Internal Audit 2015 Audit took place on 31.03.2016 at Raildata office in Basel Participants: Edith Waldvogel, Raildata Luca Mariorenzi, Trenitalia Auditor Petr Červinka, CD Cargo Auditor

Raildata Audit 2015 Used / checked general documents: Delegation of signatory powers (by UIC director general, July 2013) Members and Signature model (authorized signatures, 1.1.2015) Accounting procedure (1.1.2014) Procedure of handling invoices (26.6.2013) Procedure of handling …of change request by IT supplier Travel procedure (refund of travel costs, 15.6.2015) Valid contracts and their list Checked 2015 accounting documents: Lists of expenses and incomes Invoices, bills (random check of some) Bank account documents Annual report by Cofime   2

Raildata Audit 2015 Accounting procedure: In general OK Recommendation: important documents (mainly invoices and contracts) need be scanned and kept also in electronic form (e.g. pdf). Rule to be applied for documents arrived/issued from 1.1.2016 We need to decide where to store the files safely We need to update the Accounting procedure with this rule Annual report: Done by Cofime, received paper copies, one sent to UIC RD will ask Cofime for electronic form of the report Should be published on RD web, for GA members only 3

Raildata Audit 2015 Handling invoices procedure: It should be updated to be general (not mention specific names) Short annex to include name(s) of responsible person(s) for functional and technical check Minor additional updates also required (e.g. Service support and Use-IT budgets do not exist anymore). All 2015 invoices signed by RD Chairman and Vice-chairwoman 4

Raildata Audit 2015 Validity of procedures for projects: Existing procedures are designed and apply for existing systems (ISR and Orfeus) or General assembly But RD has new systems, e.g. CoReDa ordered and paid by other UIC units, not directly by RD members. No rules for contracts/agreements/invoices issued by RD Agreement for CoReDa is not real contract just sheet of costs Procedures need be defined also for project initiatives committed by 3rd parties. 5

Raildata Audit 2015 Procedure of handling, acceptance and delivery of Change request by IT supplier: Designed for services of LUSIS only Mixture of internal RD rules and conditions for LUSIS Needs little changes (e.g. no more USe-IT) For 2016 we will need to update the responsible persons (or use some generic terms like „Team Basel“) 6

Raildata Audit 2015 List of contracts: Generally OK Contracts are available (random checked) Some contracts not in English RD has no employment contracts Content of the old detachment „contracts“ is very vague Poor rights of RD in case of long term absence 7

Raildata Audit 2015 Staff management: Procedure for staff management, required by Audit 2014, is missing still. The aim is to establish rules for: people detached from „railways“ hired consultants Each person has another conditions (working hours, holidays) as per original company or per consultancy contract. Evidence of work is through monthly sheets from each person (also hours split per project) This procedure should also fix rules for presence in the office and worked hours. Suggestion: add these conditions in overview of contracts. Lessons from hiring of student? 8

Raildata Audit 2015 Travel procedure: Requested by previous audit New rules, applicable from 15th June 2015 Two options: a) refunds based on UIC daily rates (valid since 1.1.2002) b) refunds of real costs with some limits Recommendation: refunds of real costs to be preferred 9

Raildata Audit 2015 Invoices: A number of randomly chosen incoming invoices were checked . The checked incoming invoices were coherent with internal and financial regulations (entry no, check against contract/contents, signed by chairman and vice-chairman, etc.) Archiving is done from beginning (1995) Outgoing invoices are signed by chairman and one more person   10

Raildata Audit 2015 Accounts: Accounts seem to be done according to UIC regulation Access to bank account is limited to RD authorized persons All payments done via cheques or bank transfers No credit cards and no cash reserve kept Status of bank account on 23.2.2015 (end of booking for 2014): 869 339,6 € (19 339,6 € at account plus 850 000 € deposit) Status of bank account on 27.02.2016 (end of booking for 2015): 688 972,6 € (88 972,6 € at account plus 600 000 € deposit) Result was explained /proofed by coherent calculation and according to invoicing/bills. 11

Raildata Audit 2015 Pending Members payments: ZS paid their fees for 2014 and 2013 during last year ZS has not yet payed 2015 fees 49 844€ RD sent letter to ZS 12

Raildata Audit 2015 Some invoices not yet received due to different reasons: 45 300 € from 2014: (Lusis, SNCF, student) 83 235 € from 2015: (Lusis, RNE, comp.centre, student) We still expect incomes: 49 844 € from ZS for 2015 fee 62 400 € from UIC for CoReDa, last payment 13

Books are kept well Accounts are kept well Raildata Audit 2015 Overall situation: Procedures are described and could be explained All demanded documents could be found and explained easily Financial procedures are described in “Accounting procedure” Books seem be coherent to rules and invoices or bills Bank account saldo at the end of the “budget” year is coherent with invoicing / payment status Results: Books are kept well Accounts are kept well 14

Raildata Audit 2015 Remarks / Recommendations   Remarks / Recommendations Some documents require minor updates to reflect changes Introduce an e-storage of important documents Publish Annual report on the web (GA) Create and include rules for management of projects committed by 3rd parties (e.g. CoReDa). Establish staff management procedure (dedicated WG to propose to GA for approval) Include known working hours, holidays and travel costs arrangements in the contracts overview. 15