EUROPEAN COURT OF AUDITORS

12, rue Alcide De Gasperi

1615 Luxembourg

LUXEMBOURG

Tel. +352 4398-1

Enquiries: eca.europa.eu/en/Pages/ContactForm.aspx

Website: eca.europa.eu

Twitter: @EUAuditors

More information on the European Union is available on the internet (http://europa.eu).

Luxembourg: Publications Office of the European Union, 2016

Print | ISBN 978-92-872-6050-5 | ISSN 1831-0834 | doi:10.2865/38354 | QJ-AB-16-027-EN-C
PDF | ISBN 978-92-872-6075-8 | ISSN 1977-5679 | doi:10.2865/802820 | QJ-AB-16-027-EN-N
EPUB | ISBN 978-92-872-6092-5 | ISSN 1977-5679 | doi:10.2865/60868 | QJ-AB-16-027-EN-E

© European Union, 2016

Reproduction is authorised provided the source is acknowledged.

For any use or reproduction of the figure in Box 10 on p. 30, permission must be sought directly from the copyright holder. All rights reserved.

HOW TO OBTAIN EU PUBLICATIONS

Free publications:

•one copy:
via EU Bookshop (http://bookshop.europa.eu);

•more than one copy or posters/maps:
from the European Union’s representations (http://ec.europa.eu/represent_en.htm);
from the delegations in non-EU countries (http://eeas.europa.eu/delegations/index_en.htm);
by contacting the Europe Direct service (http://europa.eu/europedirect/index_en.htm) or
calling 00 800 6 7 8 9 10 11 (freephone number from anywhere in the EU) (*).

(*)The information given is free, as are most calls (though some operators, phone boxes or hotels may charge you).

Priced publications:

•via EU Bookshop (http://bookshop.europa.eu).

Event | Date
Adoption of the Audit Planning Memorandum/Start of audit | 15.12.2015
Official sending of draft report to Commission (or other auditee) | 21.6.2016
Adoption of the final report after the adversarial procedure | 20.9.2016
Commission’s (or other auditee’s) official replies received in all languages | 14.10.2016

EN
2016

NO 27

Special Report

Governance at the
European Commission —
best practice?

(pursuant to Article 287(4), second subparagraph, TFEU)

Audit team

The ECA’s special reports set out the results of its performance and compliance audits of specific budgetary areas or management topics. The ECA selects and designs these audit tasks to be of maximum impact by considering the risks to performance or compliance, the level of income or spending involved, forthcoming developments and political and public interest.

This performance audit was produced by Audit Chamber V, which has a focus in the areas of financing and administering the Union. The audit was led by ECA Member Mr Lazaros S. Lazarou, Dean of Chamber V, supported by Andreas Antoniades, Head of private office and Johan Adriaan Lok, Attaché of private office; Peter Welch, Director; Mariusz Pomienski, Principal Manager; Bogna Kuczynska, Head of Task; Rogelio Abarquero Grossi, Erik De Bruyne, Daria Bochnar, Andreas Dürrwanger, Mehmet Ergün, Paul Sime, Michael Tatianos and Carl Westerberg, Auditors.

From left to right: E. De Bruyne, A. Dürrwanger, J. A. Lok, P. Sime, D. Bochnar, L. S. Lazarou, B. Kuczynska, A. Antoniades, P. Welch, M. Pomienski, C. Westerberg, R. Abarquero Grossi.

Contents

List of abbreviations

Executive summary

Introduction

Getting governance right is a priority in public and private sector bodies

Audit scope and approach

Observations

Changes to governance structures and the creation of the Internal Audit Service and the Audit Progress Committee

The Commission distinguishes between its own political responsibility and the responsibility of its directors-general for management

The Commission abolished the financial controller and set up an internal audit function

The Internal Audit Service initially had a stronger orientation on high level institution-wide governance issues …

… and now gives greater attention to the Commission’s internal control framework

The Commission set up an Audit Progress Committee as one of the first steps in the reform process

Overview by the Audit Progress Committee is in practice limited to the work of the Internal Audit Service

Aligning internal controls and financial reporting with international standards

The Commission chose the COSO framework as the basis for its internal control standards …

… but completing transition to the updated COSO framework is challenging

Producing annual accounts in line with international standards improved financial reporting

Providing non-financial information to internal and external stakeholders

The Commission provides non-financial information alongside the accounts …

… but less than many other organisations do

Since 2013 the Commission has reported a material level of error in its spending

It is best practice to base the estimates of amounts at risk on a consistent methodology

Reports introduced through the Prodi reform still form the basis for Commission internal reporting

Conclusions and recommendations

Annex I | — | The GGPS Framework and COSO 2013
Annex II | — | Key elements of selected corporate reporting frameworks
Annex III | — | Overview of annual reports and accounts of selected public sector bodies

Reply of the Commission

List of abbreviations

AAR: Annual Activity Report

APC: Audit Progress Committee

ABM: Activity-based management

AMP: Annual Management Plan

AMPR: Annual Management and Performance Report

CFO: Chief financial officer

CFS: Central Financial Service

CIE: Committee of Independent Experts

CIPFA: The Chartered Institute of Public Finance & Accountancy

CONT: Committee on Budgetary Control

COSO: The Committee of Sponsoring Organisations of the Treadway Commission

DG: Directorate-general

DG AGRI: Directorate-General for Agriculture and Rural Development

DG BUDG: Directorate-General for Budget

DG DEVCO: Directorate-General for International Cooperation and Development

DG DIGIT: Directorate-General for Information Technology

DG REGIO: Directorate-General for Regional and Urban Policy

DG RTD: Directorate-General for Research and Innovation

ECA: European Court of Auditors

EU: European Union

FEE: Fédération des Experts-comptables Européens — Federation of European Accountants

FSD&A: Financial Statement Discussion and Analysis

GAO: Government Accountability Office

GGPS: Good governance in the public sector

IAC: Internal audit capability

IAS: Internal Audit Service

IASB: International Accounting Standards Board

IFAC: International Federation of Accountants

IFRS: International Financial Reporting Standards

IIA: Institute of Internal Auditors

Iperia: Improper Payments Elimination and Recovery Improvement Act

IPSAS: International Public Sector Accounting Standards

IPSASB: International Public Sector Accounting Standards Board

IIRC: International Integrated Reporting Council

ISSB: Information Security Steering Board

MP: Management plan

OECD: Organisation for Economic Cooperation and Development

OLAF: European Anti-Fraud Office

PG: Preparatory group

PIC: Public internal control

RPG: Recommended practice guideline

SAI: Supreme Audit Institution

SG: Secretariat-general

SPP: Strategic Planning and Programming

SR: Synthesis Report

TEU: Treaty on the European Union

TFEU: Treaty on the Functioning of the European Union

Executive summary

I

In the wake of the resignation of the Santer Commission and in response to the report of the Committee of Independent Experts, in March 2000, the Commission approved the ‘Reforming the Commission’ White Paper, intended to modernise the governance of the Commission. The reforms proposed covered setting priorities and allocating resources; changing human resource policy; and overhauling audit, financial management and control. The White Paper and the report of the Committee of Independent Experts continue to influence decision-making and governance in the Commission to this day.

II

The pressure to have excellent governance arrangements remains. As a recent Commission document explains: ‘We are living in times of substantial pressure on public finances at all levels in the EU. (…) Under such conditions, it is paramount that state-of-the-art frameworks and standards are implemented in the public sector.’¹ Good governance is not just about relationships, it is about achieving results, and providing decision-makers with the tools to do their job. It should encourage the efficient use of resources, strengthen accountability for the stewardship of resources, promote robust scrutiny, improve organisational leadership, management, and oversight. If these are achieved, it should lead to more effective interventions².

III

While the rules and structures set up by the Commission largely reflected best practice at the time, best practice has continued to evolve. We thus examined the current governance arrangements at the Commission with a focus on audit, financial management and control to see whether they are in line with best practice and whether they still meet the needs of the institution.

IV

Best practice has continued to evolve since the 2000 reforms. Although some action³ has been taken, we conclude that in several areas the Commission diverges from, or does not meet in full best practice set out in standards or put in place by the international and public bodies we selected as benchmarks.

V

The distinction made between the ‘political responsibility of commissioners’ and the operational responsibility of directors-general means that it has not always been made clear whether ‘political responsibility’ encompasses responsibility for the directorates-general, or is distinct from it. Recent organisational reforms are beginning to address some of the risks of a ‘silo’ culture. But to continue to address key risks the Commission will need to further strengthen the governance structure across the institution.

VI

The Internal Audit Service focuses its efforts on the Commission’s internal control systems. In recent years its coverage of institution-wide governance issues included corporate information security. Spending outside the Commission — for which the Commission is responsible — is the responsibility of audit directorates and units in the spending directorates-general. This has an impact on the information presented to the Commission’s audit committee. The role of the Audit Progress Committee (and the participation of independent, external members) is more limited than that of audit committees at international bodies we selected as benchmarks.

VII

The Commission has recently begun to accompany the accounts with non-financial information. However, despite recent improvements, it still provides less non-financial information alongside the accounts than organisations we selected as benchmarks for best practice do.

VIII

We recommend that the Commission should:

οas required of European public interest entities, when it decides not to follow best practice, explain its reasons for not doing so;

οinvite the IAS to carry out more audit work on high level governance issues;

οcomplete the process of aligning its internal control framework with the COSO 2013 principles;

οfurther bring forward the publication of the annual accounts;

οbring together information already presented in a variety of existing reports to form a single accountability report or suite of reports, containing the accounts but also incorporating:

-a governance statement;

-a President’s report;

-a discussion of operational and strategic risks;

-a report on non-financial performance;

-information on activities during the year and the achievement of policy objectives;

-a report on the role and conclusions of the Audit Committee; and

-a mid- and long-term fiscal sustainability statement, together with, where appropriate, links to information contained in other reports;

οpresent this single accountability report or suite of reports for audit of the accounts and checks by the auditor that other information presented within it is consistent with accounting information;

οpublish as part of the annual accounts or accompanying information an estimate of the level of error based on a consistent methodology;

οupdate and publish its governance arrangements on a regular basis and explain its choice of structures and processes in relation to the framework it chooses; and

οturn the Audit Progress Committee into an audit committee with a majority of independent, external members and expand its mandate to cover risk management, financial reporting and the work and results of ex post verification units and audit directorates.

1European Commission: Public Internal Control System: http://ec.europa.eu/budget/pic/index_en.cfm

2See Chartered Institute of Public Finance and Accountancy (CIPFA)/International Federation of Accountants (IFAC), ‘International Framework: Good Governance in the Public Sector’, 2014, p. 6.

3Including the publication alongside the accrual-based EU accounts of the financial statement discussion and analysis, reporting on performance (resulting in 2015 in an integration with reporting on management in the annual management and performance report) and the transition to the updated 2013 COSO internal control – integrated framework.

Introduction

Getting governance right is a priority in public and private sector bodies

01

A series of corporate failures during the 1990s brought the issue of corporate governance into the public eye — and made improving governance arrangements in the private sector a key policy priority. Typically these failures involved a situation where the full extent of a risk, or of irregular behaviour was either not known by members of the governing body, or known only to a small number of dominant (usually executive) board members. Concerns over failures in the private sector led to changes in EU legislation, requiring all public interest entities⁴ to comply with a code of governance⁵ and to confirm this in their published annual report and financial statements.

02

The move to adopt good governance arrangements extended into the public sector. The CIPFA/IFAC document Good Governance in the Public Sector⁶ (GGPS) is a recent reflection of this, as is the EU-led PIC⁷ initiative, focused on the appropriate governance and control arrangements for countries seeking admission to the EU.

03

Good governance (see Box 1) is not just about relationships, it is about achieving results, and providing decision-makers with the tools to do their job.

Box 1

Good governance

‘Good governance in the public sector encourages better-informed decision-making as well as the efficient use of resources. It strengthens accountability for the stewardship of those resources. Good governance is characterised by robust scrutiny, which places important pressures on improving public sector performance and tackling corruption. Good governance can improve organisational leadership, management, and oversight, resulting in more effective interventions and, ultimately, better outcomes.’⁸.

04

Concerns about governance in the European Commission came to a head in 1999 with the resignation of the Santer Commission and, particularly, with the report of the Committee of Independent Experts (CIE) appointed by Parliament to investigate the problems behind the resignation and to recommend a way forward. The Committee’s complaint that they could find no one ‘prepared to take responsibility’ lay at the centre of their critique of governance within the Commission (see Box 2). These events, and the report of the CIE, led to the Prodi Commission agreeing, in 2000, on a comprehensive reform package, intended to modernise the governance of the Commission (the ‘Prodi reform’). The White Paper, the resignation of the Commission, and the report of the CIE continue to influence decision-making in the Commission to this day.

Box 2

Governance and accountability frameworks

‘Governance comprises the arrangements put in place to ensure that the intended outcomes for stakeholders are defined and achieved’, according to Good Governance in the Public Sector.

The COSO 2013⁹ principles state that the governing body ‘demonstrates independence from management and exercises oversight of the development and performance of internal control’¹⁰ (see Box 10).

Accountability is a key element of governance, especially in the public sector. IFAC defines it as ‘the process whereby public sector entities, and the individuals within them, are responsible for their decisions and actions, including their stewardship of public funds and all aspects of performance, and submit themselves to appropriate external scrutiny. It is achieved by all parties having a clear understanding of those responsibilities, and having clearly defined roles through a robust structure. In effect, accountability is the obligation to answer for responsibility conferred.’¹¹.

The Commission is involved in promoting good governance in the EU Member States through the PIC network. It has stressed the importance of sound control and the use of best practice standards: ‘We are living in times of substantial pressure on public finances at all levels in the EU. More than ever, taxpayers in every Member State expect value for money and the public sector is held accountable for sound and efficient management of funds entrusted to it. The public sector must demonstrate that resources are spent efficiently, and that output and outcomes are effective. Under such conditions, it is paramount that state-of-the-art frameworks and standards are implemented in the public sector.’¹².

These are examples of best practice drawn from relevant codes and guidance. Throughout this report we use the symbol to designate boxes presenting such examples.

05

The Commission based its reform programme on three pillars: reforms to priority-setting and budgeting, modernising human resources policy, and improvements to audit, financial management, and control (Figure 1). The Commission argued that five main principles should underlie a period of ‘cultural change’: independence of the Commission, responsibility, accountability, efficiency in the achievement of results and transparency.

Figure 1

Three pillars of the Prodi (White Paper) reform

Source: European Court of Auditors (ECA) based on COM(2000) 200 final/2 ‘Reforming the Commission, A White Paper - Part I’.

06

The first pillar of the reform introduced new planning and monitoring tools for each Commission department (management plans (MPs) and AARs). The third pillar (Box 3) simplified rules for authorising expenditure. One issue of intense debate was the way the different responsibilities within the Commission were to be managed and combined. The key roles were those of the Commission as a college, the individual commissioners, the financial controller and the directorates-general (DGs) (and the directors-general who have the chief administrative role within them).

Box 3

Third pillar of the Prodi reform: Modernisation of financial management, control and audit system¹³

Overhauling the financial management, control and audit system in line with best practice:

οdevolving responsibility for checking spending from the financial controller to DGs;

οdeclaration by each director-general in the Annual Activity Report (AAR) that adequate internal controls have been put in place and that resources have been used for the intended purposes;

οcreating finance units within DGs to provide advice and assistance to operational units;

οcreating a Central Financial Service to provide advice to operational departments;

οsetting up an Internal Audit Service (IAS) under the authority of the Vice-President for Reform to assist management within the Commission;

οsetting up specialised ‘audit capability’ within each DG, reporting directly to the director-general;

οestablishing an Audit Progress Committee (APC) to monitor the control processes of the Commission, the implementation of audit recommendations, and the quality of audit work;

Defining the responsibilities of authorising officers and line managers:

οdrawing up simplified and easily accessible rules defining the responsibilities of staff with key financial roles.

07

A further reform, which was not part of the White Paper, but put forward when the Commission’s proposal for recasting the Financial Regulation was discussed, was to transform the basis for preparing the EU accounts. Following pressure from the Council, the Commission accepted the challenge of putting in place an accrual-based accounting system, based on international standards by 2005¹⁴.

08

The Commission moved quickly to make the Prodi reforms: the APC met in December 2000 (see paragraph 27); an externally recruited head of internal audit was appointed the following day; the new Financial Regulation was approved on 25 June 2002 and new Staff Regulations on 22 March 2004. The Commission produced the first set of full-accrual, IPSAS¹⁵-based annual accounts in 2005.

09

In its progress report on Commission reform of December 2005, the Commission considered that the key principles underlying reform measures remained sound and that the Commission was set to ‘build upon its achievements and ensure that its resources, both financial and human, are used efficiently and effectively in an open and transparent manner so as to facilitate control and build up the trust of Europe’s citizens’¹⁶.

10

Over 10 years have passed since this statement. While the rules and structures adopted by the Commission largely reflected best practice at the time, governance rules in respect of both private and public sectors have continued to evolve. Members of the Commission need effective tools to exercise their overall responsibility for the management of the EU budget.

4Such as companies listed on a stock exchange (Directive 2004/39/EC of the European Parliament and of the Council of 21 April 2004 on markets in financial instruments amending Council Directives 85/611/EEC and 93/6/EEC and Directive 2000/12/EC of the European Parliament and of the Council and repealing Council Directive 93/22/EEC (OJ L 145, 30.4.2004., p. 1)).

5Directive 2013/34/EU of the European Parliament and of the Council of 26 June 2013 on the annual financial statements, consolidated financial statements and related reports of certain types of undertakings (OJ L 182, 29.6.2013, p. 19) (as amended by Directive 2014/95/EU (OJ L 330, 15.11.2014, p. 1)) (Accounting Directive).

6Chartered Institute of Public Finance and Accountancy (CIPFA)/International Federation of Accountants (IFAC), ‘International Framework: Good Governance in the Public Sector’, 2014.

7Public Internal Control is a platform for exchange of information and good practices between public administrations in the EU.

8Chartered Institute of Public Finance and Accountancy (CIPFA)/International Federation of Accountants (IFAC), ‘International Framework: Good Governance in the Public Sector,’, 2014, p. 6.

9Committee of Sponsoring Organisations of the Treadway Commission (COSO), Internal Control – Integrated Framework, 2013.

10Source: Internal Control – Integrated Framework, Executive Summary, © Committee of Sponsoring Organisations of the Treadway Commission (COSO).

11IFAC Public Sector Committee, ‘Governance in the Public Sector: A Governing Body Perspective’, 2001, p. 12.

12European Commission: Public Internal Control System: http://ec.europa.eu/budget/pic/index_en.cfm

13Source: ECA based on COM(2000) 200 final/2.

14The ECA had been recommending such a step since 1978. See Eduardo Ruiz García, ‘The Role of the Court of Auditors in Modernising the Accounting System of the European Institutions’ in Revista Española de Control Externo, May 2013.

15International Public Sector Accounting Standards.

16COM(2005) 668 final of 21 December 2005 ‘Progress report on the Commission reform beyond the reform mandate’.

Audit scope and approach

11

Our central audit question, underlying the work performed to produce this report with focus on audit, financial management and control, was:

Are governance arrangements at the Commission in line with recognised best¹⁷ practice and the Institution’s needs?

12

We focused on the following issues (see Figure 1 and Box 3):

οChanges to governance structures and the creation of the IAS and the APC (paragraphs 15 to 31);

οAligning internal controls and financial reporting with international standards (paragraphs 32 to 41);

οProviding non-financial information to internal and external stakeholders (paragraphs 42 to 57).

13

We take GGPS as a key point of reference (Box 2). We also take account of the earlier IFAC study Governance in the Public Sector: A Governing Body Perspective, in particular to understand best practice at the time of the Prodi reform¹⁸. A key source for the Commission’s action on internal control during the reform period was the COSO framework (this is explained in paragraphs 32 to 39). The most recent revision of the COSO framework (2013) is principles based and puts internal control within a context of good governance. We mapped the content of the GGPS against that of COSO 2013 (see Annex I) to inform our discussion of best practice in governance. We have also taken account of the requirements of EU directives for public interest entities and of Commission recommendations in this area¹⁹.

14

We conducted our audit by reviewing Commission documents (the White Paper, internal and external reports), and documents of relevant international bodies (CIPFA, FEE, IASB, IFAC, OECD²⁰, etc.), academics, etc. We held meetings with key actors within the Commission including members of the APC, members of the APC Preparatory Group, the IAS, the Secretariat-General (SG) and DG Budget (DG BUDG). We discussed best practice with an expert focus group drawn from leading international organisations, public sector auditors, independent experts and universities, and the reform process with people who played a significant role in the process. We surveyed the EU Member States’ supreme audit institutions on public sector governance in their jurisdictions. We drew upon our audit results and reports since 2001.

17We use the term ‘best practice’ throughout this report, covering practices described as ‘best’, ‘leading’, or ‘good’ in specific reference documents.

18IFAC, ‘Governance in the Public Sector: A Governing Body Perspective’, 2001.

19Accounting Directive (see footnote 4), Commission Recommendation of 9 April 2014 on the quality of corporate governance reporting (‘comply or explain’) (OJ L 109, 12.4.2014, p. 43). Directive 2014/56/EU of the European Parliament and of the Council of 16 April 2014 amending Directive 2006/43/EC on statutory audits of annual accounts and consolidated accounts (OJ L 158, 27.5.2014, p. 196) (Statutory Audit Directive), and Regulation (EU) No 537/2014 of the European Parliament and of the Council of 16 April 2014 on specific requirements regarding statutory audit of public-interest entities and repealing Commission Decision 2005/909/EC (OJ L 158, 27.5.2014, p. 77).

20See list of abbreviations.

Observations

Changes to governance structures and the creation of the Internal Audit Service and the Audit Progress Committee

The Commission distinguishes between its own political responsibility and the responsibility of its directors-general for management

15

The European Commission is the EU’s executive body. Its governing body (see Box 4) — the College of Commissioners (college) — is the final decision-making body of the Commission. The Commission is, under the Treaty, collectively responsible for the execution of the budget. However, the Commission’s responsibilities extend far beyond the execution of the budget. In practice it has a monopoly on the proposal of EU legislation²¹, prepares rules on implementing legislative acts and has a significant role in policing the enforcement of EU law²².

16

Individual commissioners are assigned responsibilities for specific policies. This means that most have a leadership role in relation to one or more directorates-general (DG)²³. DGs are headed by directors-general²⁴. The Commission’s power to authorise EU spending is in practice delegated to directors-general (in this capacity referred to as Authorising Officers by Delegation).

Box 4

Governing body

‘Governing body is the person(s) or group with primary responsibility for overseeing an entity’s strategic direction, operations, and accountability. The governing body has a crucial leadership role with respect to implementing, evaluating, and improving an entity’s governance.’²⁵.

17

In his communication on Commission’s working methods of November 2014, President Juncker stressed that ‘commissioners should assume full political responsibility for the work done by the services that report to them’²⁶. He also organised the college with the aim that it should ‘work together as a strong team, cooperating across portfolios (…) to overcome silo mentalities by working jointly on those areas where we (the college) can really make a difference’²⁷ (see Figure 2).

18

Since the reform, a number of management groups assist the Commission (Figure 3):

οThe ABM²⁸ Steering Group, created to coordinate the policy and strategy issues linked to the three strands of the reform (strategic planning and programming, staff policy, financial management and audit). Since 2015 it also covers Commission-wide IT governance matters. Chaired by the Secretary-General, it brings together directors-general and cabinets²⁹ responsible for central services.

οThe Directors-General Group, created to implement the reform, now oversees coordination of policy implementation and provides a forum for the discussion of issues of horizontal interest.

οThe Resource Directors Group, created to examine the specific issues related to the implementation of the reform, is a consultative body of resource directors³⁰ aiming to promote a coherent and optimal management of Commission’s resources and to ensure that the needs of the operational departments are taken into account. It provides a forum for discussion and exchange of best practices between horizontal and operational departments.

Figure 2

The College of Commissioners November 2014-June 2016¹

1Commissioner Hill resigned on 15 July 2016 and his portfolio was taken over by Vice-President Dombrovskis and Commissioner Moscovici.

Source: ECA, based on Annex 3 of Working Methods of the European Commission 2014-2019, C(2014) 9004.

Figure 3

Flows of information on internal control to college

Source: ECA.

19

The Secretariat-General (SG) has responsibility for a number of corporate processes, including decision-making, document management, business continuity arrangements, and strategic planning and programming. It manages the collegial decision-making process and provides support to the President and the Vice-Presidents. It coordinates activities across policy areas and Commission departments and acts as the Commission’s interface and manages relations with the other European institutions, national parliaments and non-governmental organisations and entities.

20

A concern of the CIE was not to leave the directors-general to ‘sink or swim’³¹. It thus recommended the creation of the Central Financial Service (CFS). This department, located within DG BUDG provides support and advice on financial management, interpretation of financial rules and legislation, internal control and risk management.

21

Until the reform, the Commission’s financial controller was responsible for approving all expenditure. This role led to criticism that DGs saw their responsibility for EU spending as limited essentially to obtaining the financial controller’s approval (visa) (see paragraph 4). The Commission abolished the financial controller function and moved responsibility for checks to DGs. The move from a system of centralised ex ante approval to a system of decentralised responsibility, and ex post accountability was a fundamental building block of the reform. But this means that it has not always been made clear whether the responsibility of the Commission as a whole encompasses responsibility for the actions of its directors-general, or is distinct from responsibility of its directors-general (see Figure 4).

Figure 4

Accountability in the Commission

1COM(2015) 377 final of 23 July 2015 ‘Consolidated annual accounts of the European Union 2014’, p. 11. The individual civil servants concerned — generally directors-general and heads of service — are known as ‘Authorising Officers by delegation’ or ‘AODs’ or shortened, as in this figure ‘authorising officers’.

2The Authorising Officer for the Commission is the College of the 28 Commissioners. The College through specific decisions delegates tasks of financial management to the directors-general, who thus become the ‘Authorising Officers by Delegation’. Directors-general delegate further to the directors, heads of units, etc. who thus become the ‘Authorising Officers by Sub-delegation‘, in accordance with Articles 56, 65 and 66 of the Financial Regulation.

3Commission 2016 Human Resources Key Figures Staff Members (excluding staff in Executive Agencies).

Source: ECA, based on Commission information and figures.

22

The legal situation is, however, clear. According to the Treaty on the Functioning of the European Union (the Treaty) the Commission is collectively responsible for the execution of the budget³². This is reflected in the Financial Regulation which specifies that ’each institution shall perform the duties of authorising officer‘³³. The Commission bears this responsibility notwithstanding its delegation to directors-general (see Box 5) and thus, it is the authorising officer (Commission) who is responsible for ’implementing revenue and expenditure in accordance with the principle of sound financial management and for ensuring compliance with the requirements of legality and regularity’³⁴.

Box 5

Commission’s responsibility

The CIE stressed in 1999 that ‘the font of all authority in the Commission is the college of commissioners itself. Ultimately therefore, responsibility for all actions of the administration must find its way back to individual commissioners and through them to the college. […] The chain of delegation begins at the level of the Commission through the commissioner. She or he thus holds the ultimate responsibility for all financial matters, including for internal control, and as a member of the college’.

A 2007 CONT³⁵ Working Document on ‘Governance in the European Commission’³⁶ took a critical view of some elements of the reform. It stated that ‘The silo structure of the Commission — and the associated concentration of information and power within the directorates-general — should have made it clear to everybody that there would not be any kind of serious governance without functional reporting lines between related services across the directorates-general. That did not happen. (…)The price for considering each directorate-general as an independent fiefdom, with its own controllers, its own accountants and its own internal auditors only reporting to the director-general, is paid by the institution as a whole and is inconsistent with the Treaty, which gives the college a collective responsibility’.

Throughout this report we use the symbol to designate boxes containing examples of pressure from Parliament.

The Commission abolished the financial controller and set up an internal audit function

23

Abolition of the centralised ex ante financial controller and the creation of a ‘modern Internal Audit Service’³⁷ (see Box 6) was a key element in the Prodi reform. The Commission established the IAS in April 2001³⁸ (it had already appointed an internal auditor (see paragraph 8)). There was considerable debate as to the form Internal Audit should take (institution-wide, or within individual DGs). Eventually the Commission set up a specialised audit capability (IAC), reporting directly to each director-general alongside a central Internal Audit Service. In 2015 the Commission abolished the IACs.

24

The DGs with a significant spending role continue to have ex post verification units and audit directorates which examine spending. There are for example around 180 staff in such entities in DG DEVCO, 130 in DG AGRI, 100 covering research and 90 in DG REGIO. In 2016, the IAS had a staff of 147³⁹.

Box 6

Role of internal audit in the public sector

‘The function of internal auditing is to provide independent, objective assurance and consulting services designed to add value and improve an entity’s operations. The internal audit activity helps an entity accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of governance, risk management, and control processes. Internal audit reviews can cover a wide range of topics, including those relating to the achievement of value for money and the prevention and detection of fraud and corruption.’⁴⁰.

This definition is in line with the IIA framework: ‘Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes’.

The Internal Audit Service initially had a stronger orientation on high level institution-wide governance issues …

25

Governance arrangements were of pressing interest to the Commission as it implemented the White Paper. Thus initially, the IAS had a strong profile on high level, institution-wide governance issues⁴¹. In recent years the work of the IAS has covered both issues related to processes in individual DGs and governance. Institution-wide governance issues in recent years have included corporate information security (see Box 7). We take note of an IAS recommendation⁴² for ‘corporate level central measures … to ensure a consistent reliable complete and comprehensive approach at the operational level and overview on … Commission wide issues’ such as fraud prevention and detection. A survey of DGs by an external assessor showed that, while there was a high level of appreciation overall for the work of the IAS, appreciation of its impact on corporate governance was significantly lower.

Box 7

Some significant IAS recommendations on governance have not been followed

In its annual report for 2006 the IAS recommended that the Commission produce an annual governance statement: ‘in order to achieve full maturity and to make its governance architecture and its latest developments known to stakeholders, the Commission should describe its governance policy and practice, preferably in the synthesis report summarising the DGs annual activity reports, make it available on its website and provide for its regular updating’⁴³.

The Commission’s governance arrangements were last published in 2007 (see paragraph 45).

In its 2009 annual report, the IAS recommended that the overview is necessary at the level of the institution for common processes: ‘Risk Management overview — The role presently played by the SG and DG BUDG should be significantly strengthened so as to assure an effective overview of the implementation of risk management in the Commission, to promote best practices in risk management and to identify risks to which the Commission as a whole is exposed.’⁴⁴.

The Commission’s central departments did not accept this recommendation in its entirety, as they considered it inconsistent with the Commission’s approach of making directorates-general finally responsible⁴⁵.

In 2015, the IAS conducted an audit on corporate information security governance. It tested the adequacy of the governance structure and the measures in place to ensure that appropriate security provisions were implemented in the Commission’s information systems and processes.

Following the IAS recommendation, the Commission set up an Information Security Steering Board (ISSB) and a new IT security directorate.

… and now gives greater attention to the Commission’s internal control framework

26

A key risk to the Commission relates to the legality and regularity of its expenditure. Our work has indicated a material impact of legality and regularity errors throughout the period since the reform of the Commission. The IAS focuses its efforts on the internal control systems of the Commission. While this focus is understandable in the context of the significant work of other bodies (auditors in the Member States, audit directorates within the spending DGs, the ECA), this restricted coverage has an impact on the range of material presented to the APC. The IAS does not cover operations outside the Commission — these are the responsibility of the ex post verification units in spending DGs (see paragraph 24). The findings of these units and directorates are not considered by the Commission’s audit committee: the APC.

The Commission set up an Audit Progress Committee as one of the first steps in the reform process

27

The APC held its first meeting in December 2000, and is thus one of the longest-standing elements of the reformed governance structure. The APC was initially composed of the Budget Commissioner (chairperson), the Vice-President in charge of administration and reform, and two further members of the Commission.

28

It is best practice to have a majority of external, independent members of the audit committee (see Box 8). The Commission appointed the first external member of the APC in May 2001, and a second in 2004. This formation represented the highest share of independent, external members (two out of a total of six members of the APC). In 2005 the number of internal members increased to five, and in 2007 — to seven, thus reducing the proportion of external members to two out of nine. This formation was still in place at the time of the audit. The First Vice-President of the Commission chairs the current (2014-2019) APC and three further commissioners are members of the APC for the whole mandate. A further three commissioners will rotate halfway through the mandate. Among the internal members there is a strong representation of DGs with the highest levels of spending. The commissioner members of the APC are responsible for around 80 % of EU budget spending from the beginning of their mandate until July 2017 and for around 60 % of EU budget spending from August 2017 until the end of the mandate. In addition, the APC Charter sets out rules to further ensure that the independence of the individual APC members is not compromised by obliging the member to declare an interest and to refrain from commenting in cases where APC examines an audit report that concerns his/her services.

Box 8

Audit committees

‘It is good practice for public sector governing bodies to establish an audit committee or equivalent group or function. The audit committee provides another source of assurance on an entity’s arrangements for managing risks, maintaining an effective control environment, and reporting on financial and non-financial performance. The committee’s effectiveness depends on it being independent of the executive. It can have a significant role in:

οhelping to improve the adequacy and effectiveness of risk management and internal control;

οpromoting the principles of good governance and their application to decision-making;

οoverseeing internal audit and supporting the quality of its activity, particularly by underpinning organisational independence;

οreinforcing the objectivity and importance of external audits and, therefore, the effectiveness of the audit function;

οraising awareness of the need for sound risk management and internal control and the implementation of recommendations by internal and external audit; and

οhelping the entity to embed the values of ethical governance, including effective arrangements for countering fraud and corruption.

To enhance the effectiveness of an audit committee, the majority of its members should be independent members of the governing body. It is also important that a public sector entity’s annual report contains appropriate information about the mandate, operations, activities, and outcomes of the audit committee.’ ⁴⁶.

29

APC responsibilities include monitoring the quality of internal audit work and ensuring that audit recommendations are properly taken into account and followed up by Commission DGs and departments⁴⁷. Each meeting of the APC is preceded by meetings of a Preparatory Group (PG) composed of the two external members of the APC and members of cabinets of commissioners sitting in the APC (see Table 1). A standing invitation to attend the meeting is given to the IAS, DG DIGIT, DG BUDG and the SG at director level.

Table 1

Number of meetings of the Audit Progress Committee and its Preparatory Group in 2011-2016

Year | APC Meetings | PG Meetings
2011 | 4 (including 1 in written procedure) | 12
2012 | 4 (including 1 in written procedure) | 9
2013 | 4 (including 1 in written procedure) | 9
2014 | 3 (including 2 in written procedures) | 6
2015 | 2 (including 1 in written procedure) | 6
2016 to date (24 May) | 3 | 4

Source: ECA based on Commission documents.

Overview by the Audit Progress Committee is in practice limited to the work of the Internal Audit Service

30

Table 2 shows that the APC is focused on internal audit reports. Members of the APC plan to cover issues stemming from the external auditor’s (ECA) Annual Reports and Special Reports in the future. The APC does not examine the findings of audit directorates and ex post verification units in the spending DGs (see paragraph 26).

Table 2

Role/composition of Audit Progress Committee and selected audit committees compared to best practices recommended by Good Governance in the Public Sector Framework

Best practices recommended by Good Governance in the Public Sector Framework | Commission’s Audit Progress Committee² | Role of selected audit committees¹
World Food Programme Audit Committee | European Investment Bank Audit Committee | World Bank Group Audit Committee | United Nations Independent Advisory Committee
Provide assurance on risk management arrangements | x | √ | √ | √ | √
Provide assurance on internal control arrangements | x | √ | √ | √ | √
Provide assurance on arrangements for reporting on financial and non-financial performance. | x | √ | √ | √ | √
Oversee internal audit | √ | √ | √ | √ | √
Reinforce effectiveness of external audit | x | √ | √ | √ | x
Majority of independent members | x | √ | √ | √ | √

1Sources: World Food Programme: Terms of reference for the Audit Committee of the World Food Programme (November 2011), European Investment Bank: Audit Committee Charter (June 2007), World Bank Group: World Bank Resolution Standing Committees (2009), Annex A Terms of Reference of the Audit Committee, United Nations: Terms of reference for the Independent Audit Advisory Committee and strengthening the Office of Internal Oversight Services (June 2007).

2Source: ECA. The APC Charter also refers to external audit (see paragraph 30).

31

As stated in the Commission communication on the APC Charter, ‘audit committees play an increasingly important role in delivering the transparency and accountability citizens and other stakeholders rightly demand of public bodies’⁴⁸. The APC is currently the ‘audit committee’ of the Commission. We examined the APC against the criteria of best practice (Box 8), and international bodies selected as benchmarks (Table 2). Notably, all members of audit committees in these international bodies are independent. In the case of Commission, seven out of nine members of the APC are internal.

Aligning internal controls and financial reporting with international standards

The Commission chose the COSO framework as the basis for its internal control standards …

Box 9

Internal control

‘Internal control is a process, effected by an entity’s board of directors, management, and other personnel, designed to provide reasonable assurance of achieving objectives relating to operating, reporting and compliance’⁴⁹.

32

The Commission modified its internal control (see Box 9) arrangements as part of the Prodi reform (see Figure 1 and Box 3). The new arrangements represented a significant departure from the previous system based on the centralised approval (visa) of the financial controller. The Commission based the control arrangements on the COSO 1992 framework (see Box 10) and introduced the COSO definition of internal control into the Financial Regulation⁵⁰.

33

In 2001 the Commission introduced 24 control standards complemented by a set of baseline requirements defining the specific practical actions which should underlie each department’s internal control system. It required DGs to assess and report on their level of compliance with the baseline requirements each year. These reports rely on internal reviews, management self-assessments and relevant audits performed by the IAS and the ECA. We reported on progress in implementing these standards in our annual reports from 2002 to 2008.

34

The Commission revised its internal control framework in 2007, reducing the number of standards to 16. It asked DGs to report on an exception basis (only when they did not apply a standard). In 2014 it further reduced the number of requirements. In 2014 DGs assessed their own progress and reported that, across the Commission, they had implemented 98 % of the internal control standards⁵¹. In 2016 the Commission intends to update its internal control framework to bring it in line with COSO 2013⁵².

Box 10

COSO framework

Source: 2013 COSO Internal Control – Integrated Framework.
© Committee of Sponsoring Organisations of the Treadway Commission (COSO). All rights reserved. Used with permission.

COSO is a framework released in 1992 in the United States, that was originally aimed at private companies. It is now widely applied by both private and public sectors worldwide. COSO issued an updated framework in May 2013. COSO considered the 1992 framework to be superseded by the 2013 revisions after a transition period that ended in December 2014.

The 2013 framework introduced 17 principles that are all necessary for effective internal control. Management may determine that a principle is not relevant, based on its circumstances. If a principle is relevant, yet not present and functioning, a major deficiency exists in the system of internal control.

The new COSO requirements have a greater focus on governance concepts, including the need to establish oversight responsibilities for the board and its committees for each component of internal control (we map the requirements of COSO 2013 against the requirements of GGPS in Annex I).

… but completing transition to the updated COSO framework is challenging

35

In Annex I we present the requirements of COSO 2013 and GGPS. The internal control standards of the Commission cover most of the principles of COSO 2013. However, completing transition to the new COSO framework is challenging because it makes demands of organisations at the level of governance structures, highlighting the responsibility of governing bodies to oversee the performance of all components of the internal control system (see Box 11 COSO principle 2), and requires all elements of control to be in place and working before an organisation meets COSO standards (see Annex I). In paragraphs 36 to 39 we discuss three challenging elements of the COSO framework.

Box 11

Challenging elements of the new COSO framework

COSO Principle 2

‘The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control’.

COSO Principle 5

‘The organisation holds individuals accountable for their internal control responsibilities in the pursuit of objectives’.

COSO Principle 8

‘The organisation considers the potential for fraud in assessing risks to the achievement of objectives’⁵³.

36

Bringing the Commission’s control framework into line with COSO 2013 (COSO Principle 2) would require a central level function to provide oversight of the internal control system. The Commission told us that the reason for not having such a function is to maintain a clear definition of responsibilities and accountability at the level of DGs. The Commission considers that the current structure places responsibility for the operation of the internal control system exclusively on individual authorising officers by delegation and that a central oversight function may lead to a transfer of responsibility⁵⁴. While the CFS issued an annual document on the ‘Overview on the state of Internal Control in the Commission’ until 2014⁵⁵, this was not an independent source of assurance, but a descriptive summary.

37

The Commission abolished the financial controller function in order to make the directors-general responsible for the legality and regularity of spending by their DGs. DGs report annually on their management via the AAR (see paragraph 55). But mechanisms to hold individuals to account for their contribution to internal control (COSO Principle 5) are relatively undeveloped. The Commission has not put in place staff evaluation criteria linked to this objective. The AAR provides a potential mechanism to achieve such a linkage for directors-general. However, in practice the Commission has not established a basis to determine whether the declarations made within AARs are well-founded⁵⁶, or established a benchmark against which to hold DGs accountable.

38

In 2001, following the adoption of the first overall anti-fraud strategy⁵⁷ (COSO Principle 8) and in the wake of the White Paper on administrative reform the Commission announced that a unit within OLAF would ‘develop an overall strategic approach to fraud prevention. This should target new draft legislation with significant financial implications in areas at risk of fraud’. In 2011 the Commission developed a new anti-fraud strategy⁵⁸ covering the whole ‘anti-fraud cycle’ from the prevention and detection of fraud to investigations, sanctioning and recovery of misused funds and also clarifying the responsibilities of the various parties involved.

39

The Commission’s risk management guidelines take the risk of fraud into account and DGs are required to report annually on fraud prevention and detection in a specific section of their AARs. The Commission’s current internal control standards do not, as required by COSO principle 8 (see Annex I), address fraud risk directly. The Commission told us that they will cover this point in the next revision of the internal control standards.

Producing annual accounts in line with international standards improved financial reporting

Box 12

IPSAS

The International Public Sector Accounting Standards (IPSAS) issued by the International Public Sector Accounting Standards Board (IPSASB), ‘provide the most complete suite of accrual-based international financial reporting standards developed specifically for the public sector’⁵⁹.

40

As can be seen in Figure 5, accrual accounting was introduced in two stages. The Commission first moved towards accruals, with some changes to financial reporting in 2001. A much bigger change took place in 2005 (see paragraph 8) when the Commission moved to base its financial reporting on international standards. The impact of these changes was that the pre-2000 presentation of a partial balance sheet was replaced with a complete presentation of assets and liabilities.

41

The Commission’s new accounting framework first applied in 2005, and we were able for the first time to issue an unqualified opinion on the reliability of the 2007 annual accounts. This marked the successful culmination of the Commission’s accounting modernisation project. In producing financial statements on an accrual basis and in line with international standards (Box 12), the Commission has improved transparency and achieved a good standard of financial reporting.

Figure 5

European Union — presentation of assets and liabilities 1997-2015

Source: ECA (based on a visual presentation from French Cour des comptes in ‘La comptabilité générale de l’État, dix ans après’, February 2016).

Providing non-financial information to internal and external stakeholders

The Commission provides non-financial information alongside the accounts …

42

While the reform resulted in much better annual accounts, the EU provided no accompanying management analysis or narrative until 2014 when it voluntarily accompanied the consolidated annual accounts for 2014 with a Financial Statement Discussion and Analysis (FSD&A). This provided some background and analytical material for users⁶⁰. However the discussion of EU objectives focused on those announced for the Commission by its President⁶¹, rather than agreed EU 2020 strategy⁶². The only discussion of governance issues in the FSD&A was a brief (and Commission-centred) listing of the roles of the key institutions⁶³.

43

A key statement of best practice is provided in Box 13. We compared the contents of a number of frameworks⁶⁴ and evaluation criteria and found that several elements of best practice were common to many frameworks (see Annex II). All the benchmarks we used included an annual report on governance (as does GGPS), discussion of risks, as well as financial and non-financial performance. All but one require a narrative report covering objectives and strategies as well as social and staff issues. Three require a description of business model.

Box 13

Principles of annual reporting

GGPS: ‘Public sector entities should demonstrate that they have delivered their stated commitments, requirements, and priorities and have used public resources effectively in doing so. To that end, they need to report publicly at least annually in a timely manner, so that stakeholders can understand and make judgements on issues such as how the entity is performing, whether it is delivering value for money, and the soundness of its stewardship of resources. It is also important that the process for gathering information and compiling the annual report ensures that the governing body and senior management own the results shown.

Governing bodies should assess the extent to which they are applying the principles of good governance, as set out in this Framework, and report publicly on this assessment, including an action plan for improvement.

The performance information and accompanying financial statements that public sector entities publish should be prepared on a consistent and timely basis. The statements should allow for comparison with other, similar entities and be prepared using internationally accepted high quality standards.’ ⁶⁵

Commission recommendation for listed companies: governance information should be sufficiently clear, accurate and comprehensive to enable shareholders, investors and other stakeholders to gain a good understanding of the manner in which the company is governed. Also companies should routinely make this information available on their websites and include a reference to the website in their management report.⁶⁶

44

Among the EU Member States⁶⁷:

ο21 out of 28 Member States require public bodies to publish a statement of internal control and/or a governance statement;

ο18 Member States issue their financial statements within 6 months of year end (of which nine prepare accounts on an accrual basis);

οin 12 Member States financial statements covering the central government apparatus are signed by the Minister of Finance;

ο12 Member States prepare accounts on an accrual basis, with four others moving towards an accrual-based (generally under IPSAS) presentation;

οseven Member States require publication of an audit committee report.

… but less than many other organisations do

45

Comparing the audited EU annual accounts (including the FSD&A) with guidance and with practice elsewhere (see Figure 6 and paragraphs 43 to 44) we find:

οpreparation of accounts on an accruals basis: as described in paragraph 40 the Commission has prepared the EU accounts on an IPSAS-compliant, accruals basis since 2005.

οsummary of key figures: the FSD&A provides an overview of key figures from the economic outturn account and balance sheet, pre-financing and financial instruments.

οopinion of the independent auditor: the accounts (as published in the Official Journal) are accompanied by an opinion of the independent auditor. (Other documents that appear to have some of the characteristics of annual accountability information (such as the SR and the Financial Report) are not accompanied by an independent audit opinion).

οcomparison between budgetary and financial results: the Commission includes in the annual accounts a full comparison of the budgetary and financial results.

οanalysis of governance structures and issues: the Commission does not produce an annual statement on governance or on internal control, in line with best practice and the common practice of Member States (see paragraph 44)⁶⁸. Such a document was produced in 2007, in response to a recommendation of the Internal Auditor⁶⁹, but we found no evidence that it has been approved by the Commission. We have been informed that the Commission is currently updating its 2007 governance statement and that it will be submitted to the College of Commissioners. Since 2014 the Commission has included an overview of institutional roles, of responsibilities of financial actors within the Commission and of the discharge procedure in the FSD&A.

οpresident’s/senior official’s foreword (or report): the EU accounts are not accompanied by an explanatory foreword from the President (or other member of the Commission). The Commission’s governing body does not endorse its ownership of the annual accounts by producing a foreword or a narrative report from the President or the Budget Commissioner. The separately published Financial Report (see Figure 7) is, however, preceded by a foreword from the Vice President for the budget.

οdiscussion of the risk of irregular transactions or activities: there is limited reference to the risk of irregular transactions in the EU accounts and accompanying information. In 2015 the Commission introduced a separate section in the FSD&A on risks and uncertainties, and measures taken for ‘bearing or mitigating’ them in accordance with IPSASB RPG2 (see also paragraph 42). This addresses financial risks only: operational and strategic risks are not covered.

οestimation of the level of irregularity: the Commission provides a quantification of the risk of irregular transactions in the Synthesis Report (now included in the AMPR), but not alongside the audited annual accounts.

οinformative report on activities during the year:

-the EU accounts provide information on financial performance, but not on non-financial performance⁷⁰;

-there is no description of the EU business model (see Annex II), nor is there a report on key activities;

-the FSD&A focuses on the new Commission’s plan rather than the EU objectives and strategy under the EU2020 strategy.

οthe long-term projection sustainability report: the Commission does not accompany the accounts with any projection of long-term/mid-term sustainability of the EU finances.

οdescription of the role and conclusions of the Audit Committee: the annual accounts are not accompanied by any text summarising the role and conclusions of the APC.

Figure 6

Overview of annual reports and accounts of selected public sector bodies (see Annex III)

Source: ECA.

46

The EU annual accounts do not provide an overall view of the Commission’s governance, performance and strategy against the risks to achieving its goals. Key information is dispersed between corporate and DG-level documents presented separately throughout the year (often too late for consideration alongside the audit of annual accounts). Some of the elements not included in the annual accounts (paragraph 45) are present in other reports (Figure 7). The Financial Report is preceded by a foreword from the Budget Commissioner where it presents information on activities during the year. Operational and strategic risks are discussed to some extent in planning documents (DGs’ strategic and management plans). The risk of irregular transactions is described in the Management and Performance Report. A document on the working methods of the European Commission approved shortly after the current Commission took office covers some elements of the Commission’s governance arrangements⁷¹. However, the College of Commissioners does not produce an annual statement where it takes responsibility for the internal control and risk management in the Commission.

47

On 19 July 2016, 4 weeks after we sent the draft of this report to the Commission and one week after the closure of our audit of the annual accounts, the Commission issued an ‘Integrated Financial Reporting Package’ comprising four reports⁷². Two of these have previously been published later in the year. While we welcome this move to provide a fuller explanation of activities and finances of the EU at an earlier date, this set of reports was not, with the exception of the annual accounts, subject to audit. It represents a further step, following the introduction of the FSD&A in 2014, in the direction of producing a single accountability report (or suite of reports) subject to external assurance.

Since 2013 the Commission has reported a material level of error in its spending

48

Where there is a high risk of irregularity it is best practice both to discuss the risk and to quantify the level and likely impact. As we discuss above, the Commission has many staff working in the field of audit and control, and EU legislation also requires extensive checks on spending by bodies managing EU funds. Commission reporting on this subject pays very significant attention to ‘corrective capacity’ (the possibility to disallow spending claims after initial acceptance by the Commission) rather than to quantifying and analysing the nature of the errors it identifies. The key document on this (‘Protection of the EU budget’ — see Figure 7) provides no estimate of the level of irregularity present in initial or in approved claims for reimbursement.

Figure 7

Overview of key Commission periodic reports (timing is that applicable in 2015 and earlier years — see paragraph 47)

1In 2016 the Commission merged the Synthesis of the Commission’s management achievements and the evaluation of the Union’s finances based on the results achieved into a single document approved by the Commission, and forwarded to the Court, on 5 July.

Source: ECA.

49

In 2013 the Commission recognised for the first time in the SR that EU spending is affected by a material level of error (see Table 3). The Commission’s methodology for estimating its level of error has developed over the years, in part responding to pressure from Parliament (Box 14).

Box 14

Pressure from Parliament: disclosure of amount at risk

In the 2013 discharge resolution the Parliament asked the Commission ‘to further clarify the calculation of the amount at risk in explaining the estimated impact of corrective mechanisms on this figure’⁷³.

50

There are no mechanisms for overseeing the work of audit directorates in this respect, other than the IAS limited reviews (see paragraph 26) carried out for 11 DGs and executive agencies since 2013. The Commission needs good quality information to be able to provide reliable estimates of the level of error. We have reported in the past on actions to be taken to improve reliability of the Commission figures⁷⁴.

51

We consider good practice the approach of DG DEVCO⁷⁵ which is different from usual arrangements and uses a model that has some similarities⁷⁶ with the US model for estimating the level of error in spending (Iperia) (Box 15 and Table 3).

Box 15

Iperia

In the USA an Act of Congress requires all government agencies to carry out sufficient testing of their own payments to calculate a statistically valid estimate of the annual amount of improper payments in those programmes where risk analysis suggests that such payments are likely to exceed 1.5 % of the total sum paid. Agencies are required to publish the result both as an extrapolated total and as a percentage of payments made. The auditors of government agencies are required to report on whether the process of producing and publishing these figures is in compliance with the relevant Act of Congress⁷⁷.

Improper payments are defined as:

οincorrect amounts paid to eligible recipients;

οpayments made to ineligible recipients;

οpayments for goods or services not received;

οduplicate payments; or

οpayments for which insufficient or no documentation was found.

Table 3

Differences and similarities between US and EU models for estimating the level of error in budgetary spending

US government
European Commission

Responsibility for calculating the estimated level of error
Managers of funds must provide a statistical estimate of levels of error
√
partially¹

Coverage
All payments from the budget are subject to sampling
x
x

Spending on programmes considered risky by managers of funds are sampled
√
x

Basis for error calculation
Testing of a sample of operations selected with the use of statistical methods
√
partially

Corrective actions (carried out by managers of funds) can reduce the estimated level of error
x
√

Presentation of the estimated level of error
Estimated error presented in cash terms
√
√²

Estimated error presented as percentage
√
√²
2013 and 2015

Management results
Average level of error for 2013-2015
4.0%
From 2.6 % to 3.1 %³

Level of error for 2015
4.4%
From 2.3 % to 3.1 %

1The Commission, however, requires managers in Member States to prepare statistical estimates in some areas of spending.

2The Commission includes in its SR/AMPR a quantification of the ‘amount at risk’ which we consider as equivalent to the level of error.

3The Commission changed the way it calculated its estimate in 2015 AMPR as compared with previous years. The average is calculated on the published figures.

It is best practice to base the estimates of amounts at risk on a consistent methodology

52

Ex post examination of spending can serve multiple purposes within an organisation. It can:

οalert managers to patterns of behaviour;

οbring to light particular risks linked to the legislation in place;

οprovide a basis for focusing action to mitigate risks⁷⁸;

οallow the governing body to assess the efforts of senior managers in tackling risks.

All these objectives require the organisation to produce estimates of error separately from estimates of corrective action. It is also important for the body to evaluate the impact of errors arising from different causes.

53

In the US, the Executive Office of the President (Office of Management and Budget) provides federal agencies with instructions on how to make statistical estimates of the level of improper payments, in particular it does not allow federal agencies to rely on self-reporting by sub-agencies or the recipients of the payments as the sole source for improper payment estimates⁷⁹, nor to net off the improper payments total by calculating the impact of recovery action. The auditors of the government agencies (the inspectors general) are required to assess whether the agencies were compliant with Iperia. Agencies with programmes reported as non-compliant for three consecutive years are required to submit proposals to Congress to reauthorise the programmes or change the statutes that established them⁸⁰.

Reports introduced through the Prodi reform still form the basis for Commission internal reporting

54

The reform introduced planning and monitoring tools in the Commission. Each DG prepared a management plan (MP) for the year to come, intended to translate policy objectives in the Commission’s work programme into concrete operational objectives. In 2016 the Commission adjusted these arrangements, replacing MPs with 5-year Strategic Plans (SPs) and Annual Management Plans (AMPs)⁸¹.

55

The AAR is a management report (internal report) by the director-general to the members of the Commission⁸². The AAR covers management and internal control and the delivery of key objectives and activities identified in the MP. The AAR includes a declaration by the director-general or head of department on the financial information provided in the AAR.

56

If the director-general is unable to make the declaration in full, he/she issues a ‘reservation’ (i.e. qualifies the assurance given).

57

The Commission summarises and comments on the AARs in an annual report known until 2015 as the Synthesis Report (SR) (produced jointly by SG and DG BUDG). In spite of requests by the Parliament (see Box 16), the Commission does not provide explicit assurance through this document: as described above (Figure 4) it provides a statement that in approving the SR it takes ‘political responsibility’ for the Commission’s actions. The varying titles of the SR and the different forms in which the Commission has expressed its duties are set out in Figure 8.

Box 16

Pressure from Parliament: providing assurance

The European Parliament has frequently pressed for a more explicit statement from the Commission.

2003: It called upon the Commission to convert the ‘Annual Synthesis Report into a consolidated assurance statement on the Commission’s management and financial controls as a whole’⁸³.

2010: It called upon the Commission to ‘further improve its corporate governance and to inform the discharge authority of actions and measures taken by:

οincorporating those elements of corporate governance required or proposed by Union company law relevant for Union institutions;

οtaking measures allowing the President to sign the accounts, and to present together with the accounts:

-a description of the risks and uncertainties which could affect the achievement of the policy objectives as well as a statement in which the President, together with the college of commissioners, accepts responsibility for risk management; and

-a formal Corporate Governance declaration clearly showing which international standards for corporate governance the Commission is adhering to as well as objective and complete explanations if there is a need to depart from the corporate governance code’s recommendation (the ’comply or explain‘ principle)’⁸⁴.

The Commission rejected the recommendation.

2013: The Parliament called for the Commission ‘to issue in its synthesis report a proper ‘statement of assurance’ based on the Directors-General annual activity reports’⁸⁵.

Figure 8

From Synthesis Report to Annual Management and Performance Report

1Article 318 TFEU requires the Commission to submit to the European Parliament and the Council an evaluation report on the Union’s finances based on the results achieved, which is not covered by this report.

Source: ECA.

21Pursuant to Article 17(2) TEU, EU legislative acts ‘may only be adopted on the basis of a Commission proposal, except where the Treaties otherwise provide’.

22For example in competition policy.

23Throughout this report we use the term ‘directorate-general’ to cover both a directorate-general and a department.

24Throughout this report we use the term ‘director-general’ to cover both a director-general and a head of department.

25Chartered Institute of Public Finance and Accountancy (CIPFA)/International Federation of Accountants (IFAC), “International Framework: Good Governance in the Public Sector”, 2014, p. 9.

26Communication from the President to the Commission: The Working Methods of the European Commission 2014-2019. C(2014) 9004, p. 7.

27Communication from the President to the Commission: The Working Methods of the European Commission 2014-2019. C(2014) 9004, p. 2.

28Activity-based management.

29Also known as private offices.

30The Commission defines resource director as ‘the person of the management board in charge of resource management at DG-level including programming, human resources and financial resources management’, (SEC(2003) 59 final).

31Committee of Independent Experts, Second Report on Reform of the Commission, 1999, p. 118.

32Article 234 of the Treaty on the Functioning of the European Union (TFEU).

33Article 65.1 of Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council of 25 October 2012 on the financial rules applicable to the general budget of the Union and repealing Council Regulation (EC, Euratom) No 1605/2002 (OJ L 298, 26.10.2012, p. 1).

34Article 66.1 of Regulation (EU, Euratom) No 966/2012.

35European Parliament’s Committee on Budgetary Control.

36PE 393.916v01-00, 3.9.2007, pp. 2-3.

37A new Framework for Resource Management and Internal Auditing in the Commission, Final Report of the Planning and Co-ordination Group ‘Internal Audit’, February 2000, p. 2.

38Commission Decision, SEC(2000) 560.

39Of the total IAS staff 31 work on the decentralised agencies and other autonomous bodies. Their work is not presented to the Commission’s APC.

40CIPFA/IFAC, ‘International Framework: Good Governance in the Public Sector’, 2014, p. 29.

41Illustrated, for example, by the 2002 ‘Verstehen’ conference at which the Head of the IAS promoted the ‘single audit’ concept.

42The IAS has first made this recommendation in the Working document accompanying the Overall opinion for the year 2010.

43COM(2007) 280 final of 30 May 2007 ‘Annual report to the discharge authority on internal audits carried out in 2006’, p. 12.

44IAS, ‘Final audit report on risk management in the Commission’ (IAS.B1-2009-4 COMM-001).

45IAS Audit Report: Final Audit Report on Risk Management in the Commission, IAS.B1-2009-Y COMM-001, Annex 2, comments from SG and DG BUDG: Recommendation 1.

46CIPFA,IFAC, ‘International Framework: Good Governance in the Public Sector’, 2014, pp. 29-30.

47C(2015) 3014 final ‘Charter of the Audit Progress Committee of the European Commission - C(2015) 3014’.

48C(2015) 3014 final ‘Charter of the Audit Progress Committee of the European Commission’, p. 2.

49Definition of COSO, Committee of Sponsoring Organisations of the Treadway Commission, 2013 COSO Internal Control – Integrated Framework. © Committee of Sponsoring Organisations of the Treadway Commission (COSO). All rights reserved. Used with permission.

50Article 32.2 of Regulation (EU, Euratom) No 966/2012.

51Overview of the state of internal control in the Commission services in 2014, ARES (2015) 1930721 — 07/05/2015, p. 21.

522015 Annual Management and Performance Report for the EU Budget.

53Source: 2013 COSO Internal Control – Integrated Framework. © Committee of Sponsoring Organisations of the Treadway Commission (COSO). All rights reserved. Used with permission.

54A similar issue was raised by the IAS in the Working paper supporting the 2015 Overall Opinion: ‘an overview at the level of the institution is necessary if common processes, such as fraud prevention and detection, are to be effective in protecting the institution as a whole. The IAS recommends that at the corporate level central measures should be taken to ensure a consistent, reliable, complete and comprehensive approach at the operational level and an overall view on the Commission-wide issues and on the cost-effectiveness of the measures taken. The central services should strengthen their guidance to the DGs/Services to improve the effectiveness of controls at the operational, DG/Service level. All the recommendations are being addressed under action plans’.

55The document was discontinued in 2015.

56The IAS issues a ‘limited conclusion on internal control’ in support of the AAR rather than an ‘annual opinion’.

57COM(2000)358 final of 28 June 2000 ‘Protection of the Communities’ financial interests. The fight against fraud For an overall strategic approach’.

58COM(2011) 376 final of 24 June 2011 ‘Commission Anti-Fraud Strategy’. This built upon the Communication on fraud prevention (COM(2007) 806 final).

59CIPFA/,IFAC, ‘International Framework: Good Governance in the Public Sector’, 2014, p. 31.

60Some of the information that similar organisations provide alongside the accounts in an annual report has been made available in the synthesis report (see paragraph 57 and Figure 8).

61COM(2015) 377 final, p. 6.

62COM(2010) 2020 final of 3 March 2010 ‘Europe 2020, a strategy for smart, sustainable and inclusive growth’.

63Council is described as the forum in which ‘Governments defend their country’s national interests’, while the ‘interests of the EU as a whole are promoted by the European Commission’. COM (2015) 377 final p. 7.

64Directive 2014/95/EU of the European Parliament and of the Council of 22 October 2014 amending Directive 2013/34/EU as regards disclosure of non-financial and diversity information by certain large undertakings and groups (OJ L 330, 15.11.2014, p. 1), the International Integrated Reporting Council (IIRC), the ‘Building Public Trust Awards’ award criteria, IPSASB Recommended Practice Guidelines and OECD guidelines.

65CIPFA/,IFAC, ‘International Framework: Good Governance in the Public Sector’, 2014, p. 31.

66Commission Recommendation of 9 April 2014 on the quality of corporate governance reporting (‘comply or explain’) (OJ L 109, 12.4.2014, p. 43).

67We contacted supreme audit institutions (SAIs) in the 28 Member States, to gain an insight into the way accounts are prepared, the provision of non-financial information, and the responsibility for signing accounts.

68Listed companies in the EU are required by EU directive to include a corporate governance statement in their management report.

69Annual Report to the discharge authority on internal audits carried out in 2006, COM(2007) 280 final, p. 12, Conclusion No 5.

70Documents referred to by the Commission in its reply are only made available after completion of the audit of annual accounts.

71E.g. Communication from the President to the Commission: The Working Methods of the European Commission 2014-2019. C(2014) 9004.

72Annual management and performance report; Financial report; Communication on the protection of the EU budget; Annual accounts.

73P8_TA-(2015)0118, paragraph 27.

74See paragraph 1.20 of 2010 annual report (OJ C 326, 10.11.2011), paragraphs 1.22, 1.23 and 1.25 of 2011 annual report (OJ C 344, 12.11.2012), paragraphs 1.41-1.42 and 1.44-1.45 of 2012 annual report (OJ C 331, 14.11.2013), paragraphs 1.29-1.30 and 1.32 of 2013 annual report (OJ C 398, 12.11.2014), paragraphs 1.50, 1.53-1.54, and 1.65 of 2014 annual report. (OJ C 373, 10.11.2015), paragraphs 1.35 and 1.48 of 2015 annual report, paragraphs 61-63, 69-70, 81-88 and 113-114 of ‘Agriculture and cohesion: overview of EU spending 2007-2013’, (http://www.eca.europa.eu/Lists/ECADocuments/PL14_AR13/PL14_AR13_EN.pdf).

75See also the section on the ‘2015 residual error rate (RER) study’ in the annual report on the activities funded by the 8th, 9th, 10th and 11th European Development Funds (EDFs).

76The calculation is based on a statistically valid method.

77Currently the Improper Payments Elimination and Recovery Improvement Act of 2012 (Iperia). Certain agencies first began reporting improper payments in 2003, as required by the Improper Payments Information Act of 2002 (IPIA).

78A framework for mitigation is provided by the Four Ts approach: Treat, Tolerate, Transfer, Terminate.

79The agency may however coordinate this work with the work performed by other auditors. Executive Office of the President, Office of Management and Budget, Appendix C to circular No A-123 requirements for effective estimation and remediation of improper payments, 2014.

80IMPROPER PAYMENTS: Chief Financial Officers (CFO) Act agencies need to improve efforts to address compliance issues, GAO, June 2016.

81The Strategic Plan is built around objectives to be achieved in support of the delivery of the Commission’s priorities during its whole mandate (i.e. 2016-2019 for this planning cycle) and provides the framework for the implementation details to be specified in the subsequent Annual Management Plan.

82The Annual Activity Reports are made public after publication of the AMPR. While the SG, DG BUDG and IAS review AARs (the ‘peer review’) and the IAS carries out a small number of ‘limited review’ audits each year, the director-general has the final say on the content of the report.

83P6_TA(2005)0092, paragraph 62.

84P7_TA(2012)0153, paragraph 35.

85See footnote 74.

Conclusions and recommendations

58

The Commission is a complex organisation responsible for an annual budget of more than 140 billion euros. It achieved a significant overhaul of its governance arrangements in the first decade of the millennium, such as creating the IAS⁸⁶, setting up the APC⁸⁷, applying international standards for internal control⁸⁸ and accounting⁸⁹. However best practice has continued to evolve. Although some action⁹⁰ has been taken, we have identified areas in which the Commission’s governance arrangements with focus on audit, financial management and control diverge from or do not meet in full best practice set out in standards or put in place by the international and public bodies we selected as benchmarks.

59

The distinction made between the ‘political responsibility of commissioners’ and the operational responsibility of directors-general means that it has not always been made clear whether ‘political responsibility’ encompasses responsibility for the actions of the DGs or is distinct from it (see paragraphs 21 and 22). Recent organisational reforms are beginning to address some of the risks of a ‘silo’ culture⁹¹. But to continue to address key risks the Commission will need further to strengthen the governance structure across the institution.

60

The IAS focuses its efforts on the internal control systems of the Commission. Operations outside the Commission — the spending for which the Commission is responsible — are the responsibility of the ex post verification units in spending directorates-general (see paragraphs 25 to 26). This has an impact on the information presented to the Commission’s audit committee — the APC. The role of the APC (and the participation of independent, external members) is more limited than that of audit committees at international bodies that we selected as benchmarks (see paragraphs 30 to 31).

61

In the area of internal control, after implementing COSO 1992, the Commission is moving to the COSO 2013 framework. While the Commission has produced two communications on fraud and an anti-fraud strategy (AFS), this risk is not reflected in the current internal control framework (paragraph 39). This can have a negative impact on the effectiveness of the DGs fraud assessment exercise⁹² exposing the Commission to potential fraud risk.

62

Since 2005 the Commission has produced annual accounts in accordance with international standards. However, despite recent innovations, involving cooperation with the Court, the Commission still publishes them later than the majority of the EU Member States (see paragraph 44 and Figure 7).

63

The Commission has recently begun to accompany the accounts with non-financial information. However, despite improvements, it still provides less non-financial information alongside the accounts than the other organisations we considered. Information is dispersed among several corporate and DG-level documents (see paragraphs 45 to 47).

64

Since 2013 the Commission has recognised that the EU spending is affected by a material level of error. Individual DGs’ estimations of the level of irregular spending are not based on a consistent methodology (see paragraphs 50 to 53).

65

Best practice has continued to evolve since the Prodi reforms. Although some action has been taken, we conclude that the Commission diverges from, or does not meet in full best practice in the following areas:

οcoverage of high level governance issues by the IAS (paragraphs 25 to 26);

οcomposition of the APC (paragraph 31); and

οcoverage by the APC of:

-external audit results;

-risk management;

-financial and performance reporting; and

-the work of the Commission’s audit directorates and ex post verification units (paragraphs 26, 30 to 31);

οconsider the risk of fraud in the internal control framework (paragraph 39);

οtiming of publication of financial statements (paragraph 44);

οaccompanying the financial statements with:

-a governance statement;

-a President’s report;

-a discussion of operational and strategic risks;

-a report on non-financial performance;

-information on activities during the year and the achievement of policy objectives;

-a report on the role and conclusions of the Audit Committee; and

-a mid- and long-term fiscal sustainability statement (Figure 7 and paragraph 45).

οconsistency of calculation of the level of irregular spending and analysis of results across all DGs (paragraph 53).

66

The Commission should either comply with best practice, or explain why it considers it inappropriate to do so (see footnote 19):

Recommendation 1 — Explain where it does not comply with best practice

The Commission should, as required of European public interest entities, when it decides not to follow best practice, explain its reasons for not doing so.

Target implementation date: April 2017.

Recommendation 2 — Comply with best practice

The Commission should:

(a)invite the IAS to carry out more audit work on high level governance issues;

(b)complete the process of aligning its internal control framework with the COSO 2013 principles;

(c)further bring forward the publication of the annual accounts;

(d)bring together information already presented in a variety of existing reports to form a single accountability report or suite of reports, containing the accounts but also incorporating:

οa governance statement;

οa President’s report;

οa discussion of operational and strategic risks;

οa report on non-financial performance;

οinformation on activities during the year and the achievement of policy objectives;

οa report on the role and conclusions of the Audit Committee; and

οa mid- and long-term fiscal sustainability statement, together with, where appropriate, links to information contained in other reports;

(e)present this single accountability report or suite of reports for audit of the accounts and checks by the auditor that other information presented within it is consistent with accounting information;

(f)publish as part of the annual accounts or accompanying information an estimate of the level of error based on a consistent methodology;

(g)update and publish its governance arrangements on a regular basis and explain its choice of structures and processes in relation to the framework it chooses;

(h)turn the APC into an audit committee with a majority of independent, external members and expand its mandate to cover risk management, financial reporting and the work and results of ex post verification units and audit directorates.

Target implementation date: April 2018.

This report was adopted by Chamber V, headed by Mr Lazaros S. LAZAROU, Member of the Court of Auditors, in Luxembourg at its meeting of 20 September 2016.

For the Court of Auditors

Vítor Manuel da SILVA CALDEIRA
President

86See paragraphs 23 to 24.

87See paragraphs 27 to 29.

88COSO, see paragraphs 32 to 34.

89IPSAS, see paragraphs 40 to 41.

90Including the publication alongside the accrual-based EU accounts of the financial statement discussion and analysis, reporting on performance (resulting in 2015 in an integration with reporting on management in the annual management and performance report) and the transition to the updated 2013 COSO internal control – integrated framework.

91See paragraph 17.

92‘[…] the anti-fraud risk assessments of DGs are not sufficiently coordinated with the annual risk management exercise, or are too high level to take the existing internal control structure into account. They do not address all elements of the fraud cycle, and do not cover all management modes. Furthermore, risks identified in the AFS are not prioritised and cannot be individually reconciled or identified with actions in the AFS action plan.’(IAS Working paper supporting the 2015 Overall Opinion, May 2016).

Annexes

Annex I

The GGPS Framework and COSO 2013

Source: ECA.

Annex II

Key elements of selected corporate reporting frameworks

Directive 2014/95/EU
IIRC
Building Trust Award
(UK)
IPSASB Recommended Practice Guideline No 2
OECD Guidelines for Multinational Enterprises
(III Disclosure)

Governance
Corporate governance
Governance
Narrative clearly demonstrating governance structure and tone at the top.
Transparent information about how the Board works effectively to govern the organisation.
Governance
Governance structures and policies

Risks
The principal risks related to those matters linked to the undertaking's operations including, where relevant and proportionate, its business relationships, products or services which are likely to cause adverse impacts in those areas, and how the undertaking manages those risks.
Risks and opportunities
Linkage between risks, strategic objectives and annual report narrative Quantified risks.
Discussion of how the dynamic of the risk profile has evolved over time.
Risks and uncertainties: Risks and uncertainties with financial impact, risk mitigation measures, internal and external risks
Information on systems for managing risks and complying with laws, and
on statements or codes of business conduct.
Foreseeable risk factors.

Financial and non-financial performance
Requires information to be prepared in accordance with a recognised framework (national, Union-based or international frameworks).
Publication with accounts or separately (within 6 months).
The non-financial statement include references to, and additional explanations of, amounts reported in the annual financial statements.
Non-financial KPIs relevant to the particular business.
Outlook
An understandable and fair reflection of financial performance which is consistent with the underlying financial statements.
Discussion of actual performance against expected/budgeted performance.
Quantified KPIS aligned to strategic objectives. Balanced assessment of goals achieved and performance against target.
Information about the financial statements and variances and trends.
Comparison of budget and actual amounts in the financial statements
Financial and operating results of the company

Social and staff issues
Social and employee matters.
Respect for human rights.
The capitals: Financial, Manufactured, Intellectual, Human, Social and relationship and Natural
Discussion and quantitative analysis of people factors in the organisation.
Details of equal opportunities and diversity
-
Issues regarding employees and other stakeholders

Objectives and strategies
-
Strategy and resource allocation. Inputs
Clear statement of purpose.
Balanced view of progress against objectives
Information about objectives and strategies.
Mission and vision
Company objectives

Business model
Brief description of the business model.
A description of the policies pursued by the undertaking, including due diligence processes implemented.
Outcomes of these policies.
Business model (business activities that create value over the short, medium and long term).
Value creation process: stakeholder groups, key material matters, Risks, Strategic objectives, Value drivers, KPIs, Targets, Impact.
Different delivery models.
Narrative around how business operations support wider parliamentary objectives. Consideration of capital investment and how it achieves value for money.
-
-

Elements present in all frameworks
Elements present in 4 of 5 frameworks
Elements present in 3of 5 frameworks

Source: ECA.

Annex III

Overview of annual reports and accounts of selected public sector bodies

EU 2014 consolidated accounts¹
European Investment Fund 2015 Annual report
European Investment Bank 2015 Financial report
US 2015 Financial Report
Comptes de l’État 2014
(France)

Accrual accounting
Yes
Yes
Yes
Yes
Yes

Summary of key figures
Yes
Yes
Yes
Yes
Yes

Accompanied by the opinion of the independent auditor
Yes
Yes
Yes
Yes
Published separately

Comparison between budgetary and financial results
Yes
Published separately
Published separately
Yes
Yes

Analysis of governance structures and issues
Summarised²
Yes
Yes
Yes
Yes

Chairman’s/President’s/Senior official’s foreword (or report)
Published separately
Yes
Published separately
Yes
Published separately

Discussion of the risk of irregular transactions or activities
Published separately
No³
No³
Yes
No

Estimation of the level of irregularity
Published separately
No
No
Yes
No

Informative report on activities in the year
Published separately
Yes
Yes
Yes
Yes

Long-term projection/sustainability report
No
Published separately
Published separately
Yes
Yes

Description of the role and conclusions of an audit committee
No
Yes
Yes
No
Summarised

Source: ECA.

1See paragraphs 45 and 46.

2See paragraph 45.

3Not applicable. These reports do not include a discussion of the risk of irregular transactions or activities. However, we have indications that there are no material levels of irregularity.

Reply of the Commission

Executive summary

Common Commission reply to paragraphs I to IV

The Commission recognises the importance of a state-of-the-art framework for governance. The Commission strives to comply with evolving and relevant best practice set out in standards or put in place by international or public bodies and will continue to adapt its governance structure.

The overarching principles of the Commission’s governance framework (i.e. authority, accountability, duties and responsibilities, appointment and resignation of the Commission and its members, transparency) are enshrined in the EU treaties.

The College delegates operational tasks to its departments. To ensure that each Commission department has put in place the organisational structure and the internal control systems best suited to ensure the achievement of its objectives, the Commission has defined minimum features at corporate level, which are based on the internationally recognised COSO framework. In its 2015 Annual Management and Performance Report (AMPR), the Commission reported on the effective implementation of those standards.

The governance arrangements applicable to the European Commission are tailored to the supranational nature of the institution or its particular structure with a College of Commissioners supported by a permanent administrative corps. These features were the basis for the decisions taken in 2000 on the Commission’s governance structure. They also took into account the reports of the Committee of Independent Experts and the Court’s Opinions Nos 4/97 and 1/2000. The Commission control and audit arrangements are solid, comprehensive and are currently being enhanced to comply fully with COSO 2013 Internal Control principles. Furthermore, the IAS is fully compliant with the standards of the internal audit profession as evidenced by an external quality assessor. These arrangements enable the Commission to exert a robust oversight over the functioning of the governance structure.

See also Commission reply to VI.

V

The overarching principles of the Commission’s governance framework (i.e. authority, accountability, duties and responsibilities) are enshrined in the EU treaties. The College adopts the Annual Management and Performance Report for the EU Budget and takes overall political responsibility for the management of the EU Budget. The Commission considers that this encompasses accountability for the work of its services.

In operational terms, the oversight takes place, first via the practical arrangements governing working relations between members of the Commission, cabinets and services, second via the APC on regular basis dealing with all the IAS recommendations and third, by a clear reporting from the Authorising Officers by Delegation (AODs) to the Commission through the Annual Activity Reports (AARs) and the Declarations of Assurance by the AODs, and the overall Opinion of the Internal Auditor. See also Commission replies to paragraphs 55 and 57.

Addressing ‘silo’ culture was a priority of the new Commission. It implemented a new structure with Vice-Presidents overlooking wider policy areas and enhancing the coordinating role of the Secretariat-General and other Central Services, and through various corporate steering groups including the Activity Based Management (ABM) Steering Group and the Group of Resource Directors.

VI

In line with best practice, the Financial Regulation and its Charter, the IAS necessarily focuses on the management and control systems of the DGs who are responsible for ensuring legality and regularity of transactions, including auditing those DGs’ ex post verification/audit function. Besides the audit on the information security governance, other governance areas were also covered, for example:

οObjective setting process in the context of the management plan;

οAnnual Activity Reporting process;

οGovernance of the Anti-fraud Strategies.

The APC is just one of the multiple means in place facilitating the College’s oversight of the Commission’s governance, risk management, and internal control practices. The primary channel is through the formal communication mechanisms stated in the working arrangement between Commissioners, their cabinets and the Commission services (regular meetings, discussion of Strategic Plans, Management Plans, Annual Activity Reports, etc.) through which the Commissioner first, and the College later are informed.

Risk management, financial reporting and the results of ex post verifications/audit function fall under the responsibility of the ABM Steering Group, SG, DG BUDG, and the relevant AODs.

VII

In line with the IPSASB Conceptual Framework for GPFRs,¹ which foresees that GPFRs ‘are likely to comprise multiple reports’, each addressing more directly specific needs of different stakeholders, the Commission provides an Integrated Financial Reporting Package. This consists of the Annual Management and Performance Report (AMPR), the Financial Report, the Communication on the Protection of the EU Budget, and the EU Annual Accounts. The information presented in this package is at the same level as that provided by the benchmark entities selected by the Court. In addition, further information is available in documents such as the President’s State of the Union Speech, the Annual General Report on the Activities of the European Union, the Follow-up Report on the Discharge Recommendations, etc.

VIII First bullet

The Commission accepts this recommendation. The Commission strives to comply with evolving and relevant best practice set out in standards or put in place by international or public bodies (see reply to paragraphs I-IV, VIII, 24-26, 44-49) and will continue to adapt its governance structure.

VIII Second bullet

The Commission accepts this recommendation in line with Article 116.2 of the Rules of application of the Financial Regulation (see also the Commission’s reply to recommendation 2.h).

VIII Third bullet

The Commission accepts this recommendation. The Commission control arrangements (including the IAS) are solid, comprehensive and being enhanced to comply fully with COSO 2013 Internal Control principles. They enable the Commission to exert an adequate oversight over the functioning of the governance structure.

VIII Fourth bullet

The Commission accepts this recommendation.

See reply to paragraph 62.

VIII Fifth bullet

The Commission accepts the recommendation to issue a suite of reports in a way that mitigates additional risks as regards availability and quality of information. See also reply to recommendation 2(e).

The Commission has already taken steps in this direction through the publication on 19 July 2016 of the Integrated Financial Reporting Package.

A single accountability report would not be adequate and is not in line with the Conceptual Framework for GPFR of IPSASB which states clearly that GPFRs, which have as objective to provide information useful for accountability and decision making purposes, ‘are likely to comprise multiple reports, each responding more directly to certain aspects of the objectives of financial reporting’. In line with the Conceptual Framework the Commission provides or will provide the following documents which cover the elements identified by the Court:

VIII Fifth bullet — First indent

The Commission is currently working on an update of the Governance Statement.

VIII Fifth bullet — Second indent

In the context of the Commission, the State of the Union Address, which is presented in September, corresponds to the President’s report.

VIII Fifth bullet — Third indent

In addition to the information contained in AMPR, the Commission reports and communicates extensively on operational and strategic risks in the State of the Union Speech, and in strategic and management plans of each DG.

VIII Fifth bullet — Fourth indent

Non-financial performance information is available in the AARs and the AMPR.

VIII Fifth bullet — Fifth indent

The General Report on the Activities of the Union and the AMPR contain information on activities during the year and the achievements of the policy objectives.

VIII Fifth bullet — Sixth indent

The APC Annual Report summarises the conclusions of the APC in fulfilling its mission and highlights issues which the APC has brought to the attention of the College. The work of the APC was referred to in the Synthesis Reports and in the AMPR in 2015. There will be a specific section in the future AMPRs on the role and conclusions of the APC.

VIII Fifth bullet — Seventh indent

In particular due to differences in the debt dimension (i.e. capacity to meet financial commitments or refinance or increase debt) and the revenue dimension (i.e. capacity to vary existing taxation levels or introduce new revenue sources) the EU Budget is not comparable to the budgets of states.

In the EU context, the MFF is the tool ensuring medium to long-term stability and predictability of future payment requirements and budgetary priorities. The Commission provides information on these aspects in the AMPR, the Financial Report, the Accounts and whenever necessary other reports.

VIII Sixth bullet

The Commission partially accepts this recommendation.

The information underlying the new Integrated Financial Reporting Package and complementary reports will be made available, as far as possible (i.e. subject in particular to the relevant deadlines for Member States for providing necessary data), to the Court in order to allow checks concerning consistency.

VIII Seventh bullet

The Commission accepts this recommendation. It will continue to report on the overall amount at risk in the AMPR.

VIII Eighth bullet

The Commission accepts this recommendation. It will update and publish its governance arrangements on a regular basis and explain how it complies with international standards and good practice.

VIII Ninth bullet

The Commission partially accepts this recommendation. The Commission will consider, in the context of the mid-mandate renewal of the membership of the APC, the issue of an increase in the number of external members with proven professional expertise in audit and related matters and appointed by the Commission following an open and transparent procedure. Risk management, financial reporting and the results of ex post verifications/audit function fall under the responsibility of the ABM Steering Group, SG, DG BUDG, and the relevant AODs. Communication channels, including in particular the AARs, Management and Strategic Plans, etc., ensure that the AODs inform the respective Commissioners and the College, allowing the latter to exercise appropriate oversight. Furthermore, the IAS regularly audits the ex post verification/audit function across the relevant DGs, particularly in the key areas such as shared management, and its findings are considered by the APC. The Commission will consider inviting the IAS to undertake audit work on governance/oversight arrangements concerning risk management, financial reporting, and the ex post verification/audit function, in particular second level scrutiny, to identify any improvements which can further enhance the performance of these mechanisms.

Observations

15

A first unique feature of governance within the Commission is that the division of responsibilities and accountability lines are fixed in the Treaty (Art 317) and in the Financial Regulation (Art 66) and described in the 2000 White Paper which took into account the recommendations of the Committee of Independent Experts.

A second feature of the Commission is that, whenever a new College takes office, aspects of the internal organisational, governance and accountability arrangements may be revised. This is done through the Commissioners’ mission letters, the Working Methods of the European Commission (See C(2014) 9004) and the written working arrangements between the Commissioners and the services.

21

The overarching principles of the Commission’s governance framework (i.e. authority, accountability, duties and responsibilities) are enshrined in the EU treaties. The College adopts the Annual Management and Performance Report for the EU Budget and takes overall political responsibility for the management of the EU Budget. The Commission considers that this encompasses accountability for the work of its services.

In operational terms, the oversight takes place, first via the practical arrangements governing working relations between members of the Commission, cabinets and services, second via the APC on regular basis dealing with all the IAS recommendations and third, by a clear reporting from the AODs to the Commission through the AARs and the Declarations of Assurance by the AODs, and the overall Opinion of the Internal Auditor.

Box 5 — Commission’s responsibility

The Commission has made further changes to its governance and reporting between 2007 and 2016.

23

The Commission abolished the IACs because with the passage of time, it has become increasingly important for the internal audit function to look beyond the boundaries of one DG. This is much more effectively done with a fully centralised internal audit function. Furthermore, the centralised IAS is fully independent, which helps ensure good quality audits. An external quality assessor, while giving a clean bill of health to the IAS, had pointed to a lack of sufficient independent oversight of the IACs and a perceived risk to their independence.

The IAS is now also providing the directors-general with a limited assurance report, to feed into the Annual Activity Reports (AARs), as IACs used to do (for the first time in February 2016 covering the year 2015).

24

The staffing of the entities mentioned by the Court is not wholly devoted to audit or control activities.

The ex post verifications/audit function in many large spending DGs (often referred to as ‘audit function’) are part of the internal control system of the Authorising Officer by Delegation. They should be clearly distinguished from the internal audit function.

25

Besides the audit on the information security governance, other governance areas were also covered, in particular, but not exclusively through audits covering a multitude of DGs, for example audits addressing the:

οobjective setting process in the context of the management plan;

οannual activity reporting process;

οgovernance of the Anti-fraud Strategies;

οgovernance of the European Semester work;

οgovernance of the Common Support Centre hosted by RTD;

οgovernance of EU Trust Funds,

οsupervision of decentralised agencies;

οgovernance in the IT domain.

Box 7 — Some significant IAS recommendations on governance have not been followed

The Commission is working on a revision of the Governance Statement.

26

The IAS shares the Court’s assessment that the risk of irregular and illegal expenditure is important. This is precisely why approximatively 40 to 50 % of the available time for its audits is spent on engagements assessing the management and control systems aimed at preventing and detecting/correcting irregularities.

This includes important audits on the DG control strategies (including ex post verification/audit function) covering the main policy expenditure areas. All of these audit reports are sent to and addressed by the APC.

In line with best practice, the Financial Regulation and its Charter, the IAS necessarily focuses on the management and control systems of the DGs which are responsible for ensuring legality and regularity of transactions.

The APC is just one of the multiple means in place facilitating the College’s oversight of the Commission’s governance, risk management, and internal control practices. The primary channel is through the formal communication mechanisms stated in the working arrangement between Commissioners, their cabinets and the Commission services (regular meetings, discussion of Strategic Plans, Management Plans, Annual Activity Reports, etc.) through which the Commissioner first, and the College later are informed.

30

The Commission confirms that the APC mandate of 2015 includes a strengthening of the follow-up of the ECA recommendations. The APC analyses the ECA’s reports and the relevant findings where appropriate in the context of its thematic discussions based on groups of IAS audit reports.

The IAS carries out audits on the effectiveness of the ex post verification/audit functions in many large spending DGs. Thereby it covers this important element of the AODs’ internal control system aimed at preventing and detecting/correcting irregularities (see reply to paragraph 26). The APC addresses these issues to the extent that they are covered by IAS audits.

Reply to table 2

The APC receives and addresses all IAS audit reports, which cover the areas of risk management, internal control and reporting on financial and non-financial performance. It thus facilitates the Commission’s oversight by ensuring the independence of the IAS, monitoring the quality of its work and following up recommendations. Furthermore, it considers key documents regarding the internal control framework.

31

Risk management, financial reporting and the results of ex post verifications/audit function fall under the responsibility of the ABM Steering Group, SG, DG BUDG, and the relevant AODs. Communication channels, including in particular the AARs, Management and Strategic Plans, etc., ensure that the AODs inform the respective Commissioners and the College, allowing the latter to exercise appropriate oversight. Furthermore, the IAS regularly audits the ex post verification/audit function across the relevant DGs, particularly in the key areas such as shared management, and its findings are considered by the APC.

Other international organisations (World Food Programme, European Investment bank, World Bank and UN) have different governance structures.

35

The new revision of the Internal Control Framework the Commission is now conducting will address all the Court’s observations.

36

Taking into account the specificities of the Commission COSO Principle 2 has to be seen from a double perspective. At DG level each director-general conducts an independent oversight of the development and performance of internal control by means of the Internal Control Coordinator. At Commission level the College — i.e. equivalent to the Board of Directors referred to in COSO Principle 2 — exercises an independent oversight of the developments and performance of internal control (see reply to paragraph 21).

The Central Financial Service was created to provide support and advice on financial management, interpretation of legislation, internal control and risk management but not to oversee the actual implementation of the internal control system.

37

The current framework, as decided in the Commission reform and stipulated by the financial regulation, provides a sound definition of responsibilities and accountability. The DGs are required to set up the organisational structure and the internal control systems including sub-delegation acts and the related cascading reporting system which build up the assurance inside each DG.

Concerning the basis to determine whether the declarations made within AARs are well-founded, the instructions (and guidelines) for the preparation of the AARs provide a sound basis to build up the Declaration of Assurance and represent a clear benchmark against which to hold DGs accountable. Besides, the AARs contain a section on the reports and conclusion of the Internal Auditor on the state of control of the DG. Finally, the AAR review process ensures the quality of the AARs so that the political level can rely on the management representations and assurance.

The Commission will, however, analyse whether certain aspects can be further clarified.

38

The Commission has reported on the implementation of the Commission Anti-fraud Strategy (CAFS) annually, starting from 2013, in the Annual Report on the Protection of the EU’s Financial Interests (‘Article 325 Report’).

39

Even though it considers that the risk of fraud is sufficiently covered in the methodology and guidance for the DGs regarding the anti-fraud strategies, the Commission is currently preparing a proposal to specially include the risk of fraud in the new Internal Control Framework.

42

The objective of the Financial Statement Discussion and Analysis (FSDA) according to the IPSASB Recommended Practice Guideline 2 (RPG 2) is to provide ‘an explanation of the significant items, transactions and events presented in an entity’s financial statements and the factors that influence them.’

It is therefore logical that the FSDA focusses on the President’s 10 priorities as they ‘represent a continuation of the Europe 2020 strategy’ and are the current key drivers of Commission policy and how EU money is spent. In addition, the FSDA includes also information on Europe 2020. However, the FSDA is an evolving document. Therefore, the Commission remains open to discussing improvements to the content and focus.

44 Third bullet

The EU accounts are adopted by the Commission.

44 Fourth bullet

The Commission notes that its accrual-based accounting system and reporting is thus very well advanced in comparison with many Member States.

45 Second bullet

The FSDA prepared by the Commission complies with the structure and content suggested by the IPSASB Recommended Practice Guideline 2 (RPG 2).

45 Third bullet

As the Court notes the accounts are accompanied by the Statement of Assurance in the Official Journal. The Commission would welcome the possibility to include the Court’s opinion on the accounts in the accounts document as soon as it is adopted, as is the case in the private sector.

45 Fifth bullet

In the FSDA, the Commission also includes information on different management modes, financial reporting and accountability.

The Commission is working on a revision of the Governance Statement.

45 Sixth bullet

The EU Annual Accounts are adopted by the Commission. As a foreword can be found in the Financial Report it was not duplicated in the accounts. The Commission will consider introducing a foreword in the future.

45 Seventh bullet

In addition to the annual accounts and accompanying information, the Commission also produces, in particular, the Annual Management & Performance Report (AMPR), the Communication on the Protection of the EU Budget and the Financial Report, the General Report on the Activities of the EU and the State of the Union Address of the President of the European Commission. These documents contain extensive non-financial information and address operational and strategic risks.

The EU Annual Accounts comply with the information requirements of the relevant international accounting standards (IPSAS) and the EU accounting rules.

The Commission reports on the overall amounts at risk with regard to the legality and regularity of the transactions (amounts at risk at payment and amount at risk at closure) in the AMPR. The report also discusses what areas of expenditure are most prone to errors.

45 Eighth bullet

As the AMPR contains a quantification of the risks of irregular transactions (amounts at risk at payment and amounts at risk at closure), the Commission considers that there is no need to duplicate information. See reply above.

45 Ninth bullet — First indent

In addition to the annual accounts and accompanying information, the Commission also produces, in particular, the Annual Management & Performance Report (AMPR), the Communication on the Protection of the EU Budget and the Financial Report, the General Report on the Activities of the EU and the State of the Union Address of the President of the European Commission where information on non-financial performance is given.

45 Ninth bullet — Second indent

In addition to the annual accounts and accompanying information, the Commission also produces, in particular, the Annual Management & Performance Report (AMPR), the Communication on the Protection of the EU Budget and the Financial Report, the General Report on the Activities of the EU and the State of the Union Address of the President of the European Commission.

45 Ninth bullet — Third indent

Information on progress on the EU 2020 headline targets is regularly updated and published on Eurostat’s website and reported in the context of the European semester. See also reply to paragraph 42.

45 Tenth bullet

In particular due to differences in the debt dimension (i.e. capacity to meet financial commitments or refinance or increase debt) and the revenue dimension (i.e. capacity to vary existing taxation levels or introduce new revenue sources) the EU Budget is not comparable to the budgets of states.

In the EU context, the MFF is the tool ensuring medium to long-term stability and predictability of future payment requirements and budgetary priorities. The Commission provides information on these aspects in different reports.

45 Eleventh bullet

The role of the APC was referred to in the Synthesis Reports and in the AMPR in 2015. There will be a specific section in the future AMPRs on the role and conclusions of the APC.

Common reply to paragraphs 46-47

For the first time this year, the Commission has presented a comprehensive Integrated Financial Reporting Package. In doing so, the Commission provides at the same moment all the key financial information for the year 2015. The package includes:

(a)the AMPR providing information on the EU Budget performance based on results achieved with the EU Budget up to end 2015. It also comprises the Commission’s management of the EU Budget in 2015, containing an overview of the functioning of the internal control systems that the Commission departments have put in place to ensure the achievement of policy and operational objectives and the major related risks if any. This includes the assessment of the legality and regularity risks, the cost-effectiveness of controls and the anti-fraud strategies;

(b)the Financial Report providing in particular a detailed overview of the revenue and the distribution of funds per Member State and per MFF heading;

(c)the Communication on the Protection of the EU Budget on the actions taken to exclude illegal and irregular expenditure from financing by the EU Budget indicating also how Member States are involved and impacted;

d)the Annual Accounts of the EU (i.e. assets and liabilities, revenue and expenditure) at the end of 2015.

The integrated set of financial reporting is preceded by a foreword from the Budget Commissioner.

The College of Commissioners takes overall responsibility of the Commission’s internal control systems and risk management by adopting the Annual Management and Performance Report.

48

The Commission reports on the estimate of amounts at risk in the AMPR and provides an overview on preventive actions in the Communication on the Protection of the EU Budget. In the AAR the responsible AOD reports on the results of the controls carried out and provides an estimate of the amount at risk of irregular payments. Furthermore, the nature of the detected errors is also discussed in the AAR. In the context of the discharge procedure the Commission has also reported on request to the European Parliament on the actions taken to address some of the most frequent types of errors in specific policy areas.

49

Since 2013, the Commission has improved information on the amounts at risk compared to what was done in previous years, in particular by adding the total amount at risk at payment and at closure. The latter takes into consideration the financial corrections and recoveries which are detailed in the Communication on Protection of the EU Budget.

Prior to 2013 the Commission had reported transparently in the Synthesis Report on the reservations made and provided for the areas of expenditure the estimated amount at risk under reservation. Further information was available in the respective AARs.

50

The IAS spends a considerable part of its resources (approximatively 40 to 50 %) on engagements assessing the management and control systems aimed at preventing and detecting/correcting irregularities in addition to the limited reviews on the calculation of the residual error rate.

This work of the IAS led to real improvements, in particular in DG AGRI which was welcomed both by the Court and the Discharge Authority.

51

DG DEVCO is implementing its budget under direct management mainly, which has a different assurance model than that of shared management which represents 80 % of the EU Budget.

See also Commission reply provided to paragraph 1.35 of 2015 ECA Annual Report:

The Commission considers that reference to the statistical methodology used by ‘US bodies managing federal funds’ is not appropriate for funds under shared management. Under shared management, the Commission relies not on audits of expenditure made by its own agencies at EU level but on audit authorities in sovereign Member States auditing expenses made by these Member States, frequently with national co-financing. Therefore the Commission considers that production of a statistically valid EU wide estimate of the level of error by itself auditing beneficiaries would not provide added-value for shared management expenditure.

In line with the requirements of the legal framework, the Commission will continue to cooperate with Member States Audit Authorities and define in common a statistically valid approach to estimate the level of error, and to use such error rates after validation. The Commission thus implements the ‘single audit principle’ by focusing its activity on auditing the Member State auditors and validating their audit work. This is based upon the Court's Opinion No 2/2004 on the single audit model and a proposal for a Community internal control framework. This approach is fully in line with the objective of reducing the administrative burden on beneficiaries and reduces also the need of audit posts in the EC.

53

The Commission notes that the US General Accountability Office, i.e. the external auditor, has identified material weaknesses and concludes the following: ‘Until the Federal Government has implemented effective processes to determine the full extent to which improper payments occur, and has taken appropriate actions across entities and programmes to effectively reduce improper payments, it will not have reasonable assurance that the use of federal funds is adequately safeguarded’.

The Commission notes as well that the Executive Office of the US President included in the instruction of 20 October 2014: ‘Working with other entities. Agencies should consider working with entities — such as grant recipients — that are subject to Single Audits to leverage ongoing audits to assist in the process to estimate an improper payment rate and amount’.

The Commission underlines that it provides in the AMPR an estimate for the amount at risk at payment (which does not take into consideration recovery actions concerning improper payments). It complements this information with an estimate for the amount at risk at closure (which takes into consideration the impact of multiannual corrective systems).

57

The Commission refers to its replies to earlier requests from the Parliament and reconfirms its position on the issue of providing assurance as referred to by the Court (see Commission reply to paragraph 1.40 of the Court's 2012 Annual Report).

See also reply to paragraph V of the Executive Summary.

Conclusions and recommendations

58

The Commission will continue its actions to ensure that its governance arrangements with focus on audit, financial management and control meet relevant best practice set out in standards or put in place by international and public bodies (see detailed Commission replies to paragraphs I-IV, IX, 24-26, 44-46).

59

The overarching principles of the Commission’s governance framework (i.e. authority, accountability, duties and responsibilities) are enshrined in the EU Treaties. See also the Commission replies to paragraphs 21, 55 and 57.

60

The APC is just one of the multiple means in place facilitating the College’s oversight of the Commission’s governance, risk management, and internal control practices. The primary channel is through the formal communication mechanisms stated in the working arrangement between Commissioners, their cabinets and the Commission services (regular meetings, discussion of Strategic Plans, Management Plans, Annual Activity Reports, etc.) through which the Commissioner first, and the College later are informed.

61

See the Commission replies to paragraph 39.

62

The deadline for the adoption of the annual accounts is set by the Financial Regulation, being 31 July. However, this year, working together with the Court, the Commission has already brought forward the adoption of the 2015 annual accounts by over 2 weeks. Relying heavily on the deadlines for delivery of Member States data, the Commission will investigate if further advancements are possible.

63

The Commission does not provide less non-financial information than the other bodies — the information is provided in GPFRs other than the annual accounts. Furthermore, from 2016 onwards, the Commission will issue an integrated package of these reports containing financial and non-financial information at the same time — see replies above.

As previously stated, the IPSAS Conceptual Framework (paragraph 8.6) specifically foresees the use of multiple GPFRs, comprising the accounts or financial statements, the FSDA and other reports which address users’ complementary information needs.

64

The Commission does not share the Court’s view that the estimations of level of error are not based on a consistent methodology. The DGs are required to report in line with the AAR guidance issued by the Central Services. The various concepts and indicators have been defined in a sufficiently flexible manner to enable taking account of the specific circumstances of the various DGs and yet, ensure a sufficient degree of consistency to consolidate data².

65

See references below to the replies to the specific conclusions.

65 First bullet

See replies to paragraphs 24-26.

65 Third bullet — First indent

See reply to paragraph 30.

The Commission confirms that the APC mandate of 2015 includes a strengthening of the follow-up of the ECA recommendations.

65 Third bullet — Second indent

See replies to paragraphs 30 and 31.

65 Third bullet — Third indent

See replies to paragraphs VIII and 30, 31, 45. Performance reporting falls under the responsibility of the ABM Steering Group, SG, DG BUDG, and the relevant AODs.

65 Third bullet — Fourth indent

See Commission replies to paragraphs 26, 30 and 31.

65 Fourth bullet

See reply to paragraph 39.

65 Fifth bullet

See reply to paragraph 62.

65 Sixth bullet — First indent

The Commission is currently working on an update of the Governance Statement.

65 Sixth bullet — Second indent

In the context of the Commission, the State of the Union Address by the President is the vehicle through which the President reports on achievements and challenges.

In addition, the General Report on the Activities of the Union published each year by the European Commission gives an account of the EU’s major initiatives and achievements of the past year. It is about progress made by the Commission in delivering on its priorities (covering much broader aspects than financial information). It also contains a foreword of the President.

65 Sixth bullet — Third indent

Risk management in the Commission is mainly part of the planning phase of the Strategic Planning and Programming (SPP)-cycle in particular the preparation of the Strategic Plans (SPs) and Management Plans (MPs) by each Commission department. Critical risks are reported in the MP, Annex 4, and potential cross-cutting critical risks are assessed by the Central Services. Significant materialised risks are covered in the Annual Activity Reports (AARs) and the Annual Management and Performance Report.

In addition to the information contained in the AMPR, the Commission reports and communicates extensively on political objectives, challenges and risks in a number of forms. The State of the Union Address delivered by the President is a key vehicle for communicating challenges and opportunities at political level. Also more detailed reporting on issues specific to each policy area is included in the Strategic and Management Plans issued by each directorate-general.

65 Sixth bullet — Fourth indent

Non-financial performance information is available in the AARs and the AMPR.

65 Sixth bullet — Fifth indent

The AMPR, the Financial Report and the annual General Report on the Activities of the Union contain such information.

65 Sixth bullet — Sixth indent

The APC Charter requires the APC to report annually to the College on its activities. The APC Annual Report summarises the conclusions of the APC in fulfilling its mission and highlights issues which the APC has brought to the attention of the College. It forms part of the evidence supporting the Commission’s adoption of the AMPR of the EU Budget. The work of the APC was referred to in the Synthesis Reports and in the AMPR in 2015. There will be a specific section in the future AMPRs on the role and conclusions of the APC.

65 Sixth bullet — Seventh indent

In particular due to differences in the debt dimension (i.e. capacity to meet financial commitments or refinance or increase debt) and the revenue dimension (i.e. capacity to vary existing taxation levels or introduce new revenue sources) the EU Budget is not comparable to the budgets of States.

In the EU context, the MFF is the tool ensuring medium to long-term stability and predictability of future payment requirements and budgetary priorities. The Commission provides information on these aspects in different reports.

The IPSAS Recommended Practice Guideline does not propose reporting on fiscal sustainability to be included in or published alongside the annual accounts.

65 Seventh bullet

The Commission does not share the Court’s view that the estimations of level of error are not based on a consistent methodology. The DGs are required to report in line with the AAR guidance issued by the Central Services. The various concepts and indicators have been defined in a sufficiently flexible manner to enable taking account of the specific circumstances of the various DGs and yet, ensure a sufficient degree of consistency to consolidate data.

The Commission considers that reference to any benchmark made to ‘US agencies’ is inappropriate in reference to the EU Budget (please see reply to paragraph 53).

Recommendation 1 — Explain where it does not comply with best practice

The Commission accepts this recommendation. The Commission strives to comply with evolving and relevant best practice set out in standards or put in place by international or public bodies (see reply to paragraphs I-IV, VIII, 24-26, 44-49) and will continue to adapt its governance structure.

Recommendation 2 — Comply with best practice

The Commission partially accepts this recommendation (see detailed replies to the different actions requested below).

Recommendation 2 (a)

The Commission accepts this recommendation in line with Article 116.2 of the Rules of application of the Financial Regulation. See also the Commission’s reply to recommendation 2(h).

Recommendation 2 (b)

The Commission accepts this recommendation. The Commission control arrangements (including the IAS) are solid, comprehensive and being enhanced to comply fully with COSO 2013 Internal Control principles. They enable the Commission to exert an adequate oversight over the functioning of the governance structure.

Recommendation 2 (c)

The Commission accepts this recommendation. See reply to paragraph 62.

Recommendation 2 (d)

The Commission accepts the recommendation to issue a suite of reports in a way that mitigates additional risks as regards availability and quality of information. See also reply to recommendation 2(e).

The Commission has already taken steps in this direction through the publication on 19 July 2016 of the Integrated Financial Reporting Package.

A single accountability report would not be adequate and is not in line with the Conceptual Framework for GPFR of IPSASB stating clearly that GPFRs, which have as objective to provide information useful for accountability and decision making purposes, ‘are likely to comprise multiple reports, each responding more directly to certain aspects of the objectives of financial reporting’. In line with the Conceptual Framework the Commission provides or will provide the following documents which cover the elements identified by the Court:

οThe Commission is currently working on an update of the Governance Statement.

οIn the context of the Commission, the State of the Union Address, which is presented in September, corresponds to the President's report.

οIn addition to the information contained in AMPR, the Commission reports and communicates extensively on operational and strategic risks in the State of the Union Speech, and in strategic and management plans of each DG.

οNon-financial performance information is available in the AARs and the AMPR.

οThe General Report on the Activities of the Union and the AMPR contain information on activities during the year and the achievements of the policy objectives.

οThe APC Annual Report summarises the conclusions of the APC in fulfilling its mission and highlights issues which the APC has brought to the attention of the College. The work of the APC was referred to in the Synthesis Reports and in the AMPR in 2015. There will be a specific section in the future AMPRs on the role and conclusions of the APC.

οIn particular due to differences in the debt dimension (i.e. capacity to meet financial commitments or refinance or increase debt) and the revenue dimension (i.e. capacity to vary existing taxation levels or introduce new revenue sources) the EU Budget is not comparable to the budgets of states.

οIn the EU context, the MFF is the tool ensuring medium- to long-term stability and predictability of future payment requirements and budgetary priorities. The Commission provides information on these aspects in the AMPR, the Financial Report, the EU Annual Accounts and whenever necessary in other reports.

Recommendation 2 (e)

The Commission partially accepts this recommendation.

The information underlying the new Integrated Financial Reporting Package and complementary reports will be made available, as far as possible (i.e. subject in particular to the relevant deadlines for Member States for providing necessary data), to the Court in order to allow checks concerning consistency.

Recommendation 2 (f)

The Commission accepts this recommendation. It will continue to report on the overall amount at risk in the Annual Management and Performance Report.

Recommendation 2 (g)

The Commission accepts this recommendation. It will update and publish its governance arrangements on a regular basis and explain how it complies with international standards and good practice.

Recommendation 2 (h)

The Commission partially accepts this recommendation. The Commission will consider, in the context of the mid-mandate renewal of the membership of the APC, the issue of an increase in the number of external members with proven professional expertise in audit and related matters and appointed by the Commission following an open and transparent procedure. Risk management, financial reporting and the results of ex post verifications/audit function fall under the responsibility of the ABM Steering Group, SG, DG BUDG, and the relevant AODs. Communication channels, including in particular the AARs, Management and Strategic Plans, etc., ensure that the AODs inform the respective Commissioners and the College, allowing the latter to exercise appropriate oversight. Furthermore, the IAS regularly audits the ex post verification/audit function across the relevant DGs, particularly in the key areas such as shared management, and its findings are considered by the APC. The Commission will consider inviting the IAS to undertake audit work on governance/oversight arrangements concerning risk management, financial reporting, and the ex post verification/audit function, in particular the second level scrutiny, to identify any improvements which can further enhance the performance of these mechanisms.

1The ‘Conceptual Framework for General Purpose Financial Reporting by Public Entities’ (Conceptual Framework for GPFRs) adopted in October 2014 by the International Public Accounting Standards Board (IPSASB).

2See also Commission replies to paragraphs 1.19-1.20 of the Court's 2010 Annual Report, paragraphs 1.22, 1.23 and 1.25 of the Court's 2011 Annual Report, paragraphs 1.41-1.42 and 1.44-1.45 of the Court's 2012 Annual Report, paragraphs 1.29-1.30 and 1.32 of the Court's 2013 Annual Report, paragraphs 1.50, 1.53-1.54, and 1.65 of the Court's 2014 Annual Report and paragraphs 1.35 and 1.48 of the Court's 2015 Annual Report.

QJ-AB-16-027-EN-E    ISSN 1977-5679

Governance comprises the arrangements put in place to ensure that the intended outcomes for stakeholders are defined and achieved. Good governance is not just about relationships, it is about achieving results, and providing decision-makers with tools to do their job. In several areas, the Commission diverges from, or does not meet in full best practice set out in standards or put in place by the international and public bodies we selected as benchmarks. To continue to address the key risks the Commission will need to further strengthen the governance structure across the institution.