2010 discharge: EU general budget, Section III, Commission

DISCHARGE 2010 – COMMISSION: ANNUAL REPORT ON INTERNAL AUDITS

PURPOSE: this report informs the Discharge Authority about the work carried out by the Commission's Internal Audit Service (IAS)in 2010. It is based on IAS audit and consulting reports completed in 2010 relating to Commission departments and executive agencies. It does not cover the results of audit work in other agencies or bodies audited by the IAS, for which separate annual reports are drawn up.

The Commission’s replies to the remarks and findings of the internal auditor are contained in the summary report of the annual activity reports of the Directors-General (that are covered by the summary of the document SEC(2011)1189 of 7 November 2011).

CONTENT: the work of the IAS contributes to a culture of efficiency and effectiveness. Its audit work helps the Commission to identify synergies as well as risks, and consequently strengthens the Commission's management.

Implementation of the IAS’s coordinated audit plan: the Commission notes the positive co-operation between the IAS and the audited DGs and with their Internal Audit Capabilities. Implementation of the action plans drawn up this year and in previous years in response to audit recommendations contributes to steady improvement of the Commission's internal control framework.

The report also underlines that the Strategic Audit Plan for 2008-2010 was regularly updated to take account of specific needs (the first overall opinion, the results of management’s annual risk assessment and other changes in the external and internal environments). In 2010, the IAS completed 88% (compared with 87% in 2009) of its work programme and 85 reports were issued (30 audits, 49 follow-ups, 1 consultancy, 4 management letters and 1 report on the overall opinion). In 2010, the acceptance rate of critical and very important audit recommendations by the auditees was 100% (98.8% in 2009).

Main IAS findings for 2010: as far as IAS findings for 2010 are concerned, the report highlights the two main points that follow:

1) Control procedures: the highlights the need to obtain adequate information from the Heads of Delegation in order to substantiate the assurance provided annually by the Authorising Officer by Delegation (AOD) to assess the adequacy and effectiveness of DG AIDCO’s control strategy; it also indicates a need for DG EAC to avoid unnecessary overlaps of controls conducted by its services and by National Agencies.

DG ELARG should complement its initiative requiring Heads of Delegation to submit an Annual Assurance Strategy by developing checklists applicable to all delegations.

The IAS recommended to DG REGIO and DG EMPL improvements deemed necessary in order to obtain adequate assurance for multi-annual programmes.

At the level of control strategies the Commission has adopted an important number of measures to allow its services to set up adequate audit and control systems. Action plans have been drawn up and implemented in the domains where the risks are highest, allowing for better planning and monitoring of control activities, eliminating administrative burdens and overlaps and improving the effectiveness of the Commission's internal control systems.

Controls for checking compliance with legal time limits for payment were less effective in some DGs where. the shorter time limits requested by the Commission were not always applied. Management needs to improve its monitoring over the proper implementation of control procedures for the processing of payments. The Commission has taken several measures to improve both payment performance and associated control mechanisms, namely at the levels of the IT system (ABAC), of the validation of local IT systems and of the guidelines and by means of regular and more effective monitoring.

The IAS’s work has raised issues for consideration with the aim of improving the efficiency and effectiveness of IT start-up projects in order to further enable the Commission to achieve its goals in a cost-effective, efficient and secure manner.

Following the recommendations of the Task Force on IT, the Commission has reformed its IT governance: the ABM + IT Steering Committee was set up in 2010 followed by the Information Systems Project Management Board and High Level Committee on IT in 2011, which represent a major improvement in the way IT strategy is designed and implemented.

The IAS’s audit work on recently split-up DGs has identified lessons which should be learned ahead of any future divisions of DGs in order to soften the impact of change on DGs, central and horizontal services and staff. The Commission considers it is too early to draw definitive conclusions on the benefits/drawbacks of shared directorates and it will take stock, later on, when the services concerned have gained more experience with the new organisational structure.

Fraud: in this area, the IAS’s efforts have highlighted, in particular the lack of clarity in organisational accountability for fraud prevention and detection and the need for an updated anti-fraud strategy at Commission level. A new anti-fraud strategy, prepared by OLAF in cooperation with the central services and operational DGs, has been adopted by the Commission and fully addresses the issues raised by the IAS.