1. 1 Homologues Group Meeting Slovenia, October 2009 Republika SlovenijaEuropean Union IT audits Workshop 2 – Report Ljubljana, 12-13 October 2009 Mr. Gilles RECKERT Inspection générale des Finances, Ministère des Finances, Luxembourg

2. 2 Homologues Group Meeting Slovenia, October 2009 Republika SlovenijaEuropean Union Mr. Billi’s presentation Council Regulation 1083/2006 obliges to have computerised accounting records Commission’s Guidance Note on certification provides suggestions on the main elements of an IT-system Commission’s implementing rules 1828/2006 obliges to maintain reliable IT- systems

3. 3 Homologues Group Meeting Slovenia, October 2009 Republika SlovenijaEuropean Union The processing picture: underlying risks Unreliable / inaccurate accounting and monitoring data Irregularities or fraud left undetected A risk free system is an IT-system unplugged (no electricity) A well-functioning IT-system adds great value to the programme and can mitigate a great deal of risks Unreliable IT system / data  Less money for projects

4. 4 Homologues Group Meeting Slovenia, October 2009 Republika SlovenijaEuropean Union Conclusion IT system is mandatory for this programming period It is mandatory to provide assurance on the reliability of the data and the functioning of the system The therefore developped system has to be tested, i.e. IT-audited for reliabililty by professionals in compliance with international standars

5. 5 Homologues Group Meeting Slovenia, October 2009 Republika SlovenijaEuropean Union Ms Garsoux’ presentation Ms Garsoux’ presentation The MIS has to be well audited to assure it is: –Reliable –Continuous –Secure –Efficient/effective –Compliant Presentation of the ISACA (Information Systems Audit and Control Association)

6. 6 Homologues Group Meeting Slovenia, October 2009 Republika SlovenijaEuropean Union Ms Garsoux’ presentation Ms Garsoux’ presentation Definition of an IT-auditor competencies Use of the Cobit standard for key controls The steps of an IT-audit (plan, execute the audit, write a report) Contents of an IT-audit (environment, input, process, output) Example of an IT audit Framework Reporting

7. 7 Homologues Group Meeting Slovenia, October 2009 Republika SlovenijaEuropean Union Conclusion & Reference IT audit is a mature and regulated profession with available tools and techniques from ISACA. WWW.ISACA.ORG for Cobit and the Assurance Guide and IT assurance framework -> free downloadableWWW.ISACA.ORG Email : Email : M.Garsoux@QAP.EU M.Garsoux@QAP.EU Tel: Tel: + 32 472739836

8. 8 Homologues Group Meeting Slovenia, October 2009 Republika SlovenijaEuropean Union Ljubljana, 12-13 October 2009 The Ministry of Economy and Finance’s (MEF IGRUE) role is to coordinate MONITORING IGRUE CONTROLS PRELEX ----- COMMON BUDGET ----- MEF IGRUE ----- FINANCIAL MANAGMENT ----- EUROPEAN COMMISSION  DG REGIO  DG EMPL  DG AGRI  DG MARE NATIONAL ADMINISTRATIONS  MINISTRIES  REGIONS  AUTONOMOUSPROVINCES  OTHER BODIES

9. 9 Homologues Group Meeting Slovenia, October 2009 Republika SlovenijaEuropean Union Ljubljana, 12-13 October 2009 description of the IGRUE’s role only coordination experiences of the old period (2000-2006) new requirements (digitalisation, availability of audit-data, deadlines) description of IGRUE’s tasks in the financial management of EU-funds Mr Di Nuzzo’s presetation

10. 10 Homologues Group Meeting Slovenia, October 2009 Republika SlovenijaEuropean Union Financial Management – General view Ljubljana, 12-13 October 2009 Local IT System Area Central Coordinating Administrations Central Coordinating Administrations Certifying Authority Certifying Authority MEF-IGRUE Treasury Beneficiaries Fund Transfer EU Accrediting Managing Authority Managing Authority Payment Body Payment Body Payment orders SFC 2007 System Area European Commission European Commission IGRUE IT System Area Payment request process

11. 11 Homologues Group Meeting Slovenia, October 2009 Republika SlovenijaEuropean Union Ljubljana, 12-13 October 2009 records of irregularities controls exercised by the MA, CA, and AA and the IGRUE’s role therein the monitoring process key features of the IT-system and the respective data flows Mr Di Nuzzo’s presentation

12. 12 Homologues Group Meeting Slovenia, October 2009 Republika SlovenijaEuropean Union Controls - general view Local IT System Area Irregularities Evaluation Body Irregularities Evaluation Body Managing Authority Managing Authority Audit Authority Audit Authority Certifying Authority Certifying Authority IGRUE IT System Area MEF-IGRUE SFC 2007 System Area European Commission European Commission Cabinet Presidency Cabinet Presidency O.L.A.F. Other controlling bodies (Court of Auditors, Financial Police, etc.) Other controlling bodies (Court of Auditors, Financial Police, etc.) Annual Audit Report Irregularities Annual summary Recoveries

13. 13 Homologues Group Meeting Slovenia, October 2009 Republika SlovenijaEuropean Union SFC 2007 System Area Local IT System Area Monitoring - general view Ljubljana, 12-13 October 2009 Implementing bodies Implementing bodies Beneficiaries Managing Authority Managing Authority Projects progress data Programming data Operations programming /implementing data IGRUE IT System Area MEF-IGRUE European Commission European Commission IT System Institutional Users System report

14. 14 Homologues Group Meeting Slovenia, October 2009 Republika SlovenijaEuropean Union Ljubljana, 12-13 October 2009 Di Nuzzo’s Conclusions The exploitation of the IT System allows: coping easily with deadlines set by common legislation the minimisation of potential errors connected with manual activities and paper flows the immediate availability of information and either internal and external reports (EU, Court of Auditors, ISTAT, Italian Central Bank, etc.)