EN 11 12 2019 Official Journal of the European Union C 417/27 Actions to be taken 6 Where external staff is used, full compliance with the applicable EU and national legal framework is required as a matter of principle, but also to avoid litigation risks and reputational damage Consultancy and non-consultancy services in EUIPO 2 31 Given the scale of consulting services used by EUIPO, we carried out an analysis of the OfficeŐs management of consulting services The main contract for consultancy services has a volume of 80 million euros for four years The number of external staff provided by service providers under these and similar contracts went up from around 250 in 2011 to a peak of more than 350 in 2014 falling to 215 at the beginning of 2018 (equal to some 20 % of the OfficeŐs statutory staff) 2 32 We noted that, while a part of the services delivered under these contracts is indeed consultancy (for example project management support, business process analysis), another part is rather on administrative support (for example secretarial support, administrative clerks preparing reports, support for internal and external communication activities) The latter part represents a purchase of labour or loan of staff, which is strictly regulated by European and national labour law Only registered temporary work agencies are authorised to make external staff available and such service cannot be provided by consultancy companies The implementation of a new internal control framework is on the way 2 33 Internal control applies to all financial and non-financial activities and is a process that helps an organisation to achieve its objectives and sustain performance, respecting rules and regulations It supports sound decision making, taking into account risks to achieve objectives and reduce them to acceptable levels through cost-effective controls In April 2017, the Commission approved a revised internal control framework (ICF) 2 34 The new ICF is designed to provide reasonable assurance regarding the achievement of five objectives set in the Financial Regulations: (1) effectiveness, efficiency and economy of operations; (2) reliability of reporting; (3) safeguarding of assets and information; (4) prevention, detection, correction and follow-up of fraud and irregularities, and (5) adequate management of the risks relating to the legality and regularity of the underlying transactions It supplements the Financial Regulation with a view to align internal control standards to the highest international standards as set by the Committee of Sponsoring Organisations of the Treadway Commission (COSO) framework 2 35 As was the case for the CommissionŐs internal control standards which are being replaced by the ICF, entrusted bodies such as agencies are expected to implement the ICF by analogy By the end of 2018, the boards of 29 agencies had adopted the ICF while 15 agencies also reported its implementation Not all agencies have a sensitive posts policy in place 2 36 Management of sensitive functions is a standard element of internal control, which aims to reduce the risk of the misuse of powers delegated to staff to an acceptable level Sensitive functions are those where a member of staff executing an activity has a degree of autonomy and/or decisional power sufficient to permit them, should they so wish, to misuse these powers for personal gain (20) In an effective internal control framework, risks associated with sensitive functions are managed through mitigating controls and ultimately staff mobility We found that seven agencies (EASO, EASME, ECHA, EEA, ENISA, Frontex, SRB) do not have policies in place defining their sensitive functions and related mitigating controls Actions to be taken 7 The adoption and implementation of the CommissionŐs Internal Control Framework (2017) by all agencies is a necessity in order to align internal control standards to the highest international standards and make sure internal controls support decision making effectively and efficiently (20) European Commission (SEC 2008 (77)), Guidance on sensitive functions, 19 December 2007 
SK 11 12 2019 Úradný vestník Európskej únie C 417/27 Opatrenia, ktoré je potrebné prijať 6 Keď sa využívajú externí zamestnanci, úplné dodržanie platného právneho rámca EÚ a vnútroštátnych právnych rámcov je jednak otázkou princípu a zároveň je nevyhnutné, aby sa predišlo riziku súdneho sporu a riziku poškodenia dobrého mena.