As this was a consulting engagement and not an audit, the Internal Audit Service will not follow-up on these issues.

8.6.Audit on the financial management of the SRSS

Audit objectives and scope

The objective of the audit was twofold and encompassed compliance and performance elements:

·Firstly, the audit assessed the adequacy of the design and the effective implementation of the internal control system for financial management (legality and regularity and efficiency of the financial workflow);

·Secondly, the audit assessed the state of readiness of the Structural Reform Support Service (SRSS) to take on increased responsibility for managing the new SRSP. In this context, the Internal Audit Service analysed the SRSS's risk assessment, control strategy, business continuity measures and the implementation of the internal control standards (ICS). All these elements were analysed in respect to financial management in the Structural Reform Support Programme (SRSS).

The scope of the audit covered the design and implementation of key controls in the following processes:

·The procurement process, from the determination of the needs and planning to the effective implementation of the contract, including timely application of corrective measures, where necessary;

·The grant process, from the call for proposal, where applicable, to the effective implementation of the contract, including timely application of corrective measures, where necessary;

·The financial circuits of grants and procurements, including commitments, payments (including payment deadlines), de-commitments and recovery orders;

·Recording of exceptions and ensuring ABAC access rights;

·Reporting of the financial activity in the Annual Activity Report.

The engagement covered the year 2016 and the first three months of 2017.

Major audit findings

The Internal Audit Service identified two very important issues:

Public procurement under the Aid programme

The auditors found that the SRSS does not have a systematic and formally documented needs analysis for public procurement procedures under the Aid programme. Such an analysis is key to an effective procurement procedure and in helping to ensure that projects are ultimately successful in practice.

Furthermore, for two of the six procedures tested, the SRSS did not set the mandatory exclusion, selection or award criteria. These constitute situations of non-compliance with the Financial Regulation and its Rules of Application.

Moreover, the SRSS did not properly justify using the exception to negotiate an extension of an existing contract without prior publication. In this case and contrary to the applicable rules, the SRSS exceeded the original duration of the contract and the maximum budget. In addition, it added new tasks to the contract, which significantly changed its initial objective.

Finally, the Internal Audit Service identified cases in which the rules on ex-post publication in the Official Journal were not complied with.

Design and application of the internal control system (ex-ante and ex-post)

At the end of the audit fieldwork, the SRSS had no operating ex-post control function and its control strategy and business continuity plan were not yet finalised. The Internal Audit Service acknowledges, however, that the SRSS is currently developing them.

Furthermore, the financial circuit currently in place allowed a Head of Unit to authorise an exception he requested himself as he was deputising for the Authorising Officer by sub-delegation in that specific period. This related to the exceptional negotiated procedure mentioned in the issue above, that the Internal Audit Service considers unjustified.

Recommendations

Procurement procedures under the Aid programme

The SRSS should significantly strengthen its internal control arrangements in the area of public procurement under the Aid programme by putting in place internal control arrangements that ensure compliance with the provisions of the Financial Regulation. Furthermore, it should undertake a documented, structured and robust needs analysis, at least for every high value procurement procedure. It should also ensure compliance with the rules on ex-post publicity and organise its procurement procedure in such a way that there is no need for the supplier to start the contract before it is signed.

Design and application of the internal control system (ex-ante and ex-post)

The SRSS should review its financial circuit to ensure compliance with the principles of segregation of duties and absence of conflicts of interest. Furthermore, it should finalise the development of its ex-post control function and its control strategy and put in place a business continuity plan.

Additional information provided by SRSS on the measures defined and/or implemented following the Internal Audit Service audit

The SRSS duly assessed if the high risks identified by the Internal Audit Service in relation to the procurement procedures under the Aid Programme require a reservation. While it is considered that there had been a reputational risk linked to the incorrect application of procurement principles, it can be demonstrated that the reputational risk did not materialise and there was no impact on the reputation of the Commission. The SRSS is not aware of any complaint or other actions which would represent a reputational event.

As a consequence, the SRSS considers that the risks identified by the Internal Audit Service in relation to the procurement procedures under the Aid Programme do not fall under the scope of a reservation.

Since the end of the audit, the SRSS has already put in place corrective actions as regards the revision of the sub-delegation for commitment and the establishment of an ex-post control function. The new ex-post control strategy has been adopted in March 2018. In addition, the business continuity plan has been developed and adopted in March 2018. The SRSS started the implementation of all corrective actions agreed with the Internal Audit Service.

9.IT AUDITS

9.1.Audit on corporate IT governance framework and portfolio management (DIGIT, SG)

Audit objectives and scope

The objective of the audit was to evaluate the current corporate IT governance arrangements in the Commission, with a particular focus on the following areas:

·The effectiveness of the oversight for IT-related issues and whether there are clear roles and responsibilities in place;

·The effectiveness and efficiency of the processes which evaluate, direct and monitor value contribution of IT systems and services in the achievements of the Commission's objectives through benefit delivery, risk optimisation and resource optimisation;

·The effective oversight of IT projects, systems and services.

There were no reservations directly related to corporate IT governance arrangements in the 2016 Annual Activity Report of the audited Directorates-General.

The fieldwork was finalised on 8 November 2017. All observations and recommendations relate to the situation as of that date.

Strengths

In recent years, the Commission has significantly strengthened its corporate IT governance arrangements in recognition of the need for greater cooperation on IT developments and increased dependency on common systems. In particular, the audit noted the following strengths:

a)
   Members of the respective IT corporate governance bodies appear highly motivated in fulfilling their responsibilities with due care and professionalism.

b)
   The mandate of the IT Board is significantly broader than that of the former Information System Project Management Board (ISPMB) and now covers IT investments irrespective of their budget lines. The fact that it is under the chair of the Deputy Secretary- General for Institutional and Administrative Policies has clearly raised its profile and prominence.

c)
   Common IT services and re-usable IT components (building blocks) are promoted on an active basis.

d)
   The use of a corporate tool (GovIS2) for managing the inventory of IT assets (systems, projects, services).

e)
   There is close oversight of the Synergies and Efficiencies Review programme for the IT domain.

Major audit findings

The Internal Audit Service identified two very important issues:

Corporate IT governance framework

The IT Board is officially a sub-group of the Group of Resources Directors (GDR), which approved its mandate without further endorsement by corporate IT governance bodies. This endorsement would help to re-inforce its position and legitimacy when it monitors and evaluates IT investments in the Commission.

In 2010 the Commission decided to develop a comprehensive IT strategy and a more strategic approach to IT investments in the Commission. Although DIGIT has developed a number of initiatives with a strategic dimension, there is still no overall corporate IT strategy for the Commission as a whole. In addition, the members of the Group of Resources Directors, representing the Commission's business activity, were only able to provide limited input at the early stages of the development of such initiatives.

There is no central guidance on how IT Steering Committees (ITSC) should be set up to exercise IT governance at a decentralised level. There is also no central oversight on local IT governance arrangements aimed at identifying where common improvements may be needed.

Oversight on corporate IT portfolio

Although the IT Board has a mandate to review all IT investments, investments for ongoing IT operations (about 70% of total IT expenditure) are not subject to any corporate oversight, except for those parts which relate to the administrative IT Global Envelope.

The IT Board does not oversee active IT projects launched before the entry into force of the new corporate IT governance framework in 2015. Furthermore, in some cases inaccurate data recorded by the Directorates-General hampers initial assessment and ongoing evaluation of progress over the project life cycle. The IT Board does not receive a regular overview of the entire portfolio of IT assets (projects, systems and services). Neither does it receive information as to whether project costs and planning are on track/deviate from their initial budget and scheduling.

Business value, risks and costs are assessed at the inception phase of a project, without further assessment at regular intervals of the likelihood that projects will reach their objectives in time and within budget over their full life cycle. In addition, there is no review of lessons learned and achievement of expected benefits at the closure of a project, i.e. when the IT system or service becomes operational.

The current processes for deciding the annual allocation of funding under the IT Global Envelope consumes significant time and effort from Directorates-General and corporate IT governance bodies, which is disproportionate to the amounts at stake (less than 5% of the total IT expenditure of the Commission).

The IT Board promotes the use of common standards services and building blocks to ensure IT delivery through synergies and efficiencies gains. However, the proposed funding model involves charging a fixed annual amount irrespective of the number of actual end users, meaning that certain users bear a disproportionate amount of the cost.

Recommendations

Corporate IT governance framework

The Commission should further strengthen its corporate IT governance framework by 
  
(1) reinforcing and clarifying the role of the IT Board and its relations with other Commission corporate bodies and operational departments; (2) defining an overarching Commission-wide IT strategy providing a coherent view on IT and its alignment with Commission objectives 
  
(3) developing guidance and support on the functioning of local IT governance bodies 
  
(Directorate-General-level and project-specific IT Steering Committees).

Corporate oversight over IT portfolio

The Commission should strengthen its corporate oversight on the portfolio of IT investments, based on their respective value, risks and costs, as follows: (1) taking a risk-based approach to extend IT Board oversight to significant investments for IT operations, and major IT projects launched before the entry into force of the new governance model in 2015 (2) improving the quality of information that Commission Directorates-General and Services provide to the IT Board so that it provides an accurate and up to date situation of their IT systems, services and projects; 
  
(3) developing a process to assess and monitor the business value (benefits, risks, costs) of IT systems, services and projects over their full life cycle (4) streamlining the decision making process regarding the allocation of the IT Global Envelope; (5) ensuring a more equitable model of cost sharing for IT building blocks.

Additional information provided by Directorate-General DIGIT and the Secretariat-General on the measures defined and/or implemented following the Internal Audit Service audit

The two very important recommendations, which relate to the corporate IT governance framework and oversight of the corporate IT portfolio, were fully accepted by the auditees and an action plan was submitted to the Internal Audit Service by the Secretariat-General in association with Directorate-General DIGIT on 8 June 2018 and was considered as satisfactory by the Internal Audit Service. The implementation is foreseen respectively by end 2018 and in the course of 2019.

The actions aim at clarifying and reinforcing the IT governance arrangements to support and monitor the implementation of a comprehensive Digital Strategy to deliver a digitally transformed, user-focused and data-driven Commission.

9.2.Audit on management of IT security in DIGIT

Audit objectives and scope

The objective of the audit was to assess whether the management and control systems in place in the areas of vulnerability management and privileged user access ensure that the ICT (Information and Communications Technology) systems managed by DIGIT in its datacentres are adequately protected against cyber-attacks.

The scope of this audit covered only the DIGIT managed systems, focusing on ICT technical inventories for systems and software, monitoring of known weaknesses and vulnerabilities, security related upgrade processes, management of security exceptions and management of privilege access.

Security controls reviewed in the scope of this audit, both in the area of privileged user activity and vulnerability management, can be categorised mainly in two types: (1) preventive (e.g. mechanisms to grant access or identify potential vulnerabilities) and (2) integrity checks, after privileged activities have been performed, to enable the identification of non-compliances or unauthorised changes once occurred.

There were no observations/reservations in DIGIT's 2016 Annual Activity Report that relate to the area/process audited.

The fieldwork was finalised on 22 June 2017. All observations and recommendations relate to the situation as of that date.

Strengths

During the fieldwork a number of strengths and good practices were identified that could be more widely deployed, both inside DIGIT and across other Directorates-General. In particular, we found examples of different types of IT security controls, both preventive and detective, together with high degrees of expertise and experience which could be used to help improve security even further. More specifically:

a)
   Automated updates: different mechanisms exist for the various operating system technologies to ensure automated updates of software (patches) upon publication by the vendor.

b)
   Job/role based authorization mechanisms: two cases were noted which clearly prove the technical feasibility of having authentication/authorization models for privileged users, based on operational/business functions and corresponding technical roles in the system. In addition, we observed certain automated and regular crosscheck of users in the HAN application family (Hermes, Ares and NomCom) with the Commission staff reference user database COMREF.

c)
   Secured administration environments: some of the technologies (notably networking and operating systems, and partially databases) have implemented secured environments for administration workstations (segregation of network to provide enhanced security).

d)
   Automation of configuration deployments: some automated practices are implemented to maintain and refresh baseline configurations, for example the regular refresh of configuration files in Unix servers and regular reviews of local administrators for end user windows devices.

e)
   Audit trail: certain mechanisms have been put in place for tracing activity in SYSPER production databases, linking technical interventions to change requests.

Major audit findings

The Internal Audit Service identified two very important issues:

Assurance on the legitimacy of actions performed in production systems

Changes performed with privileged userids in production systems during day-to-day operations can be linked to formalised tickets in very few situations only. This makes it almost impossible for the Directorate-General to initiate any attempt to detect or identify suspicious activities. The root cause for this situation is a combination of technical constraints and the considerable resources that would be needed to fully address manually the issue of linking actual changes in the systems with legitimate change requests.

Mechanisms to identify suspicious activity in critical areas of the systems (e.g. firmware of appliances and integrity of critical configuration files) are generally not in place or, if they are, then they are relatively immature. This is due to a historical lack of automation technology that can facilitate compliance and integrity checks.

Regular reviews of existing privileged userids are not performed systematically for systems in production.

The DIGIT.C6 team (Digital Workplace Engineering) has made a major effort in the past years in reducing local administrator accounts in Windows workstations and laptops from more than 6 000 to 2 800. However, this is still a high number and represents around 7% of the approximately 40 000 Windows devices in the Commission.

Technical inventories of management information for security vulnerabilities 

Technical inventories, which contain for the different technologies sufficient and relevant information to manage security vulnerabilities, are not systematically maintained or lack sufficient information. They are the necessary link between the current implementation of systems in DIGIT datacentres and the corresponding vendor, community or self-discovered security alerts descriptions.

Proactive security vulnerability detection in systems in the network, in particular for the datacentre systems, is still in a very early design phase. The observed and re-performed process during the audit was not fully effective because the scope of the systems being assessed is still very small and the mode of execution is providing insufficient information due to a suboptimal use of the tool chosen.

Recommendations

Assurance on the legitimacy of actions performed in production systems 

DIGIT should improve its assurance on the legitimacy of activities of privileged users in the production IT systems. In particular, it should share among the different teams in DIGIT (and when possible advocate for them to other Directorates-General) the existing solutions and initiatives that (1) can tag legitimate session activities in an automated or semi-automated way; (2) can identify and manage baseline configurations, and cross-check them with production running instances to identify any deviations; and (3) extend the use of the current mechanisms for deploying configurations/updating inventories to detect changes in the production systems and flag these changes as legitimate or potentially illegitimate. DIGIT should also promote automated mechanisms for regularly reviewing and cleaning up potential orphan privileged user IDs by cross-checking the current groups of privileged user IDs with valid references of users and roles.

Technical inventories of management information for security vulnerabilities systems

DIGIT should improve the management of security vulnerabilities by updating the IT Security Framework derived from Commission Decision C(2017)46 with the obligation for all system owners/providers, regardless of the Directorate-General to which they belong, to: (1) define upfront the list of technical modules and register them in central repositories, before having them connected to the corporate network, and (2) maintain the repositories updated during the lifecycle of the system. In addition, DIGIT should establish and agree with the different stakeholders inside DIGIT the principles and strategy for using vulnerability scanning services to increase assurance on the security of the systems.

Additional information provided by Directorate-General DIGIT on the measures defined and/or implemented following the Internal Audit Service audit

Two very important and three important recommendations were fully accepted and an action plan was submitted to the Internal Audit Service by Directorate-General DIGIT and considered as satisfactory by the Internal Audit Service in October 2017. The implementation is foreseen mostly in 2019 and 2020. Regarding the update of the IT security Framework derived from Commission Decision C(2017)46; the Implementing Rules were adopted in December 2017.

Regarding the two very important recommendations, the following actions have been defined:

REC 1 Assurance on the legitimacy of actions performed in production systems

A) Identify improvements, document and share information, as well as, best practices in Privileged Access and Configuration Management;

B) Link Privileged Access alterations to legitimate request for change in DWP and DC services, EU login and reduce privileged user accounts for end-user devices;

C) Improve capability to identify suspicious activities compromising integrity of IT systems in DWP and DC services;

D) Improve the capability to regularly review Privileged Users rights, through automated tools, extending operational scope of process orchestration tools.

REC 2 Technical inventories of management information for security vulnerabilities

A) Build and improve the capability to maintain a central repository of technical assets supported by the IT security policy framework;

B) Build and improve the capability to do vulnerability scanning with automated and manual tools and processes, aligned with the IT security policy framework.

9.3.Audit on security of IT applications supporting nuclear accountancy and inspection processes in Directorate-General ENER

Audit objectives and scope

The objective of the audit was to assess the adequacy of the design and the effectiveness of the implementation of the management and control systems put in place by Directorate-General ENER for ensuring the security of its key information systems and data supporting nuclear accountancy and inspection processes (Euratom Safeguards).

To achieve this objective, the audit focused on:

·The structure in place for the governance of information security, with related roles and responsibilities as well as policies, standards and procedures;

·The management and monitoring of IT security services;

·The protection of information systems from circumventing logical controls through change management processes;

·The management of continuity and availability of data. the following aspects:

The scope of the audit covered the secure network infrastructure and related IT systems supporting the business processes of Euratom Safeguards. The audit focused on the following aspects:

·IT security governance structure;

·User access management through identification and authentication mechanisms with a special focus on privileges used (system and database administrators);

·Security-related documentation of the IT systems and IT applications;

·Security of servers, network components, remote connections and endpoints (e.g. hardening configuration, encryption, disposal);

·Monitoring tools and security of log files;

·Processes to test security of secure network;

·Processes to manage and test new or modified systems or applications from development to deployment into production;

·Processes ensuring availability of data (back-up procedures and tests).

The scope covered the main elements of the secure infrastructure, including network devices (i.e. firewall, routers), servers, databases, and mobile endpoints. In deciding on precisely which IT applications to examine in detail, the Internal Audit Service took into account the level of confidentiality, integrity and/or availability (criticality) declared in the corporate inventory as the main criteria.

Directorate-General ENER reported one reservation in its 2016 Annual Activity report: the residual error rate observed by ex-post controls on grant agreements signed under the Seventh Research Framework Programme was higher than the control objective (2%). This reservation has no impact on the process audited.

The fieldwork was finalised on 17 March 2017. All observations and recommendations relate to the situation as of this date.

Strengths

During the fieldwork, the Internal Audit Service noted the ongoing efforts made by Directorate-General ENER and MOVE/ENER SRD (Shared Resource Directorate) to secure the IT infrastructure and related information supporting nuclear accountancy and inspection processes in Directorate-General ENER. In particular:

a)
   The physical controls in place to prevent unauthorised access to premises and the logical access controls to prevent unauthorised connection to the secure network.

b)
   The professionalism and commitment of staff, with experience corresponding to the activities performed and exercised under a strong service management culture.

Major audit findings

The Internal Audit Service identified two very important issues:

IT Security Governance

The IT Steering Committee (ITSC) for the Luxembourg IT operations has not met since its setup in January 2015. The current security classification for Directorate-General ENER.E information systems is based on an assessment performed in 2001, which has not been updated since then. Directorate-General ENER has not yet accredited its IT systems for storing and processing EURA RESTRICTED data under the Commission's regulatory framework for handling EU classified information. In addition, certain organisational weaknesses were identified in relation to the role of the Local Informatics Security officer (LISO), a function which has not been operational in practice since December 2015 and finally, the Directorate-General does not currently have a security plan for the IT systems.

IT security risk analysis and security arrangements

There is no documented analytical basis for the current choice of security measures in place, justifying the absence of certain practices such as data encryption for databases and internal network traffic. The auditors also found that some internal servers are running a software no longer supported by the supplier, some severs had limited protection against malicious software and that there is a lack of periodic vulnerability testing.

Recommendations

IT Security Governance

Directorate-General ENER should ensure that an IT governance body properly evaluates, directs and oversees effectiveness and efficiency of IT security related activities for the secure network. It should define and implement a structured process for assessing IT security threats and vulnerabilities, their likelihood and potential impact on business. The result of such assessment should guide the definition and implementation of IT security plans. Additionally, Directorate-General ENER should analyse current EURATOM and Commission regulatory frameworks and evaluate how to comply with the obligation to undergo accreditation for IT systems handling classified information.

IT security risk analysis and security arrangements

Directorate-General ENER should strengthen its controls over the secure network and remote connections, notably by assessing the need to encrypt information stored or processed within its local secure network, upgrading or replacing servers running operating system no longer supported by the supplier and performing regular penetration testing and vulnerability assessment of its most sensitive infrastructure.

Additional information provided by Directorate-General ENER on the measures defined and/or implemented following the Internal Audit Service audit

An action plan was prepared to address the weaknesses by the end of December 2018. The actions aim at ensuring that an IT governance body properly evaluates, directs and oversees effectiveness and efficiency of IT security related activities for the secure network and strengthening Directorate-General ENER controls over the secure network and remote connections.

One recommendation on change management in infrastructure management was implemented. The key actions were related to the registration, monitoring and approval processes applicable to infrastructure changes. The recommendation was closed by the Internal Audit Service in June 2018. One recommendation on user access management is reported as implemented. The key actions were related to automated detection of software level conflicts of roles and a procedure to verify profiles and delegations. The recommendation is under Internal Audit Service review since June 2018.

  

Three recommendations on Security governance, Business Continuity and Disaster Recovery are due in 2018. The main actions undertaken are an update of the mission statement and charter of the IT Security Committee, the introduction of a structured process for the analysis of IT security risks, an IT security risk assessment as well as subsequent system upgrades and the development of specific business continuity and disaster recovery requirements.

9.4.Audit on IT programme and project management in the HR family (DIGIT, HR, EPSO, PMO)

Audit objectives and scope

The objective of the audit was to assess the adequacy of the design and the effectiveness and the efficiency of the governance, management and control systems put in place by the HR family (Directorate-General HR, PMO and EPSO) and DIGIT to manage IT related or enabled programmes and projects.

The audit focused on:

·The alignment, coordination and collaboration in managing common programmes and projects by selected HR family members;

·The programme and project management practices of individual, selected HR family members;

·DIGIT's role and practices in providing support to the needs and requirements of HR family's programme and project management.

The scope of the audit included a review of:

·Data, information and technology related governance structures, decision-making processes, roles, responsibilities and accountabilities;

·IT programme and project related governance structures, decision-making processes, roles, responsibilities and accountabilities;

·IT programme management related principles, policies, processes, procedures and capabilities;

·IT project management related principles, policies, processes, procedures and capabilities;

·The IT tools/systems used to support/automate the related governance and management processes.

There were no observations/reservations in the 2016 Annual Activity Reports of the Directorates-General analysed that relate to the area/process audited.

The fieldwork was finalised on 2 October 2017. All observations and recommendations relate to the situation as of that date.

Strengths

The Internal Audit Service survey clearly identified that "customer-oriented service culture" is the main business priority for all the members of the HR family included in the scope of the audit and which, together with DIGIT, have significant collective experience in serving an extended, diverse and demanding customer base.

In addition, during both the preliminary and the fieldwork phases, Internal Audit Service became aware of the commitment of the Directorates-General to address the challenges in this domain though a range of initiatives as follows:

a)
   The HR family members have assessed the IT service provided by DIGIT and communicated the results to DIGIT. Furthermore, they also performed IT related customer satisfaction surveys.

b)
   The HR family members have discussed with DIGIT the possibilities of revising the existing IT governance models, service agreements and reporting arrangements, with a view to further improve coordination and alignment through more transparent communication, identification of synergies and efficiencies, while at the same time ensuring IT service quality.

c)
   DIGIT's Directorate B in cooperation with the members of the HR family has developed a monthly IT portfolio dashboard aiming at gradually covering its entire customer base. It is also working on its new "service delivery model" focusing on "end to end" IT service delivery and which aims to gradually cover its entire customer base.

d)
   The HR family members have started to adopt agile software development methodologies. Furthermore, they have trained part of their staff in the Commission's project management methodology (PM2).

e)
   The HR family members and DIGIT have started to share and assess relevant best practices. They have also started to evaluate possibilities for automating selected project management related tasks though the use of already available Commission tools.

f)
   EPSO in close cooperation with DIGIT is finalising its programme management framework according to international best practices (e.g. vision, blueprints, roadmaps, benefits realisation plans).

In addition, as domain leaders and permanent members of the IT Board and of the Corporate Management Board, Directorate-General HR and DIGIT work with the services involved to set benchmarks and provide steer on best practices to other Directorates-General and services.

Major audit findings

The Internal Audit Service identified two very important issues:

Information and related technologies (IT) governance

Despite the fact that the HRMIS Steering Committee has a key role in aligning and coordinating the members of the HR family and identifying and exploiting synergies and efficiencies, it has not convened since February 2015. Neither has there been any update of the HRMIS strategy. Moreover, the various existing governance bodies currently focus mainly on IT investment decisions and on monitoring the status of IT projects rather than actually assessing IT performance and/or whether those investments have yielded the benefits envisaged. In addition, there is no IT service governance framework in place that aims to ensure consistency across the HR family and DIGIT in terms of the management of IT services levels and the evaluation of customers (business) and end-user satisfaction. This relates to both IT services provided by the members of the HR family to other Commission Directorates-General/Services, EU Institutions or EU Agencies and to the IT services provided by DIGIT to the members of the HR family. Finally, there is no data governance framework in place aimed at ensuring consistency across the HR family and DIGIT in terms of decision rights, roles and responsibilities around data assets. Moreover, there is no data management strategy at the level of either the individual members or the HR family.

IT project management

There are no guidelines in place to differentiate between the management of IT projects and operational IT services and to ensure that a balanced approach is consistently followed. In addition, there are no defined criteria and guidelines which specify the level of documentation needed to ensure that system changes are well-managed and that knowledge is effectively shared and business continuity maintained. Although the quality of an IT project's deliverables is one of the key factors of its success, which directly affects the quality of the associated IT services provided, currently the quality management of software deliverables is not sufficiently defined, monitored, reported and evaluated. More specifically, there are no key performance indicators (KPIs) and corresponding quality reports focusing on functional and structural software quality aspects. In addition, there are no quality related KPIs and corresponding reports regarding the quality of the software development process. Finally, even though there is a range of different tools available, the project management process is not sufficiently automated in a consistent way across the HR family to cover the lifecycle of an IT project.

Recommendations

Information and related technologies (IT) governance

Members of the HR family should strengthen the existing IT governance arrangements, for example through revising the mandate of the HRMIS Steering Committee, to ensure more effective strategic alignment both within the HR family and with DIGIT and to provide a better steer on key aspects such as IT performance and stakeholder satisfaction, potential synergies and risk mitigation. In addition, the Internal Audit Service recommended developing governance frameworks for both data governance and IT service governance, with a particular focus on the areas where there is either co-ownership of data assets, IT service dependencies or other common interests. In this context, the existing skills and competencies in the relevant domains should be assessed, possible gaps (in both business and IT) identified and appropriate action taken (e.g. through awareness or training courses).

IT project management

Members of the HR family should develop and adopt working definitions of project and service modes, together with appropriately tailored criteria and corresponding guidance on how to manage the different types/categories of projects or service changes. In addition, the members of the HR family should develop solution guidance in order to manage more effectively the technical debt (it relates, inter alia, to decisions/compromises made in response to business constraints or pressing priorities in the short run, which may materialise as a cost at some point in the future), and to ensure that project deliverables meet stakeholders' expectations as regards performance and value for money. They should also evaluate options for automating project management activities as well as internal and external stakeholder information/reporting needs in a consistent way across the HR family. Finally, they should assess training/awareness raising needs and develop plans accordingly to ensure that staff from both business and IT has the necessary skills and competencies in IT project management.

Additional information provided by the HR family (DIGIT, HR, EPSO, PMO) on the measures defined and/or implemented following the Internal Audit Service audit

Concerning Directorate-General DIGIT, the two very important recommendations, which relate to IT governance and IT project management, as well as a third important recommendation on IT programme management were fully accepted and an action plan was submitted to the Internal Audit Service by HR in association with Directorate-General DIGIT and considered as satisfactory by the Internal Audit Service in February 2018. Its implementation is foreseen end 2018 and in 2019.

Regarding the 2nd recommendation – IT project management for which DIGIT is responsible, the following actions are foreseen:

·To define project and service modes, together with common tailoring criteria (related e.g. to benefits, priorities/deadlines, cost, duration…) and to elaborate guidance

·To define software quality together with metrics/KPIs to be reported and to elaborate guidance including raising awareness with different stakeholders on technical debt

·To automate project management and internal and external stakeholders' related information/ reporting

·Use of existing tools/platforms (Confluence, JIRA, Folio, MS Excel, MS SharePoint, GovIS) will be further optimised (also thanks to harmonizing common glossary); e.g. CITNet and TEMPO integration, enhanced reporting using FOLIO and detailed reporting on service provisioning will be aspects to be looked at. If needed, solutions on other tools / platforms will be made.

·To ensure necessary skills and competencies are at place through the following actions:

   - To identify all jobs (per relevant entity both on the IT and business side) for which IT project management is or should be a key qualification.• To update, if necessary, the concerned job descriptions.

   - To assess whether the skills and competencies of the job holder match the qualifications of the job and, if needed, to implement relevant training.

Concerning Directorate-General HR, the necessary actions to implement the recommendations have been adopted and validated by the Internal Audit Service. All actions are set to be achieved by the deadlines defined in the action plan.

Concerning EPSO, in order to help tackle IT governance weaknesses (as identified by the Internal Audit Service audit on the management of IT programmes and projects in the HR family at the end of 2017), preparation for an external study was initiated at the end of 2017 to enable EPSO to assess the best possible way forward with finalising the development of the Candidate Portal and Talent Pool internally (with DIGIT) or outside (buy-in), or a combination of both.

  

Concerning PMO, in the framework of the HR family's development of IT systems, a new governance between DIGIT and PMO has been established (several meetings at Director and HoU level between DIGIT and the HR family have taken place since June 2017). After the Internal Audit Service audit on this subject, an action plan is currently being implemented between the different departments under the leadership of Directorate-General HR (HR, DIGIT, PMO ...). It also includes the implementation of an SLA / MoU.

9.5.Audit on IT logical security controls in OLAF

Audit objectives and scope

The objective of the audit was to assess the adequacy of the design and the effectiveness of the implementation of the management and control systems put in place by OLAF for its IT logical security arrangements. This includes (normal and privileged) user identification and password access, authenticating, access rights and authority levels, as well as infrastructure, network and end-points security. These measures are intended to ensure that only authorised users are able to perform actions in the IT systems or access information. The aim of the audit was to identify weaknesses, if any, in OLAF's IT processes, procedures and controls for protecting its sensitive information and the related IT systems.

The audit focused on the following aspects:

·Roles and responsibilities as well as policies, standards, procedures and other controls of the information security process;

·The awareness of IT security by OLAF staff;

·The process, including the controls, used to identify and classify information / systems;

·The process, including the controls, used to administer the access right for normal and privileged / administrative accounts;

·The process, including the controls, to define, implement and operate the OLAF IT systems and networks in a secured manner;

·The process, including the technical controls, to ensure availability of data.

The Internal Audit Service examined a sample of IT systems that, should any security weaknesses exist, could have very serious legal and/or reputational implications. This included the following systems:

·The OLAF Content Management (OCM) system which was brought into production mid-September 2016;

·The Core Business Information System (CBIS) (now renamed Identity and Authentication Management System (IAMS) which is a secure IT infrastructure protected by a kind of gateway;

·The Investigative Data Consultation Platform (IDCP) which stores and shares data between OLAF and the World Bank related to investigations;

·Central parts of AFIS (Anti-Fraud Information System).

·AFIS had been audited previously by the Internal Audit Service, including an assessment of the account management of Member States' users. Hence, the Internal Audit Service focused only on the central parts (databases and servers) of this system.

There were no observations/reservations in OLAF's 2015 Annual Activity Report that relate to the area/process audited.

The fieldwork was finalised on 21 December 2016. However, prior to finalising the fieldwork, the Internal Audit Service identified a number of issues of particular importance concerning the OCM system which, in view of their seriousness and urgent nature, were brought to the attention of OLAF's Management in a meeting at Director level on 30 November 2016 and in a note to the Director-General of OLAF (Ares(2016)6943435 - 13/12/2016).

Strengths

The Internal Audit Service recognised the ongoing efforts made by OLAF to manage the OLAF IT systems.

a)
   AFIS is well documented. The auditors recognise that the documentation of the AFIS domain is well structured and was up-to-date.

b)
   Logical controls for AFIS central components (servers and databases) were in place and effective.

c)
   Knowledgeable staff in IT operations. OLAF staff working in IT operations are very knowledgeable and experienced.

d)
   OLAF unit C.5 is aiming to gain certification based on ISO20000 in 2017.

Major audit findings

The Internal Audit Service identified four very important issues:

Excessive access rights granted to a number of OCM user accounts

OLAF did not implement a user access policy for the OCM application to document and justify the access privileges granted to the users. In particular, OLAF granted excessive access rights to a number of OCM user accounts. Moreover, developers of an external contractor intervened manually on the production systems to remedy blocking incidents on a daily basis. Although OLAF took technical and organisational measures to mitigate the risks associated with these interventions, it did not proactively check the log files for potential anomalies.

Gaps in key OCM documentation and logging controls

The OCM IT security plan was never officially endorsed and kept up-to-date. When the OCM system was brought into production, OLAF did not assess if the IT security measures were implemented effectively. Moreover, OLAF did not define and endorse a logging policy, assign roles and responsibilities for logging and determine the log retention time.

Conflict of interest for LISO and deputy LISO

The LISO and Deputy LISO were both located in OLAF's Directorate C which at the same time was responsible for IT activities. Moreover, the deputy LISO was at the same time System Security Officer of OCM and OCM project manager which represents a clear conflict of interest. The LISO and the Deputy LISO did not coordinate their work effectively on IT security of the OCM project. In addition, neither the LISO nor the deputy LISO formally informed the Director-General about the security situation of the OCM project.

Overall IT security roles not properly assigned and procedures not fully compliant with the implementing rules of the Commission Decision on information security

While acknowledging the existence of two specific IT security policies endorsed at operation level, the Internal Audit Service noted the absence of an overarching policy endorsed at the level of senior management, which would clearly demonstrate the importance it attaches to having a strong focus on IT security. IT security plans were either not officially endorsed or missing for some applications. Moreover, OLAF did not keep the inventory of IT systems updated and responsibilities of system owners were not always properly assigned. Finally, OLAF did not provide the necessary IT security awareness training which contributed to system owners not being sufficiently aware of their responsibilities.

Recommendations

Excessive access rights granted to a number of OCM user accounts

OLAF should reduce the number of users with high privileges, lay down OCM user access rights in a user access policy and officially endorse it. Moreover, OLAF should ensure that any intervention conducted by developers can be clearly identified in the log files.

Gaps in key OCM documentation and logging controls

OLAF should update and officially endorse the OCM IT security plan. The OCM system owner should ensure that the necessary IT security measures are implemented and properly documented. Moreover, OLAF should endorse a formal logging policy in which all logging arrangements are laid down.

Conflict of interest for LISO and deputy LISO

OLAF should assign the roles of both the LISO and Deputy LISO so that they are located outside Directorate C. OLAF should ensure that the LISO monitors the implementation of the IT security plans more closely and regularly reports the results to the Director-General.

Overall IT security roles not clearly assigned and procedures not fully compliant with implementing rules of the Commission Decision on information security

OLAF should re-inforce its overall IT security management system through clear ownership and commitment, by implementing a general information security policy that is endorsed by Senior Management. It should clearly assign key roles and responsibilities and strengthen IT security awareness across the Directorate-General.

Additional information provided by the OLAF on the measures defined and/or implemented following the Internal Audit Service audit

It should be noted that OLAF is implementing an action plan to tackle the recommendations received. An access control policy for OCM and its underlying IT infrastructure have been approved by the Director-General and operational procedures to implement it are gradually put in place. The number of OCM users with privileged access rights has been reduced and is well controlled and monitored.

An OCM security plan has been approved and its implementation is on-going, whereas a logging policy is in draft and will be approved shortly. The functions of the LISO and deputy LISO have been moved outside Directory C and they now report directly to the Director-General. An overarching OLAF IT Security Policy is in draft and will be shortly approved by the Director-General.

9.6.Audit on supervision of outsourced IT operations in Directorate-General TAXUD

Audit objectives and scope

The objective of the audit was to assess the efficiency and effectiveness of the measures put in place by Directorate-General TAXUD to exercise due control on its outsourced IT operations. To achieve this objective, the audit focused on identifying whether:

·Business requirements are properly defined and translated into IT operations services;

·Outsourcing contracts include provisions to ensure effective and efficient delivery of IT operations and management services;

·A system is in place to monitor, evaluate and assess the effectiveness and efficiency of the outsourced IT services;

·Expedient actions are planned for possible hand-over of IT operations, in the case of change in service provider.

The audit addressed the adequacy of controls designed by Directorate-General TAXUD to manage the risks relating to outsourcing arrangements for the management of its IT operations for connectivity services, IT service management services (data centre IT operations & continuous service) and quality services.

Therefore, the scope covered, on the one hand, the definition of business requirements and their translation in IT operations terms, and on the other hand, the processes Directorate-General TAXUD put in place to ensure proper supervision, monitoring and measurement of external provider performance. The assessment of the actual work performed by contractors was out of scope.

There were no observations/reservations in Directorate-General TAXUD's 2016 Annual Activity Report that relate to the area/process audited.

The fieldwork was finalised on 3 March 2017. All observations and recommendations relate to the situation as of that date.

  

Strengths

The Internal Audit Service recognised the ongoing efforts made by Directorate-General TAXUD to:

a)
   Define and implement a model for outsourcing IT services and operations based on the achievement of measurable outcome (output-based model of outsourcing) rather than resource consumption (input-based model) whenever possible.

b)
   Define and maintain its own methodology, called TEMPO, to which contractors have to comply in the execution of their IT activities. This ensures the consistent and efficient management, set-up, development, operation and support of IT projects and services.

c)
   Exercise strong governance on aligning IT operations, projects and resources with its work programme, through the IT Steering Committee.

d)
   Setup a process which drives all activities of contractors related to continuous improvement of services under a structured programme.

Major audit findings

The Internal Audit Service did not identify any critical or very important issues.

  

PART 2: Follow-up engagements (summarised)

1.
   Follow-up audit on the management of intra-muros contractors

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendations had been adequately and effectively implemented and would be closed:

Directorate-General COMM - Recommendation N° 2 (Very Important): value for money in Time&Means contracts

Directorate-General HR - Recommendation N° 3 (Important): physical security and intra muros contractors

2.
   Follow-up audit on the new Better Regulation (BR) agenda in the Commission

Secretariat-General

Based on the results of our follow-up audit, the Internal Audit Service concluded that the Secretariat-General had made good progress towards implementing the recommendations as all (intermediate) milestones of the action plan had been met at the time of this engagement. Specifically;

Recommendation N° 1 (Very Important): state of play of the main Better Regulation components

In view of the progress made and the on-going actions, the Internal Audit Service considered that the recommendation could be downgraded from Very Important to Important.

Recommendation N° 2 (Very Important): fostering the BR culture

Based on the actions taken, the recommendation has been closed. However, the Internal Audit Service emphasised the importance of the BR collaborative workspace as an ongoing process which still needs to be finalised to ensure that it is comprehensive. Whilst a lot of material has already been stored there, this should eventually contain relevant information and good practices for every phase of the BR process.

Recommendation N° 3 (Important): exemption process

Based on the actions taken, the recommendation has been closed. Nevertheless, the Internal Audit Service suggested that the Secretariat-General screens these lists regularly to identify patterns and take remedial actions as necessary.

Recommendation N° 4 (Important): measurement, monitoring and reporting

In line with the original action plan, an evaluation of the BR package is planned for 2019.

Other Directorates-General/Services

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendations had been adequately and effectively implemented and would be closed:

Directorate-General GROW - Recommendation N° 2 (Important): fostering the BR culture

Directorate-General EMPL - Recommendation N° 3 (Important): exemption process

Directorate-General ENV - Recommendation N° 2 (Important): fostering the BR culture

During our work, we noted that that some information on the intranet had not been updated following a recent re-organisation. The Internal Audit Service underlined that it is important to continuously update the intranet.

Directorate-General ENV - Recommendation N° 3 (Important): exemption process 

RSB - Recommendation N° 1B (Very Important): state of play of the main BR components

3.
   Follow-up audit on effectiveness of the management of absenteeism in the Offices (OIB, OIL and Directorate-General HR)

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendations had been adequately and effectively implemented and would be closed:

OIB - Recommendation N° 2 (Important): sickness absence management by line managers

OIL - Recommendation N° 2 (Important): sickness absence management by line managers

OIL - Recommendation N° 3 (Important): preventive measures for sickness absences without medical certificate

Directorate-General HR - Recommendation N° 3 (Important): corporate guidelines on sickness absence management

Directorate-General HR - Recommendation N° 4 (Very Important): verification of sickness absences by the Medical Service

Directorate-General HR - Recommendation N° 5 (Important): communication on new IT functionalities for the management of sickness absences

Directorate-General HR - Recommendation N° 6 (Important): calculation of sickness absence rate

4.
   Follow-up audit on early implementation of the ESIF control strategy in Directorates-General REGIO, EMPL and MARE

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendations had been adequately and effectively implemented and would be closed:

Directorate-General REGIO, EMPL, MARE - Recommendation No 1 (Very Important): design of the ESIF control strategy 2014-2020 - assurance aspects

Directorate-General REGIO, EMPL, MARE - Recommendation N° 2 (Very Important): design of the ESIF Control strategy 2014-2020 - Directorates-General audit plans

Directorate-General MARE - Recommendation No 3 (Very Important): design of the ESIF control strategy 2014-2020 – Directorate-General MARE ad-hoc control approach

Directorate-General EMPL - Recommendation N° 6 (Very Important): reimbursement of additional pre-financing for Youth Employment Initiative

5.
   Follow-up audit on information security governance in the Commission

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendations had been adequately and effectively implemented and would be closed:

Recommendation N° 1 (Very Important): information security governance structure

Recommendation N° 3 (Very Important): reference framework for information security

Recommendation N° 4 (Very Important): information security programme

For Recommendation N° 2 (Very Important): information security risk treatment, note Ares(2018)93394 of 8 January 2018 stated that the initial action plan could not be implemented by 31 December 2017 as expected. Nevertheless, the Internal Audit Service reviewed its status of implementation. The Internal Audit Service welcomed the good progress made to date in implementing recommendation N° 2. However, given that not all the risks identified had not been mitigated, it considered that it was appropriate to keep this recommendation open without downgrading its rating.

6.
   Follow-up audit on the Participant Guarantee Fund for FP7 and Horizon 2020 in Directorate-General RTD, Directorate-General ECFIN and ERCEA

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendations had been adequately and effectively implemented and would be closed:

Directorate-General RTD - Recommendation N° 1 (Important): monitoring the effectiveness of the Participant Guarantee Fund set up

Directorate-General ECFIN - Recommendation N° 2 (Important): Regular assessment of the PGF benchmark

7.
   Follow-up audit on Directorate-General AGRI's management and control system for Voluntary Coupled Support (VCS)

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendations had been adequately and effectively implemented and would be closed:

Recommendation N° 1 (Important): assessment of notifications - guidance

Recommendation N° 3 (Very Important): monitoring and control of the 2015 VCS financial ceilings

Recommendation N° 4 (Very Important): monitoring of VCS performance

The recommendation listed below had not been fully and/or adequately implemented and was therefore re-opened.

Recommendation N° 2 (Very Important): follow-up of VCS notification assessments, with original target date for implementation of 31 March 2017.

Although the Internal Audit Service was aware that additional efforts were on-going and should be completed shortly, Directorate-General AGRI had not yet sufficiently demonstrated that the risks of potential double-funding between VCS and rural development programme measures, which have been identified during the VCS assessments, are systematically and effectively followed-up on time. Furthermore, Directorate-General AGRI had yet to decide on the lead unit to be in charge of this follow-up. Therefore, the Internal Audit Service considered that the recommendation should remain open, but in light of the progress made in key areas, the rating was downgraded to Important.

8.
   Follow-up audit on the management of grants under 2014-2020 consumer and health programmes in CHAFEA

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendations were not fully implemented and would be re-opened:

Recommendation N° 1 (Very Important): internal grant management procedures

The third action (on the update, finalisation and consolidation of the procedures on grant management) was assessed as not implemented as the draft chapters of the Handbook on Procedures did not cover the later steps of the grant management cycle and were still awaiting formal approval. The recommendation was therefore re-opened.

Recommendation N° 2 (Important): evaluation committees for the Consumer Programme

One of the two actions (on ensuring that evaluation committees exercise their functions in accordance with the rules, in a transparent way, and respecting the roles of their members) was assessed as not implemented as the Handbook on Procedures was awaiting formal approval and evaluation reports had not been signed by all attending members of the Evaluation Committee. The recommendation was therefore re-opened.

Recommendation N° 3 (Important): evaluation process

One of the two actions (on the documentation of modifications of evaluation results) was partially implemented. The Internal Audit Service could not fully assessed on the basis of the evidence submitted, whether changes of the scores during the evaluation process had been documented in a transparent way. The recommendation was therefore re-opened.

Recommendation N° 4 (Important): guidance and interpretation

One of the three actions ((on the extension of checks on potential conflicts of interests for self-employed experts) was assessed as not implemented as the evidence submitted did not allow the Internal Audit Service to confirm if checks on potential conflicts of interest had been extended to other contractual relations with applicants. The recommendation was therefore re-opened.

Recommendations N° 5 (Important): double funding and N° 6 (Important): grant agreement

All actions were assessed as not implemented as the different sub-recommendations had not been taken up in the financial control strategy or were not fully covered by the draft Handbook on Procedures. Therefore the recommendations were re-opened.

9.
   Follow-up audit on public procurement in Directorate-General CLIMA

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendation was adequately and effectively implemented and would be closed:

Recommendation N° 1 (Important): issues in relation to Directorate-General CLIMA control environment for public procurement

The recommendations listed below were not fully implemented and were therefore re-opened.

Recommendation N° 2 (Very Important): procurement process, with original target date for implementation of 30 June 2017

Directorate-General CLIMA had not fully identified training needs on procurement and had not delivered training accordingly. The Internal Audit Service understood that the reorganisation of the financial function in Directorate-General CLIMA had delayed this action, but noted that some progress has already been made, notably by emphasising this point in the Directors meeting and exploring possibilities of shared training sessions with Directorate-General ENV to speed up the process. Therefore, the Internal Audit Service considered that the recommendation should remain open, but in the light of the progress made in key areas, the rating was downgraded to Important.

Recommendation N° 3 (Important): contract management and payments, original target date for implementation of 31 January 2017

Directorate-General CLIMA had issued a practical handbook on authorisation and validation of expenditure, but the Directorate-General had yet to perform a comprehensive analysis of the financial training followed so far and any training that might be needed in the future by authorising officers. Therefore, the Internal Audit Service considered that this part of the recommendation had not been addressed and that the recommendation should remain open.

10.
    Follow-up audit on Human Resources management in Directorate-General CNECT

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendation was adequately and effectively implemented and would be closed:

Recommendation N° 2 (Important): measures to cope with changes and HR targets (taxations, staff cuts in embedded overheads, Luxembourg agreement).

11.
   Follow-up audit on strategic planning and programming/ activity based management (SPP/ABM) in JRC

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendations had been adequately and effectively implemented and would be closed:

Recommendation N° 2 (Important): work programme, project management and management plan

Recommendation N° 4 (Very Important): objectives, indicators and targets

12.
   Follow-up audit of the ex-IAC audit on document management in JRC

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendations had been adequately and effectively implemented and would be closed:

Recommendation N° 1 (Important): JRC-wide definition of the content of the standard scientific Project File

Recommendation N° 4 (Important): JRC 'dormant' files closure procedure and paper archive management procedure

Recommendation N° 6 (Important): function of an archives service in Ispra

13.
   Follow-up audit of the ex-IAC audit on on nuclear decommissioning and waste management programme in JRC

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendation had been adequately and effectively implemented and would be closed:

Recommendation N° 3 (Very Important): relationship with authorities, licensing and insurance

14.
   Follow-up audit of former IAC recommendations in Directorate-General JRC

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendations had been adequately and effectively implemented and would be closed:

Ex-IAC audit on decommissioning – risk and project management at the ISPRA site:

Recommendation N° 7 (Very Important): full strategy for guaranteeing a pool of qualified Project Leaders

Recommendation N° 8 (Important): document management requirements

15.
   Follow-up audit on H2020 grant management in the REA

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendations had been adequately and effectively implemented and would be closed:

Recommendation N° 1 (Very Important): managing of conflicts of interest

Recommendation N° 2 (Important): evaluations' lessons learned

Recommendation N° 4 (Important): IT tools used for the specific evaluations in REA

16.
    Follow-up audit on H2020 grant management in Directorate-General RTD: from the preparation of the work programme to the signature of the grant agreements

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendations had been adequately and effectively implemented and would be closed:

Recommendation N  1.b (Important): double funding and plagiarism

Recommendation N  3 (Important): management of conflicts of interest

Recommendation N  5.a (Important): grant management preparation

Recommendation N° 5.b (Important): grant agreement preparation

The recommendations listed below had not been fully implemented and were therefore re-opened:

Recommendation N  1.a (Important): double funding and plagiarism, with original target date for implementation: 30/04/2017

The Common Support Centre (CSC) had developed guidance on the double funding and plagiarism checks. However this new process depends on the use of IT tool ARIS, the release of which had been postponed from 2017 to the third quarter of 2018 due to the demanding IT development schedule.

Recommendation N° 4.a (Important): evaluation procedures and lessons learned, with original target date for implementation: 31/01/2017

The CSC had implemented one of four actions covered by this recommendation, i.e. the approval of the panel review guide, which explains the key steps of the process. The remaining three actions were not implemented, as the prepared guidance documents were being reviewed by the CLSS but had not been finalised.

17.
   Follow-up audit on the set up of the Common Support Centre (CSC) for H2020

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendation had been adequately and effectively implemented and would be closed:

Recommendation N° 2 (Important): staff allocation and performance measurement and monitoring

18.
   Follow-up audit on grant management in Directorate-General JUST

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendations had been adequately and effectively implemented and would be closed:

Recommendation N° 2 (Very Important): contracting phase

Recommendation N° 3 (Important): annual work programme and calls for proposals

19.
   Follow -up audit on the management of the African Peace Facility in Directorate-General DEVCO

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendations had been adequately and effectively implemented and would be closed:

Recommendations N° 6 (Important): payments to troop Contributing Countries

Recommendation N° 7 (Important): retroactivity - impact on sound financial management

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendations had been partially implemented and would be re-opened:

Recommendation N° 2 (Very Important): design and effectiveness of the remedial/mitigating measures at contract level

Specific remedial measures had been introduced to mitigate the financial risks related to the weaknesses identified in the pillar assessments and the risk of illegal and irregular payments. However, it was still premature to conclude that they had been effectively implemented. Furthermore, the implementation of the new long-term Technical Assistance was still pending and the related contract had not yet been (re)designed.

Recommendation N° 3 (Very Important): governance and coordination between Directorate-General DEVCO- EU delegations – EEAS

For some of the actions in the ‘Aide memoire’ action plan, the work regarding monitoring was on-going and no EU staff had been deployed to advise and assist the African Union Commission (AUC) due to difficulties to free up human resources. Consequently the recommendation was not considered fully implemented. However, given the actions already implemented, it was downgraded to Important.

20.
   Follow-up audit of the limited review of Directorate-General NEAR’s residual error rate (RER) methodology and calculation

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendations had been adequately and effectively implemented and would be closed:

Recommendation N° 1 (Very Important): indirect management with Beneficiary Countries – IPA

Recommendation N° 2 (Very Important): enlargement – direct management

Recommendation N° 5 (Important): presentation of the RER in the Annual Activity Report (AAR)

Recommendation N° 3 (Important): planning and organisation was assessed as not implemented and was re-opened.

The Internal Audit Service recommended that Directorate-General NEAR establishes and follows a comprehensive Directorate-General-level plan and calendar for the calculation of the RER and the preparation of the Annual Activity Report. The Internal Audit Service observed that Directorate-General NEAR issued two notes setting out the time-table and the roles for the preparation of the Annual Activity Report, however they did not include sufficient details on the calculation of the RER. They also set unrealistic deadlines which were not consistent with the timing of the RER study outsourced to an external contractor. In addition, the deadline for the delivery of the results of the RER study by the external contractor was set too late resulting in the late availability of data and the late submission of the final Annual Activity Report.

For its 2017 Annual Activity Report, Directorate-General NEAR should establish a more realistic schedule for the provision of the RER study specifying deliverables, intermediate milestones and target dates for the production, validation and proper reflection of the RER results in the Annual Activity Report. Directorate-General NEAR had already taken action in this regard by setting the deadline for the delivery of the final 2017 RER study by the external contractor to 31 December 2017.

Recommendation N° 4 (Important): ENI and thematic lines RER was assessed as partially implemented and was re-opened.

The following parts of the recommendation had not been implemented:

Reduction of the heterogeneous nature of the population through stratification or split per expenditure category: as from the 2017 RER, Directorate-General NEAR planned to use risk indices which would follow Directorate-General DEVCO's approach.

Improvement of the data quality of the populations used for the RER measurement: although both Directorate-General NEAR and the external contractor had performed checks on the completeness and correctness of the populations, 24 transactions covering 46 intervals had to be replaced due to quality issues.

21.
   Follow-up audit on control strategy in Directorate-General NEAR

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendations had been adequately and effectively implemented and would be closed:

Recommendation N° 1 (Very Important): assurance building process for Entrustment (IPA)

Recommendation N° 2 (Important): other building blocks of assurance

22.
   Follow-up audit on the effectiveness and efficiency of Erasmus+ control strategy in the Education, Audio-visual and Culture Executive Agency (EACEA) and in National Agencies (Directorate-General EAC)

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendation had been adequately and effectively implemented and would be closed:

Recommendation N° 2 (Important): guidelines for NAs

23.
   Follow-up audit on financial management and grant processes in Directorate-General ECFIN.

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendation had been adequately and effectively implemented and would be closed:

Recommendation N° 2 (Important): justification for negotiated procedures without prior publication of a contract notice

24.
   Follow-up audit on former IAC recommendations in ESTAT

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendations had been adequately and effectively implemented and would be closed:

Ex-IAC audit on ESTAT's business continuity management:

Recommendation N° 4 (Very Important): ‘Disaster Recovery Planning and IT Business Continuity

Ex-IAC audit on sensitive information:

Recommendation N° 3 (Important): ‘Security of sensitive information in the production environment’

Ex-IAC audit on Statistical Process III - Agriculture Statistics:

Recommendation N° 2 (Important): ‘FSS statistical production - collection, validation, processing and dissemination’

25.
   Follow-up audit on the procurement process in Directorate-General COMM

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendations had been adequately and effectively implemented and would be closed.

Recommendation N° 1 (Important): procurement needs analysis – adherence to best practice

Recommendation N° 2 (Important): call for tender documents for high value procurement procedures

Recommendation N° 3 (Important): ex post controls on procurement procedures, was assessed as partially implemented and was re-opened. While some elements have been put in place, the part linked to the development and documentation of a systematic risk-based approach to support the planning of ex post controls had not been implemented. The Internal Audit Service noted that Directorate-General COMM was still working on the design of a risk-based planning for the ex-post controls, and as a result the planning for 2017 was not based on a documented risk assessment.

26.
   Follow-up audit on former IAC recommendations in PMO

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendations had been adequately and effectively implemented and would be closed:

Ex-IAC Audit on contracts related to the management of missions in the PMO:

Recommendation N° 1 (Very Important): fully automate the CAF process

Ex-IAC audit on the effectiveness and efficiency of the mission management workflow in PMO:

Recommendation N° 5 (Very Important): MIPS as managerial tool

27.
   Follow-up audit on business continuity management in OP

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendations had been adequately and effectively implemented and would be closed:

Recommendation N° 1 (Very Important): physical security shortcomings in the secondary OP data centre

Recommendation N° 6 (Important): insufficient measures to raise user awareness of business continuity

Recommendation N° 2 (Very Important): business continuity arrangements with DIGIT are not consistent with OP's recovery time objective (RTO)

28.
   Follow-up audit on management of European Commission Authentication Service - ECAS

Based on the results of the follow-up audit, the Internal Audit Service concluded that the following recommendation had been partially implemented and was therefore re-opened:

Recommendation N° 4 (Very Important): security requirements for ECAS

The Internal Audit Service noted that certain very important security controls included in the Security Plan had not yet been satisfactorily implemented in practice. In particular, according to the implementation roadmap for the Security Plan, the ECAS Business Continuity Plan (BCP) and Disaster Recovery plan (DRP) needed to be updated. Nevertheless, as the current BCP and DRP was based on a Risk Analysis (RA) and a Business Impact Analysis (BIA) performed back in 2014, the Internal Audit Service recommended that the RA and BIA are revised initially to fully take into consideration current business needs and, eventually, to update the BCP and DRP accordingly.

Taking into consideration the progress made and the extent to which the risks had been mitigated to date, the Internal Audit Service downgraded the criticality of the recommendation from Very Important to Important.

29.
   Follow-up audit on the management of the security of EU ETS IT system

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendation had been adequately and effectively implemented and would be closed:

Recommendation N° 6 (Important): security services of ETS

Recommendation N° 7 (Important): direct access at ETS's DB level

Recommendation N° 9 (Important): relationship between Directorate-General CLIMA and DIGIT

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendation had been partially implemented and would be re-opened:

Recommendation N° 1 (Very Important): implementation of the ETS's Security Controls

The Internal Audit Service acknowledges the progress made in defining a Security Plan and the corresponding implementation roadmap for the key security controls of the ETS. However, two sub items of the action plan were still open. Firstly, the actual implementation of the key security controls listed in the roadmap had not been launched. The Internal Audit Service therefore urged Directorate-General CLIMA, in cooperation with DIGIT as service provider, to ensure the preparation of the migration of the ETS platforms to the new Secured Hosting Services (SHS) provided by DIGIT. In particular, the ETS specific requirements should be assessed against the standard SHS and the gaps identified and solutions agreed by end of 2017, as per the plan. This is a necessary prerequisite for the migration to the DIGIT secured platforms and the actual implementation of the controls during 2018, as defined in the roadmap approved in January 2017.

As regards the second sub item still open, based on the preparation work in 2017 for the migration to the secured platforms and the gaps identified, Directorate-General CLIMA should re-assess the significance of the security controls that would still be missing at the end of 2018 (because of cost effectiveness issues, other technical constraints) together with the associated services (DIGIT and Directorate-General HR.DS).

Without the full implementation of these two sub items, the EU ETS system is still vulnerable to the high risks identified at the time of the audit.

Additional information provided by the DG CLIMA on the measures defined and/or implemented following the Internal Audit Service audit

The Internal Audit Service concluded that only two key sub items of the original action plan remained open. In the meantime, the first one, the migration of the Emmission Trading Scheme platforms to the new Secured Hosting Services (SHS) has been completed. The second one, the update of the risk assessment, will determine whether the EU Emmission Trading Scheme system is still vulnerable to the high risks identified at the time of the audit.

30.
   Follow-up audit on management of local IT in Directorate-General COMP

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendations had been adequately and effectively implemented and would be closed.

Recommendation N° 1 (Very Important): IT financing sources

Recommendation N° 2 (Very Important): alignment of business and IT strategies

Recommendation N° 3 (Important): IT governance

Recommendation N° 4 (Important): management of IT risks

Recommendation N° 7 (Very Important): the role of the LISO in Directorate-General COMP

Recommendation N° 8 (Important): management of IT continuity

Recommendation N° 9 (Important): firewall and network services management

Recommendation N° 10 (Important): database management

For Recommendation N° 5 (Very Important): project management and quality assurance the Internal Audit Service observed that Directorate-General COMP has made good progress in implementing the recommendation. Therefore the rating of this recommendation will be downgraded to Important. The project on management of support activities still needs to be finalised and the key IT processes and quality requirements, together with the criteria to measure them, identified before the recommendation can be considered fully implemented.

31.
   Follow-up audit on management and supervision of contracts for outsourced IT services (IT contract management) in DIGIT

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendations had been adequately and effectively implemented and would be closed:

Recommendation N° 1 (Very Important): estimation of needs before establishing a framework contract

Recommendation N° 3 (Very Important): guideline of the choice of the type of outsourcing

Recommendation N° 4 (Important): knowledge management of contract management

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendation had been partially implemented and would be re-opened:

For Recommendation N° 2 (Very Important): quality management of services outsourced on a time and means basis, while some adequate measures had been taken to improve the performance measurement of external IT service providers, for example through better IT tools that allow obtaining more relevant statistics, DIGIT had not translated new key performance indicators into its framework contracts. A strategy paper had already been drafted to set out the possible solutions to this issue, but the procedures for the new framework contracts will only be launched at a later stage. Given that the risk originally identified was partially mitigated, the rating of the recommendation was downgraded to important.

32.
   Follow-up audit on effectiveness of measures to handle manual interventions in ABAC

Based on the results of our follow-up audit, the Internal Audit Service concluded that the following recommendations had been adequately and effectively implemented and would be closed:

Recommendation N° 1 (Very Important): extensive use of the manual intervention procedures

Recommendation N° 3 (Important): lack of clear, formalised manual intervention procedures

The recommendation below has not yet been fully implemented. The original due date was 30 June 2017 and it has been revised to 31 March 2018. Nevertheless, the Internal Audit Service assessed the progress made in mitigating the related risks for this recommendation. This recommendation will remain open.

Recommendation N° 2 (Very Important): too few controls over privileged users, with original target date for implementation of 30 June 2017.

The Internal Audit Service acknowledged the progress made in enhancing the preventive and detective controls on privileged users. 19 sub-items out of 24 from the original action plan had been completed and 5 remained open. Specifically, the actual implementation of the key security controls linked to the SAP 'most powerful and privileged userids' had not been finalised. In addition, the implementation of the log analysis for reviewing privileged activity in cooperation with DIGIT was still ongoing.

The Internal Audit Service downgraded the rating to Important, since 19 out of the planned 24 actions had been completed and this effectively reduced the related residual risk. In particular, a thorough analysis of existing high privileged userids had been performed, limiting their number to the minimum needed for operations and ensuring that preventive and detective controls exist for their creation and usage. Procedures were updated and the relevant staff briefed on them. Moreover, existing manual interventions were being reviewed to identify enhancements in ABAC that could reduce the need for manual interventions.

List of follow-up audits performed in 2017 for which all recommendations have been closed after the follow-up

Based on the results of the follow-up audits performed in 2017, the Internal Audit Service assessed that the following audits listed below could be fully closed as all the recommendations had been adequately implemented.

|  |
| --- |
| Audit Title |
| 33. Follow-up audit of the limited review of the calculation and the underlying methodology of Directorate-General AGRI's residual error rates for the 2012 reporting year  34. Follow-up audit on the design of Directorate-General AGRI's management and control system for greening  35. Follow-up audit on the objective setting process in Directorate-General MARE  36. Follow-up audit on gap analysis of new legislation / design of 2014-2020 programming period European Structural and Investment funds – phase 2 in Directorate-General MARE  37. Follow-up audit of management and supervision of contracts for the outsourced IT Services (IT contract management) in Directorate-General SANTE |
| 38. Follow-up audit on Directorate-General EMPL's closure of the 2000-2006 ESF programming period  39. Follow-up audit on the gap analysis phase II in Directorate-General REGIO and   Directorate-General EMPL  40. Follow-up audit on the monitoring of the action plans for unfulfilled ex-ante conditionalities in Directorate-General REGIO and Directorate-General EMPL  41. Follow-up audit on Directorate-General REGIO's closure of the 2000-2006 ERDF programming period  42. Follow-up audit on Directorate-General REGIO's preparations for use of Financial Instruments in 2014-2020 |
| 43. Follow-up audit on closure of projects of legacy programmes in   Directorate-General CONNECT  44. Follow-up audit on preparedness of the management and control system for Connecting Europe Facility and Horizon 2020 in INEA  45. Follow-up audit of procurement management in JRC  46. Follow-up audit of the ex-IAC audit on security and safety in the JRC  47 Follow-up audit of the ex-IAC audit on intellectual property rights management in JRC  48. Follow-up audit on the ex-IAC audit on management of expert groups  49. Follow-up audit on setting of objectives and measurement of performance in Directorate-General MOVE  50. Follow-up audit of the limited review of the calculation and the underlying methodology of the residual error rate for the 2015 reporting year in the REA  51. Follow-up audit on procurement in Directorate-General RTD  52. Follow-up audit on H2020 grant management in ERCEA: from the evaluation of proposals to the signature of the grant agreements |
| 53. Follow-up audit of former IAC recommendations in Directorate-General ECHO (Legality and regularity of payments for the year 2012, Legality and regularity of payments for the year 2013)  54. Follow-up audit on financial management Humanitarian Aid in   Directorate-General ECHO  55. Follow-up audit of the ex-IAC audit on the communication flows between DEVCO's HQ and EU Delegations  56. Follow-up audit of Budget Support in Directorate-General DEVCO  57. Follow-up audit on contribution agreements with UN Bodies and other international organisations in Directorate-General DEVCO  58. Follow-up audit on risk management in Directorate-General NEAR  59. Follow-up audit on preparedness for IPA II in Directorate-General NEAR  60. Follow-up audit of the ex-IAC audit on special approvals and derogations in Directorate-General NEAR |
| 61. Follow-up audit of the ex-IAC audit on country analysis in Directorate-General EAC  62. Follow-up audit of the ex-IAC audit on document management in   Directorate-General EAC  63. Follow-up audit on the objective setting process in Directorate-General JUST  64. Follow-up audit of the ex-IAC audit on procurement in Directorate-General JUST |
| 65. Follow-up audit on knowledge management in Directorate-General COMP  66. Follow-up audit on the preparedness of the management and control systems for the SME instrument in EASME  67. Follow-up audit on HR management in response to the financial crisis in Directorate-General ECFIN  68. Follow-up audit of the ex-IAC Audit on Directorate-General ECFIN's document management  69. Follow-up audit on risk management and planning processes in   Directorate-General ECFIN in the new economic governance context  70. Follow-up audit on the effectiveness of HR management in response to the financial crisis in FISMA  71. Follow-up audit on financial management and IT procurement in   Directorate-General TAXUD  72. Follow-up audit of the ex-IAC audit on Directorate-General TAXUD's external communication strategy  73. Follow-up audit on performance measurement system in Directorate-General TAXUD customs activities  74. Follow-up audit on "Are the European Trade Defence Instruments (TDIs) managed effectively and efficiently to defend the European Union against trade distortions?" in Directorate-General TRADE |
| 75. Follow-up audit on the procurement process in Directorate-General BUDG  76. Follow-up audit on charge-back process in the Commission (Directorate-General BUDG)  77. Follow-up audit on the procurement process in DGT  78. Follow-up audit on financial management in the EPSC  79. Follow-up audit on the procurement process in EPSO/EUSA  80. Follow-up audit of former IAC recommendations in Directorate-General ESTAT  81. Follow-up audit of the ex-IAC audit on the management of the income process for the childcare facilities in OIB  82. Follow-up audit of te ex-IAC audit on 'sécurité et santé au travail' in OIL  83. Follow-up audit on financial management of procurement and grants in OLAF  84. Follow-up audit on the objective setting process in SG |
| 85. Follow-up audit on management of local IT in Directorate-General AGRI  86. Follow-up audit of the ex-IAC audit on policy design and management of IT access rights in Directorate-General CONNECT  87. Follow-up audit of the ex-IAC audit on IT security in Directorate-General ECFIN  88. Follow-up audit on management of local IT in Directorate-General MARE  89. Follow-up audit on IT governance in Directorate-General BUDG  90. Follow-up audit on management of local IT in Directorate-General TRADE |

PART 3: Summary of long outstanding recommendations as at 31 January 2018

|  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| No. | Directorate-General | Audit title | Recommendation | Comments | Final report date | Original due date | Revised due date |
| I | EMPL | Internal Audit Service Audit on Management of EESSI project in Directorate-General EMPL - Execution phase | Gaps in the Project Plan update and Limited Reporting compared to baselines (A480511) | The action plan submitted by Directorate-General EMPL for this recommendation included five tasks, of which three have been reported as completed. The remaining two are related to a) the definition of mode of operation (i.e. roles and responsibilities) for the transition period and the first years of solution in full production mode; and b) estimation for the teams' size and expected workload for the operation phase (maintenance, support, training and infrastructure including hosting and licences), as well as their associated cost.  The Internal Audit Service will perform a follow-up of this recommendation when the Directorate-General will fully declare it 'ready for review' (revised completion date 12/04/2018), together with the other two recommendations issued in the original report.  Expected delay compared to the original due date of nine and a half months. | 8/07/2016 | 30/06/2017 | 12/04/2018 |
| II | OLAF | Internal Audit Service audit on IT Logical security controls in OLAF | Access rights granted to a number of OCM user accounts (A482451) | This report was discussed at the preparatory group meeting of the Audit Progress Committee of 11 October 2017. The representative of OLAF pointed out that the "need-to-know" principle is strictly applied. In exceptional cases, external service providers still need access to the OCM system (OLAF IT system used for case management and document management) on the production site. OLAF ensures security by applying a "four-eyes-principle". However, neither a user access policy nor proactive log file checks were implemented at the time of the audit fieldwork. The Internal Audit Service will perform a follow-up audit on this recommendation in the first half of 2018 after the implementation of the missing security controls.  Expected delay compared to the original due date of nine months. | 5/05/2017 | 31/07/2017 | 30/04/2018 |
| III | PMO | Internal Audit Service Audit on effectiveness of the management of absenteeism in the Offices (OIB, OIL and PMO) | Monitoring and analysis of absences at Office level (A457169) | According to PMO, so far, the Office has communicated to Directorate-General HR (responsible for the development of the new statistical reports in this domain) the specific factors of influence, specific to PMO. Currently PMO is dependent on Directorate-General HR which is expected to provide them with information and tools to enable them to perform the monitoring of absenteeism by the end of 2018.  The Internal Audit Service will monitor carefully the implementation of this recommendation and may decide to carry out a follow-up early next year provided the corresponding recommendation in Directorate-General HR has been assessed as 'ready for review'.  Expected delay compared to the original due date of one year and six months. | 6/10/2015 | 30/06/2017 | 31/12/2018 |
| IV | RTD | Internal Audit Service audit on H2020 Project Management in RTD | Determining the level of monitoring for projects (CSC) (A482390) | According to the CSC, the project monitoring strategy has been developed and revised by the Legal Services. However, the concept of technical audits still needs to be clarified. The revision of the corresponding guidance (Vademecum) will take place in the first quarter of 2018.  A follow-up will take place as soon as the recommendation is reported as 'ready for review' by Directorate-General RTD.  Expected delay compared to the original due date of nine months. | 20/01/2017 | 31/07/2017 | 30/04/2018 |
| V | RTD | Internal Audit Service audit on H2020 Project Management in RTD | Determining the level of monitoring for projects (RTD) (A482392) | At the level of Directorate-General RTD, the rules on missions and experts were amended to ensure that they do not hamper the application of the common rules for project monitoring. The remaining actions, including a workshop with the project officers, are in progress and will be finalised once the aforementioned guidance will be made available.  A follow-up will take place as soon as the recommendation is reported as 'ready for review' by Directorate-General RTD.  Expected delay compared to the original due date of eleven months. | 20/01/2017 | 31/07/2017 | 30/06/2018 |
| VI | SG | Internal Audit Service audit on Information Security Governance in the Commission (HR,DIGIT and SG) | Information security risk treatment (A466262) | A first follow-up at the end of 2017 revealed that the ISSB adopted a Commission-wide IT Security Strategy [8](#footnote9)  in November 2016, along with related activities to be undertaken. However, these activities are planned to be completed by the end of 2018. In parallel, DIGIT should deliver in 2018 a common methodology for IT risk management and its supporting tool, making system owners in a position to assess and report IT-related risks in a consistent manner.  The Internal Audit Service will perform a second follow-up audit on this recommendation in the second half of 2018 after the implementation of the risk assessment methodology.  Expected delay compared to the original due date of one year and three months. | 12/10/2015 | 30/06/2017 | 30/09/2018 |
| VII | DEVCO | Internal Audit Service Audit on Design and Implementation of EU Trust Funds | Performance Measurement and Management (A469075) | The Internal Audit Service audit report was discussed at the 84th Audit Progress Committee round (April 2016).  According to Directorate-General DEVCO, the implementation of this recommendation is dependent on the revision of the EU Trust Funds guidelines and templates. Although good progress has been made in revising the guidelines and templates, their finalisation is dependent on the finalisation and entry into force of the new Financial Regulation (finalised in December 2017). For this reason Directorate-General DEVCO postponed the target date a second time, from 31/12/2017 to 31/03/2018.  This recommendation has not yet been followed up by the Internal Audit Service. The Internal Audit Service will follow up this recommendation once it is declared 'ready for review' by Directorate-General DEVCO.  Expected delay compared to the original due date of one year. | 29/01/2016 | 31/03/2017 | 31/03/2018 |
| No. | Directorate-General | Audit title | Recommendation | Comments | Final report date | Original due date | Revised due date |
| VIII | CLIMA | Audit on the management of the security of EU ETS IT system | Implementation of the ETS's security controls (A411483) | A second follow-up audit was performed in the first quarter of 2017, which concluded that two key sub items of the action plan still remained open.  The Internal Audit Service inquired in January 2018 about the progress of the action plans and Directorate-General CLIMA confirmed the finalisation of the set-up of test environments and the delivery of the future production environment through the Secure Hosting Services (SHS) of DIGIT. Directorate-General CLIMA still has to fully migrate the ETS production environment into SHS and perform a gap analysis to assess if additional, non-SHS standard controls should be implemented.  Expected delay compared to the original due date of two years. | 29/01/2014 | 31/12/2016 | 31/12/2018 |
| IX | DEVCO | Internal Audit Service Audit on Design and Implementation of EU Trust Funds(TF) | Governance of the TF (A469065) | The Internal Audit Service audit report was discussed at the 84th Audit Progress Committee round (April 2016).  The implementation of the recommendation is dependent on the final text of the new Financial Regulation. The trilogues for the new Financial Regulation were finalised in December 2017 and included several points related to the EUTF. The outcome of these trilogues will thus have an impact on the revised EUTF guidelines and templates and therefore the target date for their completion has been postponed a second time, now to the first quarter of 2018.  This recommendation has not yet been followed up by the Internal Audit Service . The Internal Audit Service will follow up this recommendation once it is declared 'ready for review' by Directorate-General DEVCO.  Expected delay compared to the original due date of one year and three months. | 29/01/2016 | 31/12/2016 | 31/03/2018 |
| X | DEVCO | Internal Audit Service Audit on Design and Implementation of EU Trust Funds | Performance measurement and management (A469069) | The Internal Audit Service audit report was discussed at the 84th Audit Progress Committee round (April 2016).  According to Directorate-General DEVCO, the establishment of the overarching performance frameworks for the TFs is dependent on the revision of the EUTF Guidelines. Although good progress has been made in revising the EUTF guidelines and templates, the performance frameworks can only be finalised once the final text of the new Financial Regulation has been made available (trilogues completed in December 2017). For this reason Directorate-General DEVCO postponed the target date for a second time, now to 31/03/2018.  This recommendation has not yet been followed up by the Internal Audit Service. The Internal Audit Service will follow up this recommendation once it is declared 'ready for review' by Directorate-General DEVCO.  Expected delay compared to the original due date of one year and three months. | 29/01/2016 | 31/12/2016 | 31/03/2018 |
| XI | DEVCO | Internal Audit Service Audit on African Peace Facility in African Union Commission | Institutional assessment and monitoring by Directorate-General DEVCO of the partnership with the AUC (A470932) | The Internal Audit Service audit report was discussed at the 84th Audit Progress Committee round (April and May 2016).  This recommendation was followed up by the Internal Audit Service in March 2017. The follow-up confirmed that despite steps taken to implement the agreed action plan, the underlying risks were not fully mitigated and therefore it remains open in view of the actions which still need to be completed. The Internal Audit Service will follow up this recommendation once it is declared 'ready for review' by Directorate-General DEVCO.  Expected delay compared to the original due date of one year and three months. | 21/01/2016 | 31/12/2016 | 31/03/2018 |
| XII | PMO | IAC Audit on PMO management of accidents' insurance | Reimbursement of accident costs (A451667) | This recommendation was discussed at the 87th Audit Progress Committee round (April 2017).  The implementation of the recommendation is dependent on the development of Assmal2 [9](#footnote10)  software, under development by DIGIT. As a consequence, the target date for the implementation of the recommendation is postponed accordingly. Meanwhile, PMO is using a set of custom-made reports for the accident file’s reporting purposes.  The recommendation was followed up for the first time in December 2015. The Internal Audit Service reopened this recommendation as no sufficient information was provided to assess whether there has been sufficient progress to adequately mitigate the risks.  The Internal Audit Service recently finalised a follow-up of the recommendation and concluded that the action plan had not been fully implemented. The recommendation is still rated Very Important.  Expected delay compared to the original due date of five years and three months. | 21/02/2012 | 31/12/2012 | 30/03/2018 |

:   [(1)](#footnoteref2)
     
       
       For the audit on Commission’s governance/oversight arrangements concerning risk management, financial reporting and the ex-post verification/audit function the presentation in this Staff Working Document reflects the situation following the communication in September 2018 by the auditees to the Internal Audit Service of an action plan confirming the full acceptance of all recommendations stemming from the audit report; this action plan was assessed as satisfactory by the Internal Audit Service.
:   [(2)](#footnoteref3)
     
       
       The summary reflects the assessment of the Internal Audit Service on the status of implementation of the audit recommendations at the end of the follow-up assignment. It does not take into account any further actions that may have been undertaken by the auditee and reported to the Internal Audit Service since the release of the Internal Audit Service follow-up note or report, possibly having an impact on the status of the recommendation.
:   [(3)](#footnoteref4)

     
       The three lines of defence (3LoD) model in effective risk management and control (IIA position paper) distinguishes among three groups (or lines) involved in effective risk management: 1st line - functions that own and manage risks; 2nd line - functions that oversee risks. The responsibilities of these functions vary on their specific nature, but can include: defining roles and responsibilities, providing risk management frameworks, providing guidance and training on risk management processes and facilitating and monitoring implementation of effective risk management practices by operational management and 3rd line - functions that provide independent assurance (i.e. Internal Audit).
:   [(4)](#footnoteref5)
     
       
       In this context, the applicable reference frameworks define independence as follows: "An independent audit committee member is a person who is not employed by, or providing any services to, the organization beyond his or her duties as a committee member." See IIA Global Public Sector Insight: Independent Audit Committees in Public Sector Organizations, page 12.
:   [(5)](#footnoteref6)
     
       
       The presentation in this Staff Working Document of the acceptance of the audit recommendations reflects the situation, following the communication in September 2018 by the auditees to the Internal Audit Service of an action plan confirming the full acceptance of all recommendations stemming from the audit report; this action plan was assessed as satisfactory by the Internal Audit Service
:   [(6)](#footnoteref7)
     
       
       This recommendation is not intended to cover/duplicate the Commission's high-level risk assessment at political level, but merely to link operational risks identified by the Directorates-General to the respective general or specific objectives, which (may) contribute to the Juncker priorities.
:   [(7)](#footnoteref8)
     
       
       For example, the Internal Audit Service is available to discuss with the Directorate-General Budget and the Secretariat-General the results of specific audit reports, upon request. Furthermore, in the context of the Internal Audit Service Risk Assessment preceding the audit plan, there should be a closer discussion with the central services to mutually exchange information on risks.
:   [(8)](#footnoteref9)
     IT Security Strategy for the European Commission – ref. Ares(2016)6693919 – 29/11/2016.
:   [(9)](#footnoteref10)
     
       Assmal2 aims to modernise the administration of the sickness and accident insurance scheme.

[Top](#document1)