EUROPEAN COMMISSION

Brussels, 29.4.2019

SWD(2019) 171 final

COMMISSION STAFF WORKING DOCUMENT

FRAUD RISK ASSESSMENT

Accompanying the document

COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL, THE EUROPEAN ECONOMIC AND SOCIAL COMMITTEE, THE COMMITTEE OF THE REGIONS AND THE COURT OF AUDITORS

Commission Anti-Fraud Strategy: enhanced action to protect the EU budget

{COM(2019) 196 final} - {SWD(2019) 170 final}

COMMISSION STAFF WORKING DOCUMENT

FRAUD RISK ASSESSMENT

   Accompanying the document    

COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL, THE EUROPEAN ECONOMIC AND SOCIAL COMMITTEE, THE COMMITTEE OF THE REGIONS AND THE COURT OF AUDITORS

Commission Anti-Fraud Strategy: enhanced action to protect the EU budget

TABLE OF CONTENTS

Key abbreviations

1.Introduction

2.Scope and methods

3.Focus and structure

4.Detected fraud and fraud patterns in EU spending

4.1.Detected fraud

4.2.Fraud patterns

4.2.1. Overview

4.2.2.External fraud

4.2.3.Internal fraud

4.2.4.Fraud trends

5.Fraud vulnerabilities

5.1.Data collection and analysis

5.2.Coordination, cooperation and processes

5.2.1.Coordination of fraud risk management

5.2.2.Cooperation with other EU bodies and with Member States

5.2.3.Cooperation and flow of information between OLAF and Commission services/executive agencies and other EU bodies

5.2.4. Procurement under shared management

5.2.5.Procurement and grants in direct management

5.2.6.Financial instruments and budgetary guarantees

5.2.7.External aid

5.2.8.Cybersecurity

5.3.Integrity and compliance

5.4.Know-how and equipment

5.5.Transparency

5.6.Legal framework

6.Revenue fraud

6.1.Traditional own resources (TOR)

6.2.Value added tax (VAT)

Key abbreviations

1.    Introduction

On 24 June 2011, the Commission adopted its current anti-fraud strategy. This comprised two documents: (i) a Communication from the Commission 5 to the other EU institutions, describing strategic objectives and key operational steps to attain them; and (ii) a more detailed Commission-internal Action Plan 6 .

Taking into account developments in the (anti-)fraud landscape and in the design of EU policies, the Commission has reviewed its anti-fraud strategy to prepare for the Multiannual Financial Framework (MFF) 2021 – 2027. The Commission services have carried out a fraud risk assessment for that purpose, involving also the executive agencies. The results are presented in this staff working document, which accompanies the Communication ‘Commission Anti-Fraud Strategy: enhanced action to protect the EU budget’ 7 . 

The two main vulnerabilities identified in the fraud risk assessment are: (i) an underdeveloped central analytical capacity and (ii) certain gaps in the Commission’s supervision of fraud risk management at department level. The priority objectives of the review, explained in the Communication, are therefore to equip the Commission with a stronger analytical capability and a more centralised system of oversight for the anti-fraud action of its departments. The other key objectives, also based on the fraud risk assessment and on the guiding principles and standards of the 2019 Commission Anti-Fraud Strategy (‘the 2019 CAFS’) 8 , are to maintain the highest standards of professional ethics and competence, to optimise the legal framework for and transparency of EU funding and to improve the fight against revenue fraud.

The Commission has prepared an action plan in the form of a staff working document 9 to achieve the objectives and rectify the weaknesses identified by the fraud risk assessment. Another (separate) staff working document presents an evaluation of the 2011 CAFS 10 .

2.    Scope and methods

In 2017, the Commission adopted a Communication on a revised Internal Control Framework 11 . This includes risk assessment as one of its five main components (alongside control environment, control activities, information/communication and monitoring activities).

As part of the risk assessment component, Principle 8 of the Internal Control Framework requires that ‘The Commission considers the potential for fraud in assessing risks to the achievement of objectives’. In that context, fraud is characterised as a broad concept which includes ‘notably fraudulent reporting, loss of assets, disclosure of sensitive information and corruption.’

The scope of the 2019 CAFS strikes a balance between the nonspecific concept of fraud in the Internal Control Framework and a narrow understanding of fraud as a criminal offence. More broadly, the 2019 CAFS focuses on protecting the EU’s financial interests from fraud, corruption and other intentional irregularities and from the risk of serious wrongdoing inside the EU’s institutions and bodies. These areas are also central to the legislator in the fight against fraud. 12 As a result, the 2019 CAFS covers:

ofraud – including VAT fraud –, corruption and misappropriation affecting the EU’s financial interests, as defined in Articles 3 and 4 of the ‘PIF Directive’ 13 ;

oother criminal offences affecting the EU’s financial interests, e.g., offences linked to an abuse of procurement procedures where they affect the EU budget;

oirregularities as defined in Article 1(2) of Regulation (EC, Euratom) No 2988/95 14 (insofar as they are intentional 15 but not already captured by the criminal offences referred to above); and

oserious breaches of professional obligations by Members or staff of the EU’s institutions and bodies, as referred to in Article 1(4) of the OLAF Regulation and in the second subparagraph of Article 2(1) of Commission Decision (EC, ECSC, Euratom) No 352/1999 16 .

Other non-financial types of fraud affecting EU interests in specific policies such as intellectual property or food safety are of a less cross-cutting nature. Coordinating the Commission’s fight against such types of fraud is therefore not prioritised in the 2019 CAFS, which focuses on preparing for the MFF post-2020.

To prepare for the CAFS review, all Commission services and executive agencies were asked to update their own service-level fraud risk assessments to feed into a corporate fraud risk assessment. As the lead service for the CAFS, OLAF facilitated the exercise by organising five workshops among services with a comparable profile.

OLAF’s methodological guidance for service-level anti-fraud strategies sets out minimum standards for fraud risk assessments but leaves the Commission services and executive agencies a certain margin of discretion, in accordance with the decentralised model of financial management, which — pursuant to the second sentence of Article 74(2) of the Financial Regulation 17 — assigns the responsibility for risk analysis to the authorising officers by delegation (AODs). A bottom-up approach has been taken to assess fraud risks at Commission level, meaning that the departments’ point of view is taken into account and a variety of methods are applied to risk assessment at department level depending on its specific characteristics.

OLAF has compiled a qualitative fraud risk assessment for the Commission. This is based on the contributions received, a desk review of Commission reports, audit observations and other sources (such as the annual OLAF reports and Europol’s Serious and Organised Crime Threat Assessments). This assessment is qualitative in that it is mainly built on the professional judgement of managers, internal control coordinators, operational services, financial units, OLAF investigators and OLAF contact points in the Commission services and executive agencies and supported in part by data from audit results, investigations and other sources. At present, the Commission does not have a comprehensive centralised data collection and analysis capacity which would enable it to develop a quantitative fraud risk assessment. Therefore, the risk assessment does not categorise the fraud risks in order of likelihood and impact, as that could create a misleading impression of mathematical accuracy.

The qualitative fraud risk assessment presented below focuses on issues that affect all Commission departments or that are particularly significant. More specific risks, on the other hand, should continue to be reflected in the services’ anti-fraud strategies. The assessment does not give an exhaustive overview of policy-specific fraud risks as this would take away from the big picture.

3.    Focus and structure

The fraud risk assessment has been guided by the questions of why and how fraud is committed.

According to the traditional criminological model of the ‘Fraud Triangle’ 18 , three elements must coincide for fraud to occur: (i) ‘pressure’ as the motivation; (ii) ‘rationalisation’ as a self-justifying attitude; and (iii) perceived ‘opportunity’. The traditional Fraud Triangle has recently been developed into a slightly more complex ‘New Fraud Triangle’,

The New Fraud Triangle further differentiates the elements of pressure/motivation and rationalisation/self-justification as follows.

·Pressure or motivation comprises the aspects of money, ideology, coercion and ego. For example:

–ideological motivation is that which considers participation in a fraud act as a means to achieve some perceived greater good;

–coercion occurs when individuals may be unwillingly pulled into a fraud scheme, but those individuals can turn into whistle-blowers;

–ego may provide a motive for fraud where the offence serves to protect the offender’s reputation or position of power.    

·Rationalisation or self-justification reflects the potential offender’s personal belief system and their standards of personal integrity. From a practical point of view, observing a person’s commitment to ethical decision-making can help in assessing integrity and thus an individual’s likelihood to commit fraud.

The New Fraud Triangle also adds the fraudster’s capabilities to the equation 19 .

While the motivation and technical capabilities of perpetrators are difficult to observe, the above model suggests that any weaknesses of the Commission’s internal control system and any deficiencies in staff members’ integrity can increase fraud risks. The Commission’s fraud risk assessment therefore focuses on potential systemic weaknesses. As deficiencies in integrity are difficult to observe directly before an act of fraud is committed, the fraud risk assessment looks at typical pitfalls and at the quality of systems in place to prevent them.

The assessment below summarises vulnerabilities in seven categories: (i) data collection and analysis; (ii) coordination, cooperation and processes; (iii) integrity and compliance; (iv) know-how and equipment; (v) transparency; (vi) legal framework; and (vii) revenue. The objectives set out in the Communication on the 2019 CAFS aim to mitigate the risks related to these categories. As the accompanying Action Plan refers to the objectives of the 2019 CAFS, it indirectly refers to the risk categories outlined in the Fraud Risk Assessment. For each action point, the Action Plan indicates which objective it serves and, thus, which kind of vulnerability that particular action is supposed to reduce.

The assessment of vulnerabilities is complemented by key figures that show the dimension of detected fraud and an overview of generic fraud patterns as perceived by the Commission’s departments. Knowledge about relevant fraud patterns helps us analyse how fraudsters may take advantage of vulnerabilities and what can be done to prevent it. 'The risk assessment gives an overview of detected fraud and fraud patterns, which may take advantage of one or more than one of the vulnerabilities discussed, and then addresses each of the seven categories mentioned above. For revenue fraud, both fraud patterns and vulnerabilities are discussed in the last chapter of this staff working document.

4.    Detected fraud and fraud patterns in EU spending

4.1.    Detected fraud

Based on the Commission’s accounting system and the Member States’ reporting on fraud cases in shared management, in 2013–2017 the overall detected fraud in EU spending amounted to 0.27 % of total payments (fraud detection rate) 20 .

The fraud detection rate (FDR) varies between spending areas. For the reference period 2013-2017, the FDR in the overall area of ‘natural resources’ was 0.13 %, with a higher estimate for the subsection ‘rural development’ (0.25 %) than for ‘support to agriculture’ (0.09 %). In the same period the FDR for ‘direct expenditure’ was 0.03 %. Given the multiannual framework for spending in the ‘cohesion and fisheries’ area, the relevant FDR is calculated for the whole programming period. For 2007-2013, the FDR was 0.44 %. With the implementation still under way, there is insufficient data to provide a meaningful analysis for the 2014-2020 programming period.

Fraud-related damage to the financial interests of the EU, which appears to be rather limited according to these figures, is not the only dimension of fraud. Internal fraud, i.e. misconduct by EU staff or Members of EU institutions with potential impact on the institutions’ reputation is also an issue. For example, internal fraud was found in 12 OLAF investigations concluded in 2017 resulting in recommendations for follow-up across all EU institutions and bodies 21 and in 24 cases concluded in 2017 with follow-up by the Commission’s Investigation and Disciplinary Office (IDOC) 22 23 . However, these figures must be taken in context. They represent a very small proportion of the roughly 32 000 people working for the Commission 24 and approximately 50 000 working for all EU institutions and bodies.

With the data and analytical tools currently available, the Commission is not in a position to provide a reliable estimate of undetected fraud. Out of roughly 1 000 examined transactions per year, the European Court of Auditors found suspected fraud in 11 cases in 2016, down from 27 in 2015 25 . This indicates that although the proportion of fraud may be higher than in the above detection statistics, it remains limited.

4.2.    Fraud patterns

4.2.1.    Overview

Regarding fraud patterns, the suspected fraud found by the European Court of Auditors 26 most frequently concerned: (i) the artificial creation of conditions to meet eligibility criteria; (ii) the non-delivery of goods/services; (iii) a declaration of costs that does not meet the eligibility criteria; (iv) conflicts of interest; and (v) other procurement irregularities. According to feedback by the Commission’s departments in the risk assessment exercise, the ‘top 10’fraud patterns cited were:

These figures obviously only give a rough idea of fraud patterns based on the professional judgement of managers and staff responsible for operations and internal control in the Commission services and executive agencies. However, they are partly supported by investigative experience.

4.2.2.    External fraud

The OLAF Report 2016 cites public procurement fraud — facilitated for example through corruption, irregular or fictitious subcontracting or the use of offshore accounts — as the most important focus of OLAF investigations 29 . Recent OLAF reports also highlight plagiarism, fraudulent double-funding, falsification of CVs and timesheets and creating bogus subsidiaries or hiding links between companies as frequent fraud patterns 30 . The vulnerability of public procurement is also reflected in the European Court of Auditors’ observation that ‘Failure to comply with public procurement rules has been a perennial and significant source of error’ 31 , although it should be noted that the complexity of rules is itself a significant source of errors.

Involvement of organised criminal groups has been detected both in expenditure and revenue fraud, and is especially significant in the latter 32 . The EU’s response to organised crime is coordinated between EU institutions and agencies and the Member States in the framework of a ‘policy cycle’ in which Europol and the Council’s Standing Committee on operational cooperation on internal security play key roles 33 . This policy cycle comprises: (i) fact-finding and policy development; (ii) policy setting and decision-making; (iii) implementation and monitoring; and (iv) evaluation and recommendations for further policy development. For the period 2018-2021, the Council has defined 10 policy priorities, several of which relate to the fight against fraud 34 . The EU strategy for the fight against cigarette smuggling and other forms of illicit trade in tobacco products 35 , whose action plan was recently updated 36 , also puts a strong focus on tackling organised crime.

4.2.3.    Internal fraud

Regarding internal fraud, conflicts of interest and breaches of confidentiality are recurrent forms of internal misconduct examined by the Commission’s Investigation and Disciplinary Office (IDOC) 37 . However the frequency of such incidents does not match the high alert they raise among Commission services and executive agencies 38 . There are three possible explanations for this discrepancy, alone or in combination: (i) an insufficient detection rate; (ii) conflict of interest may be an issue observed under shared management more than under direct management; and (iii) services are very concerned about conflicts of interest and breaches of confidentiality because of the potentially high reputational impact but less so because of the likelihood of those risks to materialise.

Analysing this further, reporting on irregularities by Member States does not support the second explanation: According to the statistics for 2016 39 , around 2 % only of irregularities reported as fraudulent were linked to ethics and integrity. While this finding would not rule out the first explanation, i.e. an insufficient detection rate in general, that explanation is not supported, at least for direct management, by observations of the European Court of Auditors, which attest to the good standard of procurement procedures managed by the EU institutions 40 – a domain that is particularly prone to conflict of interest and breaches of confidentiality. In conclusion, the most persuasive explanation for the widespread concern about those issues among Commission services and executive agencies is the potentially serious impact of such infringements of professional ethics on the institution's reputation, rather than an elevated likelihood of those infringements to occur within the Commission or its executive agencies.

The IDOC’s annual reports reveal that one of the most frequent types of alleged misconduct registered in 2015–2017 was harassment and other inappropriate behaviour 41 . Harassment and other behaviour reflecting adversely on a member of EU staff is prohibited by Articles 12a and 12, respectively, of the Staff Regulations 42 . As a serious breach of professional obligations, harassment could fall under the concept of fraud as outlined in Section 2 above. However, although harassment and other inappropriate behaviour may negatively affect work inside the EU institutions and thus decrease the effectiveness of the EU’s fight against fraud, the Commission considers that the challenge is being met through existing means of legal recourse. These are most notably the institutions’ disciplinary powers and their obligation to assist the victim in line with Article 24 of the Staff Regulations 43 but also informal mechanisms —particularly the Network of Confidential Counsellors put in place by the Commission 44 . While the CAFS does not, therefore, look into the issue of harassment and other inappropriate behaviour in more depth, some of the measures proposed, for example on awareness-raising and whistle-blowing, will also help with the fight against harassment and other such personal misconduct.

4.2.4.    Fraud trends

The above overview of fraud patterns does not point to any ground-breaking emerging trends in the ‘fraud landscape’. Ongoing and future developments are/could be linked to:

–changes in the Commission’s delivery model with the increased use of digital communication channels and related increase in exposure to cybersecurity risks;

–changes in commercial delivery models that frustrate the usual control procedures (e.g. paperless boarding passes or, more generally, the rapid expansion of e-commerce and the challenges it poses to customs and tax administrations); and/or

–new technology that provides fresh opportunities for fraudsters, for example enabling ever more sophisticated forgery 45 . Risks related to the adequacy of measures to prevent and respond to IT security threats are already among the top critical risks affecting the Commission as a whole.

5.    Fraud vulnerabilities

5.1.    Data collection and analysis

Data collection and analysis contribute to the fight against fraud in various ways.

oObserving the ‘(anti-)fraud landscape’ in the EU and beyond may provide insight into emerging fraud patterns and innovative ways of preventing and detecting fraud.

oCollecting and analysing data on established and suspected cases of fraud may deepen knowledge on vulnerabilities, fraud patterns and profiles of fraudsters and help to deploy control mechanisms and resources in the most effective and efficient way possible.

oProject databases combined with tools that process data on risk profiles and fraud indicators (‘red flags’) may help with fraud detection or potentially reduce the risk of double-funding or overcharging of cost claims.

Conversely, any missed opportunities in this respect could potentially weaken the Commission’s defences against attempts of fraud.

The Commission is already active in anti-fraud intelligence and analysis.

oTo observe the global anti-fraud landscape and to exchange views with experts from the public and the private sector, OLAF and other Commission departments regularly take an active part in anti-fraud and anti-corruption fora, such as:

–the conference of international investigators 46 ;

–the Economic Crime Agencies’ Network (ECAN) 47 ;

–European Partners against Corruption (EPAC) and the European contact point network against corruption (EACN) 48 ;

–OECD’s Global Anti-Corruption and Integrity Forum 49 ;

–the International Association of Anti-Corruption Authorities (IAACA) 50 ;

–the International Corruption Hunters’ Alliance (ICHA) 51 .

–the Conference of State Parties to the United Nations Convention against Corruption 52 and two of its subsidiary bodies, the Implementation Review Group 53 meetings and the Open-ended Intergovernmental Working Group on the Prevention of Corruption 54 ;

–the G20 Anti-corruption working group; and

–the EU anti-corruption experience-sharing programme 55 .

oData on cases of established and suspected fraud are mainly collected in two databases.

1)Irregularity Management System (IMS):    
In shared management, sector-specific legislation obliges Member States to report established and suspected irregularities, including fraud, to the Commission. OLAF provides the necessary technical infrastructure — the IMS — and coordinates reporting procedures. Data collected through the IMS are increasingly analysed and used to prevent fraud.    

2)Early Detection and Exclusion System (EDES):    
The EDES, established under Articles 135–145 of the Financial Regulation, is a significant advance in sanctioning fraudsters swiftly and effectively and in proactively protecting the EU budget while respecting due process. It allows Commission services and other EU institutions and bodies to flag up financial risks posed by (potential) recipients of EU funds and to exclude unreliable ones from EU funding in direct and indirect management. OLAF investigations, audits conducted by Commission services or by the European Court of Auditors (ECA), alerts received from entrusted entities under indirect management and reports transmitted by national authorities through the IMS provide valuable information for this process.    

oThe Commission processes risk profiles and supports the analysis of big data for fraud prevention purposes through a number of projects. Examples include:

–‘DAISY’ — an analytical tool for the departments responsible for research that processes risk profiles and red flags to focus audit capabilities and other control resources on the most risk-prone projects.    

–‘ARACHNE’ promotes a risk-based approach to project verification in shared management (European Structural and Investment Funds). ARACHNE is a risk scoring tool that feeds a database of projects with publicly available information to identify the most risk-prone projects. Based on a set of pre-defined risk indicators, it continually sifts through internal and external data on beneficiaries, contractors and sub-contractors and determines potentially irregular circumstances.    

–The Single Electronic Data Interchange Area (‘SEDIA’), put in place for public procurement and grants in direct management in line with Article 147(1) of the Financial Regulation can also facilitate checks for double-funding to a certain extent.    

–‘DIGIWHIST’, a project coordinated by the University of Cambridge and co-financed under the Horizon 2020 programme, is developing an open data assessment tool for public procurement. This tool will systematically collect, analyse, and broadly disseminate information on public procurement and on systems that increase the accountability of public officials. It covers 35 countries (EU-28 plus some neighbouring countries). This data will be linked to data on company and public body finances and ownership and on systems that increase public officials’ accountability. The aim is to systematically investigate the patterns and systems of allocating public resources in Europe.

However, more remains to be done in each of these areas concerning data collection and analysis, resources permitting.

oTo observe the (anti-)fraud landscape, a more intense exchange of views with academia from a criminological angle could be sought, e.g., by commissioning studies of national crime and organised crime statistics, studies of illegal or black markets and perception surveys, among others. Policy suggestions gathered at international fora could be evaluated more systematically and criminological research on fraud could be supported and exploited more proactively.    

oData quality in the IMS is affected by inconsistent reporting practices among Member States. This shortcoming is only partially mitigated by guidance developed by national experts in the Advisory Committee for Coordination of Fraud Prevention 56 with support from OLAF. The analytical dimension of the IMS has not yet been fully explored, and the EDES cannot store any information on fraud patterns but only records entities excluded due to fraud or other grounds provided for in the Financial Regulation.    

oRisk scoring tools are only available for a few Commission services and spending programmes and have not been put into use by all the Member States in shared management, although some Member States use their own alternative tools 57 .

Such gaps in the availability and analysis of data for fraud prevention and detection purposes could be filled if the Commission were to have a strong and centralised analytical capability.

In the area of traditional own resources, timely data analysis is crucial in the fight against fraud and has accordingly been put into practice. In addition to its key role in collecting data and providing EU-wide databases, the Commission — notably through its Joint Research Centre and OLAF — has developed several tools to monitor and identify suspicious activities. These include the Automated Monitoring Tool (AMT) 58 and the Contraffic project 59 . This work is shared with Member States who may react to OLAF alerts or conduct their own analysis. Feedback is encouraged, and OLAF is keen to engage with users to identify possibilities for refining its alerts, including expanding their scope and using wider data sources to improve accuracy. The Commission is also developing data analysis tools together with Member States to make better use of the available data sources to fight customs fraud.

5.2.    Coordination, cooperation and processes

This section examines possible vulnerabilities in three areas: (i) in the coordination of fraud risk management across Commission services and executive agencies; (ii) in the structure of cooperation with other EU bodies and with Member States; and (iii) in processes for the prevention and detection of fraud in specific fields.

5.2.1.    Coordination of fraud risk management

Coordination of fraud risk management ensures that largely homogeneous and consistent approaches and methods are applied across Commission services and executive agencies and that the resources available to prevent and detect fraud are deployed effectively and efficiently. Conversely, a lack of coordination decreases the effectiveness and efficiency of the Commission’s fight against fraud.

Fraud risk management in the Commission is organised in a decentralised way. In line with Articles 74(2), 36(2)(d) of the Financial Regulation, internal control, including fraud prevention and detection, is under the responsibility of authorising officers by delegation. As set out in Article 1(2) of the OLAF Regulation, OLAF contributes to the design and development of methods to prevent and combat fraud, corruption and any other illegal activity that affects the EU’s financial interests. The heads of Commission services and executive agencies play a key role in shaping the Commission’s anti-fraud policies at the stages of:

oplanning (service-level anti-fraud strategies, management plans),

oimplementation (control activities, recovery, administrative sanctions), and

oreporting (annual activity reports, contributions feeding into the Commission’s Annual Management and Performance Report and annual Report on the Protection of the EU’s Financial Interests).

To fulfil those tasks, Commission services and executive agencies are supported by the Commission’s Secretariat General and Directorate-General for Budget (DG BUDG) and by OLAF, in particular through:

omethodological guidance and, on request, individual advice for services’ anti-fraud strategies (OLAF);

othe Commission’s Internal Control Framework and Network of Internal Control Coordinators, chaired by DG BUDG;

oreview and advice on the anti-fraud aspects of services’ management plans and annual activity reports (OLAF);

oOLAF’s leading role in compiling the Commission’s annual Report on the Protection of the EU’s financial interests;

oDG BUDG’s role in carrying out recoveries and as lead service for the Early Detection and Exclusion System; and

omoderation of the Commission’s Fraud Prevention and Detection Network as a forum for the exchange of best practice among services’ anti-fraud experts (OLAF).

Moreover, in accordance with Article 118(1) of the Financial Regulation, the Commission’s Internal Audit Service (IAS) assesses departments’ risk management and advises the institution in that respect. The quality and content of internal audit work and the follow-up given to internal and external audit recommendations and to requests made by the discharge authority are monitored by the Commission’s Audit Progress Committee in line with its charter 60 .

These coordination and monitoring activities provide services with several channels of advice and exchange while leaving them plenty of room to develop their own anti-fraud policies. Despite this significant support at corporate level, OLAF’s support role is only advisory in nature, which means that service-level approaches may diverge.

OLAF’s review of management plans and annual activity reports respects the departments’ autonomy and is mostly limited to avoiding major inconsistencies and observing a few formal criteria such as the frequency of updates and monitoring exercises for services’ anti-fraud strategies. Services’ fraud risk assessments and mitigation strategies are rarely challenged in substance.

Given the above, a residual risk exists that the effectiveness and efficiency of anti-fraud controls across the spectrum of Commission services and executive agencies varies and that controls can be suboptimal in some cases. Risks related to certain weaknesses in corporate oversight were also flagged in a 2015 audit by the Commission’s IAS on the ‘Adequacy and effective implementation of DG’s anti-fraud strategies’. OLAF is taking up a stronger role providing effective and targeted oversight in that regard.

5.2.2.    Cooperation with other EU bodies and with Member States

Other EU bodies for which the Commission bears a certain measure of political responsibility, namely decentralised agencies, joint undertakings (JU) and joint technology initiatives (JTI), are in charge of their own anti-fraud policies. In defining these policies, those bodies are subject to similar legal principles as the Commission and the executive agencies. Unlike the latter, the afore-mentioned EU bodies do not form part of the Commission’s Fraud Prevention and Detection Network, but policy coordination happens in different ways. In the research area, JUs have adopted the Research family anti-fraud strategy and are fully integrated in the groups managing the anti-fraud efforts. For decentralised agencies, coordination – to a lesser degree – is arranged through an Inter-Agency Network. The Commission is also represented on the management boards or similar governing bodies of decentralised agencies, JU and JTI.

This relatively loose coordination poses risks to the quality of EU bodies’ anti-fraud controls. OLAF, DG BUDG and the partner DGs of decentralised agencies, JU and JTI mitigate such risks in the following ways: (i) by using methodological guidance for anti-fraud strategies; (ii) by participating in training/knowledge-sharing organised by the Inter-Agency Network; and (iii) through the monitoring of anti-fraud policies by the agencies’ management boards. However, the legal autonomy of the EU bodies in question sets limits to coordination. In the case of JU and JTI, cultural differences brought about by cooperation with partners from the private sector may add to potential difficulties but can also provide innovative perspectives.

Concerning Member States, national authorities involved in shared management are subject to the principle of sound financial management but have some leeway as to its implementation. In the area of European Structural and Investment Funds 61 , in accordance with the Common Provisions Regulation (CPR) 62 , national authorities must prevent, detect and correct irregularities (Article 122(2) CPR) and put in place effective and proportionate anti-fraud measures taking into account the risks identified (Article 125(4)(c) CPR). Yet, statistics gathered from Member States’ reporting through the IMS show that among EU countries, the fraud detection rate (i.e. the proportion of payments found to be affected by fraud out of total payments), varied between less than 0.01 % and 1.02 % in 2013-2017 63 . While there could be many reasons for such discrepancies, there is at least a possibility that they are due to differences in the effectiveness of anti-fraud measures between individual Member States.

A lack of consistently effective anti-fraud policies in shared management, which accounts for up to 80 % of the EU budget, exposes the budget to substantial risks.

Commission services responsible for shared management and OLAF regularly work with experts from the Member States to coordinate anti-fraud policies. Under the Advisory Committee for the Coordination of Fraud Prevention (COCOLAF), OLAF continues to encourage Member States to develop national anti-fraud strategies, and in 2016 COCOLAF adopted guidelines in this respect. Ideally, anti-fraud measures required under the CPR should be embedded in a comprehensive national anti-fraud strategy. To date, 10 Member States have put in place a national strategy. The European Parliament expressed regret that not all Member States have taken that step 64 .

5.2.3.    Cooperation and flow of information between OLAF and Commission services/executive agencies and other EU bodies

Article 8(1) of the OLAF Regulation requires the institutions, bodies, offices and agencies to transmit to OLAF without delay any information relating to possible cases of fraud, corruption or any other illegal activity affecting the financial interests of the EU 65 . OLAF has observed wide variations in the quality and quantity of the information flow on suspected fraud from the various Commission departments and the other institutions, bodies, offices and agencies. These variations in the information flow may lead to inconsistency of treatment or even to some suspicions not being treated at all.

OLAF has prepared a document entitled ‘Tasks and responsibilities of the OLAF Contact Points (OCPs) of the EU Commission services and Executive Agencies and OLAF’ for the Commission and its executive agencies. This document describes the role entrusted to the OCPs and spells out their tasks and duties and those of their department or agency, and of OLAF, on all aspects of their cooperation. The necessary flow of information is also a topic in anti-fraud training and in the exchange of best practice through the Commission’s Fraud Prevention and Detection Network.

Problems with the flow of information are even more acute for the decentralised agencies, whose dispersed location and employment of non-permanent personnel as the large majority of their staff may risk weakening the anti-fraud process to some extent. Several measures could be taken to remedy such weaknesses. OLAF could provide targeted training to raise awareness of the agencies’ management and staff about specific risks such as conflicts of interest and breaches of professional secrecy, including leaks. These training sessions could help reinforce the message that OLAF’s involvement is key for addressing fraud-related issues appropriately to their benefit, and that it does not cause them additional difficulties. Training could also cover other aspects of their anti-fraud responsibilities. It could be provided during a meeting of the Inter-Agency Legal Network which provides its members with training and updates and a forum to exchange best practices. The network has a specific working group on anti-fraud issues. OLAF should regularly participate in this group.

5.2.4.     Procurement under shared management

As OLAF’s investigations have shown, public procurement, which remains the largest channel of public spending, is an attractive marketplace for fraudsters, who use corruption and offshore accounts to facilitate fraud. Many procurement fraud cases are transnational, as the new fraud scenarios often involve a contracting authority from one Member State and bidders from several other Member States who subcontract their works to companies in different countries 66 .

Over a 5 year period (2012–2016), 20 % of all irregularities reported by Member States through the IMS have related to breaches of public procurement rules which account for 30 % of all reported irregular financial amounts 67 .

In 2014, the EU adopted new procurement directives 68 , which was one of the priority actions of the 2011 CAFS. Among the features of the new directives were:

ocreating a dedicated legal framework for concession contracts;

ointroducing e-procurement as of 2018;

ostrengthening the provisions on conflict of interest;

oclarifying the rules on modifying contracts after they are awarded; and

ostrengthening the exclusion grounds.

In 2017, the Commission adopted a procurement package 69 whose aims included professionalising Member States’ procurement staff and introducing a voluntary upstream assessment of large infrastructure projects.

The Commission departments responsible for shared management put in place a comprehensive public procurement action plan in 2013, which has been updated several times. An updated version was officially endorsed in April 2017 and includes a revised state of play of the actions to put a greater emphasis on strategic procurement and transparency. It also includes measures which contribute to preventing fraud and corruption in public procurement.

One important measure of the action plan which is relevant for the CAFS is the ‘Integrity Pacts: A Civil Control Mechanism for Safeguarding EU Funds’ 70 . This project is implemented in cooperation with the ‘Transparency International and pilots Integrity Pacts’ in a number of projects in the Member States co-financed by the EU Structural and Cohesion Funds. 

Another measure in the action plan is the public procurement guidance that aims to help practitioners avoid the most common errors in projects funded by the European Structural and Investment Funds 71 . The updated version, published in February 2018, incorporates the key changes introduced by the new Public Procurement Directive 2014/24/EU and takes procurement officers step-by-step through all stages of the process — from planning to contract implementation — while highlighting risk areas. It includes examples of good practice, case studies and useful links to help those who are involved in the planning, selection and implementation of EU-supported projects.

Member States’ managing authorities/intermediate bodies will also be provided with both internal and external training on the new directives and on strategic procurement.

All of these initiatives will gradually improve the quality of procurement procedures in the Member States and strengthen the fight against fraud. But in the meantime, public procurement in shared management is likely to remain a fraud-prone field of activities for many years 72 .

5.2.5.    Procurement and grants in direct management

In the departmental fraud risk assessments 73 , a considerable number of services engaged in direct management mentioned public procurement as one of the most significant areas of fraud risk. Fraud risks include collusion among tenderers and conflicts of interest of a staff member. However, there are also fraud risks during a project’s implementation phase due to falsification of timesheets and other documents, which play an equally important role as double-funding 74 in fraud related to grants.

The Commission has put in place an array of safeguards and controls in both grants and procurement management. Thanks to such measures, the European Court of Auditors has given a positive assessment of the institutions’ ‘robust’ procurement procedures 75 .

Progress should continue as the Commission extends its use of IT tools such as e-procurement and e-grants, as these can help to detect double-funding, for instance. For grants, the increasing use of simplified cost options and the use of financing not linked to costs 76 could reduce fraud risks still further 77 . Financing that is linked to outputs or results rather than costs and output-based lump sums largely remove the relevance of accounting for eligible costs and related risks of falsification and deceit.

In parallel, the Commission services and executive agencies will have to avoid vulnerabilities regarding technical checks on whether all conditions have been met and the results achieved by beneficiaries. These checks need to be thorough and effective if simplification measures are to reduce fraudulent and non-fraudulent irregularities.

Fraud risks at the point that lump sums are determined on the basis of estimated budgets also need to be dealt with. In procurement and possibly also in cases of financing not linked to costs or simplified forms of contributions (lump sums, unit costs and flat rates), further risks could come from knowledge gaps, where services do not carry out preliminary market consultations 78 when preparing their calls for tenders or proposals.

It should also be noted that dropping the requirement of time recording due to simplification will increase the importance of the control of the deliverables.

5.2.6.    Financial instruments and budgetary guarantees

Through financial instruments, the EU directly or indirectly provides, or contributes to, funding which helps to attain EU policy objectives with financial support in the form of equity participation, loans, guarantees or other risk-sharing instruments. Financial instruments provide benefits such as a high degree of flexibility, possibilities to bridge investment gaps and opportunities to combine EU funding with funds from national budgets and international organisations, national and international financial institutions and private investors. As a result, financial instruments have become a significant delivery model for the EU budget. During the 2014-2020 programming period, EU funds invested in financial instruments are expected to amount to around EUR 9 billion in direct and indirect management 79 and around EUR 21 billion in the European Structural and Investment Funds 80 .

Most financial instruments are characterised by a contribution from the EU budget given to an entrusted entity – usually the European Investment Bank (EIB), the European Investment Fund (EIF) or another international financial institution such as the European Bank for Reconstruction and Development (EBRD). It can also be a national promotional bank in a Member State such as KfW Group in Germany, which funds projects directly or indirectly, i.e. through other financial institutions acting as financial intermediaries and sub-intermediaries or by contributing to an investment fund or ‘fund of funds’. Where possible, EU funding will be combined with investment capital made available by the entrusted entity, the financial intermediaries and sub-intermediaries and by other contributors to funds and ‘funds of funds’.

Apart from the risk of possible misrepresentation by the final recipient, other fraud risks and systemic vulnerabilities may be present at each level of the financial instrument’s implementation — from the Commission service, executive agency or (shared management) managing authority providing the EU funding over the entrusted entity to financial (sub-) intermediaries and fund managers. They include, in particular, risks of staff misconduct, weaknesses of internal control systems and a lack of coordination of control priorities between the various actors involved at different levels of implementation.

oStaff misconduct could include misuse of confidential sensitive information.    

oSome of the implementation partners, especially local partners of entrusted entities and managing authorities, may have weak administrative capacities and internal control systems.    

oDiverging control priorities at different levels of implementation could affect the effectiveness of anti-fraud controls.    

oA multitude of funding schemes branching out under a variety of programmes may also increase the risk of double-funding.

Despite those potential fraud risks, financial instruments do not rank high on services’ internal fraud risk assessments. In practice, those risks rarely seem to materialise, as confirmed by a low number of OLAF investigations in the field of financial instruments 81 . Mitigating factors that play an important role in this respect are:

othe alignment of entrusted entities and intermediaries’ interests as they often invest with their own risk capital and therefore have an economic interest in the success of the portfolio of projects invested in;

othe chain of partners intervening in the process which creates vulnerabilities and also multiple layers of control; and    

ocomprehensive and sophisticated anti-fraud policies put in place by entrusted entities, most notably by the EIB 82 83 .

Nevertheless, mitigation is not complete and should therefore be reinforced where a systemic issue emerges. 84

For budgetary guarantees, an assessment of related fraud risks has to factor in the reliability of the counterpart and the risk profile of the transactions supported by the guarantee. Here it should be noted that the setting of the risk profile is in itself a key moment of risk. An erroneous, possibly manipulated, setting of the risk (i.e. setting the risk at an unrealistically low level) could lead to a substantial loss for the EU budget. It has to be ensured that the controls for this risk setting operation are sound.

The largest guarantee issued by the EU budget is the one underpinning the European Fund for Strategic Investments (EFSI) 85 whose amount is limited to EUR 26 billion. While the EIB Group is a reliable counterpart, financing operations under the EFSI are similar to financial instruments, except that related operations will either involve no funding or only partial funding from the EU budget, with the remaining investment coming from the EIB or EIF, backed partially by the EU guarantee.

Conclusions on financial instruments will therefore apply to a certain degree also to budgetary guarantees keeping in mind that the multitude of funding schemes will be reduced in the next MFF. In the longer run, it should be re-examined whether the implementation framework for budgetary guarantees is in line with their increasing importance as a delivery model of EU financial support.

5.2.7.    External aid

The Commission services responsible for external aid, namely

oService for Foreign Policy Instruments (FPI);

oDirectorate-General Neighbourhood and Enlargement Negotiations (DG NEAR);

oDirectorate-General International Cooperation and Development (DG DEVCO);

oDirectorate-General European Civil Protection and Humanitarian Aid Operations (DG ECHO);

work in particularly complex and challenging geographical, political and organisational settings which entail specific vulnerabilities to fraud. A number of factors make up the operational environment specific to the external relations sector, in particular:

ogeographically dispersed activities, including in areas with difficult legal and/or political conditions;

ovarying levels of efficiency of the national legal, regulatory and institutional framework and of responsiveness and enforcement regarding fraud and corruption in the areas of operation;

omultiple aid instruments and delivery models under different, and sometimes changing, management modes (direct/indirect management);

oa large volume of financial management performed by implementing authorities in non-EU countries;

odiversity of implementing organisations and partner countries with different management and control capacities;

odifficulties in exchanging information with those partners;

oa high number of operations and associated financial transactions with limited resources to ensure full-scale supervision, and strong reliance on desk reviews at headquarters; and

oa mixed composition of staff in local operations, characterised by

–a high ratio of contract agents and local agents;

–regular turn-over of officials and contract agents; and

–difficulties in attracting staff in countries marked by (post-)crisis or (post-) conflict situations.

All the departments concerned have put in place comprehensive anti-fraud controls such as staff training, requirements for authorisation by headquarters, vetting of implementing partners and upstream verification of a significant proportion of financial transactions under indirect management. Still, the great variety of implementing partners and limits to checks, notably regarding non-EU countries and international organisations, expose the EU budget to potential weaknesses as regards fraud risk management by such implementing partners. Similarly, the latest OLAF report highlights vulnerabilities to fraud in the area of humanitarian aid 86 .

With regard to EU trust funds, the European Court of Auditors has called for more transparency in the selection of implementing organisations. It has also voiced concerns that implementing organisations being represented on the operational committee of a trust fund could lead to potential conflicts of interest 87 .

Untargeted budget support is an element of the increasing part of EU funding that is not linked to the reimbursement of specific costs but to the fulfilment of ‘conditionalities’, which are in the external aid context of a political, social or economic nature This feature is shared by macro-financial assistance managed by the Directorate General Economic and Financial Affairs (DG ECFIN). Difficulties in verifying such pre-conditions for support in a non-EU country need to be anticipated.

Financial instruments are widely used in the external aid sector. They have recently been complemented by the European Fund for Sustainable Development 88 , an investment vehicle backed by a guarantee from the EU budget, similar to the EFSI. In this respect, the risk assessment for financial instruments and budgetary guarantees in the preceding section applies with the proviso that the involvement of a broad spectrum of implementing partners from the external aid sector, including bodies governed by private law in a Member State or partner country, may carry additional risks.

5.2.8.    Cybersecurity

As mentioned in Section 4.2.4. (p. 14), risks related to the adequacy of measures to prevent and respond to IT security are among the top critical risks for the Commission as a whole.

Cybersecurity risks in general are increasing exponentially. Studies suggest that the economic impact of cybercrime rose fivefold between 2013 and 2017, and could further quadruple by 2019 89 . Cybersecurity incidents are diversifying both in terms of who is responsible (fraudsters, hacktivists, state actors but also insiders in organisations) and what they seek to achieve (data breach or identity theft, political attention or defamation, theft of confidential information or dissemination of incorrect information, theft of user and administrator log-ins and passwords to manipulate financial circuits or databases used for internal reporting, and many other purposes). Tools available within the deep web or darknet (‘crime-as-a-service’) make it easier for potential perpetrators to acquire cyberattack capabilities.

Such risks are increasingly relevant to the Commission and other EU institutions and bodies due to the increased use of IT systems supporting EU policies, as required notably by the EU e-Government action plan for 2016-2020 90 and in Articles 146–149 of the Financial Regulation.

The Commission has responded at policy level in a number of ways. It adopted the 2013 EU cybersecurity strategy 91 and proposed the NIS Directive 92 . It also recently adopted initiatives such as a reform of the EU Agency for Network and Information Security, a Cybersecurity Certification Framework, a Cybersecurity Emergency Response Fund and a European Cybersecurity Research and Competence Centre. Further details of this policy response can be found in a Joint Communication with the High Representative of the Union for Foreign Affairs and Security Policy of 13 September 2017 93 .

At managerial level, the Commission has put in place a new information security governance structure, which provides the foundation for a prioritised and business-driven development of IT security capabilities. Already in 2015, following recommendations by the Internal Audit Service, the Commission created an Information Security Steering Board, chaired by a Deputy Secretary-General and reporting to the Corporate Management Board at corporate level. Inter-service coordination between the lead services — the Secretariat General, the Directorate-General for Human Resources and Security and the Directorate-General for Informatics, has thus been reinforced. In November 2016, the Information Security Steering Board adopted an IT security strategy for the European Commission. In 2017, the Commission reviewed and updated its rulebooks 94 to improve implementation of IT security controls in a way which addresses critical risks and meets business priorities. Finally, in November 2018, the European Commission Digital Strategy 95 created a new internal policy framework for a digitally transformed Commission by 2022, whose working methods should be embedded in a sound data ecosystem, which is adequately protected from cyber threats. The implementation of the strategy will be overseen by the new Information Technology and Cybersecurity Board, a subgroup of the Corporate Management Board 96 ; it is taking over the responsibilities of the Information Security Steering Board and other actors.

Despite these actions, because of the rapidly evolving threat landscape, the Commission remains exposed to a critical risk from politically or economically motivated criminal actors. Lower-level risks come from factors such as the outsourcing of IT services, opportunistic non-targeted attacks such as phishing attempts and the management of IT access rights.

5.3.    Integrity and compliance

The effectiveness of even the best anti-fraud procedures could be undermined if integrity and compliance of staff were weak. Real and apparent lapses in integrity and impartiality also risk harming the institutions’ reputation in a particularly serious way.

With this in mind, Commission services have ranked undeclared conflicts of interest and breaches of confidentiality as high in their internal fraud risk assessments. However, that ranking does not imply an elevated likelihood of conflict of interest or breaches of confidentiality 97 and the Commission has no evidence of a high rate of such infringements at corporate level 98 .

Regarding the framework in place to ensure staff adhere to ethical conduct, a number of measures have been taken since the 2011 CAFS:

oFar-reaching amendments to the Staff Regulations entered into force on 1 January 2014 99 . That reform tightened the rules on the professional ethics of EU staff, for example in the following areas:

–conflict of interest, notably avoidance of conflicts of interest when a staff member is recruited or reintegrated after a leave on personal grounds (Article 11, third and fourth paragraph);

–lobbying activities by senior officials after leaving the service (Article 16, third and fourth paragraph); and

–whistle-blowing, for which institutions are required to adopt implementing rules and procedures and to inform staff accordingly (Article 22c).

oThe Commission adopted guidelines on whistle-blowing already in 2012 100 and was the first EU institution to do so;    
At the time of the Staff Regulations reform, the Commission revised its rules on outside activities of staff members 101 , thereby strengthening its prevention of conflicts of interest. Since then, the rules have been updated once again 102 .

The Commission’s staff is also strongly encouraged to participate in the diverse range of training available on professional ethics. Therefore, the Commission does not identify any particular weaknesses of the rules of staff conduct or the way those rules are applied. However, the ECA’s ongoing audit of the Commission’s ethical framework should help refine that analysis.

The Commission has recently revised the code of conduct for its members 103 , strengthening safeguards for impartiality of Commissioners, for instance through an extended cooling-off period for post-mandate activities and greater transparency on financial interests.

Furthermore, the EU legislator and the Commission have taken steps to apply some of the rules that protect integrity in managing the EU budget to staff working for national authorities and other actors in the Member States. Apart from sectoral legislation, this drive is reflected in:

oArticle 61 of the new Financial Regulation, which explicitly extends the concept of conflict of interest to those involved in shared management at Member State level; and

othe Commission’s proposal for a Directive of the European Parliament and of the Council on the protection of persons reporting on breaches of EU law 104 .

5.4.    Know-how and equipment

Services' resilience to fraud also depends on their staff members’ awareness of fraud risks and on staff members’ skills in counteracting attempts at fraud. Therefore, awareness-raising and training already featured in the 2011 CAFS 105 .

Numerous training activities continue to be carried out by OLAF and other departments.

oThe Commission’s permanent anti-fraud training programme comprises an introductory course for all staff and an advanced class for auditors and investigators.    

oThat programme is complemented by training given by OLAF for the staff of individual Directorates-General (including in the EU delegations), executive agencies, decentralised agencies, Civilian Common Foreign and Security Policy (CFSP) Missions European Union Special Representatives and other EU institutions and bodies. Many Commission departments have developed local awareness-raising measures as part of their service-level anti-fraud strategies.    

oOLAF and other Commission departments also organise training for the staff of Member State authorities and take part in knowledge-sharing events in the Member States.

oOccasionally, OLAF trains the staff of international organisations and other implementing partners.

Further awareness-raising activities include:

odeveloping and maintaining a comprehensive Commission-internal anti-fraud website; and

oencouraging and/or facilitating the exchange of views and best practice:

–between representatives of Commission services and executive agencies in the Commission’s Fraud Prevention and Detection Network;

–with and among staff members of decentralised agencies and similar EU bodies in the Inter-Agency Network; and

–with and among experts from the Member States in the Advisory Committee for the Coordination of Fraud Prevention.

Nevertheless, according to the internal fraud risk assessment, 43 % of the participating services identified insufficient know-how as a fraud vulnerability. The Commission departments responsible for external aid, seconded by the European External Action Service, put special emphasis on training needs in the delegations, including for Heads of Delegation, as well as in the civilian CFSP missions and in the offices of EU Special Representatives. The Commission departments responsible for shared management underlined the importance of continued awareness-raising, training and professionalisation efforts for the benefit of staff working in Member States, and so does the Commission for public procurement, taxation and customs matters 106 .

The limited availability of appropriate data mining tools and of certain types of hardware (e.g. X-ray scanners for border controls) may also expose the EU budget to risks.

Through relevant spending programmes, notably the new EU anti-fraud programme proposed by the Commission (provided it is approved by the co-legislators) 107 , the Commission will continue to co-finance awareness-raising measures and anti-fraud tools and equipment, such as data mining and optical scanning tools, for national authorities.

5.5.    Transparency

The public’s access to data on public financial management is a tool in the fight against fraud, because — up to a certain degree that will depend on the scope of public access — it allows civil society and media to police the propriety of transactions such as contract and grant awards. Transparency was therefore already an integral part of the 2011 CAFS 108 .

As required by Article 38 of the Financial Regulation, the Commission operates a ‘Financial Transparency System’ 109 , which gives the public access to some information on recipients of EU funding under direct management. The Commission has also committed to supporting the International Aid Transparency Initiative (IATI) 110 , which promotes the timely, comprehensive and forward-looking publication of aid information.

However, the Financial Transparency System is limited to direct management and does not contain detailed information on contracts and grant agreements, tenders and grant applications, or the terms of a financial instrument. Providing such detailed information would open up far greater possibilities of analysing the conduct of spending services but would have to be weighed against the rights of entities and persons concerned. Data protection legislation must be respected, and further measures, also protecting organisations, might be necessary in some cases.

5.6.    Legal framework

‘Fraud-proofing’ the legal framework, i.e. optimising its resilience to fraud, corruption and other irregularities, has long been part of the Commission’s anti-fraud policy, including the 2011 CAFS 111 . In practice, fraud-proofing should be fostered both through awareness-raising and the training of staff working in policy-making departments and by consulting OLAF from an early stage of the drafting process.

Fraud-proofing is not limited to legislation. It must extend to implementing rules, model contracts/agreements, procedures, workflows, etc. While the 2011 CAFS established anti-fraud clauses in the basic acts of spending programmes 112 , the legislation governing the programming period after 2020 will have an all-encompassing provision on the protection of the EU’s financial interests (Article 129 of the revised Financial Regulation). The requirements regarding access rights for the competent EU institutions, bodies and offices laid down in that provision will have to be clarified and implemented in the non-legislative legal documentation of the different spending programmes and funding mechanisms to avoid legal uncertainty and to ensure swift checks, audits and investigations in cases of suspected fraud.

Another feature of the new programming period — partly already present in the current and even the past one, though to a far lesser extent — will be an emphasis on lump sums and/or financing not linked to costs in direct and shared management. In the external aid sector, instruments like budget support and macro-financial assistance (MFA) 113 take a similar approach and are also widely used. The main characteristic of such funding schemes is that funding depends on the recipient fulfilling certain conditions rather than providing proof of the eligible costs they incurred. Where these forms of funding involve pre-financing 114 , there is a risk that fraudulent non-/under-delivery of the agreed conditions (by a recipient who never intended to meet the conditions) may go undetected. This risk may be aggravated by reduced possibilities to verify the recipient’s operations. Therefore, in the framework of lump sums and financing not linked to costs, there is a need to develop – across the different management modes – control strategies for deliverables and for the analysis of non-/under delivery with a view to detecting fraud.

Fraud-proofing also has to look into the legal framework for investigating fraud. The setting up of the European Public Prosecutor’s Office 115 and the ongoing transposition and implementation of the PIF Directive significantly improve the legal framework for the protection of the EU’s financial interests by means of criminal law. The recent evaluation of the OLAF Regulation 116 concluded that it allowed OLAF to deliver concrete results in protecting the EU budget. The 2013 changes brought about clear improvements in the conduct of investigations, in cooperation with partners and in the rights of persons concerned. The evaluation also identified certain shortcomings in the application of the Regulation that reduce the effectiveness of OLAF investigations and thus the EU’s fight against fraud. Shortcomings that should be addressed in the short term concern, in particular:

oConducting on-the-spot checks and inspections;

oAssistance of national competent authorities before and during an investigation;

oAccess to information on bank accounts; and

oOLAF's tools for the investigation of VAT fraud.    

The Commission has consequently tabled a proposal to amend the OLAF Regulation 117 . The amendments proposed will allow OLAF to cooperate closely with the EPPO and to operate more effectively in its investigations.

Finally, a sound legal framework is essential in international cooperation beyond the territorial scope of the EU Treaties. In a world with global trade, financial, travel and data flows, fraud takes on a globalised perspective and so too should the fight against fraud. The EU’s external borders often set limits to cooperation and investigation, so OLAF’s competences need a basis in international instruments (or ad-hoc permission) for any investigation outside the territory of EU Member States.

Consequently, agreements with non-EU countries and international organisations normally have a clause on the protection of EU financial interests. OLAF investigations can sometimes be conducted more easily where Administrative Cooperation Arrangements — concluded between OLAF and a non-EU country or an international organisation — lay down implementing rules. Aside from investigative purposes, international agreements may also serve to set up data exchange between administrations, which is often crucial for fraud prevention and detection. A notable example is the WHO Protocol to Eliminate Illicit Trade in Tobacco Products, which has been ratified by the EU 118 but not yet by all Member States.

While the network of international cooperation in the fight against fraud is far from complete, every international cooperation agreement helps to close a loophole.

6.    Revenue fraud

Revenue fraud affects traditional own resources and value added tax. In this type of fraud, the harm done by organised crime groups is especially significant 119 .

6.1.    Traditional own resources (TOR)

Fraud in the area of TOR does considerable damage to the EU budget. In 2016, the fraud detection rate of 0.33 % in TOR exceeded the 0.21 % 120 fraud detection rate on the expenditure side of the budget. Even though the ‘gap’ was narrower 121 , this trend continued in 2017 (0.30 % against 0.29 %). The detected fraud mainly concerned anti-dumping, countervailing and other customs duties. Fraud may be committed through smuggling, for example cigarette smuggling, especially trafficking in non-branded cigarettes (‘cheap whites’) 122 . Fraud may also occur through the false declaration 123 of the origin of imported goods, of the value of goods (undervaluation) or of their classification under the Combined Nomenclature 124 , pursuant to Article 57 of the Union Customs Code 125 . It can also take the form of ‘transit fraud’ — situations where goods are declared to be only transiting through the EU but in reality never leave the EU 126 .

Three Commission departments (DG TAXUD, DG BUDG and OLAF) share the main responsibilities in this area.

Policy-making is mainly the responsibility of the Commission’s Directorate-General for Taxation and Customs Union (DG TAXUD). A new Union Customs Code has been in application since 1 May 2016. It aims to:

ostreamline customs procedures;

oharmonise the implementation of customs legislation;

obetter protect the internal market from safety, security and other threats linked with the flow of goods across the external borders; and

obetter safeguard the financial interests of the EU and the Member States.

While the implementation of the Customs Union is primarily the responsibility of the Member States, DG TAXUD works towards: (i) all Member States and the Commission sharing an overall vision; (ii) a more effective enforcement of the rules; and (iii) a stronger role for customs in joined-up border management and law enforcement.

The Commission’s Directorate-General for Budget (DG BUDG) exercises the Commission’s powers to inspect how Member States comply with their responsibilities in the area of TOR, how they respect relevant EU legislation and protect the EU’s financial interests. DG BUDG also assists Member States in improving their control systems to mitigate fraud risks and ensures the recovery to the EU budget of any TOR losses for which the Member States are responsible.

OLAF investigates customs fraud cases and cooperates with Member States and non-EU countries to prevent them. OLAF also organises or supports joint customs operations with the Member States and non-EU countries to combat illicit cross-border trafficking in specific goods. OLAF also has a unique administrative investigative mandate in the fight against the illicit tobacco trade. OLAF coordinates anti-tobacco-smuggling operations carried out by law enforcement agencies across Europe and works to ensure that evaded duties are recovered, that criminal smuggling networks are dismantled and that perpetrators are brought to justice.

OLAF and DG TAXUD work together to keep the legal framework up-to-date to enable effective mutual administrative assistance between Member States and cooperation between them and the Commission to combat customs fraud.

A 2016 audit by the Commission’s Internal Audit Service (IAS) looked at anti-fraud policies in the area of TOR. The IAS observed a lack of consistency and coordination in the strategies and activities of the Commission departments responsible for TOR and a lack of emphasis on TOR issues in the Commission’s anti-fraud strategy.

In the meantime, the Commission departments concerned have taken action to remedy these shortcomings. This includes the following initiatives:

oDG TAXUD, DG BUDG and OLAF have intensified their cooperation, especially on undervaluation 127 , risk management and other fraud-related issues. A strategic steering function on fraud prevention and detection for TOR at directors’ level was established in 2017. The aim is to regularly discuss strategic policy issues to protect the revenue side of the budget. The three departments also coordinate their anti-fraud activities in the newly created ad-hoc subgroup on TOR of the Fraud Prevention and Detection Network;    

oIn cooperation with DG TAXUD and DG BUDG, OLAF has revised its methodological guidance on anti-fraud strategies with an addendum in the area of TOR, which was endorsed in 2017 by the Fraud Prevention and Detection Network’s ad-hoc subgroup on TOR;    

oDG TAXUD adopted a new anti-fraud strategy in 2018, and DG BUDG is planning to do so in 2019, after the review of the CAFS coordinated by OLAF.

Thanks to this new framework for cooperation, further work on assessing specific TORrelated fraud risks, on collecting, exchanging and analysing customs-related data, on training for Commission staff and on capacity building in Member States, will be even more effective and efficient in the future.

6.2.    Value added tax (VAT)

In the area of VAT, it is estimated that cross-border fraud, such as ‘missing trader’ or ‘carousel’ fraud 128 , generates budgetary losses of around EUR 50 billion a year 129 . However, most of this is borne by the Member States.

In this respect, the Commission has found serious shortcomings in the current system of value-added taxation of cross-border transactions that make it vulnerable to fraud. The Commission has outlined its preferred way forward 130 and presented long and short-term solutions, including improvements to the rules governing cooperation with and among the Member States.

While the long-term solutions aim at a more fraud-proof, definitive VAT system for the EU, the short-term projects focus on improving the rules governing cooperation with and among the Member States. Such improvements would include joint administrative enquiries in cross-border cases and an enhanced information exchange, both among Member States and between the latter and Europol, OLAF and the EPPO, once set up.

(1)

     Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the financial rules applicable to the general budget of the Union, amending Regulations (EU) No 1296/2013, (EU) No 1301/2013, (EU) No 1303/2013, (EU) No 1304/2013, (EU) No 1309/2013, (EU) No 1316/2013, (EU) No 223/2014, (EU) No 283/2014, and Decision No 541/2014/EU and repealing Regulation (EU, Euratom) No 966/2012, OJ L 193, 30.7.2018, p. 1.

(2)

     Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999, OJ L 248, 18.9.2013, p. 1, as amended.

(3)

     French acronym for "protection des intérêts financiers de l'Union européenne".

(4)

     Directive (EU) 2017/1371 of the European Parliament and of the Council of 5 July 2017 on the fight against fraud to the Union’s financial interests by means of criminal law, OJ L 198, 28.7.2017, p. 29.

(5)

   Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee, and the Committee of the Regions and the Court of Auditors of 24 September 2011 on the Commission Anti-Fraud Strategy, COM(2011) 376 final.

(6)

   Communication to the Commission, Commission Internal Action Plan for the Implementation of the Commission Anti-Fraud Strategy, SEC(2011) 787/3.

(7)

   COM(2019) 196.

(8)

   See Section 4.1. of the Communication (reference in FN 7).

(9)

   SWD(2019) 170.

(10)

   SWD(2019) 500.

(11)

   Communication to the Commission from Commissioner Oettinger of 19 April 2017, Revision of the Internal Control Framework, C (2017) 2373 final.

(12)

     See Article 1, paragraphs 1 and 4, of the OLAF Regulation (reference in FN 2).

(13)

   Reference in FN 4.

(14)

   Council Regulation (EC, Euratom) No 2988/95 of 18 December 1995 on the protection of the European Communities’ financial interests, OJ L 312, 23.12.1995, p. 1.

(15)

     All irregularities are included in the scope of the OLAF Regulation, but the 2019 CAFS focusses on intentional wrongdoing.

(16)

   Commission Decision (EC, ECSC, Euratom) No 352/1999 of 28 April 1999 establishing the European Anti-Fraud Office (OLAF), OJ L 136, 31.5.1999, p. 20, as amended.

(17)

   Reference in FN 1.

(18)

   W. Steve Albrecht, Fraud in Government Entities, The Perpetrators and the Types of Fraud, Government Finance Review Vol. 7 No 6, 1991, building on Donald R. Cressey, Other People’s Money: A Study in the Social Psychology of Embezzlement, 1953, and others.

(19)

   R. Kassem / A.W. Higson, The New Fraud Triangle Model, Journal of Emerging Trends in Economics and Management Sciences Vol. 3 No 3, 2012, building on David T. Wolfe / Dana R. Hermanson, The Fraud Diamond: Considering the Four Elements of Fraud, The CPA Journal Vol. 74 No 12, 2004, J. W. Dorminey / A. S. Fleming / M.-J. Kranacher / R. A. Riley Jr., The Evolution of Fraud Theory, Issues in Accounting Education Vol. 27 No 2, 2012, and others.

(20)

     The fraud detection rate measures the financial impact of detected fraud as a proportion of total revenue or expenditure. It is determined for the budget as a whole and for particular sectors.

(21)

   OLAF Report 2017, p. 24: https://ec.europa.eu/anti-fraud/sites/antifraud/files/olaf_report_2017_en.pdf

(22)

   IDOC’s 2017 annual report p. 4 — IDOC’s annual reports are Commission-internal documents but are made available to members of the public on request.

(23)

   The sets of 12 OLAF and 24 IDOC cases may partially overlap where IDOC followed up on OLAF findings.

(24)

    https://ec.europa.eu/info/about-european-commission/organisational-structure/commission-staff_en

(25)

     European Court of Auditors, annual report on the implementation of the budget for the financial year 2016, together with the institutions’ replies, OJ C 322, 28.9.2017, p. 1, paragraph 1.35.

(26)

   See previous footnote.

(27)

     External fraud means fraud committed by perpetrators other than EU staff and Members of EU institutions or bodies.

(28)

   Internal fraud means fraud committed by EU staff or Members of EU institutions or bodies.

(29)

     OLAF Report 2016, pp. 15 – 18: https://ec.europa.eu/anti-fraud/sites/antifraud/files/olaf_report_2016_en.pdf .

See also OLAF Report 2017 (reference in FN 21), p. 14, referring to collusion and conflict of interest.

(30)

     OLAF Report 2016 (see previous footnote), pp. 10, 18; OLAF Report 2017 (see FN 21), pp. 17 - 19.

(31)

     ECA Special Report No 10/2015, Efforts to address problems with public procurement in EU cohesion expenditure should be intensified, Executive Summary, Section III: https://www.eca.europa.eu/en/Pages/DocItem.aspx?did=32488

(32)

   Europol, European Union Serious and Organised Crime Threat Assessment, 2017, pp. 42–45: https://www.europol.europa.eu/activities-services/main-reports/european-union-serious-and-organised-crime-threat-assessment-2017 . Concerns about organised crime affecting the EU’s financial interests were expressed in paragraph 32 of the European Parliament’s resolution of 8 March 2016 on the 2014 annual report on the Protection of the EU’s Financial Interests — Fight against fraud, 2015/2128(INI), P8_TA(2016)0071 and in paragraph 55 of the European Parliament’s resolution of 16 May 2017 on the 2015 annual report on the protection of the EU’s financial interests — Fight against fraud, 2016/2097(INI), P8_TA(2017)0206:

http://www.europarl.europa.eu/sides/getDoc.do?type=TA&reference=P8-TA-2016-0071&language=EN

http://www.europarl.europa.eu/sides/getDoc.do?pubRef=-//EP//TEXT+TA+P8-TA-2017-0206+0+DOC+XML+V0//EN

(33)

   Publication by the General Secretariat of the Council ‘The EU Policy Cycle to tackle organised and serious international crime’: http://www.consilium.europa.eu/media/30232/qc0114638enn.pdf

(34)

   Council conclusions of 18 May 2017 on setting the EU’s priorities for the fight against organised and serious international crime between 2018 and 2021, Council Document 9450/17:    
http://data.consilium.europa.eu/doc/document/ST-9450-2017-INIT/en/pdf
Fraud-related priorities (not limited to fraud to the detriment of the EU budget) concern cybercrime, excise fraud and VAT fraud, money laundering and asset recovery and document fraud.

(35)

   Communication from the Commission to the Council and the European Parliament of 6 June 2013, ‘Stepping up the fight against cigarette smuggling and other forms of illicit trade in tobacco products — A comprehensive EU Strategy’, COM(2013) 324 final. In 2017, the Commission reported on the implementation of the strategy in the report from the Commission to the Council and the European Parliament of 12 May 2017, Progress report on the implementation of the Commission Communication ‘Stepping up the fight against cigarette smuggling and other forms of illicit trade in tobacco products — A comprehensive EU Strategy’ (COM(2013) 324 final of 6.6.2013), COM(2017) 235 final.

(36)

     Communication from the Commission to the European Parliament, the Council and the European Economic and Social Committee of 7 December 2018, 2nd Action Plan to fight the illicit tobacco trade 2018-2022, COM(2018) 846 final.

(37)

     For instance, IDOC annual report 2015, pp. 8-9, 2014, p. 9, 2012, pp. 21-22. — IDOC’s annual reports are internal Commission documents but are made available to members of the public upon request.

(38)

     In 2015–2017, 6.5 % of the cases registered by IDOC were on conflict of interest, 8.2 % were breaches of confidentiality and 35.3 % (the largest proportion) concerned harassment and other inappropriate behaviour.

(39)

     Commission Staff Working Document, Statistical evaluation of irregularities reported for 2016, Own Resources, Natural Resources, Cohesion Policy, Pre-accession and Direct expenditure, Accompanying the document ‘Report from the Commission to the European Parliament and the Council, Protection of the European Union’s financial interests — Fight against Fraud Annual Report 2016’ — COM(2017) 383 final –, SWD (2017) 266 final, Part 2/2, p. 66.

(40)

     ECA Special Report No 17/2016, The EU institutions can do more to facilitate access to their public procurement, Executive Summary, Section IV    : https://www.eca.europa.eu/en/Pages/DocItem.aspx?did=37137

(41)

     82 out of 232 cases = 35.3 %, see FN 38.

(42)

     Council Regulation No 31 (EEC), 11 (EAEC) of 18 December 1961 laying down the Staff Regulations of Officials and the Conditions of Employment of Other Servants of the European Economic Community and the European Atomic Energy Community, OJ 45, 14.6.1962, p. 1385, recast by Regulation (EEC, Euratom, ECSC) No 259/68 of 29 February 1968 and subsequently amended and updated.

(43)

     See previous footnote.

(44)

     Commission Decision C (2006) 1624/3 of 26 April 2006 on the European Commission policy on protecting the dignity of the person and preventing psychological harassment and sexual harassment.

(45)

     Document fraud is explained in Europol’s ‘EU Serious and Organised Crime Threat Assessment 2017’ (reference in FN 32), pp. 20-21.

(46)

      http://www.conf-int-investigators.org/

(47)

      https://ec.europa.eu/anti-fraud/media-corner/news/03-03-2016/rising-challenge-%E2 %80 %93-economic-crime-agencies-cooperate-fight-against_en

(48)

      https://www.epac-eacn.org/

(49)

      http://www.oecd.org/corruption/integrity-forum/

(50)

      http://iaaca.org/

(51)

      http://www.worldbank.org/en/about/unit/integrity-vice-presidency/icha

(52)

      https://www.unodc.org/unodc/en/corruption/COSP/conference-of-the-states-parties.html

(53)

      http://www.unodc.org/unodc/en/corruption/IRG/implementation-review-group.html

(54)

      http://www.unodc.org/unodc/en/corruption/WG-Prevention/working-group-on-prevention.html

(55)

https://ec.europa.eu/home-affairs/what-we-do/policies/organized-crime-and-human-trafficking/corruption/experience-sharing-programme_en

(56)

     Handbook on Reporting of irregularities in shared management (2017).

(57)

     Report from the Commission to the European Parliament and the Council, Protection of the European Union’s financial interests — Fight against Fraud Annual Report 2016, COM(2017) 383 final, p. 14.

(58)

   AMT monitors trade flows and identifies suspicious changes in volume or the average price of products thus enabling the detection of undervaluation cases as well as other types of customs fraud such as evasion of anti-dumping duties or misdeclaration of the commodity.

(59)

   Contraffic allows cases of false declaration of origin to be detected by cross-checking information on physical movements of containers with information contained in customs declaration.

(60)

     Composed of the First Vice-President, five Members of the Commission and three external members with proven professional expertise. The Charter of the APC was updated with a Communication to the Commission of 21 November 2018, C (2018) 7707 final.

(61)

     With the exception of the European Agricultural Fund for Rural Development, to which different provisions apply.

(62)

     Regulation (EU) No 1303/2013 of the European Parliament and of the Council of 17 December 2013 laying down common provisions on the European Regional Development Fund, the European Social Fund, the Cohesion Fund, the European Agricultural Fund for Rural Development and the European Maritime and Fisheries Fund and laying down general provisions on the European Regional Development Fund, the European Social Fund, the Cohesion Fund and the European Maritime and Fisheries Fund and repealing Council Regulation (EC) No 1083/2006, OJ L 347, 20.12.2013, p. 320, as amended.

(63)

     Commission Staff Working Document, Statistical evaluation of irregularities reported for 2017, Own Resources, Natural Resources, Cohesion Policy, Pre-accession and Direct expenditure, Accompanying the document ‘Report from the Commission to the European Parliament and the Council, 29th Annual Report on the Protection of the European Union’s financial interests — Fight against Fraud Annual Report 2017’ — COM(2018) 553 final –, SWD (2018) 386 final, Part 1/2, p. 48.

(64)

     Paragraph 5 of the resolution of the European Parliament of 3 May 2018 on the 2016 annual report on the protection of the EU’s financial interests — Fight against fraud, 2017/2216(INI), P8_TA(2018)0196: http://www.europarl.europa.eu/sides/getDoc.do?type=TA&reference=P8-TA-2018-0196&format=XML&language=EN

(65)

   A similar requirement is established by the Inter-institutional Agreement of 25 May 1999, OJ L 136/15, 31.5.1999, and the internal decision adopted by the Commission and each executive agency pursuant thereto.

(66)

     OLAF Report 2016 (reference in FN 29), pp. 15–18.

(67)

     Report from the Commission to the European Parliament and the Council, Protection of the European Union’s financial interests — Fight against Fraud Annual Report 2016, COM(2017) 383 final, p. 32. Concerns about irregularities in public procurement under shared management were expressed in paragraph 37 of the resolution of the European Parliament of 16 May 2017 on the Annual report 2015 on the protection of the EU’s financial interests — Fight against fraud (reference in FN 32). See also paragraph 50 of the same resolution, voicing concerns about irregular procurement procedures in the context of the refugee crisis.

(68)

     Directive 2014/24/EU of the European Parliament and of the Council of 26 February 2014 on public procurement and repealing Directive 2004/18/EC, OJ L 94, 28.3.2014, p. 65.    
Directive 2014/23/EU of the European Parliament and of the Council of 26 February 2014 on the award of concession contracts, OJ L 94, 28.3.2014, p. 1.    
Directive 2014/25/EU of the European Parliament and of the Council of 26 February 2014 on procurement by entities operating in the water, energy, transport and postal services sectors and repealing Directive 2004/17/EC, OJ L 94, 28.3.2014, p. 243.

(69)

     Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions of 3 October 2017, Making Public Procurement work in and for Europe, COM(2017) 572.    
Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions of 3 October 2017, Helping investment through a voluntary ex-ante assessment of the procurement aspects for large infrastructure projects, COM(2017) 573.

(70)

    http://ec.europa.eu/regional_policy/en/newsroom/news/2017/01/16-01-2017-integrity-pacts-better-safeguarding-and-use-of-eu-funds

(71)

    http://ec.europa.eu/regional_policy/sources/docgener/informat/2014/guidance_public_proc_en.pdf

(72)

     In line with this observation, public procurement regularly features among OLAF’s investigation policy priorities, determined annually by the Director General of OLAF, pursuant to Article 17(5) of the OLAF Regulation.

(73)

     See p. 11/12.

(74)

     This is confirmed by both the departments’ fraud risk assessment and by OLAF’s investigative experience, OLAF’s annual report for 2016 (reference in FN 29), pp. 18–19.

(75)

     Reference in FN 40.

(76)

     Article 121(1)(e) of the Financial Regulation.

(77)

     In its 2016 annual report (reference in FN 25, pp. 23-24), the European Court of Auditors underlines the higher resilience of entitlement-based expenditure (which is based on the fulfilment of certain conditions) to error as compared to expenditure based on the reimbursement of eligible costs.

(78)

     As noted by the European Court of Auditors, preliminary market consultation is not widely practised by Commission Services: ECA Special Report No 17/2016, The EU institutions can do more to facilitate access to their public procurement, Reference in FN 40, p. 27.

(79)

     Report from the Commission to the European Parliament and the Council of 25 September 2017 on financial instruments supported by the general budget according to Article 140.8 of the Financial Regulation as at 31 December 2016, COM(2017) 535 final, p. 6.

(80)

     Communication from the Commission of 14 December 2015, Investing in jobs and growth — maximising the contribution of European Structural and Investment Funds, COM(2015) 639 final, p. 7.

(81)

     At the end of 2016 only 8 out of 344 ongoing OLAF investigations were related to financial instruments, which persistently ranked last out of 9 fields of investigation in 2014–2016, OLAF Report 2016 (reference in FN 29), p. 14. At the end of 2017, ongoing investigations related to financial instruments had advanced to 7th position (18 out of 362 investigations), but this should not be interpreted as a trend pointing to higher fraud risks, OLAF Report 2017 (reference in FN 21), pp. 13, 16.

(82)

      http://www.eib.org/infocentre/publications/all/anti-fraud-policy.htm?f=search&media=search

(83)

   Only a small proportion of the volume of EU-level financial instruments is managed by entrusted entities outside the EIB Group: European Court of Auditors, Annual report on the implementation of the budget concerning the financial year 2015, OJ C 375, 13.10.2016, paragraph 2.23.

(84)

   In its Annual Report 2016 (reference in FN 25, paragraphs 6.35, 6.41), the European Court of Auditors pointed to the need for improvements in the audit of financial instruments under shared management. See also Annual Report 2015 (preceding FN), Figure 6.9, where the ECA cited the example of a financial intermediary that issued a loan for a company belonging to its own group, excluded from eligibility.

(85)

     Pursuant to Articles 8–13 of Regulation (EU) 2015/1017 of the European Parliament and of the Council of 25 June 2015 on the European Fund for Strategic Investments, the European Investment Advisory Hub and the European Investment Project Portal and amending Regulations (EU) No 1291/2013 and (EU) No 1316/2013 — the European Fund for Strategic Investments, OJ L 169, 1.7.2015, p. 1, as amended.

(86)

   OLAF Report 2017 (reference in FN 21), pp. 21–22.

(87)

     ECA Special Report 11/2017, The Bêkou EU trust fund for the Central African Republic: a hopeful beginning despite some shortcomings, paragraphs 39-42.     https://www.eca.europa.eu/Lists/ECADocuments/SR17_11/SR_BEKOU_EN.pdf

(88)

     Regulation (EU) 2017/1601 of the European Parliament and of the Council of 26 September 2017 establishing the European Fund for Sustainable Development (EFSD), the EFSD Guarantee and the EFSD Guarantee Fund, OJ L 249, 27.9.2017, p. 1.

(89)

   Joint Communication from the Commission and the High Representative of the Union for Foreign Affairs and Security Policy of 13 September 2017, Resilience, Deterrence and Defence: Building strong cybersecurity for the EU, JOIN (2017) 450, p. 2.

(90)

     COM(2016) 179 final.

(91)

     JOIN (2013) 1 final. An assessment of this strategy is available in SWD (2017) 295.

(92)

     Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union,
OJ L 194. 19.7.2016, p. 1.

(93)

   See FN 89.

(94)

   Commission Decision (EU, Euratom) 2017/46 of 10 January 2017 on the security of communication and information systems in the European Commission, OJ L 6, 11.1.2017, p. 40, and Commission Decision C (2017) 8841 of 13 December 2017 laying down implementing rules for Articles 3, 5, 7, 8, 9, 10, 11, 12, 14, 15 of Decision 2017/46 on the security of communication and information systems in the Commission.

(95)

     Communication to the Commission of 21 November 2018, European Commission Digital Strategy, A digitally transformed, user-focused and data-driven Commission, C(2018) 7118 final.

(96)

     See Commission Decision of 21 November 2018 on the Corporate Management Board, C(2018) 7706 final.

(97)

   See Section 4.2.3., pp. 12-13.

(98)

   In certain decentralised agencies the European Court of Auditors found shortcomings where the audited agencies applied specific expert selection and grant award procedures based on exemptions in the founding regulation. As a result of this practice, there were risks to the principles of equal treatment and transparency and issues on potential conflicts of interest had not been fully addressed: Special Report No 12/2016, Agencies’ use of grants: not always appropriate or demonstrably effective, paragraphs 32–38,    
https://www.eca.europa.eu/Lists/ECADocuments/SR16_12/SR_GRANTS_EN.pdf .

(99)

   Regulation (EU, Euratom) No 1023/2013 of the European Parliament and of the Council of 22 October 2013 amending the Staff Regulations of Officials of the European Union and the Conditions of Employment of Other Servants of the European Union, OJ L 287, 29.10.2013, p. 15.

(100)

   Communication from Vice-President Šefčovič to the Commission on guidelines on whistle-blowing, SEC (2012) 679.

(101)

   Commission Decision of 16 December 2013 on outside activities and assignments, C (2013) 9037.

(102)

   Commission Decision of 29 June 2018 on outside activities and assignments and on occupational activities after leaving the Service, C (2018) 4048.

(103)

   Commission Decision of 31 January 2018 on a Code of Conduct for the Members of the European Commission, C (2018) 700 final, OJ C 65, 21.2.2018, p. 7.

(104)

   COM(2018) 218. See also Communication from the Commission to the European Parliament, the Council and the European Economic and Social Committee of 23 April 2018, Strengthening whistleblower protection at EU level, COM(2018) 214.

(105)

   2011 CAFS (reference in FN 5), p. 13.

(106)

   Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions of 3 October 2017, Making Public Procurement work in and for Europe, COM(2017) 572, p. 9.    
Communication from the Commission to the European Parliament, the Council and the European Economic and Social Committee of 7 April 2016 on an action plan on VAT, Towards a single EU VAT area — Time to decide, COM(2016) 148, p. 7.

(107)

   Commission Proposal for a Regulation of the European Parliament and of the Council establishing the EU Anti-Fraud Programme of 30 May 2018, COM(2018) 386 final.

(108)

   2011 CAFS (reference in FN 5), p. 17.

(109)

    https://ec.europa.eu/info/about-european-commission/service-standards-and-principles/transparency/funding-recipients_en

(110)

    https://www.aidtransparency.net/

(111)

   2011 CAFS (reference in FN 5), p. 8 (‘Fraud prevention’ — ‘design of spending programmes’). See also Communication from the Commission to the Council, the European Parliament and the European Court of Auditors, Prevention of fraud by building on operational results: a dynamic approach to fraud-proofing, COM(2007) 806 final, with further references.

(112)

   Reference in FN 5, p. 9.

(113)

   MFA is an exceptional financial instrument of untied and undesignated balance-of-payments support.

(114)

   MFA does not use pre-financing.

(115)

   Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (‘the EPPO’), OJ L 283, 31.10.2017, p. 1.

(116)

   Report from the Commission to the European Parliament and the Council of 2 October 2017, Evaluation of the application of Regulation (EU, EURATOM) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999, COM(2017) 589 final.    
Commission Staff Working Document of 2 October 2017, EVALUATION of the application of Regulation (EU, EURATOM) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999, Accompanying the document Commission report to the European Parliament and the Council, SWD (2017) 332.

(117)

   Commission Proposal of 23 May 2018 for a Regulation of the European Parliament and of the Council amending Regulation (EU, Euratom) No 883/2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) as regards cooperation with the European Public Prosecutor’s Office and the effectiveness of OLAF investigations, COM(2018) 338.

(118)

   Council Decision (EU) 2017/1749 of 17 June 2016 on the conclusion, on behalf of the European Union, of the Protocol to Eliminate Illicit Trade in Tobacco Products to the World Health Organisation’s Framework Convention on Tobacco Control, with the exception of its provisions falling within the scope of Title V of Part Three of the Treaty on the Functioning of the European Union, OJ L 268, 1.10.2016, p. 1.

(119)

   OLAF' Report 2016, p. 19: https://ec.europa.eu/anti-fraud/sites/antifraud/files/olaf_report_2016_en.pdf

(120)

   PIF Report 2016 (reference in FN 57), p. 15. The fraud detection rate measures the financial impact of detected fraud as a proportion of total revenue or expenditure. It is determined for the budget as a whole and for particular sectors.

(121)

   Detection rates for years 2016 and 2017 do not take into account the UK undervaluation case which is explained in OLAF Report 2017 (reference in FN 21), pp. 26-27.

(122)

   OLAF Report 2016 (reference in FN 29), p. 20-21.

(123)

   OLAF Report 2016 (reference in FN 29), p. 19.

(124)

   Explanation available at https://ec.europa.eu/taxation_customs/business/calculation-customs-duties/what-is-common-customs-tariff/classification-goods_en .

(125)

   Regulation (EU) No 952/2013 of the European Parliament and of the Council of 9 October 2013 laying down the Union Customs Code, OJ L 269, 10.10.2013, p. 1.

(126)

   OLAF Report 2017 (reference in FN 21), p. 28.

(127)

   Following a string of large-scale investigations in this area, see OLAF Report 2017 (reference in FN 21), pp. 26–27.

(128)

   Explained in Europol’s 2017 EU Serious and Organised Crime Threat Assessment (reference in FN 32),
p. 44.

(129)

   Communication from the Commission to the European Parliament, the Council and the European Economic and Social Committee of 7 April 2016 on an action plan on VAT, Towards a single EU VAT area — Time to decide, COM(2016) 148, p. 3.

(130)

   Communication from the Commission to the European Parliament, the Council and the European Economic and Social Committee of 4 October 2017, On the follow-up to the Action Plan on VAT, Towards a single EU VAT area — Time to act, COM(2017) 566 final.