This document is an excerpt from the EUR-Lex website
Document 52014TA1210(25)
Report on the annual accounts of the European Union Agency for Network and Information Security for the financial year 2013, together with the Agency’s replies
Report on the annual accounts of the European Union Agency for Network and Information Security for the financial year 2013, together with the Agency’s replies
Report on the annual accounts of the European Union Agency for Network and Information Security for the financial year 2013, together with the Agency’s replies
IO C 442, 10.12.2014, p. 217–227
(BG, ES, CS, DA, DE, ET, EL, EN, FR, HR, IT, LV, LT, HU, MT, NL, PL, PT, RO, SK, SL, FI, SV)
10.12.2014 |
EN |
Official Journal of the European Union |
C 442/217 |
REPORT
on the annual accounts of the European Union Agency for Network and Information Security for the financial year 2013, together with the Agency’s replies
(2014/C 442/25)
INTRODUCTION
1. |
The European Union Agency for Network and Information Security (hereinafter ‘the Agency’, aka ‘ENISA’), which is located in Athens and Heraklion (1), was created by Regulation (EC) No 460/2004 of the European Parliament and of the Council (2) which, following different amendments was superseded by Regulation (EU) No 526/2013 (3). The Agency's main task is to enhance the Union’s capability to prevent and respond to network and information security problems by building on national and Union efforts (4). |
INFORMATION IN SUPPORT OF THE STATEMENT OF ASSURANCE
2. |
The audit approach taken by the Court comprises analytical audit procedures, direct testing of transactions and an assessment of key controls of the Agency's supervisory and control systems. This is supplemented by evidence provided by the work of other auditors (where relevant) and an analysis of management representations. |
STATEMENT OF ASSURANCE
The management’s responsibility
The auditor’s responsibility
Opinion on the reliability of the accounts
Opinion on the legality and regularity of the transactions underlying the accounts
|
10. |
The comments which follow do not call the Court’s opinions into question. |
COMMENTS ON BUDGETARY MANAGEMENT
11. |
The overall level of committed appropriations was 94 %, which is explained mainly by the fact that additional funds requested from the Commission to finance the refurbishment of the new office in Athens were only approved in November 2013. In this context, an amount of 0,5 million euro that was not yet committed at year-end was carried over following a Management Board decision. |
12. |
In total, non-committed and committed appropriations carried over to 2014 amounted to 1,2 million euro (or 13,5 % of total appropriations). This mainly concerned Title II (administrative expenditure) with 0,8 million euro or 59 % of Title II appropriations. This high level is explained by the 0,5 million euro carry-over referred to in paragraph 11 and an additional 0,3 million euro carried over in order to finance furniture and networking equipment for the Athens office which was ordered towards the year-end. |
OTHER COMMENTS
13. |
Operational staff of ENISA were relocated to Athens in 2013 while administrative staff remain in Heraklion. It is likely that the administrative costs could be reduced if all staff were centralised in one location. |
14. |
According to the lease agreement between the Greek authorities, the Agency and the landlord, rent for the offices in Athens is paid by the Greek authorities. This rent is constantly paid with a delay of several months which is a business continuity and financial risk to the Agency: its operations would be affected, and its investments in office fitting and refurbishment would be lost, if the landlord were to cancel the lease agreement because of these delays in payment. |
FOLLOW-UP OF PREVIOUS YEARS’ COMMENTS
15. |
An overview of the corrective actions taken in response to the Court's comments from previous years is provided in Annex I. |
This Report was adopted by Chamber IV, headed by Mr Pietro RUSSO, Member of the Court of Auditors, in Luxembourg at its meeting of 16 September 2014.
For the Court of Auditors
Vítor Manuel da SILVA CALDEIRA
President
(1) The Agency’s operational staff were relocated to Athens in March 2013. Its administrative staff remain in Heraklion.
(3) OJ L 165, 18.6.2013, p. 41.
(4) Annex II summarises the Agency's competences and activities. It is presented for information purposes.
(5) These include the balance sheet and the economic outturn account, the cash flow table, the statement of changes in net assets and a summary of the significant accounting policies and other explanatory notes.
(6) These comprise the budgetary outturn account and the annex to the budgetary outturn account.
(7) Articles 39 and 50 of Commission Delegated Regulation (EU) No 1271/2013 (OJ L 328, 7.12.2013, p. 42).
(8) The accounting rules adopted by the Commission’s accounting officer are derived from the International Public Sector Accounting Standards (IPSAS) issued by the International Federation of Accountants or, where relevant, the International Accounting Standards (IAS)/International Financial Reporting Standards (IFRS) issued by the International Accounting Standards Board.
(9) Article 107 of Regulation (EU) No 1271/2013.
ANNEX I
Follow-up of previous years’ comments
Year |
Court’s comment |
Status of corrective action (Completed/Ongoing/Outstanding/N/A) |
2011 |
The Court identified the need to improve the documentation of fixed assets. Purchases of fixed assets are recorded at invoice and not at item level. When several new assets are covered by one single invoice, there is only one entry for all the purchased assets and the total amount. |
Completed |
2012 |
Whereas the Financial Regulation and the corresponding Implementing Rules provide for a physical inventory of fixed assets at least every three years, the Agency has not carried out a comprehensive physical inventory since 2009. |
Ongoing |
ANNEX II
European Union Agency for Network and Information Security (Athens and Heraklion)
Competences and activities
Areas of Union competence deriving from the Treaty (Article 114 of the Treaty on the functioning of the European Union) |
‘The European Parliament and the Council shall, acting in accordance with the ordinary legislative procedure and after consulting the Economic and Social Committee, adopt the measures for the approximation of the provisions laid down by law, regulation or administrative action in Member States which have as their object the establishment and functioning of the internal market.’ (Article 114 TFEU) Responsibility for the internal market is shared between the Union and the Member States (Article 4(2)(a) TFEU). |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Competences of the Agency (Quoted from Regulation (EU) No 526/2013 of the European Parliament and of the Council) |
Objectives
Tasks
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Governance |
Management Board The Management Board is composed of one representative of each Member State, and two representatives appointed by the Commission. All representatives have voting rights. Each member of the Management Board has an alternate to represent the member in their absence. Members of the Management Board and their alternates are appointed in light of their knowledge of the Agency’s tasks and objectives, taking into account the managerial, administrative and budgetary skills relevant to fulfil the tasks of a member of the Management Board. The term of office of members of the Management Board and of their alternates is four years. That term is renewable. Permanent Stakeholders Group The Management Board, acting on a proposal by the Executive Director, appoints a Permanent Stakeholders’ Group composed of recognised experts representing the relevant stakeholders, such as the ICT industry, providers of electronic communications networks or services available to the public, consumer groups, academic experts in network and information security, and representatives of national regulatory authorities notified under Directive 2002/21/EC as well as of law enforcement and privacy protection authorities. The term of office of the Permanent Stakeholders’ Group’s members is two and a half years. The Permanent Stakeholders’’ Group advises the Agency in respect of the performance of its activities. In particular, it advises the Executive Director on drawing up a proposal for the Agency’s work programme, and on ensuring communication with the relevant stakeholders on all issues related to the work programme. Executive Director The Executive Director is appointed by the Management Board, from a list of candidates proposed by the Commission, following an open and transparent selection procedure, for a term of five years which is renewable. Executive Board The Executive Board is made up of five members appointed from among the members of the Management Board. It must include the Chairperson of the Management Board, who may also chair the Executive Board, and one of the representatives of the Commission. External audit European Court of Auditors. Internal audit Internal Audit Service of the European Commission. Discharge authority European Parliament on a recommendation from the Council. |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Resources made available to the Agency in 2013 (2012) |
Final Budget 9,7 million euro (8,2 million euro) of which the Union subsidy is 93 % (100 %) Staff at 31 December 2013 47 (44) posts provided for in the establishment plan, of which occupied: 43 (42). Other posts occupied: 13 (12) contract agents; 3 (4) seconded national experts. Total staff: 59 (58), undertaking the following tasks: operational: 42 (40) administrative: 17 (18) |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Products and services provided in 2013 (2012) |
WS (1) 1 — Evolving risk environment & opportunities The objective of this work stream was to identify the most important evolving threats that are relevant to critical infrastructure and trust services. This was done by monitoring publicly available sources that publish threat-related data and by making a regular assessment of this data. Based on the analysis done, ENISA has proposed good practices and guidelines for mitigating these risks. The work has been performed in a collaborative manner with involved stakeholders and has used existing information sources wherever possible. The following objectives and results are achieved:
Number of deliverables: 7 (7) WS2 — Improving Pan-European CIIP (2) & Resilience Protecting Critical Information Infrastructures (CIIP) is a key priority for Member States, the Commission and industry (operators, service providers, manufacturers). By facilitating cooperation and coordination among Member States, ENISA has continued in this work stream to support all of these stakeholders in developing sound and implementable preparedness, response and recovery strategies, policies and measures to meet the challenges of a continuously evolving threat environment. The objectives and consequently results of this work stream were to:
Number of deliverables: 16 (13) WS3 — Enabling communities to improve network and information security (NIS) The aim of this work stream was to help the communities that are instrumental in improving NIS to enhance their capabilities and to facilitate their work through the improvement of the legal and regulatory scenarios that they must comply with. ENISA has continued to work with CERTs to improve baseline capabilities in Europe. The Agency has also complemented this approach by addressing other communities that are active in improving NIS of their systems and infrastructure such as network and information systems managers as well as providers of security services within individual organisations (e.g. Information Security Officers (ISOs)). The objectives and results of this work stream were:
Number of deliverables: 15 (10) |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
(1) WS: Work stream
(2) CIIP: Critical Information Infrastructure Protection
Source: Annex supplied by the Agency.
THE AGENCY’S REPLIES
11. |
The Agency notes that the 0,5 million euro carried over at year end were committed in 2014 at a rate of 99,78 %, and only an amount of 1 100.00 euro was cancelled. |
12. |
The total carry over of Title II, which reached the rate of 59,1 % of total Title II appropriations for 2013 can be further broken down to 50,5 % linked to projects and purchases relevant to the refurbishment works and upgrade of infrastructure of Athens office and 8,6 % relevant to projects not linked to the refurbishment project, such as day to day utilites’ costs. The funds for the refurbishment works were only approved on 4 November 2013. |
13. |
The Agency notes that the creation of an additional office based in Athens was a political compromise reached among the European Parliament, the Commission and the government of the host country, in order to increase the operational efficiency of the Agency and in particular of the work of the Core Operations Department. This decision was beyond the influence of ENISA. |
14. |
The Agency agrees with the comment and notes that it continuously communicates the problems and the risks involved to the partner DG CNECT and various authorities of the Greek Government in order to ensure that the issues pertaining to the payment of the subsidy from the Greek Government are overcome. To date the landlord has accepted the delays attributed to procedures of the Greek Government without imposing any penalty on the Agency. The landlord has given his consent to the launch of the refurbishment works, despite the delay in the payment of rent in 2014. The Agency, following a risk assessment which took into account the facts also noted by the Court, has launched the refurbishment works in June 2014, as the risk of cancellation of the lease agreement is considered low. The Agency continues to exercise and explore all possible remedies arising from the late payments from the Greek Government. To date the Agency has been able to mitigate any risks arising from the late payments. |