REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL

Annual Report to the Discharge Authority on Internal Audits carried out in 2012 (Article 99(5) of the Financial Regulation)

TABLE OF CONTENTS

1........... Introduction.................................................................................................................... 5

2........... The IAS Mission: Independence, objectivity and accountability........................................ 5

3........... Audit production............................................................................................................. 6

3.1........ Implementation of the 2012 IAS audit plan...................................................................... 6

3.2........ New recommendations and acceptance rate.................................................................... 7

3.3........ Implementation of recommendations made during 2008-12.............................................. 8

4........... Main findings and recommendations................................................................................ 8

4.1........ Horizontal audits............................................................................................................. 8

4.1.1..... Annual Activity Report process (multi-DG)..................................................................... 8

4.1.2..... Management and monitoring of staff allocation (multi-DG)............................................... 9

4.1.3..... Chargeback and internal billing systems (multi-DG)........................................................ 10

4.2........ Agriculture, Natural Resources and Health.................................................................... 11

4.2.1..... Control Strategy audits (DGs MARE, SANCO)........................................................... 11

4.2.2..... Control Strategy — Directorate J (DG AGRI).............................................................. 11

4.3........ Cohesion...................................................................................................................... 12

4.3.1..... Closure 2000-06 Programming Period (DG REGIO, DG EMPL)................................. 12

4.3.2..... Implementation of 2007-13 Programmes (DG REGIO)................................................. 13

4.4........ Research, energy and transport..................................................................................... 13

4.4.1..... Control Strategy audits (DG ENER)............................................................................. 13

4.5........ External Aid, development and enlargement................................................................... 14

4.5.1..... Set-up of internal organisation in EU delegations (DG DEVCO).................................... 14

4.6........ Education and citizenship.............................................................................................. 14

4.6.1..... Lifelong Learning Programme (DG EAC/EACEA)........................................................ 14

4.6.2..... Control Strategy audits (DG HOME)............................................................................ 15

4.6.3..... Monitoring the implementation EU Law (DG JUST)...................................................... 15

4.7........ Economic and financial affairs........................................................................................ 15

4.7.1..... Implementation by the EIF of the CIP Programme (DG ECFIN)................................... 15

4.7.2..... Off-budget operations (DG ECFIN)............................................................................. 16

4.7.3..... Control Strategy audits (DG ENTR)............................................................................. 16

4.7.4..... Monitoring the implementation EU Law (DG TAXUD).................................................. 16

4.8........ General services and HR............................................................................................... 17

4.8.1..... Statistical data production, development and dissemination (DG ESTAT)....................... 17

4.9........ IT audits....................................................................................................................... 17

4.9.1..... Local IT systems management (DG DEVCO, DG TRADE).......................................... 18

4.9.2..... IT Governance and performance (DG SANCO/EAHC)................................................ 18

4.9.3..... Horizon 2020 (DG RTD, DG CNECT, ERCEA).......................................................... 18

5........... Consultation with the Commission’s Financial Irregularities Panel................................... 19

6........... Conclusions.................................................................................................................. 19

1.           Introduction

This report on the work carried out by the Commission’s Internal Audit Service (IAS) informs the Discharge Authority, as required by Article 99(5) of the Financial Regulation. It is based on the report that the Commission’s Internal Auditor drew up under Article 99(3) of the Regulation, regarding IAS audit- and consulting reports completed in 2012[1] on Commission Directorates-General, Services and Executive Agencies[2]. It describes the identified weaknesses and action taken to remedy these, and includes information on significant risk exposure, control issues and governance aspects[3].

The Commission has already responded to some of these recommendations in the synthesis Report[4].

2.           The IAS Mission: Independence, objectivity and accountability

The mission of the IAS is to contribute to sound management in the European Commission by auditing internal management and control systems to assess their effectiveness with a view to achieving on-going improvements.

The IAS is under the authority of the Member of the Commission responsible for Audit and is accountable to the APC. The independence of the IAS is enshrined in the Financial Regulation and its Mission Charter adopted by the Commission.

The IAS performs its work in accordance with the Financial Regulation and the International Standards for the Professional Practice of Internal Auditing and the Code of Ethics of the Institute of Internal Auditors.

The IAS does not audit the Member States’ systems of control over the Commission’s funds. Such audits, which reach down to the level of individual beneficiaries, are carried out by Member States’ internal auditors, national Audit Authorities, other individual Commission DGs and the European Court of Auditors (ECA). The IAS does, however, audit measures taken by the Commission services to supervise and audit bodies in the Member States, and other bodies which are responsible for disbursing EU funds, such as the United Nations. As provided for in the FR, the IAS can carry-out these duties on the spot, including in the Member States.

Overall opinion on the Commission’s financial management

As required by its charter, the IAS issued its third overall opinion on the Commission’s financial management.

The overall opinion for 2012 is based on the audits in the area of financial management in the Commission carried out by both the IAS and the IACs during the previous three years 2010 to 2012). It also takes into account information from other sources such as the reports from the ECA

The IAS, IACs or the ECA planned to audit all financial auditable entities rated as high risk and which are material for the implementation of the budget by the end of this period to ensure comprehensive coverage The completion of audit engagements in 2012 contributes to ensuring sufficient coverage for the year 2012.

IAS contribution towards mitigating the discharge risk and a more positive Statement of Assurance (‘DAS’)

The discharge procedure entails reputational risks for the Commission. The work of the IAS supports the Commission in mitigating this risk.

Compliance remains the most important aspect of the discussion, though the discharge procedure increasingly focuses on performance. Assessment of compliance is based on the results of the European Court of Auditors’ (ECA) Statement of Assurance (‘DAS’) audit. This is the opinion of the ECA on the reliability of EU accounts and on the legality and regularity of the underlying transactions.

To address the risk of error in payments, the Commission has to ensure that the implemented control strategies are proportionate to the risks. These control strategies need to be effective in preventing and detecting error, and to be accompanied by dissuasive administrative penalties and reports on the residual rate of error.

That is why audits to ensure that a coherent control strategy is being implemented for every significant area of expenditure have priority in the IAS’ Strategic Audit Plan 2010-2012 as well as for 2013-2015. In 2012, audits on control strategies in DGs AGRI, ENER, ENTR, HOME, MARE and SANCO were carried out.

3.           Audit production

3.1.        Implementation of the 2012 IAS audit plan

By the cut-off date of 1 February 2013, the IAS had implemented 100 % of its priority engagements (88 % in 2011) and 62 % of non-priority engagements (69 % in 2011).

In all, 89 reports (including audits, follow-up-audits and consultancy) were finalised, and can be broken down as follows[5]:

|| 2012 || 2011 || 2010

|| Engagements || Reports || Engagements || Reports || Engagements || Reports

AUDIT || 29 || 49 || 20 || 23 || 24 || 28

CONSULTING || 2 || 2 || 1 || 1 || 6 || 6

FOLLOW UP || 32 || 37 || 41 || 50 || 44 || 50

REVIEWS || 1 || 1 || 3 || 3 || 0 || 0

Total || 64 || 89 || 65 || 77 || 74 || 84

The attached Services Working Document summarises all completed audit reports. It includes the objectives, scope, risks and recommendations of each report, the overall state of implementation of recommendations made for 2008-2012 and summaries of conclusions of follow-up engagements.

3.2.        New recommendations and acceptance rate

In 2012, the IAS issued the following number of recommendations, including their acceptance rate:

|| New recommendations || Accepted recommendations || Non-accepted recommendations

Priority || # || # || % || # || %

Critical || 0 || 0 || || 0 ||

Very important || 83 || 83[6] || 100 % || 0 ||

Important || 109 || 108 || 99 % || 1 || 1 %

Desirable || 0 || 0 || || 0 ||

Total || 192 || 191 || 99 % || 1 || 1 %

For all accepted (or partially accepted) recommendations, the auditees drafted action plans that were submitted to the IAS and assessed as satisfactory.

3.3.        Implementation of recommendations made during 2008-12

Auditees reported that 78 % of accepted recommendations issued between 2008 and 2012 had been implemented by the start of 2013. The attached Service Working Document provides an overview of the level of implementation of recommendations (auditees’ assessment).

However, implementation on 29 very important recommendations[7] was overdue by more than six months compared to the initial deadline[8]. No critical recommendation is outstanding. The APC was regularly informed of critical or very important recommendations overdue by more than six months.

A total of 733 recommendations were accepted, for which the IAS conducted follow-up audits by the end of 2012.

The IAS’s follow-up work confirmed that recommendations were being implemented satisfactorily, contributing to the improvement of control systems in the services audited. The IAS closed 88 % of the recommendations followed up during this period.

4.           Main findings and recommendations

4.1.        Horizontal audits

4.1.1.     Annual Activity Report process (multi-DG)

The aim of the audit was to assess the adequacy and effectiveness of the AAR process in the Commission as a whole and, in particular, the extent to which it was effective in supporting the Declaration of Assurance of the different Authorising Officers by Delegation. The IAS analysed the design of the process, the existence of clear guidance and regular monitoring at corporate level, and implementation by individual DGs/Services.

This audit was performed in the SG, in DG BUDG, and in nine operational DGs/Services, DGs CNECT, EAC, REGIO, EMPL, MARE, AGRI, HOME and DEVCO and the OIB.

Overall, the IAS considers that the process is well established and that it has achieved its objective to be an accountability and assurance tool from management to the Institution. However, it identified some very important areas in which there was a need for improvements. In particular, the IAS asked central services to:

(i) provide further instructions on reporting on economy, efficiency and effectiveness of financial and non-financial operations and on cost/effectiveness of controls, so as to adequately support the AOD’s conclusions on sound management and the Declaration of Assurance;

(ii) reinforce the quality control process to focus more on substantive elements of the AAR, such as the reliability of the assurance-building process and the information supporting the Declaration of Assurance, and

(iii) streamline the structure of the AAR to avoid overly long and complex reports and to produce documents that are more useful for the College, the ECA and the Discharge Authority.

The central services accepted the IAS recommendations and prepared an action plan to improve the AAR process, which IAS deemed satisfactory. Some actions have already been implemented in the context of the 2012 AAR exercise.

Concerning the work performed in nine operational DGs/Services, the IAS only identified a major issue[9] at DG DEVCO. A limited audit on the coordination of the Delegations’ contribution to the AAR showed that DG DEVCO should strengthen its accountability system (called ‘control pyramid’) by:

(i) improving the quality of DG DEVCO’s AAR, particularly on information on the internal control system and elements supporting the Declaration of assurance of the AOD;

(ii) promoting reports from Heads of Delegation (EAMR) as "accountability tools’, by requesting to provide more information supporting their declaration of assurance;

(iii) providing further guidance to Heads of Delegation to enable them to obtain comprehensive, consistent information supporting their declaration of assurance, and

(iv) strengthening the role of Headquarters in supporting, coordinating and supervising the reporting obligations of Heads of Delegation. DG DEVCO’s action plan is considered satisfactory.

4.1.2.     Management and monitoring of staff allocation (multi-DG)

The objective of the audit was to assess whether selected Commission Services have adequate procedures and mechanisms in place to manage and monitor staff allocation effectively and efficiently in a context of staff reduction[10].

The audit focused on relevant procedures in four DGs: AGRI, RTD, COMP and DGT, selected in order to have a representative view of the different activities in the Commission. The IAS also carried out a high-level review of staff allocation procedures at corporate level, in SG, DG BUDG and DG HR.

In addition, a general survey was carried out to obtain a comprehensive overview of procedures in place across Commission Services.

The IAS recommended that DG AGRI and DG RTD pursue their efforts to develop mechanisms and tools for task mapping, put in place tools/methods to gather sufficient, reliable information concerning workloads, and develop an HR plan. The DGs accepted all the recommendations. Action plans were assessed by the IAS as being satisfactory overall.

The audit work and the results of the IAS Commission-wide survey revealed weaknesses at operational DG level that can only be resolved and attendant risks mitigated through Central Services’ actions. The IAS recommended that Central Services further develop the corporate framework for managing and monitoring staff allocation, and facilitate the dissemination of good practices between Strategic Planning and Programming (SPP) and Human Resources professionals in this area. Central Services should also improve the corporate framework for reporting and accountability by Commission Services on use of posts redeployed to these services in line with the Commission decisions on staff allocation.

4.1.3.     Chargeback[11] and internal billing systems (multi-DG)

The IAS assessed whether charge-back[12] processes complied with the Financial Regulation and central guidance, and the consistent, transparent cost calculation of services provided. The audit was conducted in DG BUDG (as leading service for managing the budgetary and regulatory framework and for the promotion of sound financial management), DG DIGIT and SCIC. In the absence of central guidance or instruction on the charge-back process, the audit found that the audited DGs defined their own criteria. Overall, these were found to be in line with budgetary rules.

However, the IAS asked auditees to strengthen the process and to enable consistent implementation across the Commission by:

(i) establishing a governance framework with clear attribution of the ownership of the process, the definition of the charge-back process and the endorsement of cost models of the major service providers;

(ii) providing central instruction and guidance (including the criteria to identify services and costs), and

(iii) providing more clarity of budget lines used for financing IT expenditure.

The IAS considers that the ABM Steering Group, as governance body, should own the process and ultimately be the body responsible body for defining the process.

DG BUDG accepted all the recommendations and the resulting action plan is assessed as satisfactory.

DG DIGIT was asked to:

(i) identify more clearly the services and costs to be charged back and propose criteria to identify the IT systems for which hosting costs are charged back, and;

(ii) ensure the governing body endorses significant changes of the cost model.

The resulting action plan for the accepted recommendations is assessed as satisfactory.

4.2.        Agriculture, Natural Resources and Health

(AGRI, ENV, CLIMA, MARE, EAHC, SANCO)

4.2.1.     Control Strategy audits (DGs MARE, SANCO)

DG MARE’s control strategy does not include clear quantifiable and measurable targets relating to the assurance building process, in particular on national audit authorities’ and DG MARE’s own planned coverage. Quantitative and qualitative indicators to measure the performance of DG MARE’s audit activity are insufficient. DG MARE also needs to strengthen its monitoring of national audit strategies and annual control reports, and to improve its controls of the way in which national audit authorities determine sampling and the error rate.

The audit of DG SANCO covered ex-ante and ex post controls. The IAS stressed the need for DG SANCO to finalise its control strategy document.

The action plans to address the issues in both audits were assessed as satisfactory.

4.2.2.     Control Strategy — Directorate J (DG AGRI)

This audit in DG AGRI focused on the design and monitoring of the control strategy for the programming period 2007-2013.

The IAS found that the audit strategy was not sufficiently formalised, and that there were gaps in the definition of the audit universe, the setting up of quantitative and measurable objectives (e.g. audit coverage), and the related capacity analysis.

Given that the next programming period is approaching, the role of assurance providers played by certification bodies in Member States should be reinforced to strengthen controls and optimise the use of DG AGRI’s limited audit resources.

The IAS also noted that audit plans were not sufficiently supported by risk assessments and that there was a significant audit backlog (13 % of engagements of 2007-2010 still open), despite the DG’s efforts to reduce it. The IAS recommended that DG AGRI develop and formalise its control strategy, re-engineer its risk assessments according to the targets established, and ensure proper monitoring through better quantitative and qualitative key performance indicators whose disclosure in the AAR should be improved.

The DG accepted all recommendations, and the IAS assessed its action plan as satisfactory.

4.3.        Cohesion

(REGIO, EMPL)

Four audits were performed in 2012 to provide reassurance on the efforts the DGs were making to tackle high error rates, particularly in DG REGIO. For the first time, the IAS accompanied[13] DG auditors on missions to Member States.

4.3.1.     Closure 2000-06 Programming Period (DG REGIO, DG EMPL)

It is essential that DGs have a well-prepared closure process to demonstrate that all errors and irregularities are detected and corrected.

Although the DGs prepared and managed the closure process for the European Regional Development Fund (DG REGIO) and European Social Fund (DG EMPL) well, there need to be improvements in planning, methodology and guidance, particularly when preparing for the closure of the 2007-2013 programming period and to improve documentation to provide better evidence of checks on closure documents.

The audit of the closure of Cohesion Fund (CF) projects in DG REGIO identified inconsistencies and gaps in the assessment process. Given the high number of projects and the work still to be done, these must be addressed for the remainder of the closure process. In this respect, harmonised templates for the analysis of the winding-up declarations have been put in place since 21 December 2012. These have been designed to address the specific gaps identified by the IAS, in particular the coordination between audit and geographical units and ensuring consistency in the qualitative assessment of closure documents.

These audits also provided DGs with a timely reminder of the need to report on the effectiveness of the closure process for the 2000-2006 period and to demonstrate the multiannual corrective capacity of the control strategy[14].

The DG accepted all recommendations and the IAS assessed its action plans as satisfactory.

4.3.2.     Implementation of 2007-2013 Programmes (DG REGIO)

Recognising the high error rates in Cohesion, the IAS conducted an audit on implementation of the 2007-2013 programming period for the European Regional Development Fund (ERDF) and the Cohesion Fund programmes to assess the extent to which DG REGIO had determined and reported reliable error rates and the extent to which sufficient and appropriate measures had been taken to reduce high error rates.

The IAS referred to the efforts done by DG REGIO to strengthen corrective measures and reduce error rates, but stressed the very high inherent risk involved when the DG has to depend so heavily on the Member States' audit authorities. Despite the efforts already made, this still represents a major challenge for the DG. These authorities have interpreted guidance in different ways, particularly as regards statistical sampling and coverage of the audit universe[15]. In addition, the DG needs to improve its own checks on the audit authorities’ annual control reports, to ensure that auditors are able to reach conclusions on the impact of the reliability of error rates from Member States' audits.

The IAS found significant variations in the extent and depth of on-the-spot tests. Whilst recognising DG REGIO needs to have a risk based approach, on-the-spot work is so crucial to its assurance process that these inconsistencies need to be addressed to minimise the risk of non-detection of system weaknesses and/or errors and irregularities.

The auditees accepted all recommendations and the IAS assessed their action plan as satisfactory.

4.4.        Research, energy and transport[16]

(EACI, ERCEA, CNECT, JRC, REA, RTD, TEN T-EA, MOVE, ENER)

4.4.1.     Control Strategy audits (DG ENER)

The review of controls in DG ENER covered ex ante and ex post controls. It found that complete and consistent audit working papers in post audit files need to be produced. Subsequently, the IAS recommended that DG ENER use a standardised audit programme and produce better evidence for the review and approval of audit issues. The recommendations were accepted and the action plan assessed as satisfactory.

4.5.        External Aid, development and enlargement

(DEVCO, ECHO, ELARG, FPI)

4.5.1.     Set-up of internal organisation in EU delegations (DG DEVCO)

The creation of the European External Action service (EEAS) has required the set-up of a number of new structures and processes, involving both Headquarters and Delegations. The general objective of this limited review was to assess the procedures put in place between the European Commission and the EEAS to ensure the sound financial management of the external aid budget implemented through EU Delegations.

The IAS invited DG DEVCO to consider whether the creation of a middle management function — particularly in the larger EU delegations — might help the Head of Delegation to manage financial assistance. There will be an audit of the effective implementation of these revised arrangements due to on-going modifications in procedures (e.g. revised financial circuits) and the implementation of a revised internal control architecture in the Delegations[17] at the time of the limited review.

4.6.        Education and citizenship

(COMM, EAC, EACEA, HOME, JUST)

4.6.1.     Lifelong Learning Programme (LLP) (DG EAC/EACEA)

The aim of the audit was to assess whether the control strategy in place in EACEA for managing the LLP Programme enables it to obtain reasonable assurance on the legality and regularity of the underlying financial transactions and to assess the adequacy, efficiency and effectiveness of DG EAC’s internal control system for exercising its supervisory role as parent DG in the agency’s implementation of the programme.

The design of the final payments process[18] is well organised and established in EACEA, but the audit highlighted inconsistent implementation of the risk-based control strategy and non-compliance with the non-retroactivity rule.

The internal control system for exercising the supervisory role of DG EAC as parent DG was assessed as adequate, efficient and effective, though weaknesses, such as the absence of an updated supervision strategy, gaps in documentation of the supervisory arrangements and the absence of key performance indicators make it difficult to assess whether the strategic supervision policy has been achieved. The direct involvement of DG EAC in the operational management of the LLP programme may not be the most efficient use of resources.

DG EAC and EACEA accepted all recommendations and EACEA and the action plans were assessed as satisfactory.

4.6.2.     Control Strategy audits (DG HOME)

The IAS highlighted weaknesses in the monitoring of DG HOME’s closure procedures, especially in the lack of adequate tools for monitoring the management of a large number of annual programme closure processes properly. Furthermore, DG HOME had not been recording the late submission of closure documents correctly as non-compliance events. The IAS recommended that the DG comply with the requirements of the Commission’s Internal Control Standards. The DG should strengthen its management and control systems and revise its procedures through a closure checklist and guidelines for closure file documents.

The IAS also identified weaknesses in the DGs’ ex-post audit strategy, and recommended that a methodology be introduced so that the results of ex-post audits could be included in the DG’s assurance model for the AAR. The related action plan is assessed as satisfactory.

4.6.3.     Monitoring the implementation EU Law (DG JUST)

Control on Member States’ correct application of EU legislation is one of the Commission’s core activities, as laid down in the Treaty. The ‘acquis communautaire’ and policy areas of DG JUST, audited in 2012, gives rise to more than 10 % of all Commission-wide active infringement cases. The auditors recognised the good maturity level and the DG’s on-going efforts, but highlighted some shortcomings in their strategic planning and programming procedures, particularly in the coverage given to the issue in Management Plans and AARs. As a consequence, the resources allocated to this activity, and their performance evaluation, are not optimal, despite its importance and size. The related action plan is assessed as satisfactory.

4.7.        Economic and financial affairs

(COMP, ECFIN, ENTR, MARKT, OLAF, TAXUD, TRADE)

4.7.1.     Implementation by the EIF of the CIP Programme (DG ECFIN)

As a part of the wider Competitiveness and Innovation Framework Programme (CIP) and of the Entrepreneurship and Innovation Programme (EIP), the High Growth and Innovative SME Facility (GIF) is a Community financial instrument for small and medium-sized enterprises. The European Investment Fund (EIF) implements GIF on behalf of the Commission on the basis of a Fiduciary Management Agreement (FMA).

The objective of the audit was to assess how effectively the EIF implements GIF, and in particular, (i) how the EIF complies with the FMA and (ii) how effectively and efficiently DG ECFIN supervises GIF so that it achieves its specific objectives.

The audit highlighted two issues:

(i) shortcomings in the indicators used to reflect the objectives of the financial instrument, and

(ii) the definition of events constituting a material change in the FMA.

DG ECFIN accepted all recommendations and the action plans were assessed as satisfactory.

4.7.2.     Off-budget operations (DG ECFIN)

As a consequence of the financial and sovereign debt crisis, the European Union has created new financial instruments to act as a borrower and to lend money to Member States in financial difficulties. The European Commission operates the European Financial Stabilisation Mechanism, a programme of financial assistance under which it may grant loans and fund these by issuing debt instruments in the capital markets.

The audit highlighted two issues in managing the new instrument:

(i) DG ECFIN is faced with new internal and external challenges for which the usual risk management practices were not fit for purpose. The development of controls in the areas of logistic support, IT security and document management was lagging behind, and

(ii) given the environment in which DG ECFIN’s operations take place, it faces the challenge of attracting and retaining competent staff without putting business continuity at risk.

These weaknesses may affect business continuity and the efficiency and effectiveness of operations, resulting in the Commission being exposed to a high reputational risk.

To address the IAS recommendations, DG ECFIN has undertaken a comprehensive risk assessment exercise on how it is implementing its new tasks.

4.7.3.     Control Strategy audits (DG ENTR)

This audit covered ex ante and ex post controls. The IAS recommended that DG ENTR strengthen the role of the internal control coordinator. Furthermore, document management and registration of exceptions should be improved. The DG’s action plan was assessed as satisfactory.

4.7.4.     Monitoring the implementation of EU Law (DG TAXUD)

The IAS carried out an audit in DG TAXUD on monitoring the implementation of EU law. Despite a number of strengths, such as strong professional experience and background of case handlers and effective prioritisation of work, the audit highlighted some shortcomings.

DG TAXUD is one of the three most infringement-prone policy areas, with more than 12 % of all Commission-wide active infringement cases, but this is not reflected fully in the Management Plan, or in the Annual Activity Report. There need to be improvements in measuring performance in this activity. IAS also recommended ensuring better coordination between units to monitor the application of EU law more effectively in the Customs area. The DG’s action plan was assessed as satisfactory.

4.8.        General services and HR

(HR, BUDG, DGT, DIGIT, EPSO, ESTAT, SJ, OIB, OIL, OP, PMO, SCIC, SG)

4.8.1.     Statistical data production, development and dissemination (DG ESTAT)

DG ESTAT (Eurostat) is entrusted with the responsibility of ensuring the production of European statistics according to established rules and statistical principles[19] and through compliance with the European Statistics Code of Practice[20].

The lack of coordination between policy DGs and Eurostat on statistical work was included in DG ESTAT’s 2011 risk register as a critical risk.

The objective of this audit was to assess the adequacy, effectiveness and efficiency of processes related to the production, development and dissemination of statistics managed by DG ESTAT (in coordination with other Commission DGs and Services).

The issues identified that may lead to inconsistencies, gaps/overlaps, low quality of data and disruption to business continuity were:

(i) lack of a clear definition and common understanding of the term ‘statistics’ within the Commission;

(ii) non-alignment of Eurostat’s Community Statistical Programme with the Commission’s strategic planning cycle;

(iii) role and responsibility of Eurostat not fully acknowledged and recognised,

(iv) no assurance on the extent of compliance with the European Statistics Code of Practice, and

(v) lack of coordination at Commission level on the use of external providers of statistical services.

Following the audit, the Commission adopted a new Decision on Eurostat (2012/504/EU) on 17 September 2012 which addresses many of the above findings. The action plan was deemed satisfactory.

4.9.        IT audits

IAS performed several audits in the area of IT, reflecting the contribution of the IAS to the overall monitoring of the technological security and viability of the Commission.

4.9.1.     Local IT systems management (DG DEVCO, DG TRADE)

The audits of local IT in DGs DEVCO and TRADE reviewed the effective and efficient management of IT activities and found well-established IT units. The audit reports placed particular emphasis on the importance of implementing effective IT governance and better IT risk management and protecting the confidentiality of the information handled (DG TRADE) and reinforcing the IT security framework to minimise security breaches (DG DEVCO).

4.9.2.     IT Governance and performance (DG SANCO/EAHC)

DG SANCO has a relatively high IT budget and finances most of its IT spending from operational appropriations. Since the previous audit[21], a significant improvement was noted in the general maturity of IT general controls. This audit focused on governance, performance and quality aspects. A more limited review was performed for EAHC, taking into account its much smaller IT budget.

The auditors found that:

(i) DG SANCO still lacks an overall long-term IT strategic plan/or documented strategy including the EAHC, explaining how it would support business processes in this time frame. Although the IT Master Plan and the Management Plan include some high level key performance indicators, there is no comprehensive performance management process, and

(ii) EAHC should formalise some key procedures (change, performance and quality management).

The action plan is assessed as satisfactory.

4.9.3.     Horizon 2020 (DG RTD, DG CNECT, ERCEA)

The ‘Horizon 2020’ flagship programme for research and innovation aims to secure Europe’s global competitiveness and is a driver for creating new growth and jobs. Several IT projects have been developed to support the management of this project, with DG RTD as system owner and DG CNECT and ERCEA as business managers.

The IAS formulated two very important recommendations:

(i) the need for more information system integration to enable the initiative to go on making progress; including the need for clear procedures and overall governance of IT via an IT Project Steering Committee, and

(ii) the need for DG RTD to define its project work and resource plan better.

As Horizon 2020 is a new, cross-cutting initiative, implementing the recommendations may involve DG DIGIT and other research DGs.

DG RTD developed an action plans which was assessed to be satisfactory.

5.           Consultation with the Commission’s Financial Irregularities Panel

No systemic problems were reported in 2012 by the Financial Irregularities Panel under Article 73(6)[22] of the Financial Regulation applicable to the general budget of the European Communities.

6.           Conclusions

The implementation of action plans drawn up in response to IAS audits in this and in previous years contributes to steady improvement in the Commission’s internal control framework.

The Commission’s services were therefore asked to ensure they took action on recommendations resulting from audits. The IAS will conduct follow-up audits on the execution of action plans that will be examined by the Audit Progress Committee, which will inform the College as appropriate.

The IAS, in close coordination with all IACs, has drawn up a new Strategic Audit Plan covering the period 2013-2015. The IAS will continue to focus on financial/compliance and IT audits will also step up activities in performance auditing.

[1]               The audit and consulting reports finalised by 1 February 2013 are included in this Report.

[2]               The Report does not cover the decentralised European Agencies, the European External Action Service, or other bodies audited by the IAS, which receive separate annual reports.

[3]               Required by the Performance Standard 2060 of the International Standards for the Professional Practice of Internal Auditing (Standards) promulgated by The IIA.

[4]               COM(2013) 334 final.

[5]               One engagement may result in several audit reports in case the engagement covers more than one Directorate-General or Service as auditee.

[6]               4 recommendations were only partially accepted.

[7]               Of these 29 recommendations, two were issued in 2006 of which one is reported as ‘implemented’ by management since March 2013.

[8]               Cut-off date is 1 February 2013.

[9]               Minor areas for improvement detected were submitted to the DG’s attention by way of management letter. The sample DGs replied positively to this letter, committing themselves to take IAS’ observations into account — to the extent possible — as from the current AAR exercise.

[10]             The Commission had proposed a reduction of staff in each EU Institution, body and agency of 5 % during the period 2013-17 through the non-replacement of some departing staff (retiring or with expired contracts). The Commission also established a mechanism to redeploy posts in order to meet its priorities, based upon a linear 1 % levy on all basic job quotas.

[11]             Cost of services of DGs/Services to other DGs/Services or institutions that are transferred from the budget line of the client to the one of the provider (recovery orders, co-delegations and cross sub-delegations). There is no consolidated figure providing an overview of the amounts charged-back to internal and external clients by Commission service providers.

[12]             Cost of services of DGs/Services to other DGs/Services or institutions that are transferred from the budget line of the client to the one of the provider (recovery orders, co-delegations and cross sub-delegations). There is no consolidated figure providing an overview of the amounts charged-back to internal and external clients by Commission service providers.

[13]             In the Audit on implementation of the 2007-13 Programming Period in DG REGIO

[14]             A report on corrective capacity of financial corrections for the period 2000-2006 was submitted to the COCOBU on 12 April 2013.

[15]             DG REGIO has transmitted an updated sampling guidance to Audit Authorities on 4 April 2013. It also organised workshops addressed to these bodies in November 2012 in Brussels and seminars were held in 2013 in some Member States (Italy, Spain, Germany, Slovakia and Czech Republic).

[16]             Extensive audit work, in particular on control strategies, was carried out in this policy area in 2011.

[17]             e.g. revamped External Assistance Management Reports, declaration of assurance from Heads of Delegation.

[18]             Excluding final payments of the administrative budget and procurement, as well as those parts of LLP implemented through the National Agencies in the Member States.

[19]             Regulation (EC) No 223/2009, Article 6.

[20]             COM(2005) 0217 final.

[21]             2006 IT audit on ‘Large scale information systems’.

[22]             Art. 117, RAP stipulates: ‘That annual report [i.e. 99(3) report] shall also mention any systemic problems detected by the specialised panel set up pursuant to Article 73(6) of the Financial Regulation.