52006SC0049

[pic] | COMMISSION OF THE EUROPEAN COMMUNITIES |

Brussels, 17.1.2006

SEC(2006) 49

COMMUNICATION TO THE COMMISSION FROM VICE-PRESIDENT KALLAS IN AGREEMENT WITH THE PRESIDENT AND MS GRYBAUSKAITÉ

Commission Action Plan towards an Integrated Internal Control Framework:Gap analysis and action plan for Commission services

{COM(2006) 9 final}

COMMUNICATION TO THE COMMISSION FROM VICE-PRESIDENT KALLAS IN AGREEMENT WITH THE PRESIDENT AND MS GRYBAUSKAITÉ

Commission Action Plan towards an Integrated Internal Control Framework: Gap analysis and action plan for Commission services

1. INTRODUCTION AND BACKGROUND

1.1. Ending the qualified DAS

Financial year 2004 was the eleventh successive financial year for which the European Court of Auditors issued a qualified statement of assurance (or DAS) as regards payments relating to all parts of the general budget of the European Union, except for administrative expenditure and pre-accession aid and the portion of agricultural expenditure subject to IACS. The qualified DAS reflects the complexity of the issues facing the Commission in implementing the EU budget, and the challenge of providing the Court of Auditors with satisfactory audit evidence.

The negative impact of this qualified DAS on the public perception of the EU must be addressed, and the Commission has made it a strategic objective to achieve a positive DAS during its mandate.

The Commission adopted a “Roadmap to an Integrated Internal Control Framework”[1] in June 2005, which set out proposals for an adequate Community integrated control framework in order to attain this objective. Consistent with ECA opinion No 2/2004[2] on an effective and efficient integrated internal control framework, this communication proposed an integrated framework that would help to ensure more effective and efficient internal control of EU funds and provide a sound basis on which the Court could rely when drawing up its statement of assurance.

The Action Plan contained in this communication sets out the actions that the Commission and its services need to take in order to reach this target, also taking into account the reactions from the Parliament and Council and informal advice from the Court of Auditors.

1.2. Progress since the Commission’s Roadmap Communication

1.2.1. At Commission level

Signing off of the Commission's accounts by the Accounting Officer has been proposed as part of the revision of the Financial Regulation adopted on 3 May 2005. The increased use of materiality criteria will add weight to the assurance given by Directors-General. The Commission-wide management assessment has been strengthened in the 2004 Synthesis[3]. In the 2005 Synthesis report, the Commission will further improve the overall level of assurance which can be provided to the Court of Auditors. The Commission’s process of following up previous recommendations by the Court of Auditors is now supervised by the Audit Progress Committee. The Commission has also introduced a common methodology[4] for risk management within its services.

As instructed by the Commission in the Roadmap communication, the Commission's services have undertaken a ‘gap assessment’ exercise, which has culminated in a working document[5] setting out, for each management mode, the major gaps that still have to be filled in order to achieve an integrated control framework. Four working groups contributed to formulating the issues to be addressed in this communication.

1.2.2. At Member State level

On 21 and 22 September 2005, representatives from the operational, audit and financial services of all Member States met under the joint chairmanship of the Commission and the Presidency of the Council to discuss this gap assessment report and possible ways to support the Commission in defining and implementing its integrated internal control framework. Members of Parliament's Budgetary Control Committee and senior staff of the Court of Auditors attended this meeting.

Following discussions in the Budgetary Committee and COREPER, ECOFIN confirmed the Council’s support for the Roadmap initiative on 8 November 2005 and pledged the Member States' cooperation in a number of areas, such as cost-benefit analysis and the adoption of common control principles with a view to simplification. In the course of the discussions, five Member States committed themselves to signing Contracts of Confidence regarding controls over Structural Funds.

The Council conclusions provided welcome statements in a number of areas, including:

- support for the concept that an effective internal control framework should provide the Court with reasonable assurance regarding the management of risk in the underlying transactions and, in the case of multi-annual programmes, the assessment of the risk of error over the whole period;

- simplification of legislation for the period 2007-2013, consistent with providing reasonable assurance;

- scope for harmonisation of the control principles and standards implemented by the Commission and Member States, based on international best practice;

- support for contract of confidence initiatives with volunteer Member States;

- improvement of controls by building on existing control structures with a view to improving the cost-benefit ratio and promoting simplification.

However, the Council rejected the proposal for management declarations at the highest political level. Nevertheless, it concluded that existing operational-level declarations can be an important means of assurance for the Commission and, ultimately, the Court of Auditors, and that such declarations should be useful and cost-effective.

2. GAP ASSESSMENT: RESULTS AND MAIN POINTS OF CONCERN

The Commission’s internal control

The detailed analysis of the gap assessment by the different services, summarised in Annex 2, confirms that the building blocks of the Commission’s internal control are in place. For each management mode, there are control procedures to manage the risk of irregularity in the underlying transactions. The checks on underlying transactions are rarely exhaustive. The intensity of the checks, though related to some extent to their costs and benefits, is decided empirically; this approach needs to be further developed. In the areas where the risk is thought to be greatest, ex-ante checks are intensified, for example with the aid of the Commission's delegations. Likely risks in the agricultural sector have been minimised by using the Integrated Administration and Control System, or additional ex-post controls. In the case of assistance schemes centred on all but the largest projects, managers are led by cost/benefit considerations to implement on-the-spot controls at the time of the final claim, or after the project is completed, and thus to accept a greater risk of error in the interim claims.

Internal control by Member States and third parties

For the cases where the Commission relies on other authorities to manage the risk of error in the underlying transactions, there is a framework of controls in place at regional and central level which can give the Commission assurance that this risk is properly managed by the responsible authorities. The Commission verifies how this framework is operating and, when it finds that Community funds have been put at excessive risk, it suspends payments and makes financial corrections, thus repairing the damage to the Community's budget. These structures have been further reinforced in the new legislative proposals for 2007-2013 and will be further fine-tuned through appropriate implementing rules and guidance.

In this way, errors in individual claims can be detected before payment, corrected at the time of the final claim on the project concerned or after an ex-post audit, or compensated for by a financial correction charged to a Member State or relevant third party.

Areas for improvement

Practices differ, however, between the various services of the Commission and also, in the case of shared management, from one Member State to another. If the Commission is to achieve a coherent internal control framework, it will need to:

- establish common internal control principles and common benchmarks, where necessary tailored to the particular policy area, to guide services in the use of management declarations, audit certificates, ex ante checks, ex post control strategies and sampling techniques;

- define a common method to present the basis on which reasonable assurance was gained by the Directors-General, to explain how risks were addressed and control procedures were optimised;

- develop further the sharing of the results of audits and controls carried out by the Commission services or other stakeholders, and the recording of their follow-up, at DG-family level and at Commission level for common points of interest;

- incorporate a cost-benefit approach in the control strategies . On the basis of a cost estimation phase and a phase on the exploration of potential benefits (including the dissuasive effect), it will gradually become possible to quantify the tolerable level of risk.

The following principles will guide the Commission’s action plan in its efforts to strike the right balance between ensuring adequate control and avoiding onerous compliance requirements:

- Consistency, based on the control principles in the ECA’s Single Audit Opinion and on generally accepted internal control practices and benchmarks, in order to ensure a consistent approach in areas which are similar in terms of type of beneficiaries and implementing bodies, nature of the activity and volume and size of transactions.

- Simplification of legislation and control structures, where feasible, in order to reduce the burden on the various stakeholders, while continuing to guarantee a sufficient level of supervision.

- Flexibility and accountability: taking account of the specific environment of each policy area and the intermediate control levels, a proportionate level of reporting is required in order to demonstrate that the risks of error are being properly managed. The Commission supports flexibility in utilising national administrative arrangements, where possible, but considers that there is a resulting need for greater accountability of these partners in implementing the EU budget.

- Openness with regard to control activities, results and follow-up is a necessary condition for a principle-based framework to function correctly. In an integrated control framework, only well-defined and documented structures make it possible to rely on controls at each consecutive level, and hence to achieve a 'single audit'.

3. PRACTICAL PROPOSALS FOR ACTION IN 2006 AND 2007

3.1. Common internal control principles and common benchmarks

3.1.1. Principle of effective and efficient internal control in the Financial Regulation

To provide an overarching legal basis, the Commission proposes to introduce a budgetary principle on effective and efficient internal control in the revision of the Financial Regulation[6], which is currently at the inter-institutional consultation stage. This will be a means of guaranteeing that all stakeholders are bound by a fundamental set of control principles, and will define the ultimate goal of internal control in terms of the efficient management of risk in the underlying transactions. Common baselines would also provide the Court of Auditors with a clearer basis for the audit of management processes and procedures.

3.1.2. Adding value via management declarations

Member States have different views about management declarations at national level. Nevertheless, the Commission’s view is that management declarations strengthen the accountability of those directly responsible for the management of funds. The Commission therefore seeks to promote the use of management declarations or similar statements as a key instrument in internal control for shared management, decentralised management, joint management and indirect centralised management, where these are not already in place.

The gap assessment identified a potential for sharing and benefiting from the experience of other services, which should lead to guidelines on how to make management declarations more effective. These guidelines could cover, for example, the control chain, materiality, error classification and reservations. This reflection will draw on the experience of the services already applying these control mechanisms, culminating in practical guidelines from September 2006.

3.1.3. Common principles for obtaining assurance from external control and audit bodies

A need was identified for common principles to ensure that controls by external auditors and certifying/audit bodies are carried out to an adequate standard, and that the nature and impact of these controls on underlying transactions at beneficiary level is fully understood. This is a key condition for implementing the single audit approach.

As regards structural measures, the ‘Contract of Confidence’ initiative provides a model for bilateral agreements in the field of audit and control. The Commission will seek to conclude such contracts with those Member States which have already committed themselves at political level (Denmark, the Netherlands, Austria, Portugal and the United Kingdom), to extend the use of the contract of confidence to other volunteering Member States, and propagate these principles in the field of management control.

The regulatory frameworks to be introduced for the period 2007-2013 provide an opportunity to harmonise the application of the underlying principles governing the nature and extent of controls. The philosophy of the Contract of Confidence is also embedded in the future Council regulation on the Structural Funds. The Commission expects the Council to bear this aim in mind when finalising the negotiation on the legislation for 2007-2013.

For the audit and control activity undertaken by each policy family, the Commission will prepare guidelines which build on the services’ existing practices and on international professional standards. These will assist DGs and services in:

- establishing control strategies which are clear, simple and robust, and which take account of the multi-annual nature of many programmes;

- establishing criteria for audit programmes for certification auditors, including a focus on “agreed upon procedures” assignments;

- accreditation, training and monitoring of external auditors;

- reducing the administrative burden and making maximum use of controls and reporting already in place;

- adopting a common approach to ascertaining the impact on the EU budget of non-compliance with applicable conditions (including general EU rules) and of other errors.

- adopting common approaches to the use of risk-based and representative sampling, in terms of correcting and identifying the overall incidence of errors.

In addition, a tender will be launched in mid-2006 for a common framework contract to be made available to all DGs and services, covering various methodological areas and implementation of control tasks and tracking control performance.

3.2. Common method for presenting the control strategy at service level

3.2.1. Common templates for designing internal control structures

One of the major weaknesses noted in the gap assessment was the extent to which DGs and services are able to demonstrate the reliability and robustness of their internal control strategy and structures. The need to construct an overall view of the internal control flow and related accountability at service level calls for a common conceptual approach at Commission level.

The aim of these models, taking each management mode into account, is to improve the structure of the chain of control and to document how this chain of control underpins the reasonable assurance that has to be provided for the Annual Activity Report. Therefore, a number of internal control templates will be developed for different environments on the basis of the following considerations:

- balancing ex ante and ex post controls;

- making ex ante and ex post desk reviews more effective (in particular by timing reviews so that corrective action is still feasible);

- assessing the risk profile of beneficiaries (and intermediaries);

- adapting controls/audits, so that the degree of confidence and materiality for sampling corresponds to the risk environment and risk acceptance;

- taking account of the multi-annual nature of programmes;

- applying fair and proportionate levels of financial corrections or sanctions, where appropriate, and obtaining recoveries;

- prioritisation between controls at the levels of final beneficiary and implementing body;

- clarifying the roles and responsibilities of the various actors, in the Structural Funds in particular.

After a Commission-wide inter-service consultation, these models should be adopted by the Commission by May 2006.

3.2.2. Presenting an overview of the internal control strategy at DG or service level

The templates described above will allow DGs and services, with the support of horizontal services, to prepare a draft document on their control systems and related strategy by September 2006. This overview should express in simple terms how assurance is achieved through the different levels of control. Such an overview would include control systems in the Member States, where appropriate.

This documentation will then be re-examined informally for each DG policy family before the end of 2006. This will strengthen the basis for consistent end–of-year reporting on internal control systems in the 2006 Annual Activity Reports. Services should update these control framework descriptions whenever major changes occur.

3.3. Sharing of audit and control results and recording of follow-up

Where several DGs or services cooperate with the same external partners and beneficiaries, the Commission will implement a coordinating mechanism so as to maximise efficiency in obtaining assurance on their systems.

Several DG policy families already share audit reports on beneficiaries, and Member States also provide annual summaries of audit activity in the form of plans or activity reports, and provide access to their reports if requested. The Commission proposes to enhance these sharing activities in order to develop benchmarking by DG policy family on categories of errors, the error rate detected by on-the-spot checks on the basis of representative samples and the corrective measures taken and/or planned. Audit results will be regularly analysed to identify significant problems which call for corrective measures. IT tools, such as SYSAUDIT and Issue Track, can be used as a basis for improving data sharing and the follow-up of recommendations. Each Commission service will report on the progress made in their 2006 Annual Activity Reports.

In addition to this approach by DG policy family, a Commission-wide approach and exchange of information will be structured around the sharing of control and audit information (especially systems audits) between DGs and services and high-level intermediaries, such as the UN, EIB, NGOs or implementing bodies (accreditation for decentralisation, national agencies in the field of education policy, etc.). This Commission-wide approach will be integrated in the ongoing development of the ABAC information system and will be implemented gradually once it is operational.

3.4. Implementation of a cost-benefit approach

As demonstrated by the gap assessment, it is possible to set the intensity of controls more effectively by reference to the costs and benefits. In 2006, based on the input from Member States and other stakeholders (as requested by the ECOFIN Council), the Commission will coordinate an initial estimate of the cost of controls in the areas of shared, decentralised, joint and indirect centralised management. It will propose a consistent methodology and seek to present the results in early 2007. As regards the costs of control for direct centralised management, each Commission service will provide an initial estimate by September 2006. This review will form a basis for discussion on the current distribution of control costs between services, and how these costs are related to the risks in the underlying transactions.

In addition, linked to the benchmarking audit and control work, a pilot exercise will be developed in the course of 2006 to evaluate the relative benefits of suspension of payments, recoveries and the dissuasive effect, although the latter will be difficult to quantify.

The Commission believes that, together with the development of a risk management culture, this analysis of the costs and benefits will provide valuable input for defining the risks that can be tolerated.

3.5. Actions addressing inter-institutional issues

Although the actions listed in sections 3.1 to 3.4 are related mainly to Commission activity, special attention will also be given to the following additional inter-institutional actions[7]:

- the Commission will launch an inter-institutional dialogue in March 2006 aimed at reaching an understanding with the Budgetary Authority on the basic principles to be considered regarding the risks to be tolerated in the underlying transactions, having regard to the costs and benefits of controls, and agreeing common benchmarks;

- as a number of simplifications are conditional on the adoption of the revised Financial Regulation and its Implementing Rules, the Council, European Parliament and European Court of Auditors could contribute to speeding up the inter-institutional consultation in progress;

- in the shared management area, the Commission will seek to ensure that there is an effective national coordinating body able, for example by a synthesis of operational declarations, to provide stakeholders with an overview of the status of internal control per policy area in the Member State;

- in the 2007-2013 regulations in all policy areas, including the research and structural funds, the Commission will keep under consideration the need to simplify the regulatory framework, including the rules on the eligibility of expenditure, as far as possible and to clarify the roles of all the actors involved;

- as requested by the ECOFIN Council, by the end of 2006 the Commission will examine the present controls in the area of the Structural Funds at sectoral and regional level and the value of existing statements and declarations on the basis of annual reporting to be delivered by Member States' authorities by 30 June 2006 under Article 13 of Regulation 438/2001 and on audits performed by the Commission services. Guidelines will also be provided on the appropriate roles of the various parties involved;

- Member States will also be invited to provide, using a comparable methodology, the necessary information to enable the Commission to assess the cost of controls in the context of shared management, as requested by Council.

4. CONCLUSIONS

While all institutions would like a positive DAS to be granted on the implementation of the budget, it is for the Commission and the Member States together to ensure that the Court is in a position to find audit evidence of progress towards adequate management of the risk of error. Eventually, the action plan could serve as a reference framework for the Court’s audits. The challenge at Commission level is to achieve consistency between the practices adopted by each DG or service, and to ensure that sufficient evidence is kept available for the Court of Auditors. Given that positive opinions have been received on administrative expenditure, pre-accession aid, the European Development Fund and that part of agricultural expenditure subject to IACS, the action plan will initially place the emphasis on internal policies, and the Structural Funds. It is proposed that the Commission

- adopt the summary of the gaps identified by the DGs and services in Annex 2, and

- instruct its services to integrate the actions required at service level in their regular AMP cycle;

- adopt the action plan as set out in Chapter 3 of this document and presented in more detail in Annex 1;

- empower Vice-President Kallas and Commissioner Grybauskaité, in agreement with the President, to adopt, after inter-service consultation, the templates for designing accountability structures, as set out in section 3.2.1.

ANNEX 1

A ction list for Commission services

No | Action | Sub-action | Ref. | Who | When |

Simplification and common control principles |

1 | Simplification review of proposed 2007-2013 legislation | Keep under consideration simplification of the rules for the 2007-2013 period concerning in particular the eligibility of expenditure in the structural funds and in the research programmes | 3.5 | Structural Funds family; RTD | 2006 |

2 | Integrate common internal control principles in the proposal for the revised Financial Regulation | Propose internal control as budgetary principle in the revised Financial Regulation on the basis of the results of the inter-institutional consultation | 3.1.1 3.5 | BUDG | First sem. 2006 |

3a | Establish and harmonise better the presentation of control strategies and evidence providing reasonable assurance | Establish Internal Control Templates which outline the range of control components (management declarations, balance of ex ante and ex post checking, certification, etc.) which would be expected in a given control environment | 3.2.1 | BUDG & DGs | 05/2006 |

3b | Demonstrate how DGs will gain assurance on the internal control structures for shared management and internal policies, taking the developed templates and control strategies at Commission-level into account. | 3.2.2 | Int. policy & shared management DGs * | 9/2006 |

3c | Organise peer review to enhance coherence and consistency of control strategies per family | 3.2.2 | Concerned DGs * | 12/2006 |

3d | Demonstrate how DGs will gain assurance on the internal control structures for external policy, administrative expenditure, pre-accession aid, EDF and own resources, taking the developed templates and control strategies at Commission-level into account | 3.2.2 | Concerned DGs * | 6/2007 |

3e | Organise peer review to enhance coherence and consistency of control strategies per family | 3.2.2 | Concerned DGs * | 12/2007 |

4 | Initiate inter-institutional dialogue on the basic principles to be considered regarding the risks to be tolerated in the underlying transactions | Launch inter-institutional initiative on the basic principles to be considered regarding the risks to be tolerated in the underlying transactions and the definition of common benchmarks for the management of this risk | 3.5 | BUDG | 03/2006 |

Management declarations and audit assurance |

5 | Promote operational level management declarations and synthesis reports per policy area at national level | Promote the use of management declarations at operational level in the negotiations on the 2007-2013 legislation for indirect centralised management (through national agencies, mostly in the area of education and culture) and the establishment of national coordinating bodies able to provide an overview of the assurance available for example by a synthesis of operational declarations per policy area. | 3.1.2 3.5 | AGRI Structural Funds family; EAC | First semester 2006 |

6a | Examine the utility of management declarations outside shared and indirect centralised management | Develop guidelines on making management declarations more effective in research and other internal policies (at beneficiary level) | 3.1.2 | BUDG & concerned DGs | 09/2006 |

6b | Extend guidelines on making management declarations more effective for external policies | 3.1.2 | BUDG & concerned DGs | 06/2007 |

7a | Promote best practices for increasing cost-benefit of audits at project level | Establish criteria for certification audits in research and internal policies, focusing on the use of ‘agreed upon procedures’ | 3.1.3 | BUDG & concerned DGs | 12/2006 |

7b | Examine criteria, where these are not already in place, for certification audits in shared management 2007-2013, considering also the use of ‘agreed upon procedures’ | 3.1.3 | Concerned DGs * | 03/2007 |

7c | Extend criteria for certification audits, focusing on the use of ‘agreed upon procedures’, to other management modes, where appropriate | 3.1.3 | BUDG & concerned DGs | 06/2007 |

8 | Facilitate additional assurance from SAIs | Analysis of potential additional assurance from SAIs on existing practice related to EU-funds. | 3.5 | BUDG & concerned DGs | 12/2006 |

Single audit approach: sharing of results and prioritising cost-benefit |

9a | Construct effective tools for the sharing of audit and control results & promote the single audit approach | Assess potential actions necessary for enhancing the sharing of audit and control results and recording of their follow-up in the area of - Internal policies, including Research - Structural Funds 2007-2013 - other policies | 3.3 | Concerned DGs * | 10/2006 05/2007 12/2007 |

9b | For expenditure under direct management, implement a tool linked to ABAC for a Commission-wide exchange of information on control and audit missions in intermediary bodies such as UN, EIB, NGOs, etc | 3.3 | BUDG | 05/2007 |

9c | Launch tender for a Commission-wide contractual framework DGs for assistance on methodological issues, implementation of control work and tracking control performance | 3.1.3 | BUDG | 09/2006 |

10a | Conduct an initial estimation and analysis in the costs of controls | Assess costs of controls in shared management based on - define a common methodology - launch initiative for data to be provided by Member States - provision of data by Member States - analysis of received information | 3.3 3.5 | BUDG & concerned DGs AGRI, Structural Funds family * | 05/2006 09/2006 02/2007 09/2007 |

10b | Make a first estimation on the costs of control incurred in direct centralised management expenditure | 3.3 | BUDG & concerned DGs | 12/2006 |

11 | Initiate pilot projects on evaluating benefits | Run a pilot-experience for evaluating benefits in the context of control of internal policies | 3.4 | BUDG & concerned DGs | 03/2007 |

Sector-specific gaps |

12 | Address the gaps identified by participating services | Put in place steps to close these gaps via the Annual Management Plans, with follow up reporting on progress in the Annual Activity Reports | 4 | Every DG concerned | 03/2006 |

13 | Analyse the controls under Shared Management (in particular Structural Funds) at regional level and the value of existing statements | - Finalise, as requested by Ecofin, the analysis for Structural Funds on the present controls at sector and regional level and the value of existing statements and declarations, taking the Article 13 annual reports due by June 2006 and the results of Commission audits into account. - Update, in the context of the Annual Activity Reports, how DGs gain assurance from the internal control structures for Structural Funds and Agriculture for the 2007-2013 period. | 3.5 3.2.2 | Structural Funds family * | 12/2006 12/2007 |

14a | Provide greater guidance for structural funds on managing the risk of error | Disseminate good practices for primary level checks to manage the risk of error in underlying transactions and recommend Member States to step up their information activities directed at beneficiaries, including information on controls and risk of cancellation of funds. | 3.2.1 and roadmap | Structural Funds family | 06/2006 |

14b | Provide in the context of the Structural Funds and indirect centralised management 2007-2013 guidelines for beneficiaries and/or intermediate levels on controls and responsibilities in the control chain | 3.1.2 3.5 | Structural Funds family, EAC | 01/2007 |

15 | Promote the ‘Contracts of Confidence’ initiative for Structural Funds | Conclude for Structural Funds ‘Contracts of Confidence’ with 8 Member States, if sufficient volunteers, as a sound basis to prepare for implementation of the new legislation and to improve assurance on expenditure under the existing legislation. | 3.1.3 | Structural Funds family | 09/2006 |

16a | Establish common guidelines per policy family | Establish guidelines, based on existing experience, on accreditation, training and monitoring of external auditors in the domain of research and other internal policies | 3.1.3 | BUDG & concerned DGs | 12/2006 |

16b | Develop common approaches to using risk and representative sampling in - research and other internal policies - external policies | 3.1.3 | Int. policy DGs * | 12/2006 12/2007 |

16c | Coordinate audit standards, error rate reporting, etc. for Structural Funds | 3.1.3 | Structural Funds family | 06/2007 |

* with the help of central services, if required

ANNEX 2

1. OVERVIEW OF MANAGEMENT MODES

1.1. Management modes and their relationship to control principles

For all management modes, the responsibility for minimising the risk of irregularity in the underlying transactions and effecting primary controls lies with the body responsible for implementing the assistance scheme concerned. When the Commission implements an assistance scheme directly, it can readily gain assurance that this risk is minimised by the responsible services, and can rapidly take the measures it deems necessary to improve this assurance. The controls in place are described below.

For other management modes, the Commission must gain this assurance from the other bodies responsible for implementing each assistance scheme, in particular through reports and through reliance on their control systems. The Commission can test the reliability of these systems, and if necessary recover misspent money from the responsible authority. Where the systems are particularly unreliable, it can reinforce its controls. The more distant the implementing bodies are from the Commission, the more it must rely on a pyramid of audit and control bodies to obtain the assurance it needs.

The following overview presents each management mode and the particular control issues it represents. In doing so, the six control principles identified by the Court of Auditors in its ‘single audit’ opinion No 2/2004 are used[8]: Control objectives, General control conditions, Control structures, Application of controls, Cost and benefits, and Roles and responsibilities. Some of these principles are more or less relevant depending on the management mode. The means to reinforce the integrated internal control framework are then explored.

1.2. Shared management

1.2.1. Definition of management mode

While the European Commission has overall implementation responsibility for the EU budget under the Treaty, the actual operational and financial management of the funds and assistance schemes in areas under shared management is carried out by bodies appointed by the Member States. The Commission exercises supervisory controls, mainly of Member States’ control and management systems, including transaction tests at beneficiary level, and controls the flow of funds to Member States.

Final beneficiaries in areas under shared management may be farmers, private companies, associations or public entities, who conform to the eligibility criteria specified by the legislation. In the agricultural sector, eligibility criteria are defined in the regulatory framework. Eligibility criteria for Structural Funds are fixed in Community regulations and decisions but are also defined at the national level.

1.2.2. Control challenges

Policies under shared management are characterised by the predominantly local or regional nature of actions and operations. This can mean a considerable detachment from the funding source at the European level, for beneficiaries and national / local management and control actors alike. It also means a relatively long control chain with a relatively high number of actors involved and the corresponding difficulty to maintain common/comparable levels of application of rules, including potential “over-auditing” as well as “under-auditing”. The system calls for coordination of audit work and the reliance of auditors on the work of others under the 'single audit' approach.

The long control chain and reporting periods and the multi-annual nature of the system may lead to errors being detected some years after the disbursement of funds. This may limit the chances for successful recovery of amounts overpaid to private-sector beneficiaries. Where the Commission detects system deficiencies it applies flat-rate corrections which are not directly linked to beneficiaries. For the co-financed assistance schemes, moreover, the Commission sometimes encounters difficulties enforcing management and control rules and standards because beneficiaries and Member State bodies do not have sufficient awareness or knowledge of their application.

Depending on the sector concerned, there may be considerable administrative, management and control differences (control intensity, frequency and quality etc) between and even within Member States (various implementing agencies or various degrees of decentralisation), that need to be taken into account by the Commission’s planning, guidance and control activities. Member States in turn are faced by a variety of different funding schemes.

The desire to achieve high implementation rates together with absorption difficulties in Member States can diminish the focus on prevention of errors, definition of control requirements and execution of controls at the primary level. This may also reduce the incentive to cancel or recover funds. In some areas there is a lack of sufficiently dissuasive sanctions on claimants to deter incorrect claims.

1.2.3. Controls in place

Agriculture – Guarantee Section

Primary controls | Secondary controls | Central controls | Supervision |

Paying Agency (or under the supervision of Paying Agencies) | Certifying Body | Usually at Government level | Commission |

Detailed administrative controls on 100% of applications for aid, cross checks to independent databases wherever possible, and on-the-spot controls of a sample of transactions going from 1%-100% depending on the measure, and the risk associated with it (5% for rural development, 5% for arable crops, 10% for animal premia, 100% for sugar storage). Sampling is generally a mixture of risk based and representative sampling. | Independent review of the accounts and of the management system of the Paying Agencies. Representative sampling required, with a tolerable error set at 1%. (Certifying Bodies have to operate in accordance with International Audit Standards, supplemented by a number of Commission guidelines on specific subjects.) | Paying Agencies must be accredited by a Competent authority in the Member State – generally the Minister of Agriculture or the sometimes the Minister of Finance. This involves an examination of the management system. Ex post controls on a sample of large beneficiaries. It complements the controls done at primary and secondary level. Sampling is risk based. | Annual financial clearance of accounts decision – examination of the work of Certifying Bodies. Conformity audits. Analysis of Member State control statistics. Extensive guidance, including on audit and control methods, key and ancillary controls, sampling methods, sanctions Suspension of payments and financial corrections. |

Structural Funds and the Cohesion Fund:

Primary Controls | Secondary Controls | Central Controls | Supervision |

Managing Authority | Paying Authority | Member state control and audit bodies | Commission |

At beginning of programming period: Verification (desk review + missions where necessary) of descriptions of management and control systems communicated by the Member States |

During programming period: verification of operations and payment claims from beneficiaries - administrative., - legal, - physical and - financial checks In some cases, audit certificates by external auditors | During programming period: Verification of expenditure declarations presented by managing authorities with reference to the management and control systems and certification of the legality and regularity of the expenditure to the Commission. | During programming period: Member state level (central or regional, possibly Supreme Audit Institutions) controls, verifying the proper functioning of management and control systems, including transaction tests (minimum sample of 5% / 15%). . | During programming period: Monitoring of programme implementation. Audits of systems in place based on risk (with substantive tests). Guidance on control and audit work (dissemination of good practices, audit manual and annual meetings) Analysis of Member States annual reports on the controls done 100% control of expenditure declarations forwarded by the Paying Authorities to the Commission. Suspension of payments and financial corrections. . |

At the closure of the programme: Verification by an independent audit (“winding-up”) body of the management and control systems and, if necessary, of a sample of transactions, in order to obtain reasonable assurance on validity of certified expenditure declarations and the regularity of underlying operations | At the closure of the programme: Control of reliability of validity declarations provided by Member State winding-up bodies and checking of final reports and final payment claims submitted by managing and paying authorities. Closure audits on-the-spot of beneficiaries on basis of risk or representative samples followed by financial corrections and recoveries after the closure of the programme. Cross-check with OLAF databases before closure |

1.2.4. Main issues identified after gap analysis on current legislation

Control objectives: Despite extensive descriptions of the various control systems for the Structural Funds, the definition of specific control objectives at primary and secondary level is less clear than for the central Member State level (e.g. audit manuals addressed to the ex-post control bodies). Progress has been made at Commission level as evidenced in the AAR 2004. Monitoring the effectiveness and timeliness of recoveries / financial corrections needs more attention, notably in the context of Structural Funds.

General control conditions: Information on the controls carried out is not always easily available for all levels of control, and there is a need for guidance on good control practices in some areas. Provision of a legal base for and use of penalties and sanctions at Community level is as such not foreseen in Structural Funds.

Control structures: Disclosure statements and annual assurance declarations by a high-level political authority in the Member State (ex. Finance ministers, as proposed by the European Parliament) are not required. In agriculture, ex-ante accreditation as well as yearly audit certificates (and in future yearly management declarations by the Paying Agencies) are available. Structural Funds base assurance on certification of payment claims, reports of independent audit work and audit certificates at closure. In addition to this, an ex ante assessment of the compliance of the management and control system by a national audit body and an annual audit opinion are proposed for the new period.

For the Structural Funds, the ‘Contracts of Confidence’ initiative offers comparable audit assurance on an annual basis to what is proposed for the new period. It is being pursued on a voluntary basis with some Member States, while efforts are being made to raise assurance generally for all Member States through improved reporting and co-ordination. There is also scope for further harmonisation of audit standards.

Application of controls: For agriculture the use of the IACS[9] is extended to measures not yet covered by the system. For Structural Funds, common databases regarding essential control results of control are not in place but central and supervisory levels have access to records at primary and secondary levels for their audit work.

Guidance to beneficiaries on the rules to be applied could be enhanced in some areas. There is scope for better reporting by Member States on the controls carried out and their results. Controls at first and second level should be analysed and used as a management and monitoring tool. Emphasising beneficiaries’ expectations of being controlled can also reinforce the controls’ dissuasive character.

Cost and benefits: The estimation of control costs is available in areas where this represents eligible expenditure for Community funding. Where this is not the case, it should be possible to assess costs in particular for dedicated control staff and activities. Parliament recommended extending the eligibility of control/audit cost to all areas. The error rate, based on a consistent methodology (to be defined beforehand where possible), should be reported in all control reports. Among the benefits, the preventive effect of controls needs to be taken into account as well as the financial impact in terms of recoveries.

1.3. Decentralised management

1.3.1. Definition of management mode

In decentralised management, certain implementation tasks (namely tender and contracting and/or payments) are delegated to third countries. The key element of all decentralisation is that the National Administration is the contracting authority. Unlike shared management, there are various degrees or modes of decentralisation, depending on the quality and existence of management and control systems of third countries. Legally, international agreements (usually a financing agreement, often supplemented by memorandums of understanding of various kinds) between the Commission and the third country are adopted, and the Commission retains the overall responsibility for financial implementation.

There are three main types of decentralisation, the main differences arising from whether payments are decentralised or not, and whether ex-ante control by the Commission is carried out on procurement or not (some ex-post controls are always carried out).

Decentralised procurement with ex-ante control and Centralised payments: the Commission decides to entrust a number of tasks to the partner country, typically the tendering and contracting process, but the Commission controls all decisions ex-ante. Payments are made directly by the Commission to the contractors. The main reason behind this system is that the Commission does not have the means to build adequate assurance on the management and control systems in the third country (Not used in enlargement).

Decentralised procurement with ex-ante control and decentralised payment: this management mode is used for pre-accession countries in the early stages of their decentralised management and for development aid, when predefined criteria defined in article 164 of the Financial Regulation are met. Practical modalities are detailed in internal instructions.

In the case of pre-accession countries, the National Administration pays the contractor and then claims back from the Commission (who again applies ex-ante control to the claim according to the FR 79-81 often supplemented by additional ex-post controls over both procurement and payment). Since 2003 this any new operation under ‘Decentralised Implementation System’ (DIS) is preceded by a process of preparation and improvement by the National Administration of the structures and procedures which are managing EC funds in a decentralised manner. These are then checked by the Commission services through ‘DIS’ verification system audits and formally accredited by a Commission Decision[10]. The organisational structures of the National Administration for implementing aid are broadly established through Memorandums of Understanding between the Commission and the National Authorities, as well as internal operating agreements within the National Authorities. The structures include “Implementing Agencies” to handle contract and payment matters and a “National Fund”, which handles the flow of funds between the Commission and the Implementing Agencies and is responsible for overall control of the implementing systems. The Commission monitors implementation on an ongoing basis through a joint monitoring structure and where required through follow-up audits.

In the case of development aid, payments are made to the beneficiary third country or its implementing authority on a designated account from which the third country/the implementing authority is authorised to make payments to a final beneficiary.

Decentralised procurement and payment without ex-ante control – neither over decentralised tendering and contracting nor over payments : this management mode mainly applies to the implementing structures in the 10 new Member States who are still implementing Phare programmes and so-called Transition facility programmes after accession and for development aid, when predefined criteria defined in internal instructions are met. It will also apply to future candidate countries when their DIS systems are considered ready to waive the ex-ante control over tendering and contracting.

As with all decentralised models, the Commission still continues to exercise its ex-ante controls over payments of claims from the National Authority and certain selected ex-post controls over contracts and payments.

The enlargement model is practically identical to the previous one except that the ex-ante control over procurement is removed following a Commission Decision. This is done when a National Authority has been managing under the previous model and has reached the point where they have demonstrated their capacity to work effectively and have been subject to a further systems assessment. Implementation agencies are accredited by decision of the Commission following a more demanding EDIS audit of the management and control systems. This model is mandatory under the Act of Accession for new Member States who are still implementing PHARE, although it can be applied to candidate countries as well if they are ready. Furthermore, new Member States are required to apply procurement rules compliant with the Public Procurement Directives for all new procurement from the day of accession.

Likewise, in development aid, controls on procurement occur ex-post.

1.3.2. Control challenges

Inherent risks for external assistance are linked to the geographical spread of actions, the diversity of partners and of their management and control capacity, the variety of the cooperation instruments, the high number of operations and financial transactions, the fact that funds are often implemented outside the authority of the Commission and, in some cases, the fact of shared responsibility between different Commission services. These different elements, and the potential ‘dilution’ of responsibility, generate a high variety of risk profiles.

1.3.3. Controls in place

Decentralised procurement with ex-ante control and Centralised payments

This management mode is principally applied in developing countries with weaker management and control structures. The Commission play a key role in ensuring strong ex-ante checks and close supervision of the implementation of projects.

Audit certificates accompany certain claims, established by auditors selected by the contractor. These are compulsory for certain contracts and grants reaching a given ceiling. Then, there are audits of the project/programme launched by the Commission or by the partner country, as specified in the financing agreement and additional audits deriving from an audit plan based on risks.

In addition, there is a very strong ex-ante control during all steps of the project cycle starting with the tendering (including visits on the spot). This goes beyond the usual concept of supervision, as the Commission also approves a number of decisions: tender notice, award of contract, endorsement of contract, authorisation of advances, of interim payments, acceptance of reports, etc… The Commission also carries out a transactional ex-post control since 2004. Finally, the Commission relies on a Results Oriented Monitoring system, which is sub-contracted to experts and provides through field visits coherent information on the achievements of on-going projects. This is then complemented by evaluations of the assistance schemes, usually at the end of the programme. Thematic evaluations are also carried out by the Commission.

Primary controls | Secondary controls | Central Controls |

Partner Country (Implementing Body) | Partner Country(Verifying Body) | Partner Country (National authorising Officer…) |

-tendering and award of contracts/grants -check of payment requests by contractor/beneficiary | -control of payment requests | -preparation of Financing Agreement -authorisation of payment requests -audits of projects by national audit body foreseen in Financing Agreement |

Commission Checks | Commission Supervision | Commission Supervision |

-verification and signature of Financing Agreement -acceptance of tender notices and award (above 50,000 €) -acceptance and award of call for proposals -endorsement of contracts/grants -operational checks on contracts/grants (visits, reports, etc) -financial checks: verification of eligible costs claimed, payments to contractor/beneficiary -project audits by Commission foreseen in Financing Agreement | -additional control of projects | -monitoring by Headquarters of operations by devolved Delegations -acceptance of audit certificates if required -Results Oriented Monitoring (outsourced) -transactional ex-post control (sampling based on risks) -additional audits by Commission based on risk analysis -evaluations |

Other types of decentralisation

In the context of enlargement the degree of control is largely the same in these cases as in the previous model except as regards payments (where the primary payments to contractors are under the control of the recipient states) and as regards waiver of ex-ante control over procurement by the Commission in the case of ex-post controls. Contracts and payments are, nonetheless, subject to a large number of control checks within the National Administration, together with controls affected periodically by local (internal and external) auditors. The National Authorising Officer (NAO) must present to the Commission its Annual Audit Plan as well as the main findings of the previous year’s audit. The NAO also reports quarterly to OLAF and copy to the Commission on any irregularities and measures taken. When projects and programmes are implemented, the NAO presents a final declaration to the Commission. In addition to its prior accreditation of systems, the Commission also engages in normal ex-ante controls over the payments of claims and also carries out a number of ex-post checks (selected on a risk basis) over the implementation. As a result, correction, reduction or recovery of funds may be made. The National Authorising Officer (NAO) must present to the Commission its Annual Audit Plan as well as the main findings of the previous year’s audit. The NAO also reports quarterly to OLAF and copy to the Commission on any irregularities and measures taken. When projects and programmes are implemented, the NAO presents a final declaration to the Commission.

Implementation is monitored by Joint monitoring structures (effectiveness and quality of implementation, technical and financial progress). External evaluators provide their report to these monitoring structures.

The Commission may perform on the spot checks. Closure audits by the Commission of implemented programmes/projects take place according to a risk based method and lead if necessary to recoveries.

Controls in the context of enlargement:

Primary controls | Secondary controls | Central Controls |

Partner Country (Implementing Body) | Joint Monitoring Structures | Partner Country(National authorising Officer) |

-tendering and award of contracts/grants according to EC rules in case of ex-ante controls (national rules, Public Procurement Directives compliant in case of ex-post control) -check of payment requests by contractor based in the case of works on reports by independent engineers engaged by the agency) -payments to contractor | -review and assessment of the effectiveness and quality of implementation, as well technical and financial progress -external Evaluation -resulting corrective measures (decided by the Commission, implemented by Recipient State -National Fund Verification of the payment requests submitted by the Implementing Agencies | -preparation of Financing Agreement -authorisation of payment requests -audits of projects by national audit body foreseen in Financing Agreement -verification of co-financing -authorisation of payment requests, progress report on implementation, declaration by NAO -final declaration by NAO upon closure of programmes -system audit of implementing agencies by internal audit -annual audit plan and findings of audits to Commission, report to OLAF of irregularities |

Commission Checks | Commission Supervision |

-verification and signature of Financing Agreement - control of every phase of the procurement process in the case of ex-ante controls to provide conforme aux faits assurance for payments of claims - operational checks on contracts/grants (on the spot checks) -financial checks: verification of certification of expenditure by NAO before authorising payments, recoveries/corrections | -Results Oriented Monitoring (outsourced) -transactional ex-post control (carried out by Headquarters, sampling based on risks) -additional control of projects -Verification through the PERSEUS reporting system of the use made of the Community funds transferred to the NF | -follow-up audits up to 18 months after accreditation -closure of accounts procedures by Commission made on the basis of final declarations certified by the NAO, which may give rise to corrections in the Community aid - closure audits sample selected based on risks, outsourced) -suspension of payments, if Commission concludes that a Recipient State has not complied with its obligations or it finds serious failings in the management or control systems which could lead to irregularities -evaluations |

1.3.4. Main issues identified after gap analysis

Control objectives: DGs should consider their system from the perspective of providing a coherent, well documented structure on which reliance can be placed and which can be demonstrated to the ECA. This could include a further formalisation and consolidation of the overall control strategy.

Control structures: The typology defined in the single audit opinion, namely primary, secondary and central controls, does not readily fit with this management mode. This typology will be adapted as part of the action plan of the Commission. Management and control structures for assistance schemes intending to work in the future under shared management (i.e. cross border cooperation, regional development) should be further detailed to ensure a smooth functioning of these assistance schemes and sound financial management, (particular areas of improvement are prior accreditation of implementation bodies, close supervision during implementation by concerned parties, preservation of Community’s financial interests). Management declarations should be introduced, where they do not exist yet and if appropriate considering the level of ex-ante checks and controls by the Commission. Use of penalties and sanctions at Community level could be reinforced.

Application of controls: Reliance on audit certificates can be further improved, by setting a more prescriptive framework, as recently launched by some services. The possibility to develop a common database recording audit results could be explored.

Cost and benefits: Error rates are known in some areas and the cost of controls are measured for outsourced controls/audits. An appropriate system to identify and monitor costs relating to controls and error rates could be established.

Roles and responsibilities: There may be scope in some policy areas for further improvement in establishing more clearly the roles and responsibilities in the various layers of agreements leading to contracts and grants. This may be particularly important for contractors, with whom the Commission has no direct legal relationship.

1.4. Indirect centralised management

1.4.1. Definition of management mode

Where the Commission implements the budget by indirect centralised management, implementation tasks are delegated to national public-sector bodies or bodies governed by private law with a public service mission providing adequate financial guarantees and complying with the conditions provided for in the implementing rules, the so-called National Agencies. In such cases, the Commission defines a priori all procedural rules to be respected by the implementing bodies as Commission rules fully apply; it also sets all selection and awarding criteria together with annual priorities for the award of grants, through its annual programming exercise and permanent guidance for the whole duration of the assistance scheme.

So far, this management mode has been mostly limited to national agencies working as a network in all Member States, some third countries in the field of education, training and youth, and the European Bank for Investment. The implementing bodies/agencies are then selected by National Authorities, with the agreement of the Commission. From 2004, another programme started in the field of environment.

1.4.2. Control challenges

Typical control challenges are: high number of (sometimes very small) final beneficiaries, multiple small-size projects and trans-national dimension of projects – as is also often the case in direct centralised management; high dependence on National Agencies’ control systems and audit certificates; control responsibilities of National Authorities unclear/too limited.

1.4.3. Controls in place

The table set out below gives an overview of the primary, secondary, central and supervisory controls in place in the field of education, training and youth[11]:

Primary controls | Secondary controls | Central controls | Supervisory level |

National Agencies | National Agencies | National Authorities | Commission |

- Evaluation procedures and project selection (eligibility, financial capacity, etc) - Operational monitoring of projects (review of intermediate reports to assess progress made) - Control and processing of technical reports and financial claims (check of supporting documents) - On-site audits (sampling) | - Ad hoc controls on the initiative of the National Agency (not required by the Commission) | - Ex-ante: Approval of the National Agency’s work program by the National Authorities (including a commitment for co-financing) - Ex-post: Controls of the National Agencies by the National Authorities as per Commission Decisions C(2000)402, C(2000)1537, C(2000)3155 | - Monitoring visits to National Agencies by competent operational services from EAC (various tests and sampling) - System audits as per art. 35 ME - Analysis of system audits. Presentations of main conclusions regarding primary control quality to National Agencies - Dialogues between Commission and National Authorities in case of exceptional circumstances (for example replacement of National Agency) - Bilateral meetings between Commission and National Authorities (pilot) |

External Auditors |

- Certification of the financial accounts - Ad hoc audits requested by the National Agency (not requested by the Commission) |

1.4.4. Main issues identified after gap-analysis

Control Framework : The main issues identified in the gap-analysis concern the control responsibility of the National Authorities, which is considered too weak. The aim is to implement a new control architecture via the next generation of programs (2007-2013) that will strengthen the accountability of the National Authorities (notably by requiring ex-ante Disclosure Statements and ex-post Declaration of Assurances) and also ensure that the controls carried out at this level are in line with basic control principles (e.g. establishment of control objectives, clarity and simplicity of laws and regulations, application of coherent and minimum control standards, clear communication to the control chain stakeholders, promoting of internal control, etc.).

Control structures: The Commission regularly carries out audits of the National Agencies’ primary controls systems used for controlling the final beneficiaries. The consolidation and analysis of the results of the National Agencies’ controls and audits could however be improved by enhancing the monitoring and reporting tools. No common databases on the findings of audits carried out by National Agencies exist. Use of penalties and sanctions at Community level could be reinforced. Ex-ante disclosure statements and annual ex-post declarations of assurance should be introduced in order to strengthen the control responsibility of National Authorities.

Cost/benefit : Cost/benefit-aspects and risks are generally taken into account when defining the control focus and intensity. There is however room for improvement in this area. Also, further actions are necessary to define and determine acceptable error rates.

1.5. Direct centralised management

1.5.1. Definition of management mode

For direct centralised management, the Commission has a direct contractual and control relationship to the final beneficiary. The Commission performs all the key control functions from ex-ante to ex-post approval, where necessary engaging experts or contractors to perform control or evaluation tasks on its behalf.

1.5.2. Control challenges

Although the Commission can perform detailed desk checks, when dealing with a large number of widely dispersed beneficiaries, often carrying out small projects with a transnational dimension, technical and financial verification cannot be carried out on the spot on a continuous basis. Thus supervisory controls (both on-the-spot and monitoring) are essential to reinforce and evaluate the effectiveness of primary controls.

1.5.3. Controls in place

The following table gives an overview of primary and supervisory controls put in place by the Commission on centralised, directly managed assistance schemes:

Primary controls | Supervisory controls |

Commission – Operational | Commission (where possible a unit separate from the operational unit) |

Set contractual requirements regarding delivery and execution to protect the Commission’s interests. | Ex-post evaluation of projects (frequently on a sample basis) to assess whether: Ex-ante approval correctly given; Operational controls were sufficient to identify and rectify problems; Project goals were achieved; Operational control weaknesses exist which may have contributed to under performance. |

Set selection and award criteria and request appropriate evidence in order to check (high risk) applicants. |

Selection of beneficiary and agreement defined to ensure reasonable budget and project goals. Assessment of capacity of the applicant. |

Ex-ante ‘desk checks’ of periodic technical and financial reports and tracking of project delivery. Provision of advice and guidance to ensure project goals are met. |

On-the-spot review of project work and progress, assessment of quality and reliability of beneficiary. |

Review of final deliverables against stated objectives. |

Commission – Financial | Commission (where possible a unit separate from the operational unit) |

Approval of initial budget and compliance with financial provisions of the programme. | Ex-post or ‘on-the-spot’ control during or after the project (frequently on a sample basis) to assess whether: Financial claims are supported by underlying documentation; Claims have been made in accordance with applicable rules, including checks on eligibility and necessity of costs (in collaboration with the operational unit); Amounts claimed are not ‘double funded’ from other sources; Co-financing has been correctly provided and no profit is made; Financial systems are adequate to record and allocate relevant project costs. |

Approval of renewed prefinancing and interim payments based as appropriate on review of underlying documents and compliance with budget and contract. |

Controls over the correct and accurate recording of the transactions in the accounting system. |

Approval of final payments based on final delivery of project goals and compliance with budget and contract. Review of supporting documentation as appropriate. |

Independent auditor (appointed by beneficiary) |

Approval that costs claimed are consistent with requirements of the contract based on an examination of underlying documents, payments, and where appropriate a review of the beneficiary’s financial systems. |

1.5.4. Main issues identified after gap analysis

Control framework: DGs should consider their system from the perspective of providing a coherent, well documented structure on which reliance can be placed and which can be demonstrated to the ECA. Error rates and recoveries should be tracked using comparable bases where possible.

General control conditions: Legislation needs to be adapted to ensure full coherence with the reality of how assistance schemes are carried out at beneficiary level. Policies on the application of penalties and sanctions need to be introduced, harmonised and monitored across the Commission.

Control structures: The implementation of audit certification should be monitored to ensure quality control and cost effectiveness compared to other control activities.

Application of controls: Approaches to sampling and the intensity of checks should be made more consistent, taking into account the strategy implemented on ex ante controls (desk reviews or on the spot checks, supporting documents analysed). All DGs should establish awareness policies with the aim of a medium term reduction in the error rate during the lifetime of an assistance scheme.

Costs and benefits: Information on costs of controls and error rates needs to be gathered on the way to establishing a cost-benefit analysis and risk assessment to determine the appropriate level of control.

Roles and responsibilities: Consistent ex post controls can be used to make systems recommendations for beneficiary control systems which will increase the accuracy of future claims.

1.6. Joint Management

1.6.1. Definition of management mode

In joint management, certain implementation tasks are entrusted to international organisations, when actions require the pooling of resources from a number of donors, and where it is not reasonably possible or appropriate to assign the share contributed by each donor to each type of expenditure. These organisations are required to apply standards which offer guarantees equivalent to internationally accepted standards in their accounting, audit, control and procurement procedures. The Commission has to ensure that suitable arrangements exist for the control and audit of the action in its entirety. The Financial Regulation defines international organisations as international public-sector organisations set up by intergovernmental agreements, and the Red Cross.

Joint management is mostly carried out in humanitarian aid and development aid and is growing in importance (€ 159 million in humanitarian aid, and € 1.3 billion in development aid for the budget alone, 2004 figures). Other policies can have recourse to this management mode for schemes delegated to international organisations, but usually opt for the centralised direct or indirect mode.

It is proposed in the next Financial Regulation to create the possibility for a wider use of this management mode with international bodies. It is also provided that the individual contribution agreement shall contain detailed provisions for the implementation of the tasks

In addition, the existence of long-term framework agreements laying down the administrative and financial arrangements for their cooperation is one of the cases where joint management can be used in the future, the other two being the pooling of resources and joint project or programme elaborated by the Commission and the international organisation.

1.6.2. Control challenges

In this framework, control is based on mutual confidence. The focus is more on system aspects and on the action in its entirety as the EC contribution is part of a pooling of resources.

1.6.3. Controls in place

The International Organisation (IOs) may manage the EU contribution in accordance with its own regulation and rules provided that these comply with internationally accepted standards as regards accounting, audit, control and procurement procedures. The international organisation carries out its own monitoring/supervision, internal audit, and external audits. The Commission signs specific Contribution Agreements with the IOs concerned, which specify the control modalities foreseen. The Organisation has to state what parts of the action it intends to contract out, which types of contracts are foreseen and what procedures will be followed for such contracting. It will then award the contracts and monitor their implementation, being fully responsible for the co-ordination and execution of all contracted activities. The advance payment can go up to 80 or 95%. Intermediary and final payments are effected upon receipt and approval of financial reporting by Commission services.

Given the characteristics of this kind of action, the Commission has to ensure that suitable arrangements exist for the control and audit of the action in its entirety. In this respect, the General Conditions to the standard EC Contribution Agreement with an International Organisation allow the Commission to perform necessary controls, including on the spot checks. The focus of the verification clause concerns contractual and financial verifications on the individual project level in the field and at headquarters level.

The Commission has signed a number of Framework Agreements with a number of IOs (WB, UN family, etc.) with a view to establishing a lasting strategic partnership with these organisations.

Primary controls | Secondary controls | Central Controls |

International Organisation | International Organisation (Regional Offices in UN or National Red Crosses) | International Organisation |

- checks under their own rules -audit certificates if required in contract | -contracting to partners or organisations operational monitoring by Organisation experts -financial checks: verification of eligible costs claimed, payments -acceptance audit certificates -field audits | -preparation of financing request (possibly based on requests by other organisations) and signature of contribution agreement -preparation of requests to EC for advance, interim payment, and final payment |

Commission Checks | Commission Supervision |

-signature of prior framework partnership agreement - preparation of contribution agreement and commitment of funds -financial checks of payment requests (compliance with financing agreement, receipt of reports from international organisation, and of audit certificates if requested) | -operational and financial monitoring by Commission -verification mission at the International Organisation (periodic financial walkthrough test etc.) by Commission services -audits |

1.6.4. Main issues identified after gap analysis

Control objectives: As in other management modes, the overall control strategy could be better formalised and harmonised, although audit strategies already exist.

Control structures: Services intend to further harmonise and coordinate the verification of compliance with international standards by International Organisations, as foreseen in art 53.7 of the FR. There should be agreement on relevant standards on accounting, procurement, audit and internal control. Compliance audits would then be performed and incorporated into risk assessments. Management declarations should be introduced, where possible.

Cost and benefits: Error rates are known in some areas and the cost of controls are measured for outsourced controls/audits. An appropriate system to identify and monitor costs relating to controls and error rates could be established.

2. ISSUES TO BE ADDRESSED

After having analysed the replies of services on their gap analysis towards the control principles forwarded by the Court in its opinion 2/2004, a first list of issues to be addressed has been identified. This list has to be seen as a first contribution to the dialogue that will be initiated with Parliament, Council, the Court of Auditors and inside the Commission services. Through this consultation process this list will have to be fine-tuned and completed and should then lead to a concrete action plan to be adopted by the Commission by the end of 2005. In parallel, specific issue papers are presented and working groups will have to be started up in order to elaborate on certain basic concepts. These will be also further developed as this consultation process with the external stakeholders progresses.

Four major themes have been identified for further reflection: considerations on the overall control framework, suggestions for strengthening the organisational framework (inside the Commission as well as with its external partners), the instruments in implementing its control chain accountability and, finally some specific implementation issues.

2.1. Overall control framework

Defining and implementing an Integrated Internal Control Framework requires developing clear models of accountability for cooperation with beneficiaries and, in the case of indirect management[12], with management authorities, certifying bodies and audit bodies, including those in Member States.

The framework must be defined in sufficient detail to permit all participants in the control chain to identify and fully execute their role and to specify under which conditions assurances from the work of other management and control entities can be obtained. In doing so, the Commission services can use several instruments such as certification of expenses, audit certificates, management statements and other monitoring tools, which are defined more precisely in section 2.3.

The specification of a global view of the control system must go beyond the guidelines and legal bases, and include structures for monitoring and reporting which can be relied upon by all levels of the control chain. It has to give a global picture of all ex ante and ex post controls, as well as of the supervision to be put in place. On this basis, the most effective control structure can be defined and implemented.

These elements should include:

- establishing the overall objectives of the controls at each level;

- assigning accountability to each participant, including the obligations and elements to be reported on;

- ensuring each control in the chain is based on a clearly defined and transparent methodology and related strategy;

- choosing the correct range and level of control procedures and instruments to provide assurance in the most efficient manner;

- ensure the intensity of checks is proportional to the financial and other risks identified;

- providing the required level of supervision and oversight to ensure effective implementation at all points in the control chain.

2.2. Organisational issues

2.2.1. Senior management involvement

Commitment of senior management to incorporate the control framework within all aspects of programme management is key to its success. At Commission level, this means that Commissioners and Director Generals should publicise this commitment and communicate this clearly to the external partners and to the beneficiaries. At Member State level or Third Country level, the same top management involvement can be expected of representatives at Member State or Third Country level and of the management authorities.

Understanding the benefits provided by adequate risk management and the necessity of accepting a residual risk level (as a zero tolerance would impose 100% controls) are key in this respect.

Priority should be given to providing stakeholders with the information and incentives necessary to ensure all parts of the control chain are carried out to the same standard and in order to be able to give, in turn, the relevant assurances to the Commission.

2.2.2. Establishing a consistent approach per policy area regarding best practices

Initiatives which currently exist within families of DGs to develop common approaches for particular policy areas should be better structured. Models of accountability which have been found to be effective should be shared and incorporated into the global control strategy for each policy management area in accordance with the existing legal framework in each case. Organisational procedures for co-ordinating each policy management area and for structuring the work between services have to be established.

The error rate found at each control level should be monitored. These rates will vary according to the specificities of each assistance scheme and can change over time for multi-annual programmes or projects. In this context, error rates at policy level are not very meaningful.

2.2.3. Ensuring legal bases comply with the principles of the internal control framework

Legal bases should set out the criteria for the overall control strategy and define the appropriate accountability constraints, where this does not already exist. In this context, the reflection and verification of appropriate management, control and accountability mechanisms, depending upon the different actors involved, has to be reinforced[13]. The proposals the Commission has submitted in the past year in order to clarify and strengthen these mechanisms are a good platform for testing these mechanisms.

The Commission should also reflect on the necessity of adopting a specific legal base defining minimum internal control issues for all legislation, in which also global instruments, such as a management declaration at Member State level could be formalised, if this proposal is retained. Another solution would be to make the key requirements of internal control more visible in the Financial Regulation. Consideration should also be given to reconciling the multi-annual nature of Commission programming and the annuality of the DAS. Specific issue papers will develop these aspects further.

2.3. Instruments

Hereafter, some potential instruments are analysed. The minimum conditions and criteria for making these instruments effective should be defined on the basis of the control needs assessment to be done. A working group will deal with it and should include in their work the criteria to be imposed on the external partner delivering the assurances, the control specifications for the execution of the expected controls as well as the impact that these instruments have on checks and supervision by the Commission.

2.3.1. Monitoring tools and ex ante control tools

The correct implementation of ex ante controls appropriate to the domain of activity remains the primary means of ensuring sound financial management. When well constructed, defined in the legal basis (indicating the minimum level of checks for each category of expenditure), and properly supervised, ex ante checks, such as the first-level management checks in the Structural Funds, can identify and correct irregularities, allowing for immediate correction. Monitoring tools (‘scoreboards’) which provide a high-level view can identify problems not visible at the individual transaction level. A network of ex-ante financial verifiers could enable the sharing of best practice within the Commission.

The implementation of the control framework should be accompanied by regular reports and key indicators across the control chain which will enable progress to be tracked as feedback is received. These monitoring tools will permit the Commission to report adequately on its reasonable assurance or to take corrective action where necessary. The monitoring process will give the opportunity to fine tune the control strategy in order to obtain the necessary assurances throughout the life of an assistance scheme.

2.3.2. Management declarations

Management declarations (often also called ‘representations’) are a key means to focus the attention of managers on their control responsibilities and identify possible weaknesses which may have an impact on the overall level of assurance. Written management declarations should give evidence that management acknowledges its responsibility for the fair presentation of the financial statements, and for the design and implementation of internal controls.

2.3.3. Audit certificates

Audit certificates enable on-the-spot verification of a high percentage of claims to be made, providing significant assurance and the possibility of corrections before payment is made.

To ensure that this assurance is credible, the certifying auditors must fully understand the technical detail and contractual requirements of the grant/ contracts they are certifying. Effective methods to achieve this understanding should be integrated in the control framework. The type of certification to be provided and the related controls should also be adapted to each policy area.

In this context, special attention has also to be given to the criteria for selecting external auditors (including the cost effectiveness of outsourcing), the minimal control specifications to be met and the possible impact of such certificates on the level of Commission supervision. Account should also be taken of the relative costs of audit certificates by comparison with controls by the management bodies themselves.

2.3.4. System audits

In cases of indirect, decentralised or shared management of Community funds by third party entities more focus is progressively put in audit work on ensuring that the internal control system can give reasonable assurance on the regularity and legality of the underlying transactions. Instead of controlling transactions, system audits focus on the sound functioning of the internal control system and should help to base the level of assurance on more permanent mechanisms instead of testing at the level of individual transactions. Nevertheless, these system audits need also to be corroborated by some testing in order to confirm their conclusions.

Where system audits are outsourced, issues similar to those identified for audit certificates have to be addressed: the criteria for selecting external auditors, the objectives of the system audit, and the minimal control specifications to be met.

2.3.5. Ex post controls

Risk based and representative ex post controls provide a unique opportunity to verify the performance of all elements in the control chain and to reinforce the assurance provided. To maximise effectiveness, supervisory controls can make use of the underlying documentation and data from controls at secondary and central levels, where these results are reliable. The strategy should take into account the scope and methodology of ex ante controls, to remain proportional to identified risks. In particular, an appropriate balance between desk and on the spot controls has to be found. Controls should be carried out on the spot with a sufficient frequency to ensure some deterrent effect.

The benefits of these controls can be enhanced by ensuring they are performed according to a common approach within each policy management area regarding sampling methodologies, classification of errors, and overall comparability. If all elements in the control chain are performing controls according to a common representative approach, it may be possible to extrapolate the results across the policy management area.

In this context, the following issues should be developed inside the Commission: the timing of controls (during implementation, at the end of the process), the criteria for selecting external auditors, the criteria for sampling strategy, the classification of financial errors and errors in legality and regularity, and the minimal control specifications to be met in order to have a real impact on the Commission’s supervision.

2.4. Implementation issues

2.4.1. Explain and enforce common controls down the chain

In addition to establishing a consistent and effective standard for checks and supervisory controls, the Commission must ensure that secondary and central controls carried out at Member States/Third Country/International Organisations are comprehensively implemented to agreed and commonly understood minimum standards.In doing so, it is important to ensure the existence of incentives to ensure errors are identified at secondary and central level (e.g., enabling Member State authorities to keep a percentage of amounts recovered or to redistribute funds recovered to other relevant parts of the same assistance scheme)

The way Member States/Third Country/International Organisations fulfil their control obligations and report on them, will have a significant impact in achieving reasonable assurance in the area of indirect management. Guidelines must be developed well in advance and should be clearly identified as the framework the Commission will use for its checks, monitoring and supervision tasks. Support to beneficiaries (often through the intermediate levels) should get sufficient attention. The better the final beneficiary is aware of the constraints and possible sanctions, the more effective preventive controls will be.

2.4.2. Reinforce the dissuasive and proportionate nature of sanctions and recoveries

Sanctions, suspension of payments, and recoveries provide a valuable incentive to ensure claims for payment are submitted accurately and in a timely fashion. As many beneficiaries cooperate with the Commission on a long term basis, recoveries and sanctions can be easily executed, and are liable (along with the threat of suspension) to have a positive effect on future compliance.

To operate effectively, the level of sanctions or financial corrections and the criteria for their imposition must be well understood and supervised and applied fairly and proportionately (including in the case of Member States’ responsibility for applying recoveries or sanctions on claimants). The procedure for imposition of sanctions should be administratively clear and simple. The possible disincentive effects of financial corrections in the Structural Funds, for example when they lead to a net reduction of EU funding to programmes or individual beneficiaries, should be borne in mind.

2.4.3. Error rates, cost-benefit analysis and risk

As error rates become more accurately estimated according to a common methodology, the risk attached to different areas of Commission activity can increasingly be identified. To make error rates a reliable indicator of risk, however, benchmarking of standards of reporting is necessary. This should provide for split treatment of representative sampling (hopefully revealing low error rates) and risk-based sampling (aiming at finding the largest errors) and take account of the fact that due to budgetary ceilings and co-financing errors can be identified which have a small or zero budgetary impact.

Gathering data regarding the costs of controls, together with the corresponding reliable error rates and risk analyses will enable the Commission as well as every other control level to direct control activity to be more cost effective, and to ensure that the levels of controls are proportionate. Therefore, errors should be defined from the beginning in order to be correctly measured and used throughout the life of the assistance scheme.

Error rates and cost-benefit analyses will then provide the basis for DGs to assess their eventual risk tolerance and acceptable level of risk for different policies and programmes. However, it should be recognised that these methods can only provide preliminary information, after which judgement must be exercised in reaching a final decision.

[1] COM(2005) 252.

[2] OJ C 107, 30.4.2004, p. 1 (the ‘Single Audit’ Opinion).

[3] COM(2005) 256.

[4] SEC(2005) 1327.

[5] SEC(2005) 1152.

[6] COM(2005) 181, 3.5.2005.

[7] For more information, see COM(2006) 9.

[8] The checklist on which these reviews were based is attached in annex 1 and refers to points 34 to 56 of the Court’s single audit opinion No 2/2004.

[9] The Integrated Administration And Control System (IACS) comprises: a computerised data base, an identification system for agricultural parcels and animals, a system for the identification and registration of payment entitlements, aid applications, an integrated control system, and a single system to record the identity of each farmer who submits an aid application.

[10] Some agencies in Bulgaria and Romania still ‘benefit’ from the derogation in the Implementing Rules 269 regarding this prior systems assessment and Commission decision – but this situation will be superseded during 2006 by the assessments and Accreditation Decisions of the ‘EDIS’ process.

[11] It should be noted that EAC has reinforced the controls foreseen in the Financial Regulation, thus other implementations (e.g. ‘Forest focus’ at DG ENV) do not share all characteristics. It is also proposed to extend this management mode in the next Financial Regulation to international bodies.

[12] Indirect management means all management modes other than centralised direct, and includes thus shared management, decentralised management, joint management and centralised indirect management

[13] OLAF proposes within the framework of the interservices consultations systematically the introduction of the appropriate clauses regarding internal control in the legal base, including ensuring the legality of the on the spot controls carried out by OLAF in the course of its investigations.