EUROPEAN COMMISSION

Brussels, 20.6.2023

SWD(2023) 214 final

COMMISSION STAFF WORKING DOCUMENT

Accompanying the document

REPORT FROM THE COMMISSION

TO THE EUROPEAN PARLIAMENT, THE COUNCIL AND THE COURT OF AUDITORS

Annual report to the Discharge Authority on internal audits carried out in 2022

{COM(2023) 323 final}

Contents

Context of this annex    

Part 1 Final reports    

Multi-entity and horizontal audits    

1.1. Audit on the cooperation and coordination mechanisms between the ETF and the EC services (DG EAC, DG EMPL, DG INTPA, DG NEAR, ETF)    

1.2. Audit on implementation of bilateral trade agreements (DG AGRI, DG ENV, DG TRADE)    

1.3. Audit on European Commission actions against food fraud (DG AGRI, DG SANTE, OLAF)    

1.4. Audit on the Commission’s control system in relation to the reliability of performance information on EU financial programmes (DG BUDG, SG)    

1.5. Audit on performance framework for research (CINEA, DG CLIMA, DG ENER, DG MOVE, DG RTD, JRC())    

1.6. Limited review on the reporting of the Commission’s preventive and corrective measures (‘corrective capacity’) (DG AGRI, DG BUDG, DG EMPL, DG INTPA, DG REGIO, DG RTD, REA)    

1.7. Audit on physical security of persons and assets in the Commission (DG COMM, DG DIGIT, DG HR, OIB, OIL)        

1.8. Audit on the protection of personal data under the responsibility of EACEA, EISMEA, CINEA, REA, ERCEA and the CIC (CINEA, DG RTD, EACEA, EISMEA, ERCEA, REA)    

1.9. Audit on programme implementation – phase 1 (from work programme to call evaluation and grant preparation) of the Connecting Europe Facility (CINEA, DG ENER, DG MOVE)    

1.10. Audit on the design and early implementation of European Innovation Council (DG CNECT, DG RTD, EISMEA)        

1.11. Limited review of the Recovery and Resilience Facility control and audit strategies in DG ECFIN    

1.12. Audit on the effectiveness and efficiency of Eurostat’s performance management system    

1.13. Audit on studies used for policy making in DG MOVE    

1.14. Limited review on the implementation of the action plans for the reduction of the Horizon 2020 error rate and for simplifications to reduce the Horizon Europe error rate in DG RTD    

1.15. Audit on performance management in DG TAXUD    

1.16. Limited review of the internal control framework in DG TAXUD    

Cohesion, Resilience and Values    

1.17. Audit on the preparedness of DG EAC’s management and control systems for the implementation of the 2021-2027 Erasmus+ programme    

Natural Resources and Environment    

1.18. Audit on DG AGRI’s management of the wine market    

1.19. Gap analysis review of the new Common Agricultural Policy 2023-2027 in DG AGRI    

1.20. Audit on the cooperation between EFCA and DG MARE on activities related to Article 30 of the Common Fisheries Policy (DG MARE, EFCA)    

Security and Defence    

1.21. Preparedness of DG DEFIS for the management of the European Defence Fund    

Neighbourhood and the World    

1.22. Audit on control strategy for grant management under the Union Civil Protection Mechanism in DG ECHO        

1.23. Audit on contractual expenditure verifications (FPI, DG INTPA, DG NEAR)    

1.24. Audit on External Investment Plan – European Fund for Sustainable Development Guarantee (DG INTPA, DG NEAR)    

European Public Administration    

1.25. Audit on public procurement in DG DIGIT    

1.26. Audit on human resources management in DG ECFIN    

Information technology audits    

1.27. Audit on progress in the implementation of the European Commission digital strategy in DG DIGIT    

1.28. Audit on IT governance and management (DG HOME, DG JUST)    

1.29. Audit on information technology governance and project management (including software development) in the SG    

1.30. Audit on information technology application project management in DG TAXUD    

Part 2 Follow-up engagements    

2.1. Follow-up audit in DG BUDG on the management of recovery orders for competition fines (including guarantees for competition fines) and for recovery orders in the context of the Commission's 'corrective capacity' – Phase II (based on two follow-up audits performed in 2022)    

2.2. Follow-up audit in DG DEFIS on the supervision of the implementation of the 2014-2020 programme for the European Geostationary Navigation Overlay Service (EGNOS)    

2.3. Follow-up audit in DG DIGIT on the management of public cloud services (multi-DG)    

2.4. Follow-up audit in DG DIGIT on intellectual property rights supporting activities    

2.5. Follow-up audit in DG EAC on information technology governance and project management    

2.6. Follow-up audit in DG EAC on the effectiveness of the protection of personal data of beneficiaries of and participants in the Erasmus+ and European Solidarity Corps programmes (based on two follow-up audits performed in 2022)    

2.7. Follow-up of outstanding recommendations from past audits in DG ECHO    

2.8. Follow-up of outstanding recommendations from past audits in the FPI    

2.9. Follow-up of outstanding recommendations from past audits in DG HOME (based on two follow-up audits performed in 2022)    

2.10. Follow-up audit in DG INTPA on pillar assessment    

2.11. Follow-up audit in the JRC on information technology governance and project management    

2.12. Follow-up audit in DG NEAR on annual audit plans    

2.13. Follow-up audit in DG NEAR on the Neighbourhood Investment Facility and the Western Balkans Investment Framework    

2.14. Follow-up audit in the OIB on the procurement process    

2.15. Follow-up audit in OLAF on the human resources strategy    

2.16. Follow-up audit in OLAF on performance management    

2.17. Follow-up audit in DG REFORM on the processes put in place for the delivery of technical support to Member States    

2.18. Follow-up audit in DG RTD on IT project management and software development    

2.19. Follow-up audit in the SG on the Commission’s strategy for data, information and knowledge management (based on three follow-up audits performed in 2022)    

2.20. Follow-up audit in the SG on crisis communication in DG COMM, the SG, DG SANTE and DG ECHO    

2.21. Follow-up audit in DG TAXUD on human resource management    

2.22. Follow-up audit in DG TAXUD on the effectiveness of Directorate General for Taxation and Customs Union’s cooperation with external stakeholders    

List of audits for which all recommendations were closed in 2022    

Part 3 - Summary of long overdue recommendations    

List of abbreviations

CIC: Common Implementation Centre

CINEA: European Climate, Infrastructure and Environment Executive Agency

DG AGRI: Directorate-General for Agriculture and Rural Development

DG BUDG: Directorate-General for Budget

DG CLIMA: Directorate-General for Climate Action

DG CNECT: Directorate-General for Communications Networks, Content and Technology

DG COMM: Directorate-General for Communication

DG COMP: Directorate-General for Competition

DG DEFIS: Directorate-General for Defence Industry and Space
DG DIGIT: Directorate-General for Informatics

DG EAC: Directorate-General for Education, Youth, Sport and Culture

DG ECFIN: Directorate-General for Economic and Financial Affairs

DG ECHO: Directorate-General for European Civil Protection and Humanitarian Aid Operations

DG EMPL: Directorate-General for Employment, Social Affairs and Inclusion

DG ENER: Directorate-General for Energy

DG ENV: Directorate-General for Environment

DG ESTAT: Eurostat

DG FISMA: Directorate-General for Financial Stability, Financial Services and Capital Markets Union

DG HOME: Directorate-General for Migration and Home Affairs

DG HR: Directorate-General for Human Resources and Security

DG INTPA: Directorate-General for International Partnerships

DG JUST: Directorate-General for Justice and Consumers

DG MARE: Directorate-General for Maritime Affairs and Fisheries

DG MOVE: Directorate-General for Mobility and Transport

DG NEAR: Directorate-General for Neighbourhood and Enlargement Negotiations

DG REFORM: Directorate-General for Structural Reform Support

DG REGIO: Directorate-General for Regional and Urban Policy

DG RTD: Directorate-General for Research and Innovation

DG SANTE: Directorate-General for Health and Food Safety

DG TAXUD: Directorate-General for Taxation and Customs Union

DG TRADE: Directorate-General for Trade

EACEA: Education and Culture Executive Agency

EISMEA: European Innovation Council and Small and Medium-sized Enterprises Executive Agency

EFCA: European Fisheries Control Agency

ERCEA: European Research Council Executive Agency

ETF: European Training Foundation

FPI: Service for Foreign Policy Instruments

IAS: Internal Audit Service

INEA: Innovation and Networks Executive Agency ( 1 )

IT: Information technology

JRC: Joint Research Centre

LS: Legal Service

OIB: Office for Infrastructure and Logistics in Brussels

OIL: Office for Infrastructure and Logistics in Luxembourg

OLAF: European Anti-Fraud Office

OP: Publications Office of the European Union

PMO: Office for the Administration and Payment of Individual Entitlements

REA: Research Executive Agency

SG: Secretariat-General

Context of this annex

Part 1 of this annex contains:

•a summary of the 30 finalised internal audit engagements performed as part of the 2022 Internal Audit Service (IAS) audit plan (audits whose reports were issued between 1 February 2022 and 31 January 2023),

•the main recommendations (critical and very important ( 2 )) stemming from these engagements,

•information provided by the Directorates-General/services on the actions defined and/or implemented to address the IAS audit recommendations.

Each audit followed the applicable standard professional validation and contradictory procedures between auditor and auditee at the time of the finalisation of the engagement. The summary of each engagement aims at providing an overview of the audits and their main results.

Part 2 of this annex includes a summary of the results of the IAS follow-up engagements performed between 1 February 2022 and 31 January 2023 ( 3 ), including a list of audit engagements for which all recommendations were assessed as implemented following a follow-up audit by the IAS.

Part 3 provides an overview of the three long overdue very important recommendations as at 31 January 2023.

Part 1 
Final reports

Multi-entity and horizontal audits

0.0.Audit on the cooperation and coordination mechanisms between the ETF and the EC services (DG EAC, DG EMPL, DG INTPA, DG NEAR, ETF)

The objective of the audit was to assess the adequacy of the design and the effectiveness of the management and control systems put in place by the ETF and the European Commission services to ensure a successful cooperation and coordination between them.

There were no reservations in the 2021 Annual Activity Reports of DGs EMPL, NEAR, INTPA and EAC that relate to the audited area.

The fieldwork was finalised on 19 September 2021. All observations and recommendations relate to the situation as of that date.

The IAS recognised the ongoing efforts made by the ETF and the EC services to coordinate. The IAS identified the following strength and good practice in this area: to ensure better coordination for the preparation of Governing Board (GB) meetings, the ETF together with the European Commission services set up a bi-annual Structured Dialogue.

The IAS identified one very important issue concerning ETF’S mandate and formulated one very important recommendation.

·ETF’S mandate (addressed to DG EMPL)

DG EMPL, assisted by the ETF and in coordination with DG NEAR and DG INTPA, should clarify the ETF mandate, with respect to the countries that are eligible under Article 1b following the entry into force of the Neighbourhood, Development, and International Cooperation – Global Europe instrument. It should also regularly monitor any changes to the instruments referred to in the ETF mandate and clarify the implications for its activities. Finally, it should clarify the ETF mandate, with respect to the countries that fall under the remit of Article 1c and designate these countries through a formal decision of the Governing Board in compliance with the requirements of this Article.

0.1.Audit on implementation of bilateral trade agreements (DG AGRI, DG ENV, DG TRADE)

The overall objective of the audit was to assess whether DG TRADE, DG AGRI and DG ENV have established adequate processes and tools for an efficient and effective implementation of EU bilateral trade agreements in line with their policy objectives.

There were no reservations in the 2021 annual activity reports of the audited Directorates-General that relate to the audited area.

The fieldwork was finalised on 12 December 2022. All observations and recommendations relate to the situation as of that date.

The IAS did not formulate any critical or very important recommendations for DG AGRI and DG ENV.

The IAS recognised a number of strengths in DG TRADE, as it:

-created the position of the Chief Trade Enforcement Officer,

-established a single-entry point for complaints,

-put at the stakeholders’ disposal useful IT tools (Access2Markets, ROSA) facilitating access to information about trading with third countries and organised outreach events to promote the use of these tools,

-coordinates its work on trade barriers with the EU Member States at headquarters- and EU delegation-level via the three Market Access Partnership platforms (Market Access Advisory Committee, Market Access Working Groups, Market Access Teams),

-improved the coordination on implementation of agreements with other Commission services and within DG TRADE via the interservice working group and internal coordination meetings at various levels,

-made efforts to improve the implementation and enforcement of trade and sustainable development chapters of the bilateral trade agreements. To this end, DG TRADE launched a trade and sustainable development review, the results of which are reflected in the Commission Communication ‘The power of trade partnerships: together for green and just economic growth’ of June 2022 ( 4 ).

The IAS identified two very important issues in DG TRADE concerning: (1) the use of ex post evaluations and supporting studies to improve the implementation of bilateral trade agreements, (2) monitoring of the state of play of existing trade barriers and formulated two very important recommendations.

·Use of ex post evaluations and supporting studies to improve the implementation of bilateral trade agreements

DG TRADE should define more specific criteria for selecting trade agreements for ex post evaluation and formalise the roles of DG TRADE staff and other Directorates-General in the selection process. In addition, DG TRADE should provide guidance on the drafting and implementation of action plans to address the results of the recommendations stemming from external studies and establish a procedure for monitoring the implementation of these action plans. Finally, DG TRADE should adequately disseminate the revised instructions to staff and ensure their systematic implementation.

·Trade barriers

DG TRADE should establish a systemic solution to ensure that identified trade barriers are systematically followed up in view of their removal, and that related information is kept up to date for internal use and for providing correct information to stakeholders.

0.2.Audit on European Commission actions against food fraud (DG AGRI, DG SANTE, OLAF)

The objective of the audit was to assess the adequacy of the design, and the efficiency and effectiveness of the processes put in place by the audited services to prevent and detect food fraud and coordinate actions against food fraud.

There were no reservations in the 2021 annual activity reports of Directorates-General that relate to the audited area.

The fieldwork was finalised on 22 November 2022. All observations and recommendations relate to the situation as of that date.

In line with the administrative arrangements between the Commission and OLAF, the scope of the audit did not cover issues which fall under the OLAF Director-General’s independence of its duties with respect to investigations. The audit work regarding OLAF consisted therefore of a review of documents on a general level without going into the investigative activities and of interviews with relevant staff and, resulted in no finding or recommendation. Given the outcome of the audit, no final report for OLAF was issued.

The IAS recognised the technical expertise of DG AGRI and DG SANTE staff involved in the management of EC actions against food fraud and their strong commitment and dedication to the objectives, despite the high workload and resource constraints.

The IAS identified three very important issues concerning the: (1) allocation of tasks between DG AGRI and DG SANTE as regards organic food products, (2) screening of notifications and monitoring of detected potential issues in Member States control systems, (3) functionalities of the current IT systems, and formulated seven very important recommendations.

·Allocation of tasks between DG AGRI and DG SANTE as regards organic food products (one very important recommendation addressed to DG AGRI)

DG AGRI, in collaboration with DG SANTE, should:

—taking into account the respective roles and responsibilities of DG AGRI and DG SANTE, lay down in writing the agreed allocation of tasks as regards audits on the control systems in organics to ensure sufficient coverage of the risks identified both in Member States and third countries,

—establish a procedure or automated solution for coordinating the screening of notifications and ensuring that notifications are made in both IT systems.

·Screening of notifications and monitoring of detected potential issues in Member States control systems (two very important recommendations addressed to DG AGRI and DG SANTE)

DG AGRI should regularly screen both the intra-EU and third country notifications and systematically document the identification and follow-up of potential organic food fraud cases on a risk basis, based on documented risk criteria. DG AGRI should also establish internal guidelines on how to communicate with Member States in cases of persisting non-compliance with the ‘organics regulation’ (2018/848).

DG SANTE should assess how the current IT tools can be improved or establish controls over the manual overview based on the existing table to ensure its completeness.

·Functionalities of the current IT systems (four very important recommendations addressed to DG AGRI and DG SANTE)

DG AGRI should improve the functionalities in the Organic Farming Information System (OFIS) to reduce the need for manual intervention and improve data quality.

DG SANTE should:

·improve the functionalities in the integrated Rapid Alert System for Food and Feed (iRASFF) by implementing links between the different iRASFF networks,

·implement corrective measures to ensure appropriate user access rights in iRASFF, which should include periodical user access review.

DG AGRI and DG SANTE should:

·explore the possibility to introduce links between OFIS and iRASFF,

·jointly assess the possibility of using artificial intelligence and data mining tools, including required data quality improvements, in the current IT systems.

0.3.Audit on the Commission’s control system in relation to the reliability of performance information on EU financial programmes (DG BUDG, SG)

The objective of the audit was to assess whether there was an adequate control system in place to support the Commission in building assurance on the reliability of performance information on its financial programmes.

There were no reservations in the 2021 Annual Activity Reports of the SG and DG BUDG that relate to the audited area.

The fieldwork was finalised on 16 September 2022. All observations and recommendations relate to the situation as of that date.

The IAS recognised several strengths:

·The performance framework of the EU budget builds on solid foundations, as acknowledged by the Organisation for Economic Co-operation and Development (OECD) which concluded that ‘The EU system of budgeting for performance and results is advanced and highly specified, scoring more highly than any OECD country in the standard index of performance budgeting frameworks. Under the 2021-2027 multi-annual financial framework, the Commission is committed to further develop this framework and to meet new needs in a changing world.

·The importance of reliability of reporting (as a cornerstone in the culture of transparency and accountability for public spending) has been emphasised by the Commission in various internal and external communications. In this context, while the IAS has identified a need to further develop certain aspects of its performance reporting, it noted that the Commission is already taking steps to further increase the quality of its key performance report (Annual Management and Performance Report and its annexes). In addition, the IAS welcomes the multiannual financial framework data quality control framework which has been recently developed, as well as recent or ongoing developments in IT systems which aim to improve storing and sharing performance information both within the Commission and with external stakeholders.

The IAS identified one very important issue concerning control activities and formulated two very important recommendations.

·Control activities (two very important recommendations, addressed to the SG and DG BUDG):

The Secretariat-General and DG BUDG, as corporate services, should:

-further strengthen existing corporate guidance in relation to reliability controls by clarifying (for example in the instructions for the annual activity reports and/or in other forms of guidance) the operational services’ responsibility to report on their reliability controls which support the Statement of the Director(s) in charge of risk management and internal control (RMIC),

-verify, through central quality controls, that the above guidance is adequately implemented by the operational services,

-examine the results of the IAS survey in relation to IT systems and functionalities used for the information management process and assess, in the context of their further development, the improvement needs raised by operational services,

-steer the operational services in order to strengthen (and ensure it is based on common principles) the Commission’s control approach on the reliability of performance information on EU financial programmes. The control approach should adjust the intensity of controls to risks (considering, amongst other factors, the source of performance information). It could consider a system-based approach and a more extensive use of ‘assurance mapping’ (already in place in some DGs), which will allow a structured identification and assessment of sources of assurance and will help further substantiating the statements made by the Directors in charge of RMIC.

0.4.Audit on performance framework for research (CINEA, DG CLIMA, DG ENER, DG MOVE, DG RTD, JRC( 5 ))

The objective of the audit was to assess: (1) the effective implementation of the monitoring and reporting system for the Horizon 2020 performance framework, and (2) the adequacy of the design of the new performance framework for Horizon Europe.

There were no reservations in the 2021 annual activity reports of the audited services that relate to the audited area.

The fieldwork was finalised on 5 December 2022. All observations and recommendations relate to the situation as of that date.

The IAS acknowledged the efforts made by the audited services to ensure an effective implementation of the monitoring and reporting system of Horizon 2020 and an adequate design of the performance framework for Horizon Europe. In particular, the IAS highlighted the following strengths:

·The main monitoring tool (the Horizon dashboard) in place for Horizon 2020 and Horizon Europe allows for an effective monitoring of the activities conducted by the services to achieve their objectives. The Horizon dashboard is an interactive, user-friendly reporting platform that allows the visualisation and filtering of Horizon data. It is an innovative monitoring and reporting tool and constitutes a best practice at Commission level.

·The objective-setting process at cluster 5 (‘Climate, Energy & Mobility’ under Horizon Europe pillar II) level was based on the co-creation of the strategic plan, led by DG RTD but involving various Directorates-General early in the planning phase. Moreover, the objectives at cluster 5 level are aligned with the programme objectives.

·In the context of Horizon Europe, DG RTD has put in place adequate processes to plan and acquire the external data and skills needed for the operationalisation of the key impact pathways, which represents significant challenges.

The IAS identified one very important issue concerning the reporting on Horizon programmes and formulated one very important recommendation addressed to DG RTD.

·Reporting on Horizon programmes

DG RTD should review the process for verifying the data that feed into the programme performance overviews and programme statements and apply the four-eyes principle. In addition, it should maintain an adequate audit trail for the figures disclosed in the Annual Management and Performance Report and the programme statements to enable reperformance of the calculation if needed.

0.5.Limited review on the reporting of the Commission’s preventive and corrective measures (‘corrective capacity’) (DG AGRI, DG BUDG, DG EMPL, DG INTPA, DG REGIO, DG RTD, REA)

The objective of the limited review was to assess whether: (1) the corporate instructions for the reporting on the preventive and corrective measures to protect the EU budget were well designed and effectively implemented by the sampled operational Directorates-General/services, and (2) the internal controls in place at corporate and at Directorate-General/service level ensured that simple, clear and reliable information was reported by the sampled operational Directorate-Generals/services in their annual activity reports (AARs), and by DG BUDG in the Commission’s Annual Management and Performance Report (AMPR).

There were no reservations in the 2021 AARs of the Directorates-General/services reviewed that relate to the area/process reviewed.

The fieldwork was finalised on 15 June 2022. All observations and recommendations relate to the situation as of that date.

The IAS recognised the ongoing efforts of DG BUDG to improve the quality and clarity of the reporting on the preventive and corrective measures in the AMPR for 2021. In particular:

·The AMPR provides a consolidated overview table of the preventive and corrective measures implemented by both the Commission and the Member States (which were presented separately in the previous AMPRs). The presentation of the table is simplified as it reports the implemented amounts only (instead of amounts implemented and confirmed as in previous AMPRs) and presents the information according to the multiannual financial framework headings, which facilitates the comparison with figures presented in other tables of the AMPR that are structured in the same way (for example reporting on the error rates). This consolidated (Member States and Commission) overview is also presented, for the first time, on a multiannual basis (covering the period 2017-2021), providing the reader with a simple and clear evolution of the overall corrective capacity over time.

·DG BUDG set up in 2020 a data quality process to promote the quality checks of the recovery context information to be carried out by the Directorates-General/services. These checks contribute to improving the accuracy, consistency, and efficiency of the Commission’s reporting on the preventive and corrective measures. The vast majority of the quality checks were integrated in a ‘data quality dashboard’ as of November 2021.

Furthermore, while improvements are still necessary in this regard, the IAS also acknowledged the ongoing efforts of DG BUDG, together with the DG REGIO and DG EMPL, to strengthen (in the AARs and AMPR) the reporting on the corrections implemented by the Member States for the cohesion area. In particular, DG BUDG requested the Directorates-General/services to provide a split of the corrections implemented by the Member States: (1) according to their timing, preventive and corrective; and (2) by author, corrections resulting from controls in EU bodies (Commission, European Court of Auditors and OLAF) and from controls in Member States. To date, Directorates-General/services estimated (and reported in their 2021 AARs) the split of corrections by author and committed to provide this information on a multiannual basis (since the beginning of the programming period) in future AARs.

The IAS identified two very important issues concerning: (1) the availability of quantitative data and qualitative information to substantiate the corrective capacity, (2) reporting on corrections in the AARs and AMPR and formulated seven very important recommendations.

·Availability of quantitative data and qualitative information to substantiate the corrective capacity (three very important recommendations addressed to DG BUDG, DG EMPL and DG REGIO):

DG REGIO and DG EMPL should provide information in the AARs on:

-the preventive and corrective measures implemented by Member States (split ‘by time’),

-the preventive or corrective measures accepted and/or implemented by Member States on a multiannual basis, since the beginning of the programming period(s), split ‘by author’ (preventive and corrective measures as a result of: (1) Commission audits; (2) audits of the European Court of Auditors; (3) OLAF investigations; (4) additional corrections requested by the Commission to ensure a risk at closure below 2%; and (5) Member States controls/audits).

DG BUDG should:

-instruct the Directorates-General to compare, or briefly explain in their AARs, the relationship between the ‘estimated future corrections’ and the ‘corrections implemented’,

-strengthen the reporting in the AMPR of the Commission’s overall corrective capacity by complementing the existing data with additional information, to be provided by the DGs, on: (1) the split ‘by author’ and ‘by timing’ of the corrections accepted and/or implemented by Member States (as per recommendations above addressed to DG REGIO and DG EMPL), and (2) the relationship between estimated future corrections and corrections implemented (as per bullet above).

·Reporting on corrections in the AARs and AMPR (four very important recommendations addressed to DG AGRI, DG BUDG, DG EMPL and DG REGIO).

DG REGIO and DG EMPL should:

-explain clearly in their AARs the purpose and content of the table on ‘multi-annual corrective capacity’, including any possible correlation/link with the estimated future corrections and the risk at closure,

-present in their AARs the financial corrections related to the EU share of public funding.

DG AGRI should:    

-agree with DG BUDG on a way to align the reporting of the corrections implemented in both DG AGRI’s AAR and the AMPR. The approach chosen should enable the comparison between the corrections implemented and the method used by DG AGRI for the calculation of estimated future corrections. Significant differences (if any) between DG AGRI’s AAR and AMPR on reported amounts should be briefly explained,

-report in its AAR on the European Agriculture Fund for Rural Development recoveries not reimbursed to the Commission but reused by the Member States to ensure consistency with the AMPR,

-align the terminology used in its AAR for the ‘corrective capacity’ with the terminology used in the AAR instructions, to ensure consistency across DGs AARs and with the AMPR.

DG BUDG should:

-clarify the consolidated overview table of the AMPR on preventive and corrective measures by: (1) specifying the criteria for the split of corrections between ‘implemented by Member States’ and ‘implemented by the Commission’, (2) further clarifying (particularly for the cohesion area) to which programming period(s) the corrective measures implemented are linked, and (3) revising the format/presentation of this table (consider following the sequencing of controls) and discontinue the comparison (in percentage) between the total amounts corrected (including preventive) and the relevant expenditure,

-ensure that the information needed in the AMPR is requested in the AAR instructions and thus reported in the AARs of the DGs to ensure consistency between the individual AARs and the AMPR. In particular, DG BUDG should agree with DG AGRI on a consistent reporting of the corrections implemented in both DG AGRI’s AAR and the AMPR,

-in the context of the peer review of the AARs, remind the concerned Directorates-General/services concerned of the need to briefly explain the root-causes of important variations in the financial corrections and recoveries implemented compared with the previous years. Based on this information at Directorate-General level, DG BUDG should provide the relevant explanation in the AMPR where there are significant variations at the level of the Commission as a whole,

-reintroduce the glossary of terms in the AMPR, with clear and consistent definitions on corrective capacity matters,

-clarify and revise the content of the financial table ‘Recovery of payments’ to ensure it is correctly interpreted and used by the Directorates-General.

0.6.Audit on physical security of persons and assets in the Commission (DG COMM, DG DIGIT, DG HR, OIB, OIL)

The objective of the audit was to assess if the Commission established an adequate governance, risk management and internal control framework for physical security to protect its employees and safeguard its assets.

There were no reservations in the 2021 annual activity reports of the DGs covered by the audit (DG HR, DG COMM, DG DIGIT, OIB and OIL) that relate to the audited process.

The fieldwork was finalised on 30 June 2022. All observations and recommendations relate to the situation as of that date.

The IAS acknowledged the good coordination and support provided by DG HR’s Security Directorate to the Local Security Officers (LSOs). This was confirmed by the LSOs in their responses to an IAS survey aimed at better understanding how the role of the LSOs is implemented in practice across the Commission and its Representations and to collect feedback on DG HR’s activities and support related to physical security. According to the results of the survey, the vast majority of LSOs consider that the support provided by DG HR’s Security Directorate is adequate. The survey also confirms that the headquarters of the relevant DGs provide good coordination and support to the LSOs in the Commission Representations.

The IAS noted that a number of security measures implemented in the last few years, such as the establishment of the Berlaymont Welcome Centre, the overhaul of physical security systems at the Stevin car park entrance of the Berlaymont and the installation of hostile vehicle mitigation systems on rue de la Loi, have mitigated the security risk for Commission staff.

Furthermore, the IAS noted that, when implemented, projects and initiatives such as the EU PAX project for an integrated IT system for managing buildings’ access or the projects to enhance protection against hostile vehicles for Charlemagne and Berlaymont buildings, are expected to bring improvements to security aspects:

The IAS identified three very important issues concerning:

·Governance framework and organisational arrangements for physical security at the Commission

One very important recommendation addressed to DG HR on comprehensiveness of the security strategy, organisational structure, arrangements with other Commission services and quality of security policies, procedures and guidance.

One very important recommendation addressed to DG COMM on Commission and European Parliament office security rules.

·Risk management framework for physical security at the Commission

Two very important recommendations addressed to DG HR and DG COMM on the assessment of security risks.

·Internal control measures for physical security

One very important recommendation addressed to DG HR regarding incident management, internal crisis management, supervision of guarding service, and security inspections.

0.7.Audit on the protection of personal data under the responsibility of EACEA, EISMEA, CINEA, REA, ERCEA and the CIC (CINEA, DG RTD, EACEA, EISMEA, ERCEA, REA)

The objective of the audit was to assess whether the Executive Agencies, supported by the CIC, put in place an effective and efficient internal control system for the protection of personal data, in compliance with the key provisions of the EU Data Protection Regulation, Regulation 2018/1725 (EUDPR).

There were no reservations in the 2019 to 2021 annual activity reports of the Executive Agencies and DG RTD that related to the audited processes.

The fieldwork was finalised on 28 March 2022, except for the finding on controllership of the funding and tenders’ portal, which was finalised on 1 June 2022. The respective observations and recommendations relate to the situation as of those dates.

The IAS recognised that the CIC has set up a solid governance structure aimed at helping to address common questions on the management of personal data. It has taken early actions to clarify joint controllership issues, for example by requesting, together with the Data Protection Officers of certain agencies and joint undertakings, advice from the European Data Protection Supervisor.

The auditors recognise the efforts made by CINEA, EACEA, EISMEA, ERCEA and REA to achieve compliance with the EUDPR, particularly when faced with a changing landscape, which included a reshuffling of portfolios, a new multiannual financial framework, the transfer of programmes under the eGrants infrastructure and continuing uncertainty on the issue of the transfer of personal data to third countries following the Schrems II judgement. The respective Data Protection Officers actively cooperate with the Data Protection Officers of the other Executive Agencies and the Data Protection Controller of DG RTD to help find collective solutions for common issues faced by the Agencies, for example the controllership of processes involving corporate systems.

The IAS identified two very important issues concerning the: (1) controllership of the funding and tenders’ portal, and (2) transfer of personal data to third countries, and formulated two very important recommendations.

·Controllership of the funding and tenders’ portal (one very important recommendation addressed to DG RTD)

The CIC, as the Chair of the GPSB, should take necessary steps to ensure the urgent:

-finalisation of a JCA and JC record that cover all parties and all processes for the 2021-2027 multiannual financial framework,

-update of the privacy notice to reflect the new record and JCA.

·Transfer of personal data to third countries (one very important recommendation addressed to DG RTD)

DG RTD should ensure that automatic transfers of personal data to third countries are avoided altogether or take place exclusively using a proper transfer tool as per the EUDPR.

0.8.Audit on programme implementation – phase 1 (from work programme to call evaluation and grant preparation) of the Connecting Europe Facility (CINEA, DG ENER, DG MOVE)

The objective of the audit was to assess the adequacy of the design and the effectiveness and efficiency of CINEA's management and internal control system for the first phase (from call to grant agreement) of the grant management process for the implementation of the Connecting Europe Facility (CEF) 2021-2027 Transport and Energy sectors of the 2021-2027 CEF, in compliance with the applicable rules and regulations. In particular, the audit assessed whether: (1) the controls in place provide reasonable assurance regarding compliance with the relevant legislation; (2) the calls for proposals effectively support the achievement of the programmes' objectives; (3) the processes in place ensure that the highest quality projects are selected and translated into grant agreements, in compliance with the applicable rules; and (4) the supervision of CINEA by its parent DGs is adequate.

In the 2021 annual activity report, the declaration of assurance was qualified by a reservation concerning the CEF Energy error rate with a residual error rate of 2.52%. This reservation was not relevant for this audit as it referred to the previous CEF programme (CEF 1, 2014-2020).

The fieldwork was finalised on 9 August 2022. All observations and recommendations relate to the situation as of that date.

The IAS identified the following strengths:

·The experience accumulated over several programming periods by the Innovation and Networks Executive Agency ( 6 ), DG MOVE and DG ENER staff has ensured a good knowledge of the grant preparation process, as well as a forward-thinking approach to implementing effective solutions based on identified good practices.

·The close cooperation and the good working relations between CINEA and its parent Directorates-General for the CEF Energy and Transport sectors ensure smooth information flows and alignment of objectives. This cooperation has also allowed the Directorates-General and CINEA to work on the CEF Energy and Transport multiannual work programmes in parallel to the finalisation of the legislative procedure of the CEF regulation, avoiding excessive delays in the launch of the new CEF.

The IAS did not formulate any critical or very important recommendations.

0.9.Audit on the design and early implementation of European Innovation Council (DG CNECT, DG RTD, EISMEA)

The objective of the audit was to assess the adequacy of the design of governance and internal control systems in place and the effective implementation of the initial stages of the European Innovation Council (EIC) pillar under Horizon Europe by EISMEA, DG RTD and DG CNECT.

There were no reservations in the 2021 Annual Activity Reports of the DG RTD, DG CNECT and EISMEA that relate to the audited processes.

The fieldwork was finalised on 9 December 2022. All observations and recommendations relate to the situation as of that date.

The IAS identified two critical and four very important issues concerning the: (1) governance framework of the EIC programme; (2) design of the EISMEA’s internal control environment in relation to the EIC; (3) roadmap for the transition to the long-term solution for the EIC Fund; (4) evaluation process for the EIC calls; (5) EIC Fund – assurance building blocks (reporting process and monitoring of the administrative budget); and the (6) EIC Accelerator IT services and tools, and external IT service providers. The IAS formulated two critical and five very important recommendations.

·Governance framework of the EIC programme (one critical recommendation addressed to DG RTD)

DG RTD should finalise the memorandum of understanding for Horizon Europe, together with EISMEA and DG CNECT, ensuring that it reflects all the key activities performed by EISMEA, including those related to the EIC Fund. Moreover, DG RTD, with the support of EISMEA and in consultation with the responsible central services, should prepare a proposal to revise the delegation instrument (Commission Decision C (2021) 949 in view of the revised governance of the EIC Fund, and clearly define the roles and responsibility of DG RTD and EISMEA towards the management of the EIC Fund. It should also define clear rules on the conflict of interests. Finally, it should analyse the staffing needs related to the capacity of DG RTD to supervise and monitor the EIC programme and EIC Fund and align the staffing to needs identified.

·Design of EISMEA’s internal control environment in relation to the EIC (one critical recommendation addressed to EISMEA)

EISMEA, under the supervision of the parent Directorates-General and with the support of DG RTD and following the established validation workflows, should update its control and anti-fraud strategies to reflect specificities of the EIC programme and, in collaboration with DG RTD’s CIC, complete its internal guidance/manual of procedures for the evaluation process to cover adequately for all strands of the EIC programme.

·Roadmap for the transition to the long-term solution for the EIC Fund 
(one very important recommendation addressed to DG RTD)

DG RTD, with the support of EISMEA, and of the responsible central services, should carry out a comprehensive assessment of the implications of the new EIC Fund management arrangements, in terms of supervision strategy, control environment, staffing, and relations with the key stakeholders. The assessment should also include an evaluation of the resources necessary for DG RTD to be able to exercise its supervisory role on EISMEA. Furthermore, based on this assessment, DG RTD, with the support of EISMEA, should develop a roadmap or an action plan set-up (and, where necessary, for the transition period), in which the key actions, resources, milestones and corresponding responsible entities are identified.

·Evaluation process for the EIC calls (one very important recommendation addressed to EISMEA)

EISMEA, in cooperation with DG RTD (CIC), should analyse the effectiveness of the various tools/solutions currently used by the units and define the approach for the Agency as regards conflict of interest checks. It should also appoint observers in the EIC Accelerator calls as stipulated in Horizon Europe guidance.

·EIC Fund assurance building blocks - reporting process and monitoring of the administrative budget (two very important recommendations addressed to EISMEA and DG RTD)

For the fiscal year of 2022, EISMEA should, under the supervision of DG RTD, ensure that all reporting obligations of the EIC Fund stipulated in the statutory and governing documents of the Fund are performed in a timely manner. EISMEA should report on key elements related to the management of the EIC Fund in its 2022 annual activity report, and monitor and report on the administrative budget of the EIC Fund.

For the fiscal year of 2023, depending on the final arrangements decided for the EIC Fund as regards the management mode, DG RTD (with the support of EISMEA, the Alternative Investment Fund Manager/Fund manager under direct management, and/or the European Investment Bank under indirect management) should ensure that the tasks and responsibilities related to the monitoring and reporting obligations (including the administrative budget) of the EIC Fund are clearly specified in the key governance documents.

·EIC Accelerator IT services and tools, and external IT service providers 
(one very important recommendation addressed to EISMEA)

EISMEA, in cooperation with DG RTD (CIC), should finalise the IT security plan and perform the vulnerability testing for the various components of the EIC IT tools for the EIC Accelerator. It should also inform the Information Technology and Cybersecurity Board of the latest developments by providing updated and completed project charters of all EIC IT tools and update the relevant information in the corporate tool for management of information systems (GovIS2). Furthermore, the Agency should assess the current contract and agreement and conclude on the relevance of the service provided for the user needs and, on this basis, as well as on the lessons learnt from the EIC pilot, define an EIC IT strategy covering the specific IT tools to support the implementation of the three EIC strands (in particular the EIC Accelerator). In addition, EISMEA should submit the IT strategy to the relevant services/bodies for endorsement, following consultation of DG RTD (CIC).

0.10.Limited review of the Recovery and Resilience Facility control and audit strategies in DG ECFIN 

The objective of the limited review was to assess whether DG ECFIN designed adequate control and audit strategies for the Recovery and Resilience Facility (RRF) enabling it to obtain reasonable assurance on: (1) the legality and regularity of the use of payments, and (2) the effectiveness of Member States’ control systems to protect the financial interests of the Union.

There were no reservations in the 2021 AAR of DG ECFIN that relate to the area/process audited.

The fieldwork was finalised on 15 March 2022. All observations and recommendations relate to the situation as of that date.

The IAS acknowledged progress already made by DG ECFIN in setting up the RRF control and audit strategies. This has been a challenging task due to the complexity of both the operational environment and the instrument’s legal framework, coupled with extreme time pressure to approve the national Recovery and Resilience Plans (RRP) and the first regular payment requests. Key milestones achieved include:

·A new organisational structure in DG ECFIN to fulfil the new Commission’s responsibilities in the implementation of the RRF. This includes the creation of a dedicated centralised unit for controls and audits, which provides needed guidance and support to the implementation of the RRF both within the DG and, more widely, in the Commission.

·The setting up of a coordination mechanism with other Commission services, which enables, among others, an effective review of the RRPs and the assessment of milestones and targets before proceeding with the regular payments to Member States.

·The completion of the design of the control architecture to ensure compliance with the legality and regularity aspects of the programme. This includes processes for the assessment of RRPs and the payment requests against agreed milestones and targets as well as multi-level audits to be performed throughout the lifecycle of the instrument.

The IAS identified two very important issues concerning the: (1) measures for prevention, detection and follow-up of serious irregularities, double funding and serious breaches of the Financing Agreement, and (2) suspension of payments and reduction of support due to not satisfactorily fulfilled milestones and targets. The IAS formulated two very important recommendations.

·Measures for prevention, detection and follow up of serious irregularities, double funding and serious breaches of the Financing Agreement and the Suspension of payments

DG ECFIN should finalise the criteria for assessing the compliance of the Member States’ control systems with the key requirements, and complete the audit methodology for the system audits on the protection of the financial interests of the European Union by identifying the risk assessment process to be applied when defining the scope of the work. In addition, DG ECFIN should elaborate the framework and the set of activities to be implemented to avoid double funding of the same cost by the RRF and other Union programmes, and improve the process to prepare, approve and distribute the guidance to the Member States.

·Suspension of payments and reduction of support due to not satisfactorily fulfilled milestones and targets

DG ECFIN should adopt a methodology for the suspension of payments and reduction of support in case milestones and targets for a particular payment request have not been partially or fully met, and a methodology on the application of corrections in cases where the ex post substantive test results indicate material errors in the assessment of the achieved milestones and targets.

0.11.Audit on the effectiveness and efficiency of Eurostat’s performance management system

The objective of the audit was to assess the adequacy of the design and the efficiency and effectiveness of the performance management system put in place by DG ESTAT to plan, monitor and report on the achievement of its key objectives.

There were no reservations in the 2021 Annual Activity Report of DG ESTAT that relate to the audited process.

The fieldwork was finalised on 21 October 2022. All observations and recommendations relate to the situation as of that date.

The IAS recognised the ongoing efforts made by DG ESTAT to design and implement an effective performance management process and observed the following strengths in relation to the audited process.

·DG ESTAT aligned objective and performance indicators of the strategic planning and programming (SPP) cycle with the performance management framework for the Single Market Programme, through which the Directorate-General finances its activities.

·DG ESTAT communicated to staff the SPP objectives by making the objectives and output indicators available in the planning, monitoring and reporting tool in addition to the usual publication of strategic and management plans on its intranet.

·DG ESTAT implemented a robust and well documented process to monitor and report on performance management.

·The monitoring and reporting on objectives and indicators are performed twice per year.

The IAS did not formulate any critical or very important recommendations.

0.12.Audit on studies used for policy making in DG MOVE

The objective of the audit was to assess whether DG MOVE had put in place an adequate internal control system to ensure that all the stages of the studies’ lifecycle are effectively and efficiently managed, and in accordance with the applicable legislation and corporate guidance.

There were no reservations in the 2021 Annual Activity Report of DG MOVE that relate to the audited area.

The fieldwork was finalised on 28 March 2022. All observations and recommendations relate to the situation as of that date.

The IAS recognised the ongoing efforts made by DG MOVE to strengthen the internal controls in the procurement process and improve the quality of tender documents through the active support of the Legal Sector in Unit SRD.1. The use of the Vigie system, supported by annual training courses, contributes to coordinating the studies requests and optimising the use of budget resources.

The IAS did not formulate any critical or very important recommendations.

0.13.Limited review on the implementation of the action plans for the reduction of the Horizon 2020 error rate and for simplifications to reduce the Horizon Europe error rate in DG RTD

The objective of the limited review was to assess the extent to which the action plans to reduce the error rate for Horizon 2020 and to bring simplifications for Horizon Europe had been implemented by DG RTD (through the Common Implementation Centre) and are likely to effectively contribute to the above-mentioned objectives.

There were no reservations in the 2020 Annual Activity Report of DG RTD (hosting the Common Implementation Centre, Directorate RTD.H) concerning the scope of this limited review.

The fieldwork was finalised on 1 February 2022. All observations and recommendations relate to the situation as of that date.

The IAS recognised the significant and ongoing efforts made by DG RTD to implement the action plans, while being confronted with important challenges marked by the transition from the 2014-2020 programming period to the 2021-2027 EU Multiannual Financial Framework and the COVID-19 pandemic. Moreover, the progress of a number of actions was closely linked to exchanges and coordination with internal (Commission) or external (EU institutions) partners.

In this context, the priorities and the focus of the activities of the Common Implementation Centre were on the finalisation of the 2021 audit campaign for Horizon 2020 and on horizontal tasks related to the set-up of the new programming period: the finalisation of the preparation and the adoption of the Horizon Europe regulation and implementing decisions, the reorganisation of DG RTD and the preparation and implementation of new mandates of the implementing bodies in the research family (executive agencies and joint undertakings).

As regards the two action plans for the reduction of the error rate for Horizon 2020 and the simplification under Horizon Europe, the IAS noted that DG RTD, through the CIC:

·Promoted the launch of the Research and Innovation Network for Ex Ante Controls (‘RINEC’), whose aim is to enhance the efficiency and effectiveness of ex ante controls, by discussing, disseminating and exploiting best practices.

·Put in place new solutions to raise the awareness of a high number of beneficiaries and providers of certificates of financial statements regarding reporting on specific costs under Horizon 2020.

The IAS identified one very important issue concerning the effective implementation of the action plans and formulated one very important recommendation.

·Re-assessment of the action plans

On the basis of the lessons learnt from the first year of implementation of the action plans, DG RTD, in coordination with DG BUDG, should:

-re-assess the action plans (including the analysis of the contribution of the actions already implemented to address the root causes of the error rate) and revise them where necessary to ensure that they prioritise those measures which are most likely to effectively address the root causes of errors and hence further contribute to the reduction of the error rate,

-at the level of the individual actions, define the next steps to fully implement them in line with the prioritisation established.

This recommendation was partially accepted by the auditee.

0.14.Audit on performance management in DG TAXUD

The objective of the audit was to assess the adequacy of the design and the efficiency and effectiveness of the performance management system put in place by DG TAXUD to plan, monitor and report on the achievement of its key policy objectives.

There were no reservations in the 2020 Annual Activity Report of DG TAXUD that relate to the audited area.

The fieldwork was finalised on 18 November 2022. All observations and recommendations relate to the situation as of that date.

The IAS acknowledged several strengths.

Effective coordination

·Unit TAXUD.E.2 (‘Inter-institutional relations, coordination, communication and strategic planning’) coordinates effectively the strategic planning and programming (SPP) exercise and supports the operational units in the process of the preparation of the SPP documents.

Monitoring of the customs and tax action plans

·For the purpose of monitoring the customs and tax action plans, DG TAXUD has set up a ‘traffic light system’, which provides user-friendly information for senior management about the progress of activities and actions.

·Several DG TAXUD’s operational units prepare ‘concept notes’ to keep the Director-General informed on the activities undertaken on customs and tax action plan initiatives.

The IAS did not formulate any critical or very important recommendations.

0.15.Limited review of the internal control framework in DG TAXUD 

The objective of the limited review was to assess if the Authorising Officer by Delegation (AOD) of DG TAXUD performed an adequate assessment of the presence and functioning of all internal control principles and components as laid down in the Commission communication on the revision of the internal control framework (ICF), adapted to its own circumstances.

There were no reservations in the 2020 Annual Activity Report of DG TAXUD that relate to the audited area.

The fieldwork was finalised on 18 November 2022. All observations relate to the situation as of that date.

The IAS identified the following strengths:

·Clear allocation of roles and responsibilities within the DG in ICF matters.

·Balance between the effective monitoring of the ICF by the coordinating unit E1 and the contribution from operational units (for example assessment at the level of the internal control monitoring criteria).

·Comprehensive set of indicators to assess the presence and functioning of internal control principles, targeted to the Directorate-General’s needs and specific context.

·Effective use of DG BUDG’s tools and templates to support: (1) the assessment of the internal control monitoring criteria, and (2) the assessment at internal control principle, component and standard levels.

·The use of a comprehensive data source for evaluating each internal control monitoring criterion.

The IAS did not formulate any critical or very important recommendations.

Cohesion, Resilience and Values

0.0.Audit on the preparedness of DG EAC’s management and control systems for the implementation of the 2021-2027 Erasmus+ programme 

The objective of the audit was to assess if DG EAC designed and put in place efficient and effective processes to ensure the preparedness of the management and control systems for the implementation of the 2021-2027 Erasmus+ programme.

There are no reservations in the 2021 Annual Activity Report of DG EAC related to the 2014-2020 and 2021-2027 Erasmus+ programmes.

The fieldwork was finalised on 14 October 2022. All observations relate to the situation as of that date.

The IAS identified the following strengths:

·Clear allocation of roles and responsibilities for the implementation of the 2021-2027 Erasmus+ programme within DG EAC.

·Comprehensive set of guidance documents for the preparation, programming, implementation, and review of the 2021-2027 Erasmus+ programme, including aspects related to horizontal priorities and anti-fraud measures.

·Comprehensive set of internal procedures for the assessment of the deliverables of the national authorities, national agencies, and independent audit bodies.

·Extensive involvement of the national agencies in the preparation and programming of the 2021-2027 Erasmus+ programme (co-creation).

·Expertise of DG EAC’s staff involved in the preparation, programming, implementation and review of the 2021-2027 Erasmus+ programme.

The IAS did not formulate any critical or very important recommendations.

Natural Resources and Environment

0.0.Audit on DG AGRI’s management of the wine market 

The objective of the audit was to assess whether DG AGRI put in place an adequate internal control system for the effective and efficient implementation of the National Support Programmes in the wine sector by the Member States.

The following reservations were made in the 2021 Annual Activity Report concerning specifically the area/process under the scope of this audit engagement:

·In the wine sector, DG AGRI audits found deficiencies (Spain, Hungary) and the Member State (Hungary) reported an error rate above materiality. The Certification Body also identified deficiencies in Spain.

·Under the wine crisis distillation measure, DG AGRI identified deficiencies in the checks setting up of price for wine distillation, possible creation of artificial conditions to receive the aid, and the price paid to distillers in Romania.

The fieldwork was finalised on 27 September 2022. All observations and recommendations relate to the situation as of that date.

The IAS recognised the technical expertise of DG AGRI staff involved in the management of the National Support Programmes in the wine sector and their strong commitment, in spite of the high workload stemming from DG AGRI’s transition towards the new Common Agricultural Policy and the challenges resulting from the current geopolitical and climatic situation.

The IAS identified one very important issue concerning the monitoring of performance and formulated one very important recommendation.

·Monitoring of performance

DG AGRI should:

-develop guidance to the Member States on the applicable requirements as regards the data to be reported on interventions in the wine sector under the Common Agricultural Policy Strategic Plans (by means of Annex V to Implementing Regulation (EU) 2022/1475),

-ensure that Member States Annex III notifications under the current five-year programme of the National Support Programmes are systematically analysed and documented in a consistent manner so that they can be used in the monitoring of the wine sector.

0.1.Gap analysis review of the new Common Agricultural Policy 2023-2027 in DG AGRI

Pursuing similar objectives as the ones set for the review of the gap assessment performed in 2014 on the Common Agricultural Policy (CAP) for the period 2014-2020, this gap analysis review identified the main differences (‘gaps’) between the initial Commission proposals for the 2023-2027 CAP and the final regulations adopted. It has assessed the resulting main management challenges and associated risks with a view to enabling the Commission (in particular, DG AGRI) to manage those risks adequately.

The analysis was finalised on 7 April 2022. All conclusions relate to the situation as of that date.

The IAS acknowledged the efforts deployed by the Commission's services during the negotiation phase to defend the New Delivery Model, to promote a new intervention logic centred on the performance of the new CAP around a set of ambitious objectives, notably in relation to the contribution of the CAP to the European Green Deal. However, the IAS noted that the adopted legislation has resulted in important amendments bringing significant additional challenges and risks, which will need to be addressed when designing and implementing suitable controls for the new 2023-2027 CAP. The IAS did not formulate any critical or very important recommendations but brought a number of issues for consideration to the attention of the Directorate-General.

0.2.Audit on the cooperation between EFCA and DG MARE on activities related to Article 30 of the Common Fisheries Policy (DG MARE, EFCA)

The objective of this audit was to assess the adequacy of the design of the existing underlying processes, and the efficiency and effectiveness of the cooperation between EFCA and DG MARE on activities related to compliance with international provisions under Article 30 of the Common Fisheries Policy (CFP).

There were no reservations in the 2021 Annual Activity Report of DG MARE that relate to the audited area.

The fieldwork was finalised on 10 May 2022. All observations and recommendations relate to the situation as of that date.

The IAS acknowledged a number of strengths:

·While setting clear boundaries for EFCA’s international activities, the Working Arrangements adopted in 2020 leave some flexibility to adapt to future needs and EFCA’s resources in stating that ‘the implementation of the specific actions shall be discussed and agreed, if necessary, between EFCA and DG MARE on a case-by-case basis, by taking into consideration EFCA's workload, availability of resources and other priorities.’

·The interaction and cooperation between EFCA and DG MARE are spread across the two organisations and the intensity of the activities varies across units. The tasks EFCA and DG MARE cooperate on are very diverse in nature, size and complexity. DG MARE and EFCA cooperate in an efficient way: the knowledge of the respective teams of the various regulations and the tasks stemming therefrom have reached a high level of maturity. Both entities have dedicated teams who work closely together. Communication between them is fluid and both teams are proactive and responsive. Based on a sample of exchanges of emails and deliverables, the IAS has assessed the reactivity of the teams, against quantitative (time to react) and qualitative criteria (relevance of staff in copy, level of exchanges).

The IAS did not formulate any critical or very important recommendations.

Security and Defence

0.3.Preparedness of DG DEFIS for the management of the European Defence Fund 

The objective of the audit was to assess the adequacy of the design and effective implementation (where already applicable) of the control strategy of the European Defence Fund (EDF) programme by DG DEFIS.

There were no reservations in the 2021 Annual Activity Report of DG DEFIS that related to the audited area.

The fieldwork was finalised on 17 September 2022. All observations and recommendations relate to the situation as of that date.

The IAS recognised the ongoing efforts made by DG DEFIS regarding the management of the EDF programme and identified the following strengths.

·As regards the organisation, DG DEFIS staff responsible for the management of the EDF programme is knowledgeable, motivated and has extensive valuable experience in the defence field.

·There is good cooperation within the Directorate-General (between the operational units and the financial units), as well as with other key stakeholders (Member States, national experts, etc.), in the annual work programme preparation and the harmonisation of the calls for proposals process.

·The process for the definition and harmonisation of topics for the calls for proposals is well established and effectively implemented in terms of ensuring quality and timeliness. In this regard, a lessons learnt exercise is regularly performed and has enabled further improvement of the work programme preparation for 2022, with a revision of the roles and responsibilities between DG DEFIS and Member States.

·The call evaluation report is well designed to effectively address the different provisions of the Financial and EDF Regulations. The report provides a comprehensive view on the call for proposals and evaluation process, including eligibility and admissibility checks, timelines, scores of award criteria, tracking of changes performed by the evaluation committee to the consensus reports, budgetary considerations, ethics.

The IAS identified one very important issue concerning the validation of small and medium-sized enterprises (SME) and mid-cap status and formulated one very important recommendation.

·Validation of SME and mid-cap status

DG DEFIS should:

-develop an approach for in-depth checks of the SME and mid-cap status of risky candidates which REA is unable to check due to its annual capacity limitations,

-ensure that the control approach is re-assessed at regular intervals in the light of the results of controls (notably in-depth ex ante checks) and adapted, if necessary,

-define guidance on the risk assessment for selecting the entities to be submitted for in-depth ex ante checks to REA (full status validation),

-define in its control strategy the actions to be taken in case of negative outcome of the ex-ante in-depth check, including the possibility or need to use the call reserve list to replace the excluded consortium.

Neighbourhood and the World

0.4.Audit on control strategy for grant management under the Union Civil Protection Mechanism in DG ECHO

The objective of the audit was to assess the adequacy of the design and the effective implementation of the control strategy of the Union Civil Protection Mechanism (UCPM) for the management of grants.

There were no reservations in the 2021 Annual Activity Report of DG ECHO that relate to the audited area.

The fieldwork was finalised on 14 October 2022. All observations and recommendations relate to the situation as of that date.

The IAS recognised several strengths.

-The control strategy of DG ECHO covering both the humanitarian aid and the UCPM includes several positive elements: it provides a good overview of the UCPM actions, a list of the relevant ECHO procedures, together with the control stages and the responsible Units and staff positions.

-The IAS acknowledged as a good practice the audit information paper addressed to the Civil Protection Grant beneficiaries issued in August 2022. It includes, among other elements, a section on ’most frequent errors resulting in disallowances’ and the reasons for the latter, thus providing useful guidance to beneficiaries.

The IAS identified one very important issue concerning the direct award of grants, and it formulated one very important recommendation.

·Grant award procedure – use of exceptions

DG ECHO should include in the UCPM work programme the criteria for selecting beneficiaries for the exceptions covered by Article 195 (a), (b), (c) and (f) of the financial regulation, based on annex 3 of the internal rules for the implementation of the EU budget. In addition, DG ECHO should include a justification for the use of direct awards in all award decisions when an exception to the call of proposals is used, based on Article 195 (c) and (f) of the financial regulation.

0.5.Audit on contractual expenditure verifications (FPI, DG INTPA, DG NEAR)

The objective of the audit was to assess whether the contractual expenditure verifications process in DG INTPA, DG NEAR and FPI was adequately designed and efficiently and effectively implemented to serve as a reliable source of assurance on the legality and regularity of payments.

The fieldwork was finalised on 9 December 2022. All observations and recommendations relate to the situation as of that date.

The IAS recognised the ongoing efforts made by DG INTPA to maintain and continuously update the guidance, templates (contractual documents, terms of reference for contractual expenditure verifications) and related procedures, which are used by the entire external action family. This helps to implement a consistent approach across DG INTPA, DG NEAR and FPI and all their EU delegations, and the knowledge transfer when staff rotates among the Directorates-General. The IAS also recognised high professionalism of the members of contracts and finance sections and units in dealing with the contractual expenditure verifications.

The IAS has identified two very important issues concerning: (1) the objective and design of contractual expenditure verifications as a control, and (2) monitoring and feedback on the contractual expenditure verifications and formulated four very important recommendations.

·Objective and design of contractual expenditure verifications as a control 
(one very important recommendations addressed to DG INTPA)

DG INTPA, together with DG NEAR and FPI, should clarify the objective of the contractual expenditure verifications as a control and revise the template terms of reference for contractual expenditure verifications (including a detailed description of verification procedures and of the risk assessment and sampling methodology), to ensure that they achieve the stated objective. They should also share guidance, interpretative materials, or frequently asked questions on EU expenditure eligibility rules, expenditure verification procedures, risk assessment and sampling methodologies with the external auditors.

·Monitoring and feedback on the contractual expenditure verifications
 (three very important recommendations addressed to DG INTPA, DG NEAR, FPI)

DG INTPA, DG NEAR and FPI, should implement periodic assessments of the sound functioning and cost-benefit of contractual expenditure verifications.

0.6.Audit on External Investment Plan – European Fund for Sustainable Development Guarantee (DG INTPA, DG NEAR)

The objective of the audit was to assess the adequacy and effectiveness of the European Fund for Sustainable Development (EFSD) Guarantee scheme.

There were no reservations in the 2021 annual activity reports of DG INTPA and DG NEAR that relate to the audited area.

The fieldwork was finalised on 22 July 2022. All observations and recommendations relate to the situation as of that date.

The IAS acknowledged the following strengths:

•The auditors recognise the ongoing efforts made by DG INTPA and DG NEAR to establish an adequate governance structure and ensure active involvement of the EU Member States and the other main stakeholders in the decision-making process.

•The EFSD Guarantee is a new and unique instrument and DG INTPA, with the support of DG NEAR, managed to sign agreements for the whole amount of the instrument by the final deadline established by the EFSD Regulation – 31 December 2020. This was achieved despite the significant challenges related to the establishment of the new implementation modality, the need to negotiate a number of horizontal clauses (for example EU restrictive measures) and the reorientation to address the challenges of the COVID-19 crisis. There are already a number of operations covered by the EFSD Guarantee under half of the signed guarantee agreements.

•A new relevant control system ‘VI – Indirect management – Financial Instruments and Budgetary Guarantees (EFSD, EFSD+)’ was included in the annexes of the 2021 Annual Activity Report of DG INTPA. It provides a comprehensive overview of the control activities for the budgetary guarantees as well as the main risks and cost-effectiveness indicators per stage. In addition, the 2021 Annual Activity Report presents, for the first time, relevant overall financial figures in the section on control results and more information on the achievements of the EFSD Guarantee programme in the part on policy highlight.

The IAS identified four very important issues concerning: (1) governance, (2) assurance building, (3) the guarantee agreement clauses, and (4) performance monitoring and reporting. It formulated four very important recommendations addressed to DG INTPA.

·Governance

DG INTPA, in cooperation with DG NEAR, should define who does what as regards the risk monitoring on the basis of the guidance of the risk compendium developed under the auspices of the steering committee on contingent liabilities.

In addition, DG INTPA, in cooperation with DG NEAR should define the overall investment goals and their scope and ensure that the agenda of the EFSD+ strategic board includes regular discussions and exchange of information on the complementarity and coherence between the EFSD+ and the other EU external programmes and financial instruments. The EFSD+ strategic board should adopt guidelines covering all objectives and eligibility criteria for the External Action Guarantee under the EFSD+ in line with the Neighbourhood Development and International Cooperation Instrument (NDICI) regulation.

Lastly, DG INTPA, in cooperation with DG NEAR, should ensure that the EFSD+ rules of procedures translate the mandate for the operational board in the NDICI regulation into specific tasks and the expected outputs.

·Assurance building

DG INTPA, in cooperation with DG NEAR should invite the international development financial institutions (IFIs) to launch the pillar reassessment if not already done and enhance the monitoring of the risk information reported and the financial statements provided by the relevant IFIs.

DG INTPA should describe the submission process of the management declarations and audit opinions in its relevant control system for budgetary guarantees in the annex of the annual activity report. In addition, DG INTPA, in cooperation with DG NEAR, should revise the management declaration template and develop internal guidance and review procedures as well as model guarantee agreement clauses regarding the unaudited and audited financial statements.

·Guarantee agreement clauses

DG INTPA should check if other guarantee agreements, in addition to the reviewed four, allow refinancing of existing loans and that in all such cases, it is ensured that the mobilised global investment exceeds the amount of the guarantee.

DG INTPA, in cooperation with DG NEAR, should adopt an internal procedure for reviewing the claims, where it should be defined what constitutes ‘default’.

Lastly, DG INTPA should adopt specific guidance and standard agreement clauses related to the recoveries, and, if necessary, propose to the IFIs to amend the signed guarantee agreements.

·Performance monitoring and reporting

DG INTPA, in cooperation with DG NEAR, should establish a target for the instrument and should start reporting on the share of investment in least developed countries and fragile countries and should reassess the overall leverage target. Internal guidelines for calculation and reporting on the EFSD objectives should be adopted.

DG INTPA should establish a methodology to support reporting on additionality and all EFSD Guarantee objectives to be adopted, as well as a mapping of the core and cross-sector indicators of the signed guarantee agreements and the EFSD Guarantee objectives to be carried out.

Finally, DG INTPA, in cooperation with DG NEAR, should clarify which methodologies have to be used for data collection and calculation of the cross-sector indicators regarding greenhouse gas emissions and indirect employment, and should reassess the methodologies for the indicators of number of beneficiaries.

European Public Administration

0.7.Audit on public procurement in DG DIGIT

The objective of the audit was to assess if the governance, risk management and internal control framework set-up by DG DIGIT for its procurement activities were adequately designed, efficient and effective and provide reasonable assurance that key internal control objectives are achieved.

There were no reservations in the 2021 Annual Activity Report of DG DIGIT that relate to the process audited.

The fieldwork was finalised on 14 June 2022. All observations and recommendations relate to the situation as of that date.

The IAS acknowledged the progress made by DG DIGIT in the last years to modernise its procurement activities. In particular, the IAS welcomed the following initiatives.

·Since 2019, DG DIGIT adopted a Dynamic Purchase System (DPS) to procure cloud services. This system encourages competition and increases the number and quality of offers received. The IT system used under DPS (Negometrix) is also considered by DG DIGIT staff as an efficient tool to facilitate the tendering process, especially the communication with the tenderers and the evaluation of the offers.

·DG DIGIT is increasing the use of framework contracts with reopening of competition which, by definition, encourages competition for specific contracts compared to the framework contracts with cascade which were more favoured in the past.

The IAS identified one very important issue concerning the steering of information and communication technology (ICT) procurements and formulated one very important recommendation.

·Steering of ICT procurements

DG DIGIT should:

(a)steer further the ICT procurement towards more efficient procurement methods that encourage competition. In particular:

-the DPS, currently used for cloud services, should be extended, and favoured for high value ICT procurements, whenever this is possible and cost-effective given the nature of the purchase,

-open procedures should be used preferably with the reopening of competition and the use of the cascading system should be progressively reduced for framework contracts above certain thresholds, except for the cases where security of supply is endangered,

-framework contracts should be signed with a higher number of contractors, whenever appropriate, in order to encourage more competition for the specific contracts and to obtain better specific offers while reducing in parallel the administrative burden through improved IT tools and a more efficient organisation of the procurement process.

(b)set up a comprehensive set of procurement tools enabling result-oriented alternatives to the use of ‘Time and Means’ contracts for ICT development and service delivery. The use of ‘Time and Means’ contracts should be progressively reduced, whenever possible. Since DG DIGIT contracts are used by a wide range of customers, DG DIGIT should seek the support of the Information Technology and Cybersecurity Board (ITCB) as part of a move towards alternative contractual models, together with the development of a roadmap for the progressive reduction of ‘Time and Means’ contracts, 

(c)seek the support of the ITCB in obtaining an overview across the Commission of all ICT high value procurements and contracts, to avoid potential overlaps, resource waste and inefficiencies,

(d)establish an overview/centralised planning and supervision arrangements for its own low and very low value procurements, with a view to grouping them, where possible, into higher value procurements. The aim being to generate more competition and make procedures more efficient,

(e)further develop the tender specifications to be more in line with the increased expectations as regards the environment. This could include requirements on the way the services are delivered (for example to reduce the energy consumption) and/or the supplies are produced and replaced (for example by using recycled and/or sustainable materials or renewable energy).

0.8.Audit on human resources management in DG ECFIN

The objective of the audit was to assess whether DG ECFIN had put in place an effective human resources management strategy and processes to ensure the availability of sufficient and adequately skilled resources to support the achievement of its operational objectives.

There were no reservations in the 2021 Annual Activity Report of DG ECFIN that relate to the audited area.

The fieldwork was finalised on 13 July 2022. All observations and recommendations relate to the situation as of that date.

The IAS acknowledged the following strengths:

·DG ECFIN has set up several bodies at different levels of hierarchy and launched initiatives to exchange views and enhance dialogue on human resources matters. This includes the Human Resources Board, the Sounding Board and the Group on Equality Mainstreaming, the 'Coffee with Maarten' initiative, the Midday Info Sessions and the Middle Management club.

·All levels of the organisation highly appreciate the contribution and support of the Resources Director and the Human Resources Business Correspondent (HRBC). The 2021 HRBC Assessment Exercise carried out by DG HR highlighted that ʻthe HRBC team makes contributions to the discussions on [human resources] matters in a pro-active and transparent wayʼ.

·DG ECFIN’s Learning and Development offer is substantial, and regularly updated and improved based on the assessment of staff needs and the Directorate-General’s priorities. It includes, among others, the ECFIN Summer School, which is highly valued by the staff and the ECFIN specific female talent management programme.

The IAS did not formulate any critical or very important recommendations.

Information technology audits

0.9.Audit on progress in the implementation of the European Commission digital strategy in DG DIGIT

The objective of the audit was to assess whether the Commission designed and deployed an effective and efficient control system to oversee, manage and monitor the implementation of the European Commission Digital Strategy.

There were no reservations in the 2021 Annual Activity Report of DG DIGIT that relate to the audited area. The Commission departments involved did not disclose any reservation in their respective annual activity reports regarding the implementation of the European Commission digital strategy (ECDS).

The fieldwork was finalised on 26 April 2022. All findings and recommendations relate to the situation as of that date.

The IAS observed several notable developments in the Commission’s general IT working environment, in particular since the beginning of the implementation of the ECDS. These help to constitute strong foundations for the digital transformation of underlying processes. In particular, the following elements were developed and are being implemented by the Commission departments:

·New user-centric digital workplace.

·IT infrastructure for remote access supporting teleworking.

·Re-usable solution platform to develop and operate digital solutions.

·Construction of a data ecosystem for the sharing and re-use of data.

·Hybrid cloud services offering.

·IT security risk management framework.

The IAS identified one very important issue concerning the digitalisation and formulated one very important recommendation.

·Digitalisation

In its role to coordinate the implementation of the ECDS, DG DIGIT should strengthen its guidance and support to Commission departments in preparing and monitoring the progress in implementing: (1) process digitalisation, (2) the digital solutions modernisation plan (DSMP) related actions, and (3) the digital delivery model.

0.10.Audit on IT governance and management (DG HOME, DG JUST)

The objective of the audit was to assess the adequacy of the design and the effectiveness and efficiency of the implementation of the IT governance and management arrangements in DG HOME and DG JUST for the information and communication systems (CIS) owned by each Directorate-General and managed under their responsibility.

There were no reservations in the 2021 Annual Activity Reports of DG HOME and DG JUST that relate to the audited area.

The fieldwork was finalised on 18 November 2022. All observations and recommendations relate to the situation as of that date.

The IAS identified the following good practices regarding IT governance, project management and software management in DG JUST and DG HOME:

·An established IT governance structure, allowing both IT and business stakeholders to regularly evaluate, monitor and decide upon IT budget, priorities, key activities and issues.

·A defined annual IT work plan (portfolio) with key deliverables for the upcoming year.

·IT systems delivered in line with political expectations.

·The involvement of stakeholders through project organisation structures and regular communication between the system/project owner and solution provider to identify, continuously validate and, if needed, update business requirements and expectations throughout the duration of the project.

The IAS did not formulate any critical or very important recommendations.

0.11.Audit on information technology governance and project management (including software development) in the SG

The objective of the audit was to assess the effectiveness and efficiency of the IT governance, project management, and software development practices in the SG for IT systems developed and owned by the SG and for those owned by the SG, but which are developed by DIGIT or through outsourcing contracts.

There were no reservations in the 2021 Annual Activity Report of the Secretariat-General that relate to the audited area.

The fieldwork was finalised on 20 July 2022. All observations and recommendations relate to the situation as of that date.

The IAS noted several strengths regarding IT governance, project management and software development practices, in particular the SG:

·Established IT governance and project management structures, which help to create a platform for the discussion of IT budget related issues, priorities, and key activities.

·Defined annual IT work plans which clearly identify the key deliverables for the coming year.

·Comprehensively involves stakeholders through project organisation structures and regular communication between the system/project owner (and its representatives) and solution provider (and its representatives). This helps to ensure that business requirements and expectations are identified, continuously validated and, if needed, updated throughout the duration of the project.

The IAS did not formulate any critical or very important recommendations.

0.12.Audit on information technology application project management in DG TAXUD

The objective of the audit was to assess the adequacy of the design as well as the effective and efficient implementation of the management and control systems that DG TAXUD put in place to manage its IT application projects.

There were no reservations in the 2021 Annual Activity Report of DG TAXUD that relate to the audited area.

The audit was finalised at the end of the preliminary survey, on 16 November 2022. All observations relate to the situation as of that date.

The IAS identified the following strengths:

·DG TAXUD’s IT steering committee (ITSC) takes decisions on IT strategy, projects and services, and oversees the implementation of the DGs’ IT work plan.

·DG TAXUD’s IT risk management and internal control practices are in line with the Commission methodologies.

·DG TAXUD has a comprehensive IT project management methodology in place

·As DG TAXUD does not develop IT in-house, it has put in place monitoring, reporting and quality controls for all its outsourced development activities.

·DG TAXUD estimates, approves and monitors its IT budget.

·DG TAXUD has created an IT security strategy with a corresponding roadmap and regularly monitors its implementation.

The IAS did not formulate any critical or very important recommendations.

Part 2
Follow-up engagements 

1.

1.0.Follow-up audit in DG BUDG on the management of recovery orders for competition fines (including guarantees for competition fines) and for recovery orders in the context of the Commission's 'corrective capacity' – Phase II (based on two follow-up audits performed in 2022)

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented:

·Recommendation No 3 (important): monitoring and reporting on fraud cases.

·Recommendation No 5 (important): DG BUDG’s automatic validation and calculation of due dates.

1.1.Follow-up audit in DG DEFIS on the supervision of the implementation of the 2014-2020 programme for the European Geostationary Navigation Overlay Service (EGNOS)

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented:

·Recommandation No 1 (important): EGNOS extension to non-EU countries.

·Recommendation No 6 (important): monitoring and reporting of the EGNOS 2014-2020 programme.

The following recommendations were assessed as not fully and/or adequately implemented:

·Recommendation No 2 (important): GSA’s annual reporting package

The 2021 annual reporting package was submitted by European Union Agency for the Space Programme (e) with one week delay from the agreed deadline. The independent audit body opinion, due on 15 March, has not yet been received and it is not expected before the end of July. This delay will again prevent DG DEFIS from using the information in the ongoing internal audits.

·Recommendation No 5 (important): monitoring access to EGNOS services

In November 2021, DG DEFIS sent a formal letter to the European Union Aviation Safety Agency (EASA) requesting a periodic verification by EASA of non-EU countries’ continuous compliance with the relevant provisions of the Single European Sky regulation related to the EGNOS Safety of Life service.

EASA replied to the request - requesting further instructions from DG DEFIS regarding the content, timing and characteristics of the reporting.

Although the process for establishing a monitoring mechanism by DG DEFIS has been initiated, it has not been completed and therefore not yet effectively implemented.

1.2.Follow-up audit in DG DIGIT on the management of public cloud services (multi-DG)

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented:

·Recommendation No 1 (very important): governance of cloud service.

1.3.Follow-up audit in DG DIGIT on intellectual property rights supporting activities

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were not fully and/or adequately implemented:

·Recommendation No 1 (very important): efficiency and effectiveness of intellectual property rights (IPR) management in DIGIT

The JRC, in its role as the Commission’s central intellectual property (IP) service, established EURECA, a database for the declaration and management of IP assets, including information technology (IT) software.

DG DIGIT provided guidance and technical support to other DGs which have IP assets to declare and started encoding its own IP assets in the EURECA database.

However, not all of DG DIGIT’s assets with high ‘asset relevance’ have been encoded in EURECA and the use of the database is not yet systematic within DG DIGIT. For this reason, there is no systematic identification of the IP assets with high ‘asset relevance’ (assets that are likely to be distributed outside the Commission), and no assessment of the related risks.

DG DIGIT should work towards a realistic completion date for populating the database and harmonising its use.

DG DIGIT is currently developing a scanning tool intended to automatically identify assets encoded in EURECA which may not be suitable for distribution outside the Commission, due to incompatibility of software licences. This will assist in the risk assessment specific to the management of IT software IP assets. However, the tool is not yet in production (expected by the end of 2022) – as an interim solution prior to full implementation of the action, a data catalogue has been established to record the necessary information.

·Recommendation No 4 (very important): software and IT solutions

While DG DIGIT planned to revise the General Terms and Conditions for Information Technology Contacts (GTCs), it finally set up a working group with DG BUDG, DG INTPA, the Legal Service and the JRC to provide a Commission-wide model framework contract that can be adapted by all users according to their specific needs, including IT procurement. Once in place, this model will replace the three currently used by DG BUDG, DG DIGIT and DG INTPA, making obsolete the current DG DIGIT GTCs. However, the template has not yet been agreed and the process is expected to be finalised before the end of 2022, following an inter-service consultation.

DG DIGIT, jointly with the JRC, created a software policy for the Commission to regulate the dissemination of software owned by the Commission. The resulting Commission decision C(2021)8759 on the open-source licensing and reuse of Commission software was adopted on 8 December 2021. This part of the recommendation is considered by the IAS as implemented.

Considering the actions taken to mitigate the risks identified by the IAS in the audit report, both recommendations were downgraded from very important to important.

1.4.Follow-up audit in DG EAC on information technology governance and project management

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented:

·Recommendation No 3 (important): software development practices.

1.5.Follow-up audit in DG EAC on the effectiveness of the protection of personal data of beneficiaries of and participants in the Erasmus+ and European Solidarity Corps programmes (based on two follow-up audits performed in 2022)

Based on the results of the follow-up audits, the IAS concluded that the following recommendations were adequately and effectively implemented:

·Recommendation No 2 (important): handling of data subjects’ request.

·Recommendation No 3 (very important): supervision of processors’ compliance with the EU data protection regulation.

·Recommendation No 4 (very important): storage limitation principle.

·Recommendation No 6 (important): handling of personal data breaches.

The following recommendation was assessed as not fully and/or adequately implemented and was downgraded from very important to important:

·Recommendation No 1 (very important): Information to Erasmus+ participants during personal data collection

DG EAC informed all Erasmus+ participants for whom there is already data in its databases about their rights as data subjects, either via a link in the message to the participants’ survey or in a separate message, fully in line with the obligations of the data controller towards the data subjects.

For the future storage of personal data, DG EAC has designed a process which is compliant with the EU data protection regulation setting out the role of National Agencies, beneficiaries or Commission systems in conveying this information. DG EAC accordingly updated all relevant records, privacy statements, and templates of agreements between the parties to reflect the new setup.

According to the new approach, the data controller should inform the data subjects about the data processing and their rights during the data collection. This process was put in operation for the IT system (MobilityTool+) which supported the Erasmus+ programme during the previous multiannual financial framework. However, for the new multiannual financial framework, DG EAC changed the IT system managing personal data processing, but has yet to develop and implement the same process for informing participants. Consequently, there is a backlog of Erasmus+ participants (data subjects) of more than one year, who have not yet been informed about their rights. DG EAC should activate the same process as in the MobilityTool+ in the new IT system and clear the backlog using a method as applied previously (for example a separate message).

Based on the review of the information and supporting documents provided, the IAS considered that DG EAC partially mitigated the risks related to the observation through the actions taken. Therefore the IAS downgraded it from very important to important and re-opened it in its recommendations tracking system.

1.6.Follow-up of outstanding recommendations from past audits in DG ECHO

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented:

Audit on the control strategy for humanitarian aid actions

·Recommendation No 2 (important): (Re-)assessment of non-governmental organisations.

·Recommendation No 5 (very important): ex post headquarters audit and verifications.

1.7.Follow-up of outstanding recommendations from past audits in the FPI

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented:

Audit on Performance Management in the FPI

·Recommendation No 3 (important): performance monitoring and reporting.

1.8.Follow-up of outstanding recommendations from past audits in DG HOME (based on two follow-up audits performed in 2022)

Based on the results of the follow-up audits, the IAS concluded that the following recommendation was adequately and effectively implemented:

Audit on DG HOME’s audit activity and clearance of accounts

·Recommendation No 1 (very important): Set-up and planning of DG HOME’s audit activity.

·Recommendation No 2 (very important): execution of the audit plan.

·Recommendation No 4 (important): quality assurance.

Audit on the preparation for the 2021-2027 programming period of DG HOME funds

·Recommendation No 1 (very important): delays in the work programmes of the thematic facility.

·Recommendation No 2 (very important): monitoring of progress in the programming of 2021-2027 period and reporting to senior management.

1.9.Follow-up audit in DG INTPA on pillar assessment 

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was not fully and/or adequately implemented:

·Recommendation No 27 (important): follow-up of verification mission recommendations related to findings that may affect pillar compliance

To implement the audit recommendation, DG INTPA has:

—Revised the terms of reference and the template for the expenditure verification report to enable the reporting of systemic findings. In accordance with the template, the report shall include the systemic findings identified, their nature and the reasons they are considered systemic. However, neither the terms of reference nor the instructions included in the template for the expenditure verification report: (1) specify that the auditors should report non-financial systemic findings (related to for example internal control, compliance), and (2) require that the auditors assess if the finding may negatively affect pillar-compliance.

—Designed a procedure to identify and analyse systemic findings on an annual basis and inform DG BUDG and the lead service for pillar assessment about the outcome of its analysis. DG INTPA has decided that, in its first year of application, the procedure will be limited to ‘globally operating international organisations whose audit task management is centralised’ but has not yet decided if and when it will be extended to other pillar-assessed entities.

The system put in place by DG INTPA will be used for the first time for the preparation of the 2023 annual audit and verification plan.

1.10.Follow-up audit in the JRC on information technology governance and project management

Based on the results of the follow-up audits, the IAS concluded that the following recommendation was adequately and effectively implemented:

·Recommendation No 3 (important): software development practices.

·Recommendation No 4 (important): IT risk management.

1.11.Follow-up audit in DG NEAR on annual audit plans

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented:

·Recommendation No 3 (very important): key performance indicators and reporting.

The following recommendation was assessed as not fully and/or adequately implemented and was downgraded to important:

·Recommendation No 2 (very important): Follow-up of audit results.

DG NEAR adopted a Procedure to report on findings stemming from verification missions to international organisations in January 2022. The design of the procedure is adequate, but its practical implementation will only be assessed once it is completed for the first time (first half of 2023).

DG NEAR has not yet revised the guidance on the follow-up of financial findings. For this reason, the recommendation cannot be considered as fully implemented. However, based on the progress made by DG NEAR, the IAS downgraded the recommendation from very important to important.

1.12.Follow-up audit in DG NEAR on the Neighbourhood Investment Facility and the Western Balkans Investment Framework

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented:

·Recommendation No 6 (important): Western Balkans Investment Framework (WBIF) – Project reporting.

·Recommendation No 7 (very important): Western Balkans Investment Framework (WBIF) - Monitoring at the facility level.

1.13.Follow-up audit in the OIB on the procurement process

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was not fully and/or adequately implemented and downgraded the recommendation from very important to important:

·Recommendation No 1 (very important): procurement procedures

Regarding the second part of the action plan on a revised ‘Kallas procedure’, the OIB made some progress, as follows:

—The OIB and DG HR set up a working group in 2018 to prepare the revision of the ‘Kallas procedure’ in accordance with the Financial Regulation.

—The OIB prepared a working document including a proposal for a substantially revised ‘Kallas procedure’ and submitted it to the members of the working group at the end of September 2018. The working group submitted its comments on the revised methodology to the OIB in September 2020, which was subsequently discussed with DG BUDG and the Legal Service.

—The drafting of the ‘new methodology’ (the revised ‘Kallas procedure’), is being finalised. The Legal Service provided their legal analysis in 2022, which DG HR has now taken into consideration for the revised version. Another round of informal consultation with DG BUDG, the Legal Service and the SG was initiated. Once finalised, the inter-service consultation is expected to be launched in the second quarter of 2022.

The IAS recognised that:

—The ‘Kallas procedure’ plays an advisory role to the Real Estate Committee, while supplementing the Financial Regulation.

—Until the revision of the procedure is finalised, Annex 20 of the Commission Decision C(2018) 5120 on the Internal rules for the implementation of the general budget of the EU constitutes the formalised rules for the management of real estate transactions and they are aligned with the provisions of the Financial Regulation.

However, until the new methodology to replace the ‘Kallas procedure’ is approved, the IAS considers that this part of the recommendation is not fully implemented as the aspects related to clarifying market prospects and the negotiation processes are not yet sufficiently addressed. The ‘new real estate methodology’ is expected to be more flexible, to focus on the strict application of the Financial Regulation and to improve the prospecting and negotiating process in order to address certain weaknesses of the previous methodology and to bring the real estate methodology closer to the evolving building needs of the Commission.

However, the actions taken by the OIB (together with those on-going), reduce the risk initially identified regarding weaknesses in the needs analysis which was that tender specifications may not fully respond to the real requirements of the organisation and that procured goods or services may not be fit for the intended purposes. Consequently, the recommendation was downgraded from very important to important.

1.14.Follow-up audit in OLAF on the human resources strategy

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented:

·Recommendation No 2 (very important): task and skills mapping.

·Recommendation No 3 (very important): workload assessment and staff allocation.

·Recommendation No 4 (important): recruitment (selection of temporary agents).

·Recommendation No 5 (important): staff development.

·Recommendation No 6 (important): staff satisfaction with working methods and environment.

1.15.Follow-up audit in OLAF on performance management

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented:

·Recommendation No 1 (important): roles and responsibilities for performance management activities.

1.16.Follow-up audit in DG REFORM on the processes put in place for the delivery of technical support to Member States

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented:

·Recommendation No 2 (important): defining project output indicators and reporting on project implementation.

1.17.Follow-up audit in DG RTD on IT project management and software development

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented:

·Recommendation No 2 (important): IT project governance.

1.18.Follow-up audit in the SG on the Commission’s strategy for data, information and knowledge management (based on three follow-up audits performed in 2022)

Based on the results of the follow-up audits, the IAS concluded that the following recommendations were adequately and effectively implemented:

·Recommendation No 1 (very important): design of the Data Information and Knowledge Management (DIKM) strategy.

·Recommendation No 2 (very important): strategic layer – the IMSB.

·Recommendation No 3 (important): cooperation between IMSB and ITCB.

·Recommendation No 4 (very important): role and responsibilities of the Information Management Team.

·Recommendation No 5 (very important): data, information and knowledge management governance - Sharing of information on progress and deliverables of actions.

·Recommendation No 6 (important): Data, information and knowledge management work programme and data strategy action plan.

·Recommendation No 7 (important): data quality.

1.19.Follow-up audit in the SG on crisis communication in DG COMM, the SG, DG SANTE and DG ECHO

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately implemented:

·Recommendation No 2 (important): capacity building.

1.20.Follow-up audit in DG TAXUD on human resource management

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were not fully and/or adequately implemented and were downgraded from very important to important:

·Recommendation No 3 (very important): human resources management - task and skills mapping.

DG TAXUD:

—Moved to the use of ATLAS in full mode and implemented a process to update the system regularly.

—Finalised the mapping of tasks across the Directorate-General.

—Designed the skills mapping tool, and adopted the skills assessment process based on a staff survey and meetings between the human resources correspondent and the Directors.

—Defined the gap analysis process which is to be based on the results of the skills assessment.

However, the implementation of the skills assessment process is still ongoing. DG TAXUD will perform the gap analysis once the skills assessment process is finalised.

·Recommendation No 4 (very important): workload assessment, staff allocation and project teams.

DG TAXUD:

—Designed the workload assessment framework, which includes the workload assessment process, workload indicators covering the activities of the Directorate-General and a monitoring dashboard.

—Established staff allocation criteria and planned their regular revision.

—Designed the staff allocation process.

—Put in place tools to manage and monitor staff allocation (the vacancy dashboard, a flexible secretary post to manage staff needs and the procedure for staff reinforcement).

—Analysed the reasons for the non-recoverable overtime and management’s response to requests for overtime recuperation in 2019 and 2020.

—Defined its approach to flexitime working arrangements in line with Commission Decision C (2022) 1788.

—Designed and communicated to staff guidelines on the establishment and management of project teams.

However, the assessment of staff allocation is still ongoing. Once finalised, DG TAXUD will re-allocate staff and balance workload, if considered necessary based on the results of the allocation assessment.

Considering the elements already implemented, the recommendations were downgraded from very important to important as the residual risk level is now considered medium.

1.21.Follow-up audit in DG TAXUD on the effectiveness of Directorate General for Taxation and Customs Union’s cooperation with external stakeholders

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was not fully and/or adequately implemented:

·Recommendation No 4 (important): management and monitoring of expert groups/project groups

In January 2022, DG TAXUD adopted new guidelines aligned with the Commission’s corporate rules on creating and managing expert groups (EG). When communicating the guidelines to staff, DG TAXUD emphasised the following main principles:

—Units managing the EGs are responsible for ensuring the overall compliance with the existing guidance.

—Senior management carries out quarterly reviews on the list of expert groups and related activities.

Moreover, Unit E2, Inter-institutional relations, coordination, communication and strategic planning, was appointed to liaise with other units, provide guidance and monitor compliance by screening a sample of EGs.

However, the guidelines have not yet been fully implemented. In particular, the IAS found that:

—The ‘Register of Commission Expert Groups and Other Similar Entities’ is not fully up to date. For example, some meeting agendas and/or minutes are not uploaded, and some EGs status (open, on hold or closed) are not timely recorded in the Commission’s register.

—The DG’s EGs internal overview file is not fully updated and aligned with the Commission’s register.

—The two quarterly screenings made on a sample of EGs (5 out of 50) were not fully effective. The first screening did not spot missed encoding of meetings. For the second screening, conducted in the second quarter of 2022, DG TAXUD selected one EG which had been closed in January 2022 and should therefore not have been sampled.

List of audits for which all recommendations were closed in 2022

Based on the results of the follow-up engagements performed in 2022, the IAS assessed that the audits listed below could be closed as all the recommendations were assessed as implemented. The audit titles are presented per policy area, and within each area they are ordered alphabetically (per European Commission DG/Service). Audits on several Commission Directorates-General and/or services (multi-entity audits) and horizontal audits, and audits in the area of information technology are presented separately.

Part 3 - Summary of long overdue recommendations

At the end of the reporting period, 31 January 2023, there were 3 very important long overdue recommendations, overdue by more than six months compared to the original expected completion dates set in the auditees’ initial action plans.

DG BUDG reported that a substantial part of the recommendation (three out of the four sub-recommendations) is implemented, and consequently, in their opinion, the residual risk is significantly reduced.

However, the set-up of a comprehensive and reliable set of tools at Commission level to monitor the financial and legal situation of contractors and beneficiaries is on-going. This action has been included into the proposal for a corporate strategy for the management of the accounts receivable prepared by DG BUDG. The Communication to the Commission - An enhanced corporate strategy for the management of the Commission’s debtors, planned to be launched in interservice consultation during the first quarter of 2022, was postponed. DG BUDG revised the expected completion date to 30 June 2023 as the re-launch of the adoption process is expected in early 2023 (after the recently amended Internal Rules).

In the meantime, intermediate measures were taken (awareness notes were sent to the eight most affected DGs requesting them to take a decision on the pending recovery orders and waivers, which, according to DG BUDG, they have done).

(1) ()    By Commission Implementing Decision (EU) 2021/173, the Innovation and Networks Executive Agency (INEA) was replaced by the new European Climate, Infrastructure and Environment Executive Agency (CINEA) on 12 February 2021.

(2) ()    Important recommendations are not listed in this annex.

(3) ()    Each summary reflects the IAS’s assessment of the implementation status of audit recommendations at the end of the follow-up engagement. It does not take into account any further action, with possible impact on the status of the recommendations, that the auditee may have undertaken and reported to the IAS since the release of the IAS follow-up note.

(4) ()    The practical implementation of the results of the review has recently started and could not be assessed during the IAS audit.

(5) ()    In addition to the Commission Directorates-General and services, the audit also covered the Clean Aviation Joint Undertaking, which is an EU autonomous body and therefore falls outside the scope of this report.

(6) ()    By Commission Implementing Decision (EU) 2021/173, the Innovation and Networks Executive Agency (INEA) was replaced by the new European Climate, Infrastructure and Environment Executive Agency (CINEA) on 12 February 2021.

(7)      COM (2023) 99 final specifies in its annex the methodology to determine partial suspension and partial payments in the context of the RRF

(8) ()    On 14 October 2020, the EDPS gave all European institutions a formal order to: (a) perform a mapping exercise to provide information concerning processing operations that involve international transfers of data, and (b) report to it any identified risks and gaps, in accordance with the order. The EDPS also asked the European institutions to perform, in a second phase, a case-by-case ‘transfer impact assessment’ to identify the level of protection provided by the third country of destination of the data. To facilitate this assessment, the EDPS will provide in due time specific guidance.