1. Supervisory and control systems for national accounts purposes Viewpoint from the European Commission’s internal auditor
Eurostat Seminar 8/9 December 2009
Benoit VERMEERSCH
Head of Unit IAS.B5
27/11/2018

2. Supervisory and Control Systems
Presentation overview
PART 1: Key concepts
1.1 Background
1.2 Internal Control & Supervision
1.3 Risk Management
1.4. How to build assurance – Role of different actors
1.5. Role of the IAS
PART 2: Implementation
2.1 EU Budget financial management modes
PART 3: Conclusion
27/11/2018

3. PART 1
1.1. Background
27/11/2018 3

4. Background
April 2000: Reform of European Commission’s financial management
Each Directorate General (DG)
responsible for design and implementation of internal control system in the DG based on standardised Internal Control Standards
Annual Activity Report (AAR) and “Assurance declaration” with
Formal opinion on the functioning of the internal system
Formulation of possible observations / reservations in the AAR
PEER review to ensure consistency.
Accountability of line managers
Operational manager = financial responsible (Authorising officer)
Internal Audit Capability (IAC) and IC coordinator in each DG
Accounting Officer (annual accounts signed off) and local correspondant
Internal Audit Service (IAS) and Audit Progress Committee (APC)
27/11/2018 4

5. 1.2. Internal Control & Supervision
PART 1
1.2. Internal Control & Supervision
27/11/2018 5

6. Internal control & Supervision COSO Framework
Internal control is designed to assist organizations in achieving their objectives
Three Objectives
Rules and procedures enabling the risk management actions ,defined by top management, to be immediately applied e.g.
Évaluation des Risques
Activités de Contrôle
Operations
Finance
Compliance
Activité 2
Delegations of authorities
Approval
Common processes and systems
Separation of functions
Accounts reconciliations
Activité 1
Monitoring
Unité B
Information &
Communication
Unité A
Five Components
Control Activities
Risk assessment
Entire organisation
Control Environment
27/11/2018 6

7. Internal control & Supervision COSO Framework
Monitoring helps ensure “that internal control continues to operate effectively”.
Identify and correct internal control problems
Produce reliable information for use in decision-making,
Prepare accurate and timely financial statements
Be in a position to provide periodic assertions on the effectiveness of internal control
27/11/2018 7

8. Internal control & Supervision at the Commission: ICS
December 2000: Internal Control Standards (ICS) were defined by the Commission for the first time based on an internationally recognized COSO framework
December 2002: The standards were complemented by minimum “Baseline Requirements” to facilitate the implementation of Standards
October 2007: The standards were revised and renamed as “Internal Control Standards for Effective Management”: 16 revised ICS (instead of 24) complemented by 61 baseline requirements.
27/11/2018 8

9. Internal control & Supervision at the Commission
Definition of Internal Control in the Commission
Internal Control is a process intended to provide reasonable assurance regarding the achievement of the DG’s objectives in terms of:
the effectiveness and efficiency of operations,
the compliance with rules and procedures,
the safeguarding of assets and information/ prevention and detection of fraud,
the reliability of financial and management information
It is all the measures management and staff can take to ensure that these objectives are met.
27/11/2018

10. 27/11/2018

11. 27/11/2018

12. Internal control & Supervision at the Commission-ICS n°9: Supervision
Key Guidelines of Supervision in EC:
Internal control activity to ensure effective implementation of activities while complying with applicable provisions.
Covers both legality and regularity aspects and operational performance (i.e. achievement of Annual objectives).
In deciding the supervisory controls, management needs to consider the level of risks and how the risk exposure changes over time.
Source: BudgWeb Internal Control Standards for Effective Management
27/11/2018

13. PART 1
1.3. Risk management
27/11/2018 13 13

14. Risk management IIA Definition
The uncertainty of an event occurring that could have an impact on the achievement of objectives. Risk is measured in terms of consequences and likelihood. (IIA, Glossary, Issued 1 October 2008)
EC Definition of Risk
Risk is “any event or issue that could occur and adversely impact the achievement of the Commission’s political, strategic and operational objectives. Lost opportunities are also considered as risks.”
Lost opportunities are risks related to the development and modernisation of the organisation and its activities (i.e. adaptation to new circumstances and expectations
27/11/2018 14

15. The common “risk typology”
Risk management:
The common “risk typology”
of the Commission
27/11/2018 15

16. Risk management: Critical risks referred in 2007 & 2008 Annual Management Plans
External
Environment
(28%)
(22% last year)
Planning,
Processes
& Systems (33%)
(34% last year)
People &
Organisation (26%)
(27% last year)
Legality &
Regularity (5%)
(8% last year)
Information &
Communication (8%)
(9% last year)
27/11/2018
Source: BUDG synthesis of 2007 & 2008 AMPs 16

17. PART 1 1.4. How to build assurance?
Internal control frameworks
PART 1
1.4. How to build assurance?
27/11/2018 17 17

18. How to build assurance: within the DG
ASSURANCE DECLARATION:
I, the undersigned, Director-General of XXX, Head of Service of XXX in my capacity as authorising officer by delegation
Declare that the information contained in this report gives a true and fair view[1].
State that I have reasonable assurance that the resources assigned to the activities described in this report have been used for their intended purpose and in accordance with the principles of sound financial management, and that the control procedures put in place give the necessary guarantees concerning the legality and regularity of the underlying transactions. This reasonable assurance is based on my own judgement and on the information at my disposal, such as the results of the self-assessment, ex post controls, the work of the internal audit capability, the observations of the Internal Audit Service and the lessons learnt from the reports of the Court of Auditors for years prior to the year of this declaration.
Confirm that I am not aware of anything not reported here which could harm the interests of the institution.
However the following reservations should be noted: [where appropriate]
Place …………….., date (signature)
[1] True and fair in this context means a reliable, complete and correct view on the state of affairs in the service.
27/11/2018

19. How to build assurance: Actors involved
Monitoring tools
(Guidance, instructions, check list)
Management and Control
Actors
European Anti-Fraud Office (OLAF)
– Investigators
Internal Audit Actors
Internal Audit Service (IAS)
– at the Commission Level
The Authorising Officer (Dir Gen) – Control staff – Ex Post Controllers
Central Financial Service (CFS) in DG Budget
The Accounting Officer, Deputy DG of DG Budget
Audit Progress
Committee
(APC)
“Audit
Committee”
Internal Audit Capabilities (IAC)
– at the DG Level
Other Audit/
Control Actors
European Court of Auditors (ECA)
– External Auditor
27/11/2018 19

20. How to build assurance: within the DG
Commissioner consulted on Annual Management Plan and informed about critical risks
of the DG in that respect
Director General ultimately responsible for DG objectives and risks, risk management strategy and effectiveness
Commission
IAS
BUDG DG
IAC
Res. Dir
Dir
Dir
CFS
Internal auditor can evaluate effectiveness of risk management in the DG
Guidance
ICC supports risk management in the DG - guidance and facilitation
At the pilot questions were raised about the nature of the responsibility of the Commissioners. Note: their responsibility is purely political. The DG reports at least twice yearly to the Commissioner (in reality to Cabinet) but the Commissioner should not be involved inn the day-to-day running of the DG
Unit
Unit
Horizontal support (methodology, guidance, check lists, Risks and control typologies)
Staff
27/11/2018 20 20

21. PART 1 1.5. Role of the IAS Internal control frameworks 27/11/2018 21

22. Controls by Management
Role of the IAS
External
Control
Internal audit
/ other auditors
IT Controls
Controls by Management
Operational steps and controls (separation of tasks, competency, autocontrol, …)
Inherent
risk
Residual
risk
Taking into account the internal risk control organization
27/11/2018 22 22

23. Role of the IAS
According to the International Standards for the Professional Practice of Internal Auditing:
« the internal audit activity must evaluate the adequacy and effectiveness of controls in responding to risks within the organisation’s governance, operations, and information systems regarding the:
Reliability and integrity of financial and operational information
Effectiveness and efficiency of operations
Safeguarding of assets
Compliance with laws, regulations and contracts »
Source: The International Standards for the Professional Practice of Internal Auditing, IIA
27/11/2018

24. Role of the IAS
The Internal Audit Service (IAS) of the European Commission
Guided by the IIA standards (IAS certified in 2008)
Set up strategic planning based on own risk analysis and coordinated
Coordinated approach with European Court of Auditors and IACs
Provide opinions on the quality of management and control systems
recommendations
Report to
Audit Progress Committee
the Commission (Overall Internal audit Report, Art Fin. Regulation), monitoring bi-annual reports on all recommendations (exception reports)
has full and unlimited access to information
Source: BudgWeb Management modes
27/11/2018

25. Role of the IAS Supervisory and Control Systems
Difference between Management Supervision and the work of the Internal Auditors
1) Supervisory controls are direct control exercised by management within the area of its responsibility
Whereas
Internal Auditors (IAS and IACs) are conducting controls independently from any management responsibilities also covering Management supervision
2) Supervisory controls should be a continuous management responsibility
Audits conducted by the Internal Auditors are discrete by nature and can only focus over a certain period on those areas identified by the auditor based on its risk assessment
Source: BudgWeb Internal Control Standards for Effective Management
27/11/2018

26. EU Financial Management modes
Internal control frameworks
Part 2
Implementation
EU Financial Management modes
27/11/2018 26 26

27. Supervisory and Control Systems
EC Supervision per Management Mode
Source: BudgWeb Budget Management modes
27/11/2018

28. Supervisory and Control Systems
EC Supervision per Management Mode
Centralised direct management
Ensure supervision and control of the implementation of the tasks
Centralised indirect management (art 56 Financial Regulation)
May entrust tasks of public authority and budget implementation to
Agencies created by the Commission (executive agencies)
Bodies created by the European Communities
community agencies, joint undertakings, others (European Investment Bank, European Investment Fund)
National public-sector bodies or bodies governed by private law with a public service mission (so-called « national agencies »)
Ensure supervision, evaluation and control of the implementation of the tasks entrusted (6 pillars considering the equivalence procurement, audit, accounting and internal control procedures)
Source: BudgWeb Management modes
27/11/2018

29. Supervisory and Control Systems
EC Supervision per Management Mode
Art. 56 FR : Requirements for Indirect Centralised Management Mode
Entrusted entities must have:
Transparent procurement and grant-award procedures which are non-discriminatory and exclude any conflict of interest
An effective and efficient internal control system for the management of operations, which includes effective segregation of the duties of authorising officer and accounting officer or the equivalent functions
An accounting system that enables the correct use of Community funds to be verified and the use of funds to be reflected in Community accounts
An independent external audit
Public access to information at the level provided for in Community Regulations
Adequate annual ex post publication of beneficiaries of EU funds (Art. 30(3) FR
Source: Article 56 FR; BudgWeb Management modes
27/11/2018

30. Supervisory and Control Systems
EC Supervision per Management Mode
A few key controls in the EC Control architecture
Ex-ante system assessment on implementing bodies
Ex-ante control of transactions (Financial Circuits « 4 eyes principles »)
Beneficiaries audit reports
Ex-post control of transactions/system (audit or transactions based)
Monitoring missions on projects management (Results Oriented Missions)
Verification missions or on-the-spot controls
Source: Article 56 FR; BudgWeb Management modes
27/11/2018

31. Internal control frameworks
PART 3
Conclusion
27/11/2018 31 31

32. Conclusion Supervision is part of the internal control system
Management is primarily responsible for supervision, not Internal Audit
Supervision is everywhere : at Commission, at Member States, at implementing bodies levels,…
Supervision is complex, comprises various actors and numerous activities.
Clear responsibilities, subsequent supervision and control activities to be well established between all actors
Source: Article 56 FR; BudgWeb Management modes
27/11/2018

33. THANK YOU VERY MUCH
27/11/2018