1. Proof of concept 29 September 2010
ESF Risk Scoring
Proof of concept
29 September 2010

2. Contents Introduction Systems and data Risk Scoring results AS IS
BEST EXISTING
Recommendations

3. Introduction Objective of ESF Risk Scoring
Promote the use of a risk based approach in the audit planning and selection of projects
Complement the risk assessments as regards to indicators of financial irregularities
Monitor such indicators on a continuous basis
Provide guidance to Member States on risk indicators and internal controls
Build up a better defence against fraud in ESF programs

4. Introduction Proof of concept
Assessment of the possibility to implement an ESF Risk Scoring.
3 countries in scope: A, B and C.
On-site visits to identify and collect relevant data sources.
Perform risk scoring on the collected data with the ESF Risk Scoring tool prototype.
Description of the AS IS and BEST EXISTING situation.
Recommendations to move towards a BEST POSSIBLE situation.

5. Contents Introduction Systems and data Risk Scoring results AS IS
BEST EXISTING
Recommendations

6. Systems and data Country A
Data is stored in a centralized, custom-made system developed by a third party.
Data is entered/uploaded through an on-line application (by managing/certifying/auditing authority and beneficiaries).
Available data required for ESF Risk Scoring:
Project data (description, approved budget per category, start/end date, beneficiary, program, financing structure).
Beneficiary data (national ID number, name, address, annual turnover, relevant management, …)
Cost statements (date of claim, accumulated amounts per cost category)

7. Systems and data Country A
Missing critical information for ESF Risk Scoring
No registration of sub-contractors in database structure.
No registration of cost statements on line item detail.
No registration of employees and timesheets of the beneficiaries in database structure.
Beneficiary data unavailable in BCE (‘banque-carrefour des entreprises’) is not requested from the beneficiary and entered into the system.

8. Systems and data Country B
Data is stored in a centralized, custom-made system developed by a third party.
Data is entered/uploaded through an on-line application (by managing/certifying/auditing authority and beneficiaries).
Available data required for ESF Risk Scoring:
Project data (description, approved budget, start/end date, beneficiary, program, financing structure).
Beneficiary data (national ID number, name, annual turnover, relevant management, …)
Cost statements (line item details: invoice date, amount, cost category, activity, sub- contractor name, subcontractor national ID number)
Missing critical information for ESF Risk Scoring
No registration of employees and timesheets of beneficiaries.

9. Systems and data Country C
Data is stored in a centralized, custom-made system developed by a third party.
Data is entered/uploaded through an on-line application (by managing/certifying/auditing authority and beneficiaries).
Available data required for ESF Risk Scoring:
Project data (description, approved budget, start/end date, beneficiary, program, financing structure).
Beneficiary data (national ID number, name, address, project ID, etc.)
Cost statements (line item details: invoice date, amount, cost category, activity, sub- contractor name, subcontractor national ID number)
General information on instructors and technical persons (national ID number , name, address, function, planned hours, project ID)
Participants (national ID number & type, name, gender, birth date, project ID)
Partners (national ID number, name, country, project ID)

10. Systems and data Country C
Missing critical information for ESF Risk Scoring
No registration of management and turnover of beneficiaries
No registration of employees and timesheets of beneficiaries.
Sub-contractors are not registered in a database.

11. Contents Introduction Systems and data Risk Scoring results AS IS
BEST EXISTING
Recommendations

12. Risk Scoring results Overview projects
Average project risk scores per country
Country A
Country C
Country B
Ratio’s
8,18
4,10
4,84
Cross-project
62,30
16,65
22,52
Sanity
9,68
11,51
10,28
PEP
7,32
0,10
6,68
OVERALL
13,43
8,31
9,06

13. Risk Scoring results Overview projects
Average beneficiary risk scores per country
Country A
Country C
Country B
Ratio’s
8,34
5,03
4,68
Cross-project
50,28
9,54
20,26
Sanity
10,39
11,74
PEP
1,89
0,06
6,84
OVERALL
11,53
7,51
8,73

14. Contents Introduction Systems and data Risk Scoring results AS IS
BEST EXISTING
Recommendations

15. Contents Introduction Systems and data Risk Scoring results AS IS
BEST EXISTING
Recommendations

16. Best Existing
Country B and C have a similar overall availability of data required for ESF Risk Scoring. The key differences are:
Unavailability of information on management of beneficiaries in Country C.
Unavailability of information on registration of participants and instructors in Country B.
Country A collects the most comprehensive data (attendance lists, work performed by beneficiary employees). However, not all information is stored in a structured format and is therefore not suitable for automated risk scoring and the beneficiary data is not cross-checked through an interface with the databases of the tax authorities.

17. Contents Introduction Systems and data Risk Scoring results AS IS
BEST EXISTING
Recommendations

18. Recommendations Country A
Include data on management and shareholdings from public or corporate databases.
Update beneficiary data with data which is not available in BCE (e.g. annual turnover for non-profit organisations).
Register the cost statement details (line items) in the centralized database structures (e.g. through replacing the xls files with xml files and implementing a uniform structure for key information fields).
Register sub-contractor master data in the system.
Monitor quality of the registered data (e.g. test data in the operational system, …).
Implement an inter-face with the databases of the tax authorities to cross-check the beneficiary data (tax debts, social debts, …).
Implement built-in controls in the system for required information on annual turnover, management and key functions (official representative, project manager, finance manager).

19. Recommendations Country B
Register additional information on beneficiaries:
Address
Shareholders/directors/stakes (source: corporate databases)
Implement built-in controls in the system for required information on annual turnover, management and key functions (official representative, project manager, finance manager).
Collect and review participant lists.
Collect and review timesheets for all employees (hours reported, function, name, address, national ID, project ID, etc.).

20. Recommendations Country C
Implement built-in controls in the system for required information on management and key functions (official representative, project manager, finance manager).
Include data on management and shareholdings from public or corporate databases.
Collect and review timesheets for all employees (hours reported, function, name, address, national ID, project ID, etc.).
Require registration of subcontractors (name, national ID, address, legal organisation type, etc.).

21. Recommendations General
Implement cross-country project categories suitable for ESF Risk Scoring resulting in statistically relevant data populations.
Implement the collection and review of management information, attendance lists , employee lists and timesheets in all Member States.
Implement built-in controls on submittal of required data from beneficiaries.
Introduce a standardized approach and uniform structure for data submittal to Member States by beneficiaries.
Cross-check legal position, tax position and management information received from beneficiaries by use of public or corporate databases.
Create a central database for continuous ratio, cross-project, sanity, PEP and sanction list testing based on a standardized approach and uniform structure for data submittal by Member States.
Introduce the concept of risk based sampling (instead of at random sampling) at Member States on the basis of the exception reporting from the central database.

22. Next steps Possibility to enlarge sample to all O.P.s
Member States interested;
Willing to implement fraud prevention approach (assists in meeting Article 60 requirements);
Use as input in risk assessment e.g. for Article 13;
Annual update of risk scoring possible;
Assistance from EMPL audit unit(s) available

23. Your observations and/or questions are appreciated
ESF Risk Scoring
Thank you for your attention
Your observations and/or questions are appreciated