2005 discharge: European Agency for Networks and Information Security

This report from the Court of Auditors concerns the results of the audit carried out by the Court on the annual accounts of the European Network and Information Security Agency for the financial year ended 31 December 2005.

The European Network and Information Security Agency became fully autonomous in the second half of 2005. The Agency’s main task is to enhance the capability of the Community to prevent and respond to network and information security problems by building on national and Community efforts. In principle its mandate expires in 2009.

The Court states that the audit was planned and performed to obtain reasonable assurance that the accounts are reliable and the underlying transactions are legal and regular. The Agency’s accounts for the financial year ended 31 December 2005 are, in all material respects, reliable. Legality and regularity of the underlying transactions The transactions underlying the Agency’s annual accounts, taken as a whole, are legal and regular. The observations which follow do not call the Court’s statement into question.

The report shows that the appropriations entered in the final budget amount to EUR 6 346 000 with EUR 4 540 000 committed and EUR 2 139 000 paid. EUR 2 112 000 was carried over to 2006 and 2 095 000 cancelled.

The Court makes the following observations:

- the implementation of the budget for the financial year 2005 was marked by a low rate of commitment (70 %) and a substantial rate of carry-over (more than 40 % overall and up to almost 80 % for operating expenditure). This situation was in part due to problems inherent in the Agency’s start-up period and to

the fact that it did not start becoming operational until the second half of 2005. In future, the Agency should be vigilant concerning this risk, in particular by ensuring strict programming of its activities.

- the Court noted that no activity-based management had been brought in, despite the Agency’s financial regulation making provision for its introduction, on the lines of that applied to the general budget, with a view to improving the monitoring of performance. In this context, achieving the Agency’s aims should not mean merely carrying out a series of tasks. It should rather be seen as contributing to the goals laid down in its basic Regulation. The Agency’s work programme should, in principle, express this contribution in operational and measurable terms.

The Agency responds point by point to the Court’s observations:

- giving that the Agency only became operational only in September 2005, it was understaffed, and had limited time available. It therefore proved very difficult to improve the budget implementation rates. The management will take necessary action and it is expected to have higher execution rates for the budget implementation of 2006. Having less than 12 months of operational activity, the Agency lacks the necessary resources in order to introduce and apply effectively an Activity Based Management system. It is true that Activity Based Management would improve dramatically the measurability of the Agency’s work. The management will endeavour to have it in place as soon as the Agency is in a position to dedicate the necessary resources for an Activity Based Management system to be developed.