52021SC0132

OP: Publications Office of the European Union

PMO: Office for the Administration and Payment of Individual Entitlements

REA: Research Executive Agency

SG: Secretariat-General

SG.RECOVER: Secretariat-General Recovery & Resilience Task Force

SJ: Legal Service

UKTF: Task Force for Relations with the United Kingdom

Content of this staff working document

Part 1 of this document contains:

·a summary of the internal audit engagements performed as part of the 2020 Internal Audit Service (IAS) audit plan (reports issued between 1 February 2020 and 31 January 2021); and

·the principal recommendations (critical and very important 2 ) made.

The information contained in this document reflects the state of play when the audit engagements were finalised. Each audit followed the applicable standard professional validation and contradictory procedures between auditor and auditee at the time of the finalisation of the engagement. The enclosed summary of each engagement aims to provide an overview of the audits and their main results. Additional, up-to-date information is provided in specific sections by the auditees on measures drawn up and already implemented after the internal audit engagements were finalised.

Part 2 of this document contains a summary of the results of the Internal Audit Service’s follow-up engagements performed between 1 February 2020 and 31 January 2021 3 .

Part 3 provides a summarised overview of the six long overdue very important recommendations as at 31 January 2021.

PART 1: Final reports

Horizontal audits

1.Audit on pillar assessment in the external action family (DG BUDG, DG ECHO, DG INTPA, DG NEAR, FPI)

The objective of the audit was to assess the adequacy of the design, and the efficiency and effectiveness of the implementation of the pillar assessment process of entities to be entrusted with the implementation of Union funds in the external action domain and to assess if it enables the Commission to ensure a level of protection of the financial interests of the Union equivalent to the one that is provided when the Commission implements the budget directly.

There are no observations / reservations in the 2019 Annual Activity Reports of the audited Directorates-General/Service that relate to the area/process audited. The fieldwork was finalised on 11 December 2020. All observations and recommendations relate to the situation as of that date.

The IAS acknowledged the coordination steps DG BUDG has taken so far, in particular the design of the planned central repository that, after improvements, will become a very useful tool to enhance consistency and efficiency of the pillar assessment process across the Commission.

The IAS also acknowledged the coordination efforts (e.g. alignment of existing pillar assessments with the requirements of the current Financial Regulation) and support to other Commission services by the DG INTPA as the lead service for a high number of pillar assessed entities.

The efficiency and documentation of the pillar assessment process have improved over time.

The IAS identified two critical issues concerning: (1) pillar assessment of the United Nations Secretariat; and (2) agreements signed with pillar assessed entities. It also identified three very important issues concerning: (1) the corporate oversight role; (2) substantive changes in pillar assessed entities’ systems, rules and procedures; and (3) the Commission services’ involvement in the pillar assessment process. The IAS formulated four critical and fifteen very important recommendations:

Pillar assessment of the United Nations Secretariat in DG INTPA (1 critical recommendation addressed to DG INTPA)

DG INTPA should launch as soon as possible, and based on the support of all interested services, the pillar assessment for the United Nations Secretariat (covering both the procurement and grants pillars) and for the entities that cannot rely on it (covering all but the three new pillars introduced in 2019), and apply supervisory measures until the pillars are positively assessed. Furthermore, based on the outcome of the existing joint working group with the United Nations Secretariat, launch the assessment of the three new pillars introduced in 2019 and finalise it within the deadline set by the Interinstitutional Relations Group fiche of November 2020.

Agreements signed with pillar assessed entities (3 critical recommendations addressed to DG INTPA, DG NEAR and DG ECHO respectively and 1 very important recommendation addressed to DG BUDG)

DG BUDG should inform the services of the conditions for making a presumption of conformity, liaise with them to implement supervisory measures for pillars that are not fully compliant, and cooperate to verify the information regarding the scope of the assessment of the sub-delegation pillar. It should correct/record the scope and outcome of the pillar assessments in its inventory, when applicable.

The operational services should follow the instructions of DG BUDG and provide the necessary information. As prescribed by the Financial Regulation, prior to signing a contribution agreement, they should verify that the agreement allows the entrusted entity to use only the pillars it complies with, or that adequate supervisory measures are applied if the entity is not fully compliant.

Corporate oversight role (3 very important recommendations addressed to DG BUDG, 1 very important recommendations addressed to DG INTPA, 1 very important recommendation addressed to DG NEAR)

DG BUDG should further develop its corporate oversight role by clearly defining the scope of this role and the mandatory or advisory nature of its instructions and guidance to ensure coordination and coherence in the pillar assessment process across the Commission. It should develop, in cooperation with the other services concerned and drawing from their experience, comprehensive corporate guidance including process description, templates and tools for pillar assessments applicable to all Commission services. It should also adopt a roadmap with milestones towards the establishment of the central repository / automated workflow tool and refine and complete the functional and technical requirements of the planned tool.

Substantive changes (5 very important recommendations addressed to DG BUDG, DG INTPA, DG NEAR, DG ECHO and FPI respectively)

DG BUDG should establish a mechanism enabling the lead services to verify compliance by the pillar assessed entities with the obligation to report substantive changes to their systems, rules and procedures. It should adopt a procedure and issue guidelines for assessing such changes, and specify which measures to apply if substantive changes reported by an entity undermine the positive result of the pillar assessment.

Commission services’ involvement in the pillar assessment process (4 very important recommendations addressed to DG INTPA, DG NEAR, DG ECHO and FPI respectively)

For ongoing and future pillar assessments, the operational Directorates-General / services should effectively use the possibilities at their disposal (e.g. participation in meetings, review of draft reports, their compliance with terms of reference, completeness, quality) to ensure that pillar assessments are of a good quality so that they can be relied on to take an informed decision on entrusting budget implementation tasks under indirect management. Moreover, they should adequately document the pillar assessment review process and communicate its outcome, including the supervisory measures, when applicable, correctly and in a timely manner; to the pillar assessed entity and the other Commission services. Finally, DG NEAR and DG ECHO should establish roadmaps for the implementation of recommendations, monitor their implementation and systematically review if the supervisory measures established are relevant and sufficient.

Additional information provided by DG BUDG, DG INTPA, DG NEAR, DG ECHO and FPI on the measures defined and/or implemented following the Internal Audit Service audit

The multi-DG audit on pillar assessment in the external action family resulted in five ‘very important’ recommendations for DG BUDG. They concerned (further) developing the corporate coordination and coherence of the pillar assessment process, the related guidance for the DGs, the central repository/automated workflow tool, the mechanism of reporting the substantial changes and the conditions for making a presumption of conformity. DG BUDG’s action plan was agreed with the IAS in April 2021.

DG BUDG's action plan, agreed by the IAS, includes 22 measures related to these recommendations, some of which have already been delivered as planned (e.g. first training session held and further sessions are scheduled, general guidance on Indirect Management published, updated repository made available to other Services, model notes for lead DGs, updated FAQs, Budgweb pages on indirect management have been reshaped, DG BUDG expert group on pillar assessments has been established, organisation of the update of the repository on a monthly basis). The bulk (50%) of DG BUDG measures is expected to be implemented by the end of June 2021.

DG BUDG is also liaising, within its remit, with external action DGs with regard to the implementation of their respective action plans put forward to address the IAS recommendations (e.g. UNS supervisory measures, sub-delegation, repository of pillar-assessed entities, complementary assessments progress).

Since the reception of the audit report, DG INTPA has further assessed the IAS observations and, in cooperation with the IAS has put in place an action plan. Its implementation should be completed by end of December 2021. In particular, the following measures have already been implemented to address the two critical and three very important recommendations issued to DG INTPA:

- On behalf of the Commission, DG INTPA has written to the UN Controller outlining the immediate consequences of the IAS report and the measures taken by the Commission and requesting the information needed to launch the missing pillar assessments of the UN Secretariat and some related entities (UNEP / UNODC).

- The Director-General of DG INTPA issued an instruction note to all DG INTPA authorising officers and Heads of Delegation to suspend the signature of contribution agreements with the UN Secretariat and entities relying on its pillar assessment until the supervisory measures are put in place.

- A separate letter with the list of applicable supervisory measures, pending the finalisation of the PA, was sent to the UN on 15 April, following agreement by DG BUDG and the Legal Service. These supervisory measures are detailed conditions for the entities to award procurement and grants while ensuring a level of protection of the EU funds equal to the level of protection assured by the Commission. Cooperation with the entities could therefore resume. However, the signature of agreements with supervisory measures is done on an exceptional basis and it is limited to actions that need to be urgently concluded before the completion of the pillar assessments.

- On behalf of the Commission, DG INTPA has written to the UN Controller providing clarifications on the conduct of the complementary assessments of the three new pillars on exclusion from access to funding, publication of information on recipients of funds and protection of personal data and recalled the need for completing such assessments by 31 December 2021.

- On 28 April 2021 DG INTPA signed the contract for the assessment of the grants and procurement pillars of the United Nations Secretariat (UNS). The announcement letter was sent to the UN on 30 April. The assignment starting date is mid May.

- DG INTPA has carefully assessed all other building blocks supporting the assurance in relation to the operations affected by the findings (i.e. DG INTPA’s verification missions, RER study, ECA audits, management declarations, follow-up of audit results). The conclusion is that there is reasonable assurance as regards the accuracy of payments made and the legality and regularity of the underlying transactions.

- DG INTPA has also analysed the potential impact of the risks reported by the IAS on the operations with the identified entities in the report in terms of relevant expenditure in 2020. DG INTPA has also verified whether further payments to entrusted entities in 2020 that were not identified in the IAS report could also be affected by missing or incomplete pillar assessments. This additional analysis covered operations with the 20 most important (by paid amounts) entrusted entities 4 and 468 transactions were assessed. Relevant expenditure (i.e. total payments made minus pre-financing plus clearing of pre-financing) relating to contracts affected by the IAS findings amounts to EUR 55.4 million and the amount at risk corresponds to EUR 1.7 million. The conclusion is that the risk identified is under control while the financial impact is below the de minimis threshold.

- DG INTPA liaised with and obtained information from relevant services so that complete information on the scope of the assessment of the sub-delegation pillar to be included in DG BUDG database.

- DG INTPA replaced the databases on its Intranet with a link to the inventory compiled by the Directorate-General for Budget, after having liaised with DG BUDG on the needed corrections to be made.

It is also foreseen that the following measures are going to be implemented:

- DG INTPA already included a reminder in the latest version of INTPA Companion published in February on the need for diligent verification prior to the signature of agreements that in the absence of full PA-compliance supervisory measures are needed. INTPA will also bring formally this to the attention of all services and add/update information on supervisory measures.

- DG INTPA has already been strengthening the involvement of relevant services in the PA process by increasing participation in opening and closing meetings, encouraging Entities to submit draft reports, systematically sharing the draft reports with relevant colleagues in BUDG and line DGs and providing comments on the reports. Checklist(s) including the issues to be considered during the quality review process of the draft and pre-final PA reports will soon be introduced.

- Following DG BUDG Instruction Note of 31 March on the discontinuation of the sub-delegation pillar and DG BUDG Note on ‘Complementary assessment of pillar 6 – Financial Instruments and Budgetary Guarantees’, DG INTPA will shortly send communications clarifying the need for certain entities to undergo complementary assessments of the grants pillar and relevant sections of the financial instruments pillar. For entities that were only assessed for sub-delegation - without the grant pillar being assessed - contractual (supervisory) measures will be needed to cover the gap pending the completion of the assessment of the grants pillar. In addition, if the complementary assessment for relevant sections of pillar 6 is still ongoing at the moment of entering into contractual arrangements for InvestEU and/or EFSD + guarantee agreements and equity, relevant contractual provisions will have to be included in the agreements. DG INTPA has started the drafting of such measures.

DG NEAR adopted the action plan to address the IAS recommendations in March 2021, its implementation should be completed by October 2021. The actions to address the critical recommendation have been already implemented, more specifically:

- DG NEAR has updated the relevant checklist and sent a note to the staff at Headquarters and in EU Delegations with a reminder that only those tasks, for which the pillars have been assessed, can be entrusted, and that the supervisory measures should be applied, when they are established.

The other three very important recommendations have also been mostly implemented. They cover:

- the update of the Manual of procedures (MAP), including indicating the assignments of responsibilities within DG NEAR;

- a closer monitoring of possible substantive changes in the pillar assessed entities;

- better substantiation of the decision to directly contract auditors, which from now on will be done with a note to the file signed by the Director-General;

- the usage of checklists for reviewing draft and pre-final reports and considering participation in the closing meetings;

- setting the deadlines for communicating the results of the pillar assessments in MAP;

- the quarterly follow-up of the implementation of the recommendations in the roadmaps;

- bi-annual re-assessment of the the supervisory measures.

Some of the above listed points might need to be updated once DG BUDG issues their guidance in mid-2021. In addition, DG NEAR has carried out a thorough analysis of the payments made in 2020 to entrusted entities, including also entities not specifically identified by the IAS. The comprehensive checks conducted by DG NEAR 5 resulted in the identification of errors equal to 0.21% of the payments made in 2020 to entrusted entities under indirect management, well below the materiality level (2%).

DG ECHO has accepted the recommendations and an action plan has been agreed with the IAS. The recommendations should be implemented by 30 June 2021 and include the following actions:

- An instruction note will be issued by the Director-General. It will set out the responsibilities within DG ECHO units to ensure that the outcome of the pillar assessment and the established supervisory measures are adequately recorded and applied. The instruction note will also identify the responsible unit in charge of the monitoring of the substantive changes communicated by the entities pillar assessed, the analysis of these changes and the identification of additional measures that can be needed following these changes.

- Furthermore, a specific checklist will be developed for the review of the pillar assessment reports to ensure that the assessment process is adequately monitored and properly documented.

- In addition, DG ECHO has included supervisory measures in its IT tool and will ensure that compliance is achieved on a permanent basis.

- Concerning the critical audit finding for the pillar assessment of the UN Secretariat, DG ECHO noted that supervisory measures are in place and applied as necessary.

DG ECHO performed similar checks to the ones described by DGs INTPA and NEAR and found that for 2020, 0.22% of its payments to pillar assessed entities were at risk. The estimated financial impact amounted to EUR 56 000 and was well below the de minimis threshold for raising a reservation in the annual activity report. According to DG ECHO, sufficient assurance could be obtained, and this analysis was performed in full cooperation with DG BUDG, the IAS and the other partners.

It is foreseen that the two very important recommendations addressed to the FPI will be implemented by the drafting of a detailed internal FPI note due on 30 June 2021. The note will:

- define the pillar assessment procedures;

- clarify among others the process for dealing with substantive changes and FPI’s involvement in meetings and in drafting assessment report analysis;

- set standards for the documentation of the pillar assessment review process.

2.Audit on the Commission’s strategy for data, information and knowledge management (DG BUDG, DG DIGIT, DG ESTAT, DG HR, JRC, SG)

The objective of the audit was to assess the effectiveness of the Commission’s strategy on data, information and knowledge management (DIKM) in addressing the challenges and expectations in this domain.

There are no observations / reservations in the 2019 Annual Activity Reports of the audited Directorates-General that relate to the area audited. The fieldwork was finalised in October 2020. All observations and recommendations relate to the situation as of that date.

The IAS recognised a number of strengths as regards the Commission’s framework for data, information and knowledge management, in particular:

·Governance structure: the Commission has set up a multi-layer governance structure for DIKM which is fully embedded in the overall Commission’s governance. The Information Management Steering Board (IMSB) reports to the Corporate Management Board and is chaired by the Chief Operating Officer of the Commission. It is supported by an Information Management Team (IMT), composed of experts from several Directorates-General. Its tasks are to develop policies and action plans and submit proposals to the IMSB. The IMSB has achieved the goal to set up very ambitious work programmes and to coordinate and support the efforts of many Commission services aiming to address the DIKM challenges in a collaborative and agile way. Its coordination efforts are welcomed by the services closely involved in the DIKM.

The IMSB and the IMT operate in a very transparent and open way. The outcome of the meetings is well documented and there are dedicated webpages where all the relevant information is stored, including those related to the data strategy actions and the data ecosystem collaborative space.

·Communication and visibility actions: the Secretariat-General together with the JRC, DG DIGIT and DG HR have made particular efforts to promote the DIKM visibility activities. The knowledge weeks, organised in 2018 and 2019, were successful and well attended events and achieved to raise awareness of the DIKM projects and support the individual Directorates-General in implementing them. These events were also key in further supporting the cultural change within the Commission.

Some of the DIKM actions, such as the one-stop-shop, the new corporate search and the opening of the ARES files, have been very successful in improving the information and knowledge sharing in the Commission.

The IAS identified two very important issues on: (1) the design of the DIKM strategy; and (2) DIKM governance issues and formulated four very important recommendations:

Design of the DIKM strategy (1 very important recommendation addressed to SG)

The different elements of the DIKM strategy have to be reassessed and revised to strengthen their strategic orientation and coherence and better demonstrate how it contributes to the Commission’s priorities and activities. This has to be translated into SMART long-term strategic objectives giving the different departments involved in the implementation a common understanding of the strategic direction when designing and implementing the actions. These objectives have to be adequately reflected in the management plans of the services implementing the DIKM actions.

DIKM governance issues (3 very important recommendations addressed to SG)

The role of the IMSB regarding the monitoring of the human and financial resources deployed for implementing the DIKM corporate actions has to be clarified. The roles and tasks of the IMT have to be clarified and monitoring procedures have to be adopted. The Secretariat-General should implement tools to ensure effective coordination and sharing of information among action leaders and improve the exchange of information between the IMSB and the Information Technology and Cybersecurity Board.

Additional information provided by SG on the measures defined and/or implemented following the Internal Audit Service audit

The Secretariat-General coordinated the preparation of an action plan for the IAS audit on DIKM, which was accepted by the IAS on 25 March 2021. The action plan puts forward actions to address the audit’s recommendations, such as aligning of DIKM strategic documents and objectives, enhancing the monitoring and reporting of the strategy’s implementation, systematising the information exchange among the participating governance bodies, and developing operational guidance on data quality.

To address the audit’s very important recommendations, the Secretariat-General will coordinate the following actions, which will have been completed by January 2022:

- assess the relevance and coherence of existing DIKM strategic objectives and will formulate a set of specific and measurable medium term objectives, aligned with the Commission’s political guidelines and priorities. The objectives will guide the IMSB’s next work programme;

- verify that the DIKM strategic objectives are adequately reflected in the management plans of the services involved in their implementation;

- update the mandate of the IMSB and other policy documents to clarify its responsibilities. The information management team’s (IMT) added value, key role, responsibilities and procedures, including monitoring and reporting, will also be reviewed;

- improve further the systematic information exchange between the IMSB and the Information Technology and Cybersecurity Board, e.g. by sharing meeting minutes regularly and aligning the rolling agendas of the two Boards;

- enhance further the systematic knowledge sharing among the action leaders, the IMT members and the local data correspondents, e.g. through the use of a common collaboration space using Microsoft Teams;

- provide further guidance to the action leaders, including a common approach for referencing the corporate actions in their management plans and other planning documents;

- continue providing progress information to the IMSB through the biannual monitoring reports, which document in their milestones and/or deliverables the progress of all relevant activities of an IMSB action, including IT projects;

- clarify to the action leaders that for the actions under their responsibility in the IMSB’s next work programme, they should: define result-orientated performance indicators, and set baseline values, targets and milestones.

3.Audit on the management of the European fund for strategic investments guarantee fund (DG BUDG, DG ECFIN)

The audit objective was to assess the adequacy and effectiveness of the internal control systems related to the management of the European fund for strategic investments guarantee fund (including management of the European fund for strategic investments guarantee fund’s assets and calls on the EU guarantee) by DG BUDG and DG ECFIN, ensuring that the Commission is able to honour the calls on the EU guarantee.

There are no observations/reservations in the 2019 Annual Activity Report of DG ECFIN that relate to the area/process audited (until the transfer of the main part of the audited activity to DG BUDG on 1 January 2020, DG ECFIN was exclusively performing these tasks). The fieldwork was finalised on 27 November 2020. All observations and recommendations relate to the situation as of that date.

The IAS recognised the following strengths/good practices:

·The staff members managing the European fund for strategic investments guarantee fund and conducting the related financial operations have the required expertise.

·There is a strong collaboration and knowledge sharing between the different units in ECFIN.DDG2 and BUDG.E.

The IAS did not formulate any critical or very important recommendations.

4.Audit on WIFI4EU (DG CNECT, DG DIGIT, INEA)

The objective of the audit was to assess the effectiveness of the management of the WiFi4EU initiative by the DG CNECT and INEA, including the IT support provided by the DG DIGIT.

There are no observations / reservations in the 2019 Annual Activity Reports of the Directorates-General and Executive Agency that relate to the area/process audited. The fieldwork was finalised on 16 October 2020. All observations and recommendations relate to the situation as of that date.

The IAS acknowledged the ongoing efforts made by DG CNECT, DG DIGIT and INEA to ensure the effective implementation of the WiFi4EU initiative and recognised the following strengths:

·The governance arrangements between the DG CNECT, DG DIGIT and INEA are overall well established. The current written agreements (memoranda of understanding between the two Directorates-General provide a sound framework for the supervision of the WiFi4EU initiative.

·WiFi4EU is implemented and supervised by knowledgeable and committed staff in DG CNECT, DG DIGIT and INEA. Furthermore, there is a good collaboration between these entities.

·In addition to the functionalities of the WiFi4EU portal, the INEA has set up:

oclear guidelines and procedures for staff (including supporting checklists for 10 processes/sub-processes);

oan effective control mechanism for processing payments and monitoring the execution of the initiative;

oa mapping tool to check the geolocation data encoded in the installation reports.

·DG DIGIT provides effective support to the management of WiFi4EU with tools for monitoring the execution of the initiative. Moreover, it developed an IT security plan adapted to the specificities of the initiative.

The IAS did not formulate any critical or very important recommendations.

5.Audit on the implementation of anti-fraud actions in research (DG CNECT, EASME, ERCEA, DG RTD, INEA, REA)

The objective of the audit was to assess whether the anti-fraud framework in the research family is adequately designed and effectively implemented to ensure that: potential fraud cases can be prevented and timely detected; appropriate follow-up actions are taken when cases of serious suspicions are detected or for established fraud cases; anti-fraud activities are compliant with the applicable rules.

There are no reservations in the 2019 Annual Activity Report of the audited Directorates-General or Executive Agencies that relate to the area/process audited. The fieldwork was finalised on 26 November 2020. All observations and recommendations relate to the situation as of that date.

The IAS recognised the following strengths:

·The design and implementation of the research anti-fraud strategy is centrally coordinated via the Fraud and Irregularities in Research Committee, chaired by the Common Audit Service and attended by the Research and Innovation family. In addition, the Common Audit Service facilitates the coordination with OLAF for the whole family, which ensures a coherent approach regarding key elements of the anti-fraud framework such as the development of a common fraud awareness training.

·The ex ante controls in Horizon 2020 projects are supported by common information technology tools designed by the Common Implementation Centre. At the end of 2019, the Common Implementation Centre reinforced the anti-fraud controls before and after signature of the grant agreements by providing effective information technology support tools (ARIS and SIMBA) for the detection of double funding and plagiarism, which enable to check the content of deliverables against other documents already submitted to the Commission.

The IAS did not formulate any critical or very important recommendations.

6.Audit on the management of experts in H2020 grants (DG CNECT, DG RTD, EASME, INEA, REA)

The objective of the audit was to assess if the internal control system setup for the expert management process in the research family is adequately designed and effectively implemented to ensure that the experts selected adhere to the criteria defined for the fulfilment of their evaluation and monitoring tasks and ensures compliance with the applicable rules.

There are no observations/reservations in the 2019 Annual Activity Report of the Directorates-General and Executive Agencies that relate to the areas/process audited. The fieldwork was finalised on 30 October 2020. All observations and recommendations relate to the situation as of that date.

The IAS recognised the following strengths:

·The central role of Unit REA.C4 for Horizon 2020 evaluators ensures overall coordination and coherence in contracting with experts as well as processing payments in a timely manner.

·The business process owner for expert management organises and coordinates regular meetings of the Expert Management Steering Committee and Key Users Group to discuss major issues and developments regarding the expert management process.

·The operational units have made sustained efforts to ensure that selected experts adhere to the criteria defined for the fulfilment of their evaluation and monitoring tasks (experience, skills, knowledge, and independence).

The IAS identified two very important issues concerning: (1) the monitoring of expert participation patterns and respect of rotation rules; and (2) compliance with personal data protection and formulated two very important recommendations:

Monitoring of participation patterns of independent experts and respect of the rotation rules 1 very important recommendation addressed to DG RTD)

The Common Implementation Centre should revise its guidance on monitoring participation patterns and respect of rotation rules, clearly allocate the responsibility for collecting the relevant data and request the Horizon 2020 implementing bodies to respect the guidance. The Common Implementation Centre should also determine for which experts the rotation rules were not respected when the pools from which to select experts were created and take the necessary corrective action.

Processing of experts personal data (1 very important recommendation addressed to DG RTD)

The Common Implementation Centre should develop a common policy at research family level on checking experts’ competence from social media and on the internet and processing personal data collected from these external sources in line with the applicable rules. Furthermore, the Common Implementation Centre should update the expert management record (updated legacy notification) and privacy statement to include this common policy.

Additional information provided by DG RTD on the measures defined and/or implemented following the Internal Audit Service audit

The Common Implementation Centre, together with the Directorates-General and Executive Agencies concerned, drafted an action plan addressing the two very important recommendations. The action plan was presented to the IAS on 26 February 2021 and according to it the Common Implementation Centre will:

- update and align the guidance on rotation and monitoring of participation rules for experts, in agreement with Horizon Europe and including the template of the call evaluation report;

- provide instructions (to be included in the eExperts Vademecum) for services to communicate to the Business Process Owners, as part of the Steering Committee tasks, on the adequate number/gender balance of experts available for their specific needs;

- develop guidance (to be included in the Vademecum) on the use of social media/internet and the processing of personal data of experts retrieved from external sources, including practical implementation aspects;

- include in a single call for expression of interest a reference to social media (and a reference in the portal's privacy statement if required);

- further enlarge the extended mandate of the Taskforce on Elimination and Retention Safeguadrs (TFERS) to manage the elimination of obsolete personal data of experts on shared drives;

- create awareness on data protection via different channels such as trainings and the DG’s Intranet.

The Business Process Owners will ensure that publication of personal data published on the Portal abides by the respective rules.

7.Audit on data protection (DG DIGIT, DG HR, JRC, LS, SG)

The objective of the audit was to assess whether the Commission has put in place an effective and efficient control system enabling Directorates-General/services to demonstrate compliance with the provisions of Regulation (EU) 2018/1725.

There are no observations/reservations in the 2019 Annual Activity Reports of the Directorates-General / services concerned that relate to the area/process audited. The fieldwork was finalised in mid-July 2020. All observations and recommendations relate to the situation as of that date.

The IAS recognised the following strengths:

With the entry into force of Regulation (EU) 2018/1725 (Internal Data Protection Regulation - IDPR), the Commission adopted an action plan with ambitious objectives and milestones for the implementation of the new rules in the Commission, thus giving the right tone at the top. The Data Protection Officer (DPO) has monitored and reported on the implementation of the action plan annually.

The Commission has put in place a decentralised model aiming at ensuring an adequate level of responsibility and accountability across the organisation through key actors at corporate and at Directorate-General/service level (DPO and (delegated and operational) controllers), as well as a network of Data Protection Coordinators (DPC). While the IAS has identified the need to strengthen certain aspects, this decentralised model, as conceived, provides a proportionate balance between steer at corporate level and accountability at Directorate-General/service level and helps to ensure a good level of collaboration across the organisation.

The DPO is appropriately positioned in the Commission’s governance structure. Although attached for administrative purposes to the Secretariat-General, he is functionally independent of the Secretariat-General and other Commission Directorates-General/Services. Hierarchically, the DPO and his team are placed under the supervision of the Chief Operating Officer (COO) and reports regularly to the Group of Resource Directors, a permanent sub-group of the Corporate Management Board (CMB), chaired by the COO.

Overall, in the sampled Directorates-General / services, there is a good level of awareness of data protection aspects by the actors involved at the different stages of the process.

The data protection process is supported by a dedicated IT system, i.e. Data Protection Records Management System (DPMS), managed by the DPO (i.e. the system owner). While the IAS has identified the need to develop certain features in this system to improve its efficiency, DPMS provides overall a good basis for the management of processing operations in compliance with the IDPR.

The IAS identified three very important issues related to: (1) the general framework governing personal data protection; (2) the DPO role and actions; and (3) compliance with key provisions of the regulation and formulated eight very important recommendations:

General framework governing personal data protection aspects in the Commission (3 very important recommendations addressed to SG/DPO, 1 very important recommendation addressed to DG HR, 1 very important recommendation addressed to DG DIGIT)

The IAS recommended that the DPO adopt additional guidance on the DPC function and, jointly with DG DIGIT, develop methodology and guidance for defining a minimum set of IT related controls to address the requirements of the IDPR when designing new IT systems or significantly updating existing IT systems. The IAS also recommended: (1) the DPO should provide guidance to ensure that the shared DPC function is based on harmonised arrangements that set out the roles and responsibilities of each party; and (2) DG HR should assess, jointly with the delegated controllers of the four Offices of the HR family, whether it is feasible to maintain a common DPC function and if so, to support the shared function with appropriate arrangements, including the allocation of the necessary resources and the clarification of key responsibilities.

Data Protection Officer’s role and actions to support the data protection process across the Commission services (2 very important recommendations addressed to SG/DPO)

The IAS recommended that the DPO strengthen its draft annual work programme 2020-2021 (including clearly defined objectives, timeliness for the planned actions, key performance indicators to monitor actions and the resources to be allocated) and adopt it on a timely basis. As part of this exercise, the DPO should analyse in particular the resources needed to carry out audits and/or inspections to monitor the internal application of the IDPR, while considering the work to be carried out by other assurance providers. The work programme should be presented to the CMB, which considering its oversight and advisory role on personal data protection matters, should decide on the actions to be taken as regards any resourcing issues. The DPO should issue an annual activity report on the activities performed, including on the implementation of the work programme.

In addition, the IAS recommended that the DPO, as system owner of DPMS, issue comprehensive guidance as regards the existing records types (‘individual’, ‘corporate centralised’ and ‘corporate decentralised’) and revise the ‘DPMS record template’ to reflect the roles as defined in the implementing rules (delegated controller, operational controller). The DPO should also implement a module in DPMS for the management of personal data breaches across the Commission and include a feature to facilitate the regular review of the records of processing operations.

Compliance with key provisions of the regulation on data protection across the Commission (1 very important recommendation addressed to SG/DPO)

The IAS recommended that the DPO further raise awareness (in the Group of Resource Directors and the DPC Network) on the urgent need to keep a proper record of all the processing activities in line with the provisions of the IDPR and report to the CMB the exceptions so that appropriate action may be taken. The DPO should, in consultation with the DPC network, issue guidance on the handling of data subjects’ requests, implement a corporate solution to protect the data subjects’ rights and develop a training module aiming at building-up competencies on performing data protection impact assessments by operational controllers. The DPO should issue guidance on the internal arrangements to be concluded between Directorates-General and services where processing operations are carried out jointly. The DPO should, taking account of the EDPS’s recent order and planned guidance on international transfers of data, as well as the information received from the delegated controllers, analyse how compliance of the Commission’s processing operations with the IDPR can be ensured. In this context, the DPO should provide assistance to the delegated controllers and consult with the EDPS, when appropriate.

Additional information provided by SG, DG DIGIT and DG HR on the measures defined and/or implemented following the Internal Audit Service audit

The Secretariat-General had five very important recommendations from the Internal Audit Service addressed to the Data Protection Officer (DPO) on guidance and methodology. The action plan was approved by the Internal Audit Service and will be implemented in 2021 with the exception of a couple of actions that will be implemented in the first quarter of 2022 .

The main actions for the implementation of these very important recommendations include the issuing of guidance, the creation in the ‘DPMS record template’ of the necessary fields to reflect the roles defined in the Implementing Rules, the implementation of certain changes to the DPMS, the development – in consultation with the data protection coordinators’ network – of a training module or workshop on performing a data protection impact assessment by operational controllers, the raising of awareness on the urgent need to keep a proper recording of all the processing activities and the issuance of a standalone annual activity report on the activities performed by the Data Protection Officer. On international transfers, taking account of the European Data Protection Supervisor’s recent order and planned guidance on international transfers of data, as well as the information received from the delegated controllers, the Data Protection Officer will analyse how compliance of the Commission’s processing operations with the IDPR can be ensured. This includes coordinating the Services’ completing and updating (where required) the Commission’s inventory of processing operations involving international transfers. In addition, the Data Protection Officer will provide assistance to the delegated controllers in order to help implement any forthcoming guidance on this matter by the European Data Protection Supervisor.

Only one (very important) recommendation concerned DIGIT as associated DG, namely that the DPO should adopt jointly with DIGIT and in consultation with data controllers and the DPC network, a methodology and guidance for defining a minimum set of IT related controls to address the requirements of the IDPR when designing new IT systems or significantly updating existing IT systems. This recommendation is not due until the end of 2021.

The recommendation addressed to DG HR consists in DG HR needing to review its centralised Data Protection Coordination (DPC) role for the DG HR family (OIB, OIL, EPSO and PMO). The decision has been taken to devolve the DPC role to the Offices. The decision is already being formally communicated to the Offices, a transition period is now entered in which DG HR assures the function for the time the Offices need to organise their own Data Protection Coordinator. The recommendation will be deemed implemented once the transition period is completed.

8.Audit on indirect management with entrusted entities (DG INTPA, DG NEAR)

The objective of the audit was to assess if indirect management agreements are designed and implemented in an efficient and effective manner, in compliance with the regulatory framework.

There are no observations / reservations in the 2019 Annual Activity Reports of the two Directorates-General that relate to the area / process audited. The fieldwork was finalised on 24 November 2020. All observations and recommendations relate to the situation as of that date.

The IAS recognised the following strengths/good practices:

·The EU Delegation in Turkey documents comprehensively the calls for proposals, related evaluation and negotiation reports, in particular for actions implemented through the Facility for Refugees in Turkey.

·There is complete documentation in the Common Relex Information System of requests for derogations from contractual clauses (general conditions) and prior approvals.

·The external assistance management reports reviewed provide comprehensive information on the funding (commitments/payments) channelled through indirect management with entrusted entities and related challenges.

The IAS did not formulate any critical or very important recommendations.

Agriculture, natural resources and health

1.Limited review of the management of State aid in the field of agriculture in DG AGRI

In the context of the transfer of the State aid Unit from DG AGRI to DG COMP as from 1 January 2020, the objective of this limited review was to provide assurance on the effectiveness and efficiency of the controls implemented by DG AGRI for dealing with State aid in the agricultural sector.

The 2017 and 2018 Annual Activity Reports contain no reservations concerning State aid. The fieldwork was finalised on 20 December 2019. All observations and recommendations relate to the situation as of that date.

The IAS recognised the in-depth knowledge and experience of staff managing State aid in agriculture. This has been developed over a number of years and has helped the unit to meet all the required statutory deadlines.

The IAS did not formulate any critical or very important recommendations.

2.Audit on the financial management of the 2014-2020 European agriculture fund for rural development in DG AGRI

The objective of the audit was to assess the design and effective implementation of DG AGRI’s internal control processes for the financial management of the 2014-2020 European agricultural fund for rural development.

The following observations/reservations were made in the 2019 Annual Activity Report concerning specifically the area/process under the scope of this audit engagement:

- The reservation concerns the payments made on rural development in 2019 and it covered the amount of EUR 288.35 million, representing 2.03% of the total annual European agricultural fund for rural development expenditure of EUR 14 179.98 million. Reservations have been made concerning 21 paying agencies, comprising 18 Member States.

The fieldwork was finalised on 18 June 2020. All observations and recommendations relate to the situation as of that date, except for finding one for which additional information was received and assessed following DG AGRI's comments to the draft audit report.

The audit team noted the profound knowledge and extensive experience of the finance team in Unit AGRI.R.4. This, together with their availability to support the colleagues in the geographical units, was also clearly confirmed through the replies to the IAS survey of the geographical unit colleagues.

The IAS did not formulate any critical or very important recommendations.

3.Audit on the design and implementation of CHAFEA control strategy

The objective of the audit was to assess whether CHAFEA has designed an adequate control strategy and implements it effectively and efficiently to ensure the legality and regularity of the underlying transactions and sound financial management of its delegated programmes.

There are no observations/reservations in the 2017 and 2018 Annual Activity Reports of CHAFEA that relate to the area audited. The fieldwork was finalised on 7 July 2020. All observations and recommendations relate to the situation as of that date.

The IAS recognised the commitment and expertise of key staff in the ‘Corporate Support and Resources Management Unit’ and operational units of CHAFEA.

The IAS did not formulate any critical or very important recommendations.

4.In-depth risk assessment of the innovation fund (DG CLIMA)

The objective of this engagement was to identify, categorise and assess, in cooperation with DG CLIMA, the main inherent risks relating to the set-up and start of the innovation fund, with a view to enabling the Directorate-General to manage those risks adequately.

Originally, the IAS intended to undertake an audit in this area. However, at the time of engagement, the processes relating to the set-up of the fund were still very much under discussion. Furthermore, subsequent to the start of the engagement, the Commission decided to delegate the responsibility for the implementation of the fund to the Innovation and Networks Executive Agency. Consequently, the Internal Audit Service focussed, in cooperation with DG CLIMA, on the identification of the main inherent risks associated with the set-up of the fund, including the launch of the first call for proposals, from both the supervisory and implementation perspectives.

As the engagement was a risk assessment, the report did not contain an audit opinion or conclusion and no formal recommendations were issued. Instead, the report contained issues for consideration for the attention of management. Their effective implementation will not be formally followed up by the IAS.

Cohesion

1.Audit on the process for coordinating technical support to the Member States in DG REFORM (including the contribution of DG REGIO and DG EMPL to the coordination mechanism)

The objective of the audit was to assess whether or not DG REFORM’s processes for coordinating the provision of technical support to the Member States and for selecting projects under the Structural Reform Support Programme are adequately designed and functioning effectively. The audit also assessed whether DG REGIO and DG EMPL have put in place adequate procedures for contributing to the coordination mechanism on technical support established by DG REFORM and whether these are functioning effectively.

There are no observations/reservations in the 2019 Annual Activity Report of DG REFORM that relate to the area/process audited. The fieldwork was finalised on 30 May 2020. All observations and recommendations relate to the situation as of that date.

The IAS recognised the following strengths in the practices followed by DG REFORM:

·Clear instructions were provided by DG REFORM to Member State authorities on how to prepare requests of technical support for submission. In order to answer any additional questions the Member State had on the Structural Reform Support Programme process, DG REFORM organised meetings with the Member States' coordinating authorities in the form of videoconferences.

·The instructions on the Structural Reform Support Programme consultation for the assessment of Member State requests provided by DG REFORM to the participating Directorates-General were clear and adequate and have remained consistent during the audited period. In case the Directorates-General needed any further clarifications, these were provided to them through direct bilateral exchanges with DG REFORM. Also the topic of the Structural Reform Support Programme request consultation process has been included in the topics that are discussed during the technical support working group meetings.

·The tailor-made dashboards prepared by DG REFORM for each of the participating Directorates-General (showing the number of requests received from the Member State and the status of their project implementation) elicited a high satisfaction rate from the Directorates-General participating in the 2020 satisfaction survey.

The IAS did not formulate any critical or very important recommendations.

2.Audit on implementation of financial instruments under European Regional Development Fund/Cohesion Fund 2014-2020 in DG REGIO

The objective of the audit was to assess whether DG REGIO has put in place adequate controls for supporting Member States in the uptake and use of financial instruments under the 2014-2020 programming period for the European Regional Development Fund / Cohesion Fund and for monitoring their implementation.

In its 2019 Annual Activity Report, DG REGIO did not issue a reservation specifically on financial instruments. Nevertheless, the Directorate-General made a reservation for the 2014-2020 programming period concerning weaknesses in management and control systems in 58 European Regional Development Fund / Cohesion Fund programmes in 13 Member States. The necessary preventive and corrective actions have been or are being requested from the Member States concerned. The fieldwork was finalised on 25 November 2020. All observations and recommendations relate to the situation as of that date.

The IAS recognised the following strengths in the practices followed by DG REGIO in the audited area:

·Organisation and function of financial instruments matrix meetings: the financial instruments matrix enables sharing examples of good practices / successful use of different types of financial instruments among its members.

·Country responsibilities in Unit B3: a clear allocation of Unit B3 staff per Member States to provide support. Expert knowledge and support provided by the coordination unit is very well perceived by the implementation units. During the last two years Unit B3 made significant efforts to improve and facilitate the coordination and cooperation in the area of financial instruments implementation.

·DG REGIO developed a dedicated tool in SharePoint for monitoring the uptake of the Coronavirus Response Investment Initiative for each Member State, which covers also measures related to financial instruments.

The IAS did not formulate any critical or very important recommendations.

Research, energy and transport

1.Audit on the effectiveness of the design and of the implementation of the ex post control strategy for Connecting Europe Facility (CEF) by INEA

The objective of the audit was to assess the effectiveness of the design and implementation by INEA of the ex post control strategy in order to obtain reasonable assurance on the legality and regularity of underlying transactions.

There are no observations/reservations in the 2019 Annual Activity Report of INEA that relate to the area/process audited. The fieldwork was finalised on 9 September 2020. All observations and recommendations relate to the situation as of that date.

The IAS recognised the ongoing efforts made by INEA in the design and implementation of the ex post control strategy for the CEF programme and identified the following strengths / good practices:

·There is a good document archiving system thanks to which all the project information and audit files (paper and electronic data) are easily accessible to the INEA staff involved.

·There is a thorough supervision of the audits performed by the external contractor including monitoring and detailed quality review of their main deliverables. The supervision also includes performing joint missions once a year.

·There is an effective internal review process (audit follow-up process) on the implementation of audit results that is used by the ex post audit team to inform operational and financial colleagues of the outcome of an ex post audit and agree the implementation of financial recommendation.

·The ex post audit team succeeded in delivering the annual audit plans while not being fully staffed.

The IAS identified one very important issue on the assessment of the legality and regularity of amendments to implementing contracts and formulated one very important recommendation:

INEA should update its ex post audit methodology for the assessment of the legality and regularity of amendments or exceptions to the procurement procedures. Moreover, the Agency should prepare clear guidelines and checklists to enable consistent assessment of the legality and regularity of amendments to implementing contracts (for example the due diligence at tender phase) and to document all checks performed. Additionally, the Agency should raise awareness with the beneficiaries on the restrictive interpretation of the use of contract amendments without public tendering.

Additional information provided by INEA on the measures defined and/or implemented following the Internal Audit Service audit

The action plan with the measures to address this very important recommendation was defined and agreed with the Internal Audit Service. The measures included the revision of the public procurement checklist to provide improved guidance to auditors auditing public procurement procedures for the Agency. This checklist was validated by DG GROW and is applicable already as of the 2021 Ex-post Audit Plan. In addition, the Agency has paid particular attention to raising the awareness of its beneficiaries to the interpretation of the justifications of contract modifications both in ex-post audits and more widely. The measures addressing this very important recommendation were implemented by the Agency in the first quarter of 2021 and will be subject to a follow-up by the Internal Audit Service before being formally closed.

2.Audit on the JRC’s support to EU policy and knowledge management (selection of and delivery on Commission requests)

The objective of the audit was to assess whether the processes put in place by the JRC to support policy (both policy making and policy implementation) and knowledge management are adequately designed and effectively and efficiently implemented.

There are no observations/reservations in the 2019 Annual Activity Report of the JRC, which relate to the area/process audited. The fieldwork was finalised on 10 November 2019. All observations and recommendations relate to the situation as of that date.

The IAS recognised the ongoing efforts made by the JRC to further improve the policy support delivered to the policy Directorates-General and to develop knowledge management in the Commission.

The IAS recognised the following strengths:

·The preparation of the work programme is based on well-structured procedures with clear roles and responsibilities.

·The JRC has in place an effective change management procedure to update the work programme during its execution in order to address new requests expressed by the client services.

·Following the guidelines of its Strategy 2030 on managing knowledge and competences, the JRC has created six knowledge centres and seven competence centres which enable exploitation of the knowledge and competences of staff in the JRC and in the partner Directorates-General.

·Several good practices were identified in the knowledge and competence centres such as the organisation of knowledge weeks, workshops, trainings and exchanges in communities of practice, communication practices and tools, internal organisation of teams and registry of policy Directorates-General requests.

·To enhance the added value of knowledge management, the JRC internally reflected in a senior management roundtable held in May 2020 on the experience of knowledge management over the last four years and its possible evolution, including its mission, roles, tasks and responsibilities.

In the survey carried out by the IAS, the policy Directorates-General provided positive feedback on:

·The quality of the JRC deliverables: 82% of respondents rated it good or very good.

·The cooperation with the JRC for the definition of the specifications of the work: 76% of participants rated it as good or very good.

Moreover, the policy Directorates-General appreciate the possibility to co-design the work delivered by the JRC as well as the transparent communication by the JRC on the scientific support it can provide, the clarity of roles and responsibilities for policy support within the JRC, and progress and possible issues during the execution of the projects.

The IAS identified one very important issue on the policy support: definition of priorities, identification of needs and assessment of the requests and formulated one very important recommendation:

JRC should: (1) set up a regular coordination/consultation forum at Director-General level to coordinate priorities and needs for policy support; (2) include a formal consultation of the policy Directorates-General early in the process to prepare the work programme to obtain a reliable and up-to-date view on their needs; and (3) develop a mechanism/system in order to obtain a structured and systematic overview of requests made through different entry points to enable the JRC to better prioritise requests and track their responses.

Additional information provided by JRC on the measures defined and/or implemented following the Internal Audit Service audit

According to the action plan accepted by the IAS on 22 February 2021, the JRC will address the very important recommendation by continuing having meetings at DGs’ level to discuss future priorities. The JRC will revise the work programme processes (adoption of revision proposal and implementation are planned respectively by December 2021 and by March 2022). Better prioritisation and consultation of partner DGs on their priorities and needs will be addressed in the revision. A longer period for the formal ISCs has been already implemented (from 15 to 20 working days). Definition of priorities will also be discussed within the process of ‘Reset, Re-imagining and Re-energising for new challenges’, where the JRC will re-assess its priorities, align, and simplify its processes. By the end of 2021, a dedicated system to keep track of all requests from partner DGs and JRC responses will be set up.

3.Audit on accounting of assets in JRC

The objective of the audit was to assess the adequacy of the design and the effectiveness and efficiency of the implementation of the fixed assets management accounting controls put in place by the JRC to report and present fairly the assets it owns in its accounts.

There are no observations/reservations in the 2019 Annual Activity Report of JRC that relate to the area/process audited. The fieldwork was finalised on 17 December 2020. All observations and recommendations relate to the situation as of that date.

The IAS recognised the ongoing efforts made by the JRC to ensure the completeness of the assets registered in the accounts as well as the high level of professionalism and dedication of the staff involved, including the JRC asset accountant. In particular, the IAS identified the following positive elements:

·The establishment of an asset coordination group through which best practices and knowledge are exchanged. Thanks to this network, in 2018 Unit R.9 organised a training for the new asset manager of Karlsruhe in Ispra to introduce her to the specificities of the job.

·Unit R.9 organised accounting and JRC integrated processing system (JIPSY) trainings on a regular basis during the year and upon request. It also provides support to the JRC users of JIPSY and ABAC Assets for accounting and asset related issues.

The IAS identified one very important issue concerning the asset accounting control related to process documentation, guidance and methodology and formulated one very important recommendation:

JRC should complete the existing guidelines and manual with additional documentation describing the assets accounting control process, the methodology for performing the assets accounting controls and the calculation methods for the key performance indicators concerned.

Additional information provided by JRC on the measures defined and/or implemented following the Internal Audit Service audit

Based on the action plan accepted by the IAS on 4 March 2021, the JRC will address the identified very important issue within the end of 2021 as follows: the existing accounting guidelines and manual will be completed with additional documentation and instructions for staff in order to better describe the whole asset accounting control process (e.g. types of controls, methodology used, roles and responsibilities, reporting of information, process for annual closure). Reference will be added to the relevant DG BUDG guideline, where applicable. The calculation method for the KPIs concerned will also be described in a detailed document.

Moreover, the methodology for calculation of the error rate has been reviewed by March 2021, as scheduled, in response to an important issue identified by the auditors. The accounting error for year 2020, as included in the JRC AAR 2020, has been estimated following the revised approach.

4.Audit on Horizon 2020 grant management phase 3 in REA

The objective of the audit was to assess: (1) the effectiveness of the ex ante controls on Horizon 2020 payments; (2) the compliance of the management of projects with EU restricted information with the applicable rules; and (3) the effectiveness of the process for the closure of REA’s H2020 projects.

There are no observations/reservations in the 2019 Annual Activity Report of REA that relate to the processes audited. The fieldwork was finalised on 7 December 2020. All observations and recommendations relate to the situation as of that date.

The IAS acknowledged the ongoing efforts made by REA in ensuring effective implementation of ex ante controls on Horizon 2020 grant payments in the context of an increasing workload and recognised the following strengths:

·REA has a strong control environment, including systematic reviews of periodic reports by independent experts and financial verifications performed centrally by Unit C.2. This provides a solid basis for an effective implementation of ex ante controls on Horizon 2020 grant payments.

·The networks of project officers, financial officers, ethics correspondents and legal officers have regular meetings to discuss in particular the Horizon 2020 grant management process and to ensure a coherent approach and overall coordination of the process in REA.

The IAS identified one very important issue concerning the management of projects with RESTREINT UE/EU RESTRICTED information and formulated one very important recommendation:

REA should ensure the respect of the rules as regards the briefings for monitors and the organisation and documentation of the review meetings with RESTREINT UE / EU RESTRICTED deliverables, and align the internal REA guide to the provisions of Commission Decision No 2019/1962. Furthermore, the staff involved in managing projects with RESTREINT UE / EU RESTRICTED deliverables should attend the training courses on the RUE system and formally acknowledge their security obligations.

Additional information provided by REA on the measures defined and/or implemented following the Internal Audit Service audit

REA accepted the IAS recommendation and is addressing it by a dedicated action plan which includes the update of REA internal guidance, the development of specific briefing material for research consortia and experts, improved handling of review meetings involving EU restricted deliverables, and the increase of staff awareness about the security rules and their obligations while managing projects with classified information.

The action plan should be fully implemented by end of January 2022, with a first set of actions completed by end of May 2021: the updated REA internal guidance and various briefing materials will be delivered according to the agreed timeline. The second part of the actions, relating to awareness raising actions and training of staff will be implemented in a subsequent step.

Moreover, as REA parent DGs and other executive agencies expressed their interest in benefitting from the outcome of the action plan, a complementary action is being carried out so that the good practice can be shared in future in an efficient way.

5.Audit on the Horizon 2020 ex post audit strategy in DG RTD

The objective of the audit was to assess the adequacy and effectiveness of the Horizon 2020 ex post audit strategy (‘the strategy’) in contributing to the assurance about the legality and regularity of the underlying transactions.

There are no observations/reservations in the 2019 Annual Activity Reports of the Horizon 2020 implementing bodies that relate to the process audited. The fieldwork was finalised on 15 December 2020. All observations and recommendations relate to the situation as of that date.

The IAS recognised the ongoing efforts by the Common Audit Service (CAS) to design and implement the ex post audit strategy for the Horizon 2020 programme and identified the following strengths and good practices concerning the implementation of the strategy by the CAS, information technologies supporting the CAS processes, and the overall level of satisfaction with the services provided by the CAS:

·The CAS has addressed the weaknesses identified in the previous IAS audit on the ex post audit strategy for the seventh framework programme concerning the audit planning and staff allocation, the execution and documentation of audits, the supervision and quality control, and the monitoring and reporting on audit delivery, and has enhanced its internal organisation and procedures effectively. They have also made a significant effort to close individual audit files that were long overdue, including analysing and addressing the root causes of the delays.

·The audit process is supported by detailed manuals, standard procedures, and checklists.

·The audit process is supported by information technology (IT) systems COMPASS (offering fully integrated workflows for the management of internal and external audits) and AUDEX (ensuring storage of all information on the status, inputs and results of all audits).

·The recently released CAS dashboard enables the CAS and its stakeholders to easily and continuously monitor the various targets and key performance indicators set for the ex post audits (e.g. number of closed audited participations, direct coverage of the paid financial statements provided by the audits).

·Overall level of satisfaction with the services provided by the CAS: 68% of the stakeholders are overall satisfied with the services and deliverables provided by the CAS.

The IAS identified one very important issue concerning the design of the strategy and formulated two very important recommendations:

The Common Implementation Centre (CIC) should adjust the ex post audit strategy to allow the CAS to optimise to the extent possible the use of its resources by supplementing the common representative sample with audit samples covering the high risk areas (e.g. high risk beneficiaries or projects) for all implementing bodies, to strengthen the contribution of the ex post controls to the corrective mechanisms. It should also further develop the existing guidance on ad hoc requests for risk-based audits to clarify situations where they can be requested and to provide considerations and criteria to be used by the CAS when deciding to approve or reject the submitted requests.

Furthermore, the CIC should define and implement a roadmap to complement the existing control strategy in view of progressively reducing the error rate, taking into consideration cost/benefit elements (including the impact on the business) and should ensure that the audit strategy contributes to the revised control strategy.

Additional information provided by DG RTD on the measures defined and/or implemented following the Internal Audit Service audit

According to the action plan, the CAS will regularly run corporate risk-based selections. For the future, the Horizon Europe ex-post audit strategy will be a risk based one.

The CIC will adapt its outreach campaign to Horizon 2020 beneficiaries to focus the content of the seminars on the cost category contributing by far the most to the error rate (personnel cost) and undertake active steps to ensure the participation of the categories of beneficiaries most vulnerable to errors (newcomers, SMEs, third country participants, one-time participants). It will analyse the possibility of enhanced in-depth ex-ante checks on a sampling basis to a number of risk-prone beneficiaries. The CAS will continue to provide information on the most common errors and feed the information presented to the officers responsible for ex-ante controls. It will also prepare an online training (webinar) that would be available to all certifying auditors upon taking up the assignment.

The CIC will timely implement all the actions included in the action plan agreed via the High Level group between DG BUDG, RTD, IAS and the SG.

External actions

1.Audit on performance management in FPI

The objective of the audit was to assess whether FPI has put in place an adequate performance management framework to plan, monitor, manage and report on the achievement of its policy objectives.

There are no observations/reservations in the past Annual Activity Reports of FPI that relate to the area/process audited. The fieldwork was finalised on 3 July 2020. All observations and recommendations relate to the situation as of that date.

The IAS recognised the ongoing efforts made by FPI to build its performance management framework and integrate it into its daily operations. In particular, the following strengths were observed:

·The development of an FPI manual has been a major step forward in setting a harmonised FPI-wide approach to project management, evaluation and other horizontal functions.

·The FPI results framework, included in the FPI manual, sets a solid foundation for a future FPI-wide system for monitoring the results of FPI’s instruments.

·The reporting in the Annual Activity Report and programme statements rigorously follows the objectives and indicators defined in the 2016-2020 Strategic Plan and the 2019 Management Plan.

The IAS identified one very important issue concerning the fragmentation of the performance management framework and formulated the following very important recommendation:

FPI should increase the central coordination of its performance management framework, so that the framework covers all FPI’s activities coherently.

Additional information provided by FPI on the measures defined and/or implemented following the Internal Audit Service audit

The actions to be taken by FPI, agreed with the IAS, will be implemented progressively and include:

- the setting up of a central coordination function for performance management;

- further reinforcement of the coherence and steering of the Service’s performance management framework; in this context a revision of the Results Framework in conjunction with a revision of the FPI Manual is foreseen during 2021;

- establishment of the needs for outsourcing contracts from all operational units during N+1 by the end of the year N; based on the analysis of the needs communicated, FPI will advocate the added value in pooling contracts between relevant Units. This coordination exercise will be launched in 2021 (year N);

- ensuring for the next Multiannual Indicative Programmes, that objectives and expected results are as specific as possible and indicators are aligned with the FPI Results Framework;

- performing systematic review and annual assessment of objectives and indicators as proposed by FPI Operational Units; in this revision, attention will be given to ensure that objectives are SMART and indicators RACER;

- performing a first results collection/reporting exercise in OPSYS by end 2021 where increased quality controls on indicators will be carried out;

- as part of the roll out of OPSYS in 2021, FPI has and will further develop action-level indicators and Logical Framework for EOM and CFSP actions;

- the appointment within each operational unit of a person responsible for quality control of the calculation of indicators; furthermore, each Unit will formalize the calculation method and introduce a double verification procedure; the central coordination function (FPI.6) will assure the coordination, relevant guidelines and homogeneous approach throughout the Service to the extent possible.

The recommendation is expected to be fully implemented by the end of 2021.

2.Consulting engagement on EU visitors’ programme in FPI

The objective of the consulting engagement was to provide advice to the FPI Head of Service on how to improve the cooperation of the Commission and the European Parliament on EU visitors’ programme. The scope of the engagement covered the functioning of the EU visitors’ programme, including governance and decision-making processes, the two institutions’ respective contributions to the programme, and monitoring and reporting on performance. The engagement did not assess the performance of the programme itself.

As the assignment is a consultancy engagement, the report did not contain an audit opinion or conclusion and no formal recommendations were issued. Instead, the report contained issues for consideration. Their effective implementation will not be formally followed up by the IAS.

Education and citizenship

1.Audit on effectiveness of the protection of personal data of beneficiaries of and participants in the Erasmus+ and European Solidarity Corps programmes managed by DG EAC

The objective of the audit was to assess whether DG EAC has put in place an effective and efficient control system for the protection of personal data of beneficiaries of and participants in the Erasmus+ and European Solidarity Corps programmes, in compliance with the key provisions of the internal data protection regulation (IDPR).

There are no observations/reservations in the 2019 Annual Activity Report of DG EAC that relate to the area/process audited. The fieldwork was finalised on 30 November 2020. All observations and recommendations relate to the situation as of that date.

The IAS recognised that DG EAC’s main actors are well aware of the IDPR, its content, importance and implications, and have already taken actions towards compliance. Notably, DG EAC is currently addressing challenges with regard to personal data protection in the context of the implementation of the new technological framework and a new information technology landscape which implements the principle of personal data ‘by design and by default’. This will enable to remove many of the inconveniences of the past architecture of DG EAC’s mature information technology environment related to the protection of personal data.

The IAS identified one critical issue on transfer of personal data to third countries and four very important issues on: (1) information to all Erasmus+ participants during personal data collection; (2) supervision of processors’ compliance with the IDPR; (3) storage limitation principle; and (4) handling of personal data breaches. The IAS formulated one critical and four very important recommendations:

Transfer of personal data to third countries (1 critical recommendation)

DG EAC should analyse, with the support of the Data Protection Officer, how compliance of its programmes with the IDPR concerning international transfers of data can be ensured in the context of the order and the announced guidance of the European Data Protection Supervisor.

Information to Erasmus+ participants during personal data collection (1 very important recommendation)

DG EAC should ensure that all participants whose data are already stored in Mobility Tool+ are informed about the fact that the European Commission has their data and explain the way they can exercise their rights. For future data collection, DG EAC should inform all Erasmus+ participants before they provide any personal data about their rights as data subjects and the identity and contact details of the controller and the Data Protection Officer. Furthermore, the agreements signed by participants should be updated with a reference to the privacy statement.

Supervision of processors’ compliance with the IDPR (1 very important recommendation)

DG EAC should, after consulting the Data Protection Officer and the Legal Service, complete/complement the delegation agreements and grant agreements templates with: (1) National Agencies’/beneficiaries’ obligation to report to DG EAC about the data protection measures put in place for ensuring compliance with the IDPR; and (2) reinforce the existing concrete monitoring tools (e.g., checks, audits) to enable the European Commission to exercise its supervision/monitoring on how the National Agencies/beneficiaries handle personal data. Based on the reporting obligations for the National Agencies, independent audit bodies and beneficiaries, DG EAC should reinforce the existing monitoring mechanisms to effectively supervise the processes of handling of participants’ personal data by the national authorities and the beneficiaries of the Erasmus+ and European Solidarity Corps programmes.

Storage limitation principle (1 very important recommendation)

DG EAC should assesses the retention periods currently applied, align them with the closure of projects and calls and respect the principle of storage limitation, and ensure that after the expiry of the retention period data is effectively deleted or anonymised.

Handling of personal data breaches (1 very important recommendation)

DG EAC should adopt and implement a formal procedure for handling data breaches and ensure that action plans adopted to address weaknesses which led to data breaches are effectively implemented.

Additional information provided by DG EAC on the measures defined and/or implemented following the Internal Audit Service audit

DG EAC has immediately taken extensive proactive measures in response to the findings and has prepared and begun implementing an action plan to address the recommendations. Four out of the six actions to mitigate the risks identified by the IAS are now substantially completed or launched. Two of the six recommendations require additional time due to the roll-out of the new programme and the process regarding third country transfers of contact data, respectively. Looking at the plan as a whole by sub-action, half of the sub-actions specified in the overall plan are now complete.

On 25 March 2021, the IAS concluded a first follow-up of the audit on protection of personal data. Based on their review of the information and supporting documents provided, the IAS consider that DG EAC partially mitigated the risks related to observations on third country transfers of personal data (by improving the transparency about the level of protection of the data in the host countries) and the procedure on data breaches (a revised coherent procedure has been adopted). The IAS decided, on that basis, to downgrade the recommendations respectively from ‘critical’ to ‘very important’ and from ‘very important’ to ‘important’.

2.Audit on grant management (phase 3) – ex post controls in EACEA

The objective of the audit was to assess the effectiveness of the design and implementation by EACEA of its ex post control strategy in order to obtain reasonable assurance on the legality and regularity of underlying transactions.

There are no observations/reservations in the 2019 Annual Activity Report of EACEA that relate to the area/process audited. The fieldwork was finalised on 18 June 2020. All observations and recommendations relate to the situation as of that date.

The IAS recognised the efforts made by the agency in designing and implementing the ex post control strategy for the grant management of the programmes it implements and identified the following strengths and good practices:

·The internal review process on the quality and content of the audit reports and their findings, based on the four-eyes principle (from ex post controls and operational units) and two stages of review of the audit report (at the preliminary and the draft report).

·The effective collaboration among the operational units and the ex post team as well as early coordination with the anti-fraud sector which ensures an effective exchange of information, synergies in the decision making process and early treatment of potential fraud cases.

The IAS did not formulate any critical or very important recommendations.

3.Audit on grant management of the 2014-2020 Justice and Rights, Equality and Citizenship programmes – implementation in DG JUST

The objective of the audit was to assess whether DG JUST has put in place effective processes for: (1) managing the project implementation phase; and (2) implementing and reporting on ex post audit results.

In the 2019 Annual Activity Report of DG JUST there is one reservation regarding the process audited for centralised direct management – grants (2007-2020 programmes) as the residual error rate at year-end exceeds 2% (equal to 2.65%). DG JUST assessed that the financial impact of the reservation on the assurance equals to 0.94% of the payments made by DG JUST in 2019 amounting to EUR 1.68 million. The fieldwork was finalised on 30 July 2020. All observations and recommendations relate to the situation as of that date.

The audit identified the following strengths.

·DG JUST has provided extensive support to applicants and beneficiaries throughout the grant award and implementation phases. The client oriented culture together with constant contacts with beneficiaries and additional pedagogical efforts made by project officers on a daily basis to explain programme and the grant rules, technicalities of the information technology systems especially for first time applicants are good practices to be followed.

·The grant management sector of Unit JUST.04 has made effective use of the various reporting functionalities of the information technology system for grant management, including for example, the systematic use of the business activity monitoring reports and CORDA database. This enables robust monitoring and regular assessment of achievements against key indicators.

The IAS did not formulate any critical or very important recommendations.

Economic and financial affairs

1.Limited review on the implementation of the new internal control framework in DG COMP

The objective of the limited review was to assess if the authorising officer by delegation of DG COMP had performed an adequate overall assessment of the presence and functioning of all internal control principles and components as laid down in the Communication on the revision of the internal control framework.

There are no observations/reservations in the 2019 Annual Activity Report of DG COMP that relate to the area/process reviewed. The fieldwork was finalised on 21 August 2020. All observations and recommendations relate to the situation as of that date.

The IAS recognised the ongoing efforts made by DG COMP to strengthen its internal control system. Notably, the following strengths were identified:

·DG COMP has developed an ‘Internal Control Strategy of DG Competition’ which sets out control environment, inherent risks, control framework and monitoring mechanisms for the internal control system. This demonstrates the Directorate-General’s commitment to set the right tone at the top.

·DG COMP has implemented a decentralised monitoring system for the internal control framework which involves all units. In particular, the units have to conduct the self-assessment and to monitor on an ongoing basis the controls under their responsibility. Representatives of the units and the Internal Control Officer participate in the Internal Control Network, which ensures coordination on internal control aspects. This structure promotes commitment of management and staff, and enhances the awareness and knowledge on the new internal control framework.

The IAS identified one very important issue on the identification and assessment of deficiencies and formulated one very important recommendation:

DG COMP should include in its internal control strategy a description of the identification of strengths and deficiencies, ensure that all relevant sources of information are used during the annual assessment of the internal control framework and clearly describe, rate and document the identified deficiencies.

Additional information provided by DG COMP on the measures defined and/or implemented following the Internal Audit Service audit

The IAS recommendation will be addressed in line with the agreed action plan, to be implemented in 2021 and 2022. In particular, according to the action plan, DG COMP has included references to documents and/or other sources of evidence used in its assessment of the Internal Controls in 2020. DG COMP has also planned to include in its internal control strategy (to be concluded by mid-2021) a description of the identification of strengths and deficiencies, all relevant sources of information, and clear description, rating and documenting of the identified deficiencies.

2.Audit on supervision of the implementation of the 2014-2020 programme for the European geostationary navigation overlay service in DG DEFIS

The objective of the audit was to assess the effectiveness of the supervision processes of DG DEFIS for: (1) monitoring and steering the effective and timely implementation of the 2014-2020 European geostationary navigation overlay service (EGNOS) programme; (2) obtaining assurance on the sound financial management of the 2014-2020 EGNOS budget entrusted to the European GNSS Agency and the legality and regularity of the underlying transactions; (3) ensuring compliance with reporting obligations to the European Parliament, the Council, and the programme committee, laid down in the GNSS regulation.

There are no observations/reservations in the 2019 Annual Activity Report of DG GROW (before being transferred to the new DG DEFIS on 1 January 2020, the audited activity was performed by DG GROW) that relate to the area/process audited. The fieldwork was finalised on 18 November 2020. All observations and recommendations relate to the situation as of that date.

The IAS recognised DG DEFIS efforts to supervise the effective and timely implementation of the 2014-2020 EGNOS programme. The staff involved in supervision of the EGNOS programme are experienced, knowledgeable and committed. In particular, DG DEFIS:

·Has put in place thorough project management (including cost and schedule) as well as risk management approaches in line with the standards developed through the European cooperation for space standardisation.

·Has developed strong supervision processes based on: (1) the approval of programmatic supervision documents at different levels of authority (programme committee, College, Director-General and GNSS Director); (2) the approval of the annual acquisition and grant plans by the European GNSS Agency, including the right to select procurements to scrutinise the tender documentation or the award procedure or both, and exercise veto rights; (3) detailed reporting on the implementation of the EGNOS 2014-2020 programme from the European Space Agency and the EGNOS service provider to the European GNSS Agency and from the latter to DG DEFIS; (4) regular meetings for monitoring progress with approved minutes, including a systematic and formal follow-up of issues raised and actions to be taken.

·Has developed detailed and specific checklists to review the budgetary and accounting part of the annual and quarterly implementation reports prepared by the European GNSS Agency.

·Performs, on an annual basis, ex post financial audits on the costs declared by the European GNSS Agency for the implementation of the entrusted tasks.

The IAS did not formulate any critical or very important recommendations.

3.Audit on payments and accounting for tangible assets under the Galileo and Copernicus 2014-2020 programmes in DG DEFIS

The objective of the audit was to assess the adequacy and effective application of the controls on payments and accounting for assets under Galileo and Copernicus 2014-2020 programmes.

There are no observations/reservations in the 2019 Annual Activity Report of DG GROW that relate to the area/process audited (before being transferred to the new DG DEFIS on 1 January 2020, the audited activity was performed by DG GROW). The fieldwork was finalised on 11 December 2020. All observations and recommendations relate to the situation as of that date.

The IAS recognised the efforts made by DG DEFIS to ensure adequate and effective application of the controls on payments and accounting for assets under Galileo and Copernicus 2014-2020 programmes. In particular:

·DG DEFIS organises annual workshops with the involvement of its operational units, DG BUDG, the European Space Agency (ESA) and the European Global Navigation Satellite System Agency (GSA) to discuss the overall status of the programmes as well as to analyse the costs eligible for capitalisation and the possible impairment of assets.

·The costs declared by the agencies for the implementation of the entrusted tasks are subject to annual ex post financial audits which results are taken into account during the clearings.

·The staff involved in the supervision of the Galileo and Copernicus programmes are experienced, knowledgeable and committed.

The IAS did not formulate any critical or very important recommendations.

4.Limited review on the implementation of the new internal control framework in DG FISMA

The objective of the limited review was to assess if the authorising officer by delegation of DG FISMA had performed an adequate overall assessment of the presence and functioning of all internal control principles and components as laid down in the Communication on the revision of the internal control framework.

There are no observations/reservations in the 2019 Annual Activity Report of DG FISMA that relate to the area/process reviewed. The fieldwork was finalised on the 26st of June 2020. All observations and recommendations relate to the situation as of that date.

The IAS did not formulate any critical or very important recommendations.

5.Audit on evaluation activities in DG TRADE

The objective of the audit was to assess the adequacy of the design and the effectiveness of implementation of DG TRADE’s internal control systems for the management of evaluations and related contracts.

There are no observations/reservations in the 2019 Annual Activity Report of DG TRADE that relate to the area/process audited. The fieldwork was finalised on 15 December 2020. All observations and recommendations relate to the situation as of that date.

The IAS recognised the ongoing efforts made by DG TRADE to continuously improve its evaluation processes and in particular found that:

·DG TRADE has implemented a rigorous quality review process during which the evaluation support team (Unit A.3) analyses all key deliverables and verifies that the contractor has followed the methodology set in the terms of reference.

·Unit A.3 centrally supports the operational units by providing advice on the better regulation requirements and the evaluation processes in general.

·The preparation of the economic assessment of the negotiated outcome, requires knowledge and technical expertise from various units / staff in DG TRADE. To strengthen this process, in November 2017 DG TRADE established a new procedure to formally appoint the units that will participate in the preparation of the assessment based on their respective expertise.

·For the three types of evaluations (i.e. impact assessment, sustainability impact assessment and ex post evaluation), DG TRADE established interservice steering groups at the launch of the evaluations to support the evaluation work, monitor progress of the evaluation and provide feedback/ quality review of key deliverables.

The IAS identified one very important issue concerning the evaluation process: planning and monitoring and formulated one very important recommendation 6 :

DG TRADE should put in place enhanced planning and monitoring arrangements for its evaluation activities. This should include planning for all types of evaluations, defining criteria for the selection and prioritisation the evaluations to be performed and monitoring the evaluation plan through a set of performance indicators. In order to address potential delays in the evaluation process, DG TRADE should document the lessons learned from relevant past evaluations and use this when setting timelines for deliverables of contractors. DG TRADE should also analyse the resources needed in the operational units for the evaluation activities and plan and monitor their use for each evaluation.

Additional information provided by DG TRADE on the measures defined and/or implemented following the Internal Audit Service audit

The IAS recommendation will be addressed in line with the agreed action plan, to be implemented in 2021, notably on improvements in the planning and monitoring of the evaluations, update of the Sustainability Impact Assessment guidance and improvement of the communication guidance.

General services

1.Audit on human resources management in DG ESTAT

The objective of the audit was to assess whether Eurostat has put in place an adequate system for managing its human resources that supports effectively the achievement of its operational objectives.

The 2019 Annual Activity Report of Eurostat does not include any observations/reservations that relate to the area/processes audited. The fieldwork was finalised on 16 December 2020. All observations and recommendations relate to the situation as of that date.

The IAS recognised the ongoing efforts made by Eurostat to address its human resources management challenges in the context of staff reduction and uncertainty linked to issues in recruitment in Luxembourg, and identified the following strengths/good practices:

·The human resources business correspondent team has set up a continuous and effective collaboration with the human resources account management centre 6.

·Eurostat has organised internal staff surveys every two years (the last one in 2017) to collect information on staff satisfaction.

·The 2018 Commission staff survey indicated a higher satisfaction rate in Eurostat on the working environment (wellbeing and work-life balance) compared to the overall Commission rate.

·Eurostat organises many activities to foster good communication between management and staff and to enhance collaboration and sharing of information in-house. Furthermore, numerous well-being and social activities are offered to the Office’s staff.

The IAS identified three very important issues concerning: (1) human resources strategic management; (2) human resources planning; and (3) human resources monitoring and reporting and formulated eight very important recommendations:

Human resources strategic management (1 very important recommendation)

ESTAT should develop an integrated local human resource strategy (including in the area of learning and development) aligned with the business strategy (objective and priorities). The human resource strategy should address the specific human resource risks that Eurostat is facing and should include clear human resource objectives, expected results and deliverables.

Human resources planning (6 very important recommendations)

Eurostat should design and implement an integrated human resources planning process and prepare an annual human resource plan translating the strategic human resource priorities. Eurostat should also set up and implement a mapping exercise of tasks and skills / competences, develop a workload assessment system and, based on the results, revise the allocation of staff to remove possible imbalances.

Human resources monitoring and reporting (1 very important recommendation)

Eurostat should design and implement a monitoring and reporting system at Directorate-General level based on a set of human resource indicators to be able to regularly monitor and report on key human resource issues and identify areas where management follow-up/decisions are required.

Additional information provided by ESTAT on the measures defined and/or implemented following the Internal Audit Service audit

Eurostat developed an action plan for the implementation of each of these recommendations, which was agreed by IAS on 18 March 2021. The implementation of the action plan has already started.

Concerning the recommendation on HR strategic management, taking into account the upcoming guidance from DG HR on developing a local HR strategy, Eurostat will develop a local Eurostat HR strategy, based on the following steps: specific HR risk identification and assessment, detailed description of objectives, expected results and deliverables and definition of a learning and development strategy.

Regarding HR planning process, Eurostat will describe its future integrated HR planning process in one document and ensure that the designed and implemented HR planning process covers the assessment of the existing resources, the identification of the priorities/tasks and related HR needs and the assessment of the workload, with the aim of supporting the most effective allocation of resources.

Eurostat will also develop an annual HR plan, based on the strategic HR priorities, that contains a set of actions with clear targets, deliverables and responsibilities for the upcoming year. In doing so, Eurostat will ensure that the long-term objectives are achieved.

Eurostat will set up a comprehensive task mapping exercise in order to identify all tasks to be performed and the related resources in a comparable manner across the directorates. The task mapping exercise should lead to comparable data that can support the decision-making process.

Eurostat will also carry out a skills mapping exercise by mapping of the available skills and the missing ones, cross check the results of the mapping exercise with the future skills needed, and will develop appropriate actions in the context of the HR strategy and the HR annual planning to fill the gaps where necessary.

Concerning workload assessment, Eurostat has already reminded all staff to encode actual working hours in Sysper on 19 March 2021. Furthermore, Eurostat will reflect about an appropriate scheme to measure workload in statistical production units and horizontal support units including the impact on overtime of its staff with the aim to develop and adopt appropriate indicators to measure and monitor workload.

When reviewing staff allocation, Eurostat will also take into consideration the results of the workload assessment exercise and its integration in the HR planning process. This will be done with the aim of ensuring the most effective staff allocation according to the priorities of the Directorate-General.

Recommendation 8: HR monitoring and reporting.

Based on the plan agreed at the 1091st (9 February 2021) Directors’ meeting, Eurostat carries out quarterly reporting and monitoring of key aspects of human resources situation at Directorate-General level, starting from the first quarter 2021. The monitoring draws on the reports provided by HR Account Management Centre 6. It aggregates key SYSPER data and include operational indicators related to the staff composition, workload, absenteeism, status of vacancies, flexitime management and attendance to trainings. Directors can analyse the indicators provided in the quarterly HR metrics for their Directorate, together with the new reporting tool, the Managers’ HR Dashboard offered to all managers in the Commission, to support HR management in their Directorate. Furthermore, the HR Business Correspondent in Eurostat will prepare a summary quarterly report of the key issues identified at Directorate-General level and areas where follow-up decisions are required. From April 2021, the report is being presented to the Directors’ Meeting in the month following the reference quarter.

2.Audit on performance management in OLAF

The objective of the audit was to assess whether OLAF has put in place an adequate performance management framework to plan, monitor and report on the achievement of its key policy objectives.

There are no observations / reservations in OLAF’s 2019 Annual Activity Report that relate to the audited process. The fieldwork was finalised on 30 November 2020. All observations and recommendations relate to the situation as of that date.

The IAS recognised OLAF’s ongoing efforts to continuously improve its performance management system in the current changing environment and highlighted the following good practices:

·Effective coordination: Unit OLAF.02 effectively coordinates the strategic planning and programming exercise. It provides clear instructions for units involved in the exercise, organises bilateral meetings with these units to clarify any methodological issues and orally presents progress and results to the Directors’ meetings in parallel with reviewing the compliance and quality of deliverables.

·Monitoring and reporting: OLAF level: The protection of the budget is a key priority of the Commission where OLAF plays an essential role. In this context, the European Parliament raised some concerns as regards the lack of information on amounts actually recovered following financial recommendations resulting from OLAF investigations. In 2019, the Court of Auditors and the IAS also flagged issues on the monitoring and follow-up of OLAF financial recommendations.

The Commission therefore committed itself to tackle these issues and the Corporate Management Board requested the Commission services to strengthen their follow-up and to provide relevant information to OLAF and DG BUDG to enable a better corporate oversight of the follow-up of OLAF financial recommendations.

In this context, and in order to coordinate efficiently and effectively the monitoring of and reporting on its financial but also judicial, disciplinary and administrative recommendations, OLAF created a dedicated task force under the responsibility of its Director-General. This task force is in charge of developing good practices and guidelines on the implementation of the monitoring exercises, analysing the implementation of OLAF’s recommendations and acting as OLAF’s central contact point on the implementation of OLAF recommendations.

At Directorates and Units’ level, in addition to objectives and indicators set in the Management Plan, the units in the four OLAF directorates have developed specific key performance indicators, which are monitored daily and reported in the weekly Directorates’ meetings and in the bi-monthly Directors’ meetings.

The IAS did not formulate any critical or very important recommendations.

3.Limited review on the implementation of the new internal control framework in OP

The objective of the limited review was to assess if the authorising officer by delegation of OP has performed an adequate overall assessment of the presence and functioning of all internal control principles and components as laid down in the Communication on the revision of the internal control framework.

There are no observations/reservations in the 2019 Annual Activity Reports of OP that relate to the area / process audited. The fieldwork was finalised on 28 May 2020. All observations and recommendations relate to the situation as of that date.

The IAS recognised the ongoing efforts made by the Office to establish a robust internal control assessment process, in particular by setting out very clearly the roles and responsibilities of the actors involved and ensuring that its various units are properly consulted during the process.

The IAS did not formulate any critical or very important recommendations.

Information technology audits

1.Audit on management of public cloud services (DG DIGIT, DG HR, SG)

The objective of the audit was to evaluate whether the Commission has put in place appropriate arrangements for the use of public infrastructure as a service and platform as a service cloud services, enabling it to achieve its objectives while reducing risk exposure to an acceptable level and optimising the use of resources.

No reservations were made in the 2019 Annual Activity Reports for SG, DG DIGIT and DG HR that relate to the area audited. The fieldwork was finalised on 20 July 2020. All recommendations relate to the situation as of that date.

The IAS recognised the following strengths: the strategic vision for cloud computing, the dynamic purchasing system as a multi-institutional call for tender to procure cloud services, and DIGIT as being the single point of contact for procurement procedures with external cloud service providers.

The IAS identified two issues concerning: (1) the governance of cloud services; and (2) cloud security services and formulated two very important recommendations:

Governance of cloud services

The Information Technology and Cybersecurity Board (chaired by SG), should strengthen the corporate governance on cloud issues through the creation of a cloud centre of excellence for promoting cloud computing adoption and a portfolio of cloud services aligned with business needs, through adequate cross-functional collaboration. It should also receive regular reporting on the progress made in implementing the Commission’s cloud strategy. The Information Technology and Cybersecurity Board should ensure that cloud-related risks (of technological investment, security and budgetary nature) are properly reflected in the risk management implementation guide so that main risks at department and corporate level are duly reported. Appropriate guidance should also be made available to Commission departments in assessing the scope and the use of cloud services in the transition process. This could be enhanced by developing an internal cloud community of practice.

Cloud security services

DG DIGIT, through its different roles of cloud broker and cloud security service provider, should reinforce the development, implementation and management of a full set of cloud security services, based on a cloud technical, data and security architecture. This should ensure a correct balance between security baseline of cloud services and business requirements resulting from the risk assessment. The service level offered by cloud security services should be effectively monitored in practice and the results reported on a regular basis to the corporate governance bodies, based on key performance indicators.

Additional information provided by DG DIGIT and SG on the measures defined and/or implemented following the Internal Audit Service audit

DG DIGIT is progressing with the timely implementation of the audit recommendations, as described in the dedicated action plan and therefore mitigating the related risks. DG DIGIT drafted a proposal for the establishment of a new Cloud Council and its mandate. DG DIGIT also revised the roadmap for their cloud security services. Both elements were approved by the Information Technology and Cybersecurity Board (ITCB) on 25 March 2021.

Both of the above-mentioned actions are crucial for the implementation of the remaining parts of IAS recommendations, mentioned below, which are due later in 2021 and 2022.

In terms of governance, the Cloud Council will oversee the cloud users’ community (i.e. the existing Cloud Community of Practice that since end 2020 has a dedicated channel of communication), in which task it will be supported by a Cloud Center of Excellence already hosted in DIGIT as cloud broker. The Cloud Council will also investigate specific cloud requirements, or issues at a technical level, as notably, it will develop landing zones operational model and cloud services architecture, for ITCB endorsement. The establishment of a clear governance structure will enable updating risk management to ensure that the risks relevant for cloud environments are properly considered; and putting in place of regular yearly reporting about the progress of the implementation of the cloud strategy, in the scope of the European Commission Digital Strategy (ECDS) reporting.

The Roadmap for cloud-enabled IT security services, foresees to incrementally develop, during a two-year programme, a comprehensive set of cloud-enabled IT security services that covers the business needs on the usage of cloud (security consulting services, monitoring, threat hunting, development, identification and remedial to weaknesses, detection of ‘Shadow IT’, etc.). The service offering will be complemented by a cloud security maturity model and by a set of key performance indicators that will enable the effective monitoring of the services.

2.Audit on information technology security management in DG GROW

The objective of the audit was to assess the adequacy of the design and the effectiveness of the implementation of the governance, management and control processes put in place by DG GROW for its information technology (IT) security management.

The fieldwork was finalised on 24 November 2019. All observations and recommendations relate to the situation as of that date.

The IAS recognised the following strengths:

·DG GROW regularly performs vulnerability scans for the information technology application IMI (Internal Market Information) and duly follows up their results. The IMI vulnerability scan in March 2019 did not identify any high-level risks. Moreover, during the development of the information technology application MDR EUDAMED (European Database on Medical Devices), DG GROW also performed regular vulnerability scans on the system.

·For the important changes/updates to IMI, the specific security measures are identified, documented and regularly reviewed by DG GROW. Team leaders of MDR EUDAMED performed code reviews, applying the four-eyes principle during the software development lifecycle. The project managers of IMI, CPNP (Cosmetic Products Notifications Portal) and MDR EUDAMED pay special attention to the security awareness of the developers when recruiting.

The IAS did not formulate any critical or very important recommendations.

3.Audit on information technology governance and project management in JRC

The objective of the audit was to assess the adequacy of the design and the efficiency and effectiveness of the management and control systems put in place by JRC for its information technology governance and project management processes.

There were no observations/reservations in the 2018 Annual Activity Report of JRC that relate to the area/process audited. The fieldwork was finalised on 26 May 2020. All observations and recommendations relate to the situation as of that date.

The IAS recognised the ongoing efforts and significant improvements made by JRC in the past two years as regards its information technology governance arrangements and in the initiation/approval phase of information technology projects.

The following good practices were noted:

·Information technology governance arrangements in JRC are well-defined, formalised and implemented in practice. Both information technology and business stakeholders periodically discuss, monitor and decide on information technology activities and their direction. This ensures that information technology is seen by senior management as a key component to deliver on the long-term strategy of JRC and ensures business-focused and value-driven information technology.

·The establishment of a central body ‘JRC ICT Programme Office’, which among many functions, examines all new information technology investments and ensures their alignment with the defined information technology architecture, and with the Commission information management governance and project management methodology as well as supporting the implementation of the Commission’s digital strategy.

·The risk management process is well-defined, formalised and implemented in practice, in compliance with the Commission’s regulatory requirements, and in line with the JRC integrated management system processes, including information technology risks.

The IAS identified one very important issue concerning information technology project management practices and formulated one very important recommendation:

JRC should define and implement a comprehensive information technology project management methodology with supporting artefacts and guidelines tailored to the type and size of the projects. This would ensure that each project has a clear project organisation structure in place, supported by appropriate project logs and documentation, as well as stronger continuous reporting and monitoring of its status.

Additional information provided by JRC on the measures defined and/or implemented following the Internal Audit Service audit

As agreed in the action plan accepted by the IAS on 29 October 2020, the identified very important issue will be addressed through the preparation of guidelines for IT project management tailored to the needs of the JRC. These guidelines will contain recommendations for a clear project organisation structure, as well as project monitoring and reporting processes guidelines; maintaining project management logs and guidelines for project closure activities will be also treated. The guidelines for IT project management are planned to be submitted for approval to the ICT governance of the JRC by the end of 2021, together with a policy document in preparation regarding the system ownership for IT systems funded by policy DGs (to be reviewed and updated where needed).

PART 2: Follow-up engagements (summarised)

1.Follow-up audit in DG BUDG on the effectiveness and efficiency of the new early detection and exclusion system in protecting the EU financial interests in DG BUDG, DG INTPA, DG REGIO and DG RTD (2 follow-ups performed in 2020)

Based on the results of the two follow-up audits, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1 (very important): guidelines and awareness raising

Recommendation No 7 (very important): applying early detection and exclusion system in practice

2.Follow-up audit in DG CLIMA on the LIFE financial instrument: effectiveness and efficiency of the current framework in DG CLIMA and DG ENV

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1 (important): functioning of the steering committee

Recommendation No 2 (important): financial and performance monitoring

Recommendation No 3 (very important): visibility and promotion of the EU contribution

3.Follow-up audit in DG EMPL on monitoring the implementation and performance of 2014-2020 operational programmes in DG EMPL, DG MARE and DG REGIO

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1 (very important): assessing programme performance, identifying and following up on implementation weaknesses

Recommendation No 3 (important): reporting on implementation

4.Follow-up audit in DG ENV on the LIFE financial instrument: effectiveness and efficiency of the current framework in DG CLIMA and DG ENV

The following recommendation was assessed as not fully and/or adequately implemented:

Recommendation No 3 (very important): visibility and promotion of the EU contribution

DG ENV developed and approved a ‘Communication and Engagement Plan’ for the Natural Capital Financing Facility (NCFF). The plan was approved by the NCFF steering committee. However, to date, DG ENV has not been able to provide evidence that the ‘Communication and Engagement Plan’ is functioning as intended. Therefore, the recommendation cannot be closed.

However, the IAS acknowledged that in the light of the Covid-19 crisis, there is considerable uncertainty as regards to when any new LIFE operations linked to the NCFF will be signed. When coupled with the fact that the ‘Communication and Engagement Plan’ has been developed and approved, if not yet fully implemented in practice, the IAS considered that the residual risks have been sufficiently reduced for the recommendation to be downgraded from ‘very important’ to ‘important’.

5.Follow-up audit in DG ESTAT on the production process and the quality of statistics not produced by Eurostat (DG ENER, DG ESTAT, DG FISMA, DG GROW and DG JUST)

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1 (very important): framework for statistical production in the Commission and Eurostat’s coordination role in the development and production of statistics by other Commission services

Recommendation No 2 (very important): completion of the statistical inventory and masterplan

6.Follow-up audit in DG GROW on the production process and the quality of statistics not produced by Eurostat (DG ENER, DG ESTAT, DG FISMA, DG GROW and DG JUST)

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1 (important): completion of the statistical inventory and masterplan

Recommendation No 3 (important): methodological and quality framework for the statistics produced or acquired internally

Recommendation No 4 (important): referencing and use of disclaimer when publishing statistics

7.Follow-up audit in DG HOME on human resources management and staff allocation in DG HOME and DG JUST

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1 (very important): DG HOME’s strategic approach to human resources management

Recommendation No 3 (important): increasing staff performance through measures of sustainable management

The following recommendation was assessed as not fully and/or adequately implemented:

Recommendation No 2 (very important): allocation of human resources

DG HOME dedicated a section of its strategy on how to match human resources to needs. The strategy recognises the need for an allocation mechanism based on factual data and follows the corporate guidelines and procedures for identifying human resources needs on an annual basis. DG HOME complemented the corporate procedures with its own internal procedures to allow for an ongoing identification and monitoring of human resources needs, linked to political priorities. It has also developed a template for unit management plans, but it is not yet used. Nor has DG HOME provided evidence of the use of objective criteria to support human resource decisions. However, the IAS considered that the residual risk has been partly mitigated and downgraded the rating of the recommendation from ‘very important’ to ‘important’.

8.Follow-up audit in DG HR on the effectiveness of the management of absenteeism in OIB, OIL and PMO

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1 (very important): measurement, analysis and reporting on sickness absence level in the Commission

Recommendation No 2 (very important): identification of the reference sickness absence rate at Commission level

9.Follow-up audit in DG INTPA on the effectiveness and efficiency of the new early detection and exclusion system in protecting the EU financial interests in DG BUDG, DG INTPA, DG REGIO and DG RTD

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 2 (very important): guidelines and awareness raising

The following recommendation was assessed as not fully and/or adequately implemented:

Recommendation No 5 (very important): applying the early detection and exclusion system in practice

The IAS acknowledged the progress being made in applying the early detection and exclusion system in practice, but notes that further actions are still needed to strengthen the monitoring of OLAF cases, in particular by updating its internal procedures and guidelines. However, in view of the progress made overall, the IAS considered that the residual risks have been reduced. Consequently, the rating of this recommendation was downgraded from ‘very important’ to ‘important’.

10.Follow-up audit in DG JUST on the production process and the quality of statistics not produced by Eurostat in DG ENER, DG ESTAT, DG FISMA, DG GROW and DG JUST

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1 (important): completion of the statistical inventory and masterplan

Recommendation No 4 (important): referencing and use of disclaimer when publishing statistics

11.Follow-up audit in DG JUST on human resources management and staff allocation in DG HOME and DG JUST

The following recommendation was assessed as not fully and/or adequately implemented:

Recommendation No 2 (very important): allocation of human resources

DG JUST follows the corporate guidelines and procedures on the yearly identification of human resources needs, and complemented these procedures with internal ones that allow for ongoing identification and monitoring of human resources needs that are linked to political priorities. To close the gap between human resources needs and available resources, it also introduced new tools and working methods that facilitate staff reallocation, and senior management meet and discuss human resources matters on a weekly-basis. However, DG JUST has not yet defined and used objective criteria to support its analysis of staff needs and related human resources decisions and has only recently started developing a template for unit management plans.

Taking into consideration the actions already implemented, the IAS considered that the residual risk had been partly mitigated and downgraded the recommendation from 'very important' to 'important'.

12.Follow-up audit in JRC on intellectual property rights supporting activities in DG COMM, DG DIGIT, DG GROW, JRC and OP

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 1 (very important): corporate information technology management at the Commission

13.Follow-up audit in DG MARE on monitoring the implementation and performance of 2014-2020 operational programmes in DG EMPL, DG MARE and DG REGIO

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 1 (very important): assessing programme performance, identifying and following up on implementation weaknesses

14.Follow-up audit in OIL on the effectiveness of the management of absenteeism in OIB, OIL and PMO

The following recommendation was assessed as not fully and/or adequately implemented:

Recommendation No 1 (very important): in-depth analysis of absences at office level

The IAS acknowledged that overall, there has been some progress in the analysis of sickness absences in the Office. However, a more comprehensive analysis is needed at Office level to identify the root-causes of the higher absence rates in certain staff categories, in order to define the adequate measures (at local or corporate level) with the objective of reducing those rates. Therefore, although the risks identified during the audit on the management of sickness absences have not been fully mitigated, the IAS considered that the actions implemented so far have reduced the residual risk. Consequently, the recommendation was downgraded from ‘very important’ to ‘important’.

15.Follow-up audit in OP on intellectual property rights supporting activities in JRC, DG COMM, DG GROW, DIGIT and OP

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 1 (important): intellectual property rights management for EU-publications

16.Follow-up audit in PMO on the effectiveness of the management of absenteeism in OIB, OIL and PMO

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 2 (important): sickness absence management by line managers

The following recommendation was assessed as not fully and/or adequately implemented:

Recommendation No 1 (very important): monitoring and analysis of absences at office level

The IAS acknowledged that overall, there has been some progress in the analysis of sickness absences in the Office. However, a more comprehensive analysis is needed at Office level to identify the root-causes of the higher absence rates in certain staff categories, in order to define the adequate measures (at local or corporate level) with the objective of reducing those rates. Therefore, although the risks identified during the audit on the management of sickness absences had not been fully mitigated, the IAS considered that the actions implemented so far have reduced the residual risk. Consequently, the recommendation was downgraded from ‘very important’ to ‘important’.

17.Follow-up audit in DG REGIO on monitoring the implementation and performance of 2014-2020 operational programmes in DG EMPL, DG MARE and DG REGIO

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1 (very important): assessing programme performance, identifying and following up on implementation weaknesses

Recommendation No 3 (important): reporting on implementation

18.Follow-up audit in DG REGIO on the effectiveness and efficiency of the new early detection and exclusion system in protecting the EU financial interests in DG BUDG, DG INTPA, DG REGIO and DG RTD

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 4 (very important): guidelines and awareness raising

19.Follow-up audit in DG RTD on the effectiveness and efficiency of the new early detection and exclusion system in protecting the EU financial interests in DG BUDG, DG INTPA, DG REGIO and RTD

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 3 (very important): guidelines and awareness raising

Recommendation No 6 (very important): applying early detection and exclusion system in practice

20.Follow-up audit on the monitoring and enforcement of EU health law in DG SANTE

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 1 (important): compliance assessments

21.Follow-up audit on the management of the employment and social innovation programme (EaSI) with special emphasis on PROGRESS axis in DG EMPL (2 follow-up audits performed in 2020)

Based on the results of the 2 follow-up audits, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1 (important): budgeting and call implementation

Recommendation No 3 (important): call management and timeliness of the grant procedures

22.Follow-up audit on ex ante controls on Horizon 2020 grant payments in DG CNECT

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 1 (important): functioning of ex ante controls

23.Follow-up audit on human resources management – recruitment of temporary scientific staff in JRC

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 1 (very important): recruitment strategy

The following recommendation was assessed as not fully and/or adequately implemented:

Recommendation No 2 (very important): monitoring the recruitment process

The IAS considered that sub-action 2.4 of the action plan is not fully implemented. In particular, a reporting tool has not yet been chosen, the frequency of monitoring of the indicators has not been established and the periodical reporting to senior management has not been put in place. The periodical reassessment of the adequacy of the targets set for each indicator has also not been done yet.

However, as the other main parts of the recommendation have been implemented and thus the residual risk has decreased, the recommendation was downgraded from ‘very important’ to ‘important’.

24.Follow-up audit on verification plans in DG INTPA (2 follow-up audits performed in 2020)

Based on the results of the two follow-up audits, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 2 (important): control framework - guidance

Recommendation No 3 (important): control framework - training

Recommendation No 4 (important): risk assessment in EU delegations – risk assessment process

Recommendation No 8 (important): planning phase – assessment of contracts excluded from planning

Recommendation No 9 (very important): key performance indicators and targets

Recommendation No 10 (very important): monitoring mechanism on the implementation of audits in the audit and verification plan

25.Follow-up audit on common foreign and security policy in FPI

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 1 (very important): closure of mandates of common security and defence policy missions

26.Follow-up audit on partnership instrument in FPI

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 2 (very important): implementation of partnership instruments projects: control environment and headquarters supervision

27.Follow-up audit on the Neighbourhood Investment Facility (NIF) and the Western Balkans investment framework (WBIF) in DG NEAR (2 follow-up audits performed in 2020)

Based on the results of the two follow-up audits, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1 (important): NIF: pre-contract signature phase

Recommendation No 2 (important): NIF: monitoring of project implementation

Recommendation No 4 (very important): NIF: Commission monitoring and reporting (at facility level)

The following recommendations were assessed as not fully and/or adequately implemented:

Recommendation No 3 (very important): NIF: financial management

Sub-recommendation 3e) is assessed as not implemented because the guidelines to assess the periodic financial and operational reports from the blending projects on an annual basis and where possible clear the related pre-financing are currently being revised and the updated instructions have not yet been issued. Considering the significant progress made in implementation, this recommendation was downgraded from ‘very important’ to ‘important’.

Recommendation No 5 (important): WBIF: screening, assessment and approval of grants

The IAS assessed some remaining sub-recommendations as not fully implemented because DG NEAR had not yet updated the relevant documents and procedures. This concerns, in particular, the grant application form template (5b), the screening checklist (5c), and the guidelines on follow-up of assessors’ comments (5f).

Recommendation No 6 (important): WBIF: EWBJF project reporting

The IAS assessed the three sub-recommendations as not fully implemented. In particular, DG NEAR had not finalised the necessary revisions of the rules of procedure (6a) and the template of the progress report (6b). Moreover, it was not possible to assess the implementation of communication and visibility actions as the report summarising the actual actions carried out was not available (6c).

Recommendation No 7 (very important): WBIF: monitoring at the facility level

Sub-recommendation 7e) is assessed as partially implemented by the IAS because the 2018 versions of the management declarations are in compliance with the contractual arrangements, however, the 2019 Annual Activity Report does not mention the scope of the management declarations.

Sub-recommendations 7a) and 7b) are assessed not implemented by the IAS because the revision of the WBIF architecture and relating rules of procedure had not taken place as DG NEAR is waiting for the next multi-annual financial framework to be adopted.

Recommendation No 8 (very important): WBIF: financial management and financial reporting

The IAS assessed that all five parts of the recommendation have not been fully implemented. In particular, DG NEAR has not finalised the necessary revisions of the guidelines on the preparation of the grant application form (8a), has not yet ensured adequate disbursement forecasts for the WB-EDIF equity funds (8b), has not yet revised the general conditions linked to the calculation of the fees (8c), has not yet finalised an agreement with the EBRD to provide regular financial information (8d), and is still in the process of analysing all open pre-financing and perform the clearing (8e).

28.Follow-up audit on DG HOME’s audit activity and clearance of accounts

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 3 (very important): clearance of accounts

29.Follow-up audit on procurement in DG JUST

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 2 (important): implementation of procurement procedures

Recommendation No 3 (important): supervision of the procurement process 7

Recommendation No 4 (important): implementation of the anti-fraud strategy

The following recommendation was assessed as not fully and/or adequately implemented:

Recommendation No 1 (very important): preparation of procurement procedures

As per the action plan, DG JUST put in place a template for an ‘orientation document’. This document sets out certain key information on procurement activities, and policy units are requested to fill it in before the start of each procurement activity. This includes the nature of the activity, justification of the outsourcing option where relevant, and links the activity to the annual work programme. For all the procurement activities sampled by the IAS, the policy units responsible had adequately completed the orientation documents which were also signed off by the respective Heads of Unit.

The Directorate-General has taken a number of steps to ensure that a needs analysis is properly documented in preparation of the launch of procurement procedures. It has put in place a document that lists planned procurement activities as part of the preparation for the 2019 annual work programme. However, it has yet to sufficiently develop all the necessary elements of the needs analysis. The needs analysis document sets out a description of the activity and the planned amount. For the 2019 annual work programme, this includes the justification and timing of the procedure in the comments section for some, but not all cases. For the 2020 needs analysis document, there is a dedicated column for the justification and the timing of the procedure. However, in both years, the basis on which the planned amounts have been decided on is not consistently reflected. Furthermore, for both 2019 and 2020 annual work programmes, there was no sign-off/approval by the authorising officer.

Nevertheless, although the risks identified during the audit have not been fully mitigated, the IAS considered that the actions implemented so far have reduced the residual risk and downgraded recommendation No 1 from ‘very important’ to ‘important’.

30.Follow-up audit on anti-fraud information system in OLAF

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 7 (important): anti-fraud information system multiannual strategy

31.Follow-up audit on supervision of outsourced IT operations in TAXUD

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 2 (important): contract performance measurement and reporting

The following recommendation was assessed as not fully and/or adequately implemented:

Recommendation No 4 (important): configuration management

The IAS noted that DG TAXUD has configured all configuration items in the service management tool (SMT). However, a number of actions have yet to be fully implemented:

- The release of version No 9.62 of SMT allows access to documentary artefacts (e.g. methodology, policies, procedures, manuals, etc.) related to configuration items and processes in the configuration management database. However, DG TAXUD has yet to do this in practice.

- DG TAXUD has decided to use template reports to identify reference and/or baseline configurations of configuration items, since the functionality of the service management tool does not enable it to integrate them in a way that suits its needs. However, DG TAXUD has not yet been using these template reports.

- The integration of procurement and assets inventory processes is not yet ensured. To achieve this, an asset management tool still needs to be implemented, enabling contractors to access data from the configuration management database.

32.Follow-up audit on the procurement process in DIGIT

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 3 (important): sensitive functions and follow-up of the ABAC access rights review

The following recommendation was assessed as not fully and/or adequately implemented:

Recommendation No 1 (important): ex ante controls

While the IAS acknowledged that DIGIT re-engineered some financial workflows, including optimisation measures, these actions did not address the aspects recommended by the IAS. In particular, no risk criteria (or thresholds) were established to delegate powers to authorising officers by sub-delegation and the data provided by DIGIT showed that the authorisation of payments was not spread evenly among the authorising officers by sub-delegation during the last two years (2018 and 2019). Furthermore, DIGIT did not update the ex ante control checklists for payments to reflect the controls actually carried out. Therefore, the IAS considered that the risks identified in the original audit have not been adequately addressed and consequently sub-recommendation 1.1 (design of the internal control system) has not been implemented.

While DIGIT performed ex ante price checks as a user of the Natacha III framework contract, it did not advise the other users of the framework contract to perform those ex ante checks. To facilitate a consistent application of ex ante price checks by all users and address the risk of erroneous price conditions not being detected, DIGIT proposes to develop guidance on ‘price checks’ to be carried out by each user for the new Natacha IV framework contract (expected to be signed in May 2021). Therefore, the IAS considered that sub-recommendation 1.2 (application of ex ante controls for the framework contract ‘Natacha III’) has not been implemented. The IAS welcomed the proposal of DIGIT, as technical manager of the contract, to develop the above guidance on ex ante checks for a consistent application of price checks across users.

33.Follow-up audit on Eurostat’s quality management of statistical processes

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 1 (very important): design and implementation of quality reviews.

34.Follow-up audit on effectiveness of Eurostat’s cooperation with external stakeholders

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 2 (important): roles and responsibilities and information sharing.

35.Follow-up audit on management of information technology security in DG DIGIT

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 3 (important): security logs for suspicious activity detection

Recommendation No 4 (important): exception management of security vulnerability corrections

The following recommendation was assessed as not fully and/or adequately implemented:

Recommendation No 1 (very important): assurance on the legitimacy of actions performed in production systems

DG DIGIT has performed an exercise to identify and publish good practices in the organisation for identifying and assessing the legitimacy of activities and the integrity of configurations in the production systems. In addition, several solutions have been implemented to keep track of legitimate changes in the different types of systems (end user devices, servers and network). DG DIGIT also made available specific environments for special needs, such as developers who are granted sufficient privileges to perform normal functions, but with a reduced risk of potentially compromising production systems. Certain actions related to the management of baseline configurations still need to be fully implemented. However, in view of the progress made, the IAS considered that the residual risks have been reduced and downgraded the rating from ‘very important’ to ‘important’.

36.Follow-up audit on information technology governance in DG INTPA

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 1 (very important): information technology governance framework

The following recommendation was assessed as not fully and/or adequately implemented:

Recommendation No 4 (important): business process governance

DG INTPA’s revised information technology governance framework includes a new governance body in the form of a Business Processes Governance Board, mandated by the DG INTPA’s Information Technology Board to ensure that business processes are documented, harmonised, optimised and continuously improved. DG INTPA appointed external experts to help with this new governance structure, based on a phased approach and encompassing five ‘work packages’. Although the Information Technology Board approved the activation of the Business Processes Governance Board, which will commence its work in the first quarter of 2021, the IAS considered that the Directorate-General has yet to fully implement the underlying enterprise architecture and business governance framework in practice. The workflow to establish an effective and efficient liaison between process owners and the various information technology system suppliers and service providers still needs to be implemented. Similarly, the framework (mandate, roles, responsibilities, resources) needed to document and manage business processes appropriately also needs to be implemented. This is essential to have changes in business processes properly integrated in the information technology tools.

37.Follow-up audit on information technology security management in DG RTD (2 follow-up audits performed in 2020)

Based on the results of the two follow-up audits, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1 (important): traceability of administrator accounts activities

Recommendation No 2 (important): security event logging and monitoring

Recommendation No 3 (important): security analysis and testing activities in the change and project management

Recommendation No 5 (important): regular review of security measures

List of audits for which all recommendations have been closed in 2020 after a follow-up audit

Based on the results of the follow-up audits performed in 2020, the IAS assessed that the following audits listed below could be fully closed as all the recommendations had been implemented.

Audit Title

38, 39 and 40. Audit on the processes for managing and sharing data on agri-environmental-climate issues in DG AGRI, DG CLIMA and DG ENV

41. Limited review on the reporting on the corrective capacity (DG AGRI, DG BUDG, DG EMPL, DG INTPA, DG REGIO, DG RTD and EASME)

42 and 43. Audit on the management of intra-muros contractors (DG BUDG, DG COMM, DG DIGIT, DG HR, JRC)

44 and 45. Audit on synergies and efficiencies review (DG BUDG, DG COMM, DG DIGIT, DG HR, DG SCIC, SG, OIB)

46. Audit on management of recovery orders for competition fines (incl. guarantees for competition fines) and for recovery orders in the context of the Commission’s ‘corrective capacity’ – phase 1 (DG CNECT, DG ENER, SJ, EACEA)

47, 48 and 49. Audit on the effectiveness of simplification measures under the 2014-2020 European structural and investment funds in DG EMPL, DG MARE and DG REGIO

50, 51, 52, 53, 54 and 55. Audit on the review of the annual assurance packages in DG EMPL, DG MARE and DG REGIO

56 and 57. Audit on early implementation of European structural and investment funds control strategy in DG EMPL and DG REGIO

58. Audit on the evaluation process in DG EMPL and DG REGIO

59. Audit on the coordination and working arrangements with European Union regulatory agencies and bodies in DG HOME and DG SANTE

60, 61 and 62. Audit on the management of the fruit and vegetables regime in DG AGRI

63. Audit on the control strategy for the common agricultural policy 2014-2020 in DG AGRI

64. Audit on the management of IPARD II in DG AGRI

65. Limited review of the management of State aid in the field of agriculture in DG AGRI

66. Audit on the approval process of the 2014-2020 rural development plans in DG AGRI

67. Audit on the implementation of payments and corrections in DG AGRI

68. and 69. Audit on major projects in DG REGIO

70. Audit on Horizon 2020 grant management in ERCEA – phase 2

71. Audit on competitive activities in JRC

72. Audit on Horizon 2020 grant management in REA - phase 2 project monitoring and ex ante controls

73. Audit on the implementation of the FP7 ex post audit strategy by the Common Audit Service in DG RTD 8

74. Audit on the assurance building process in DG INTPA headquarters

75. and 76. Audit on Erasmus+ and Creative Europe grant management in EACEA - phase 2 from project monitoring to payment

77. Audit on evaluation in DG ECFIN

78. Audit on the preparation of legislative initiatives by DG TAXUD

79. Audit on financial management of procurement contracts and grants in DG TRADE

80. Audit on internal processes supporting trade policy negotiations in DG TRADE

81. Audit on the procurement process in DG COMM

82. Limited review of the effective implementation of the new internal control framework in DG COMM

83. Limited review of the effective implementation of the new internal control framework in DGT

84. Limited review of the effective implementation of the new internal control framework in EPSO

85. Audit on the support by Eurostat to the Europe 2020 strategy and the new Commission priorities

86. Audit in PMO on the governance, planning, monitoring and implementation of the budget line of OLAF Supervisory Committee

87. Audit on ethics in OLAF

88. Limited review of the effective implementation of the new internal control framework in OIB

89. and 90. Limited review of the effective implementation of the new internal control framework in OIL

91. Limited review of the effective implementation of the new internal control framework in SCIC

92. Audit on management of European Commission Authentication Service in DG DIGIT

93. Audit on information technology governance and portfolio management in DG GROW

94. Audit on information technology security management in DG GROW

95. Audit on information technology security in JRC information and communication technology systems

96. Audit on information technology project management practices in OLAF

97. Audit on human resources information technology corporate application – nouvelle application de paie (NAP) in PMO

Part 3: summary of long-outstanding recommendations – state of play as at 31 January 2021

No.	DG	Audit title	Recommendation	Comments	Final report date	Original agreed completion date	Revised expected completion date
I	NEAR	Neighbourhood Investment Facility & Western Balkans Investment Facility in DG NEAR	WBIF: Financial management and financial reporting	DG NEAR marked the recommendation as ‘ready for review’ on 26 June 2020. A follow-up conducted by the IAS in July 2020 assessed all sub-recommendations as not implemented. As a result, the IAS re-opened the recommendation and encouraged DG NEAR to implement the agreed action plan as soon as possible. The IAS will perform a second follow-up once DG NEAR reports this recommendation as ‘ready for review’. Expected delay between the originally agreed and revised expected completion dates is 12 months.	21.12.2018	30.6.2020	30.6.2021
II	SANTE	Efficiency and effectiveness of the Health and Food audits and analysis service	Staffing of activities	The IAS recommended that DG SANTE assesses the impact of the remote location (Grange, Ireland) and the recruitment needs of its Health and Food Audits and Analysis Directorate and develops an HR strategy in relation to it. The DG reported that the implementation of the recommendation is delayed due the COVID-19 pandemic and the Commission’s new corporate HR strategy. Expected delay between the originally agreed and revised expected completion dates is 2 years and 6 months.	24.10.2019	30.6.2020	31.12.2022
III	SANTE	Efficiency and effectiveness of the Health and Food audits and analysis service	Time reporting and performance monitoring	The IAS recommended that DG SANTE should assess the scope for introducing a time recording system in the Audit and Analysis Directorate, collect and analyse performance information and finalise the development of the coverage of its audit universe. The DG reported that the implementation of the recommendation is delayed due the COVID-19 pandemic. Expected delay between the originally agreed and revised expected completion dates is 18 months.	24.10.2019	30.6.2020	31.12.2021
IV	NEAR	Neighbourhood Investment Facility & Western Balkans Investment Facility in DG NEAR	WBIF: Monitoring at the facility level	DG NEAR marked the recommendation as ‘ready for review’ on 31 March 2020. A follow-up conducted by the IAS in July 2020 assessed sub-recommendations 7c) and 7d) as implemented, 7e) as partially implemented and 7a) and 7b) as not implemented. As a result, the IAS re-opened the recommendation and encouraged DG NEAR to implement the agreed action plan as soon as possible. The IAS will perform a second follow-up once DG NEAR reports this recommendation as ‘ready for review’. Expected delay between the originally agreed and revised expected completion dates is 15 months.	21.12.2018	30.3.2020	30.6.2021
V	OIB	Procurement process in OIB, OIL and DG BUDG	Procurement procedures	OIB prepared a working document including a proposal to revise substantially the current real estate procedure (‘Kallas procedure’) and submitted it at the end of September 2018 to the working group that was set up to prepare the revision of the procedure to align it with the Financial Regulation. Technical meetings took place with DG HR which submitted the revised new Kallas methodology to OIB in September 2020. The next steps are the consultation of the Legal Service and DG BUDG, and the launch of the inter-service consultation by DG HR for final approval. The further delay is due to the COVID-19 pandemic situation and the necessary changes in the Commission’s real estate strategy. A follow-up will take place in the second half of 2021 as soon as OIB reports the recommendation as ‘ready for review’. Expected delay between the originally agreed and revised expected completion dates is 3 years and 9 months.	20.1.2017	22.12.2017	30.9.2021
VI	PMO	Charge-back in PMO	Service-level agreements (SLAs)	In its first follow-up in September 2019, the IAS found that, while PMO had made significant progress, it had not yet implemented important parts of the recommendation. In particular, it had not fully completed the revision of all existing SLAs with external clients. Discussions with the parties concerned are still ongoing. The further delay is due to the COVID-19 pandemic situation and some specific issues still under discussion with certain European Institutions. The IAS will perform a second follow-up in the second half of 2021, once PMO management reports this recommendation as ‘ready for review’. Expected delay between the originally agreed and revised expected completion dates is 2 years and 11 months.	19.1.2017	31.3.2018	26.2.2021

Choose the experimental features you want to try