CA/20/17. Report of the Board of Auditors of the European Patent Organisation on the 2016 accounting period. Europäische Patentorganisation

Transcription

1 Europäische Patentorganisation European Patent Organisation Organisation européenne des brevets CA/20/17 Verwaltungsrat Administrative Council Conseil d'administration Report of the Board of Auditors of the European Patent Organisation on the 2016 accounting period CA/20/17 e

2 CA/20/17 Orig.: de, en Munich, SUBJECT: SUBMITTED BY: ADDRESSEES: Board of Auditors' report on the 2016 accounting period Explanations and reasons supplied by the President of the Office 1. Board of Auditors of the European Patent Organisation 2. President of the European Patent Office 1. Supervisory Board of the RFPSS (for opinion, Article 80 FinRegs) 2. Budget and Finance Committee (for opinion, Article 80 FinRegs) 3. Administrative Council (for approval and discharge, Article 80 FinRegs and Article 49(3) and (4) EPC) CA/20/17 e LT

3 - I - Subject CONTENTS Page CONTENTS... I I. SUMMARY... 1 A. Our task in brief... 1 B. Opinion on the accounts Accounting rules Opinion... 1 C. Opinion on financial management Financial situation Financial reporting Balance sheet figures Economic situation, factoring in the present value of future national renewal fees Income statement Statement of cash flows Budget and forecasting accuracy Operations Comments on the accounts and financial management... 3 (a) Post-employment benefit and other long-term employee benefit obligations... 3 (b) Repurchase value Caisse Nationale de Prévoyance ("CNP")... 3 (c) IT roadmap... 3 (d) Process for determining actuarial assumptions Internal control system... 4 (a) Internal control system regarding financial statements... 4 (b) RFPSS governance Business administration IT... 5 (a) IT roadmap... 5 (b) IT UNIP project... 5 (c) IT incident management... 5 (d) IT risk management Buildings Academy... 7 II. DETAILED REPORT... 8 A. Preliminary remarks... 8 B. Audit opinion... 9 C. Comments on the accounts The EPO's financial and economic position Introductory remarks Financial statement figures in brief CA/20/17 e

4 - II- 2. Specific accounting remarks Post-employment benefit and other long-term employee benefit obligations Repurchase value Caisse Nationale de Prévoyance ("CNP") IT roadmap Process for determining actuarial assumptions General comments on budget implementation Forecast income statement Forecast balance-sheet figures Comparison of budget as adopted and as implemented Appropriation transfers D. Internal control system Bookkeeping and financial statements Control tables IT general controls IT operations Archiving RFPSS governance IT upgrade including control of user profiles and execution of compliance checks Proper working of the internal control system Daily compliance checks Reporting of accruing interest and dividends Interface with Bloomberg for market values at year end E. Operations Purchase-to-pay process Review and internal appeals procedure New e-tool Update of figures ILOAT judgments IT IT roadmap assessment IT UNIP project Decommission of legacy systems IT incident management IT risk management Building projects Building investments in The Hague Other building activities Benchmark for building cost Academy An overhaul of its internal organisation The Academy's strategic management A stable range of activities CA/20/17 e

5 - III Financial programming and reporting to be improved Human resources Monitoring and evaluating the Academy's work III. STATUS OF FINDINGS A. OFFICE'S FOLLOW-UP REPORT ON CA/20/16 (STATUS ), AND AUDITORS' REACTION B. OFFICE'S FOLLOW-UP REPORT ON CA/20/15 (STATUS ), AND AUDITORS' REACTION C. OFFICE'S FOLLOW-UP REPORT ON CA/20/14 (STATUS ), AND AUDITORS' REACTION D. OFFICE'S FOLLOW-UP REPORT ON CA/20/13 (STATUS ), AND AUDITORS' REACTION E. SUMMARY AND PRIORITY OF OUR RECOMMENDATIONS IV. EPO PRESIDENT ADDITIONAL EXPLANATIONS AND REASONS V. RECOMMENDATION FOR PUBLICATION VI. ANNEXES ANNEX I Year-on-year comparison, balance sheet and income and expenditure account (in EUR '000s) Annex I/1 Income statement Annex I/2 Balance sheet Annex I/3 Statement of cash flows ANNEX II Comparison of budgeted and actual income and expenditure (in EUR '000s) Annex II/1 Income Annex II/2 Expenditure Annex II/3 Implementation of the budget of the Pension and Social Security Schemes Annex II/4 Comparison between original and amended budgets ANNEX III Financial forecast and actual income and expenditure Annex III/1 Income Annex III/2 Balance sheet ANNEX IV Audit expenditure ANNEX V List of abbreviations CA/20/17 e

6 I. SUMMARY A. OUR TASK IN BRIEF 1) The Board of Auditors performs its tasks in accordance with Articles 49 and 50 EPC, its rules of procedure and professional audit principles. 2) Under Article 50 EPC in conjunction with Article 79 FinRegs, our report contains in particular: an audit opinion on the accounts the results of our audit carried out to ascertain whether the financial management of the office is sound whatever observations we consider necessary as to the appropriateness of the existing budgetary and financial arrangements. B. OPINION ON THE ACCOUNTS 1. ACCOUNTING RULES 3) Introduced by the EPO in 2005, the IFRSs have applied in their entirety since deletion of an exception with effect from 1 January 2011 (CA/D 5/11). 2. OPINION 4) We have been able to give an audit opinion without any reservations on the 2016 accounts. 5) The notes to the financial statements shed further light on specific aspects of the balance sheet. C. OPINION ON FINANCIAL MANAGEMENT 6) Our audit included not only the annual accounts but also management audits concerning in particular the financial situation, operations and the RFPSS. These have given rise to the following main findings. 1. FINANCIAL SITUATION 1.1. Financial reporting 7) The EPO revised its financial reporting procedure with effect from 1 January As a result, its accounts as from 2011 are comparable under IFRSs. As set out in CA/84/11, this means that the annual result is subject to greater volatility, particularly because of the accounting treatment of the social-security scheme. CA/20/17 e 1/98

7 1.2. Balance sheet figures 8) As at 31 December 2016, non-current assets were approx. EUR 9 771m. Of the EUR 1 082m increase, EUR 700m came from RFPSS net assets and EUR 269m from bonds. 9) As at 31 December 2016, non-current liabilities amounted to approx. EUR m, an increase of EUR 3 827m over the 2015 figure. They included EUR m for defined benefit liabilities (pensions and similar obligations), which rose by EUR 3 883m. 10) Current assets were down by EUR 32m, while current liabilities were up by EUR 64m Economic situation, factoring in the present value of future national renewal fees 11) The present value of future national renewal fees cannot be shown under IFRSs because there is no legal obligation to pay them. 12) The present value of future national renewal fees has been put at EUR 4bn (CA/60/17), resulting in an imputed shortfall of EUR 7bn. 13) For a long-term view, see the actuarial valuation as at 31 December 2014 (CA/53/15) and the Office's comments on it (CA/54/15). See also the financial study in CA/79/16 (including Add. 1 and Add. 2) Income statement 14) At EUR -9m, the operating result, albeit still negative, is up by EUR 136m on the 2015 figure. This improvement is mainly down to a EUR 88m increase in revenue and a EUR 24m fall in employee benefit expenses. 15) The financial result is EUR 149m, which is EUR 225m higher than in ) The loss of EUR 2 981m under other comprehensive income can be attributed almost exclusively to reduced discount rates Statement of cash flows 17) The inflow from operating activities is EUR 520m, and the outflow from investment activities is EUR 566m. The outflow from financing activities is EUR 4m. CA/20/17 e 2/98

8 1.6. Budget and forecasting accuracy 18) In CA/D 1/15, the AC adopted an authorisation budget within the meaning of Article 25(1)(a) FinRegs totalling EUR 2 132m. The actual outturn was EUR 2 202m, which is only 3.3% higher than forecast. 2. OPERATIONS 2.1. Comments on the accounts and financial management (a) Post-employment benefit and other long-term employee benefit obligations 19) We concur with the accounting treatment for post-employment and other long-term benefit obligations applied by the Office, but highlight the level of estimate involved. Amongst other factors, the calculation of the defined benefit obligations is significantly affected by the discount rate, the mortality tables, the load factor of the tax adjustment, the assumption as to last salary at the end of the career and the probability of retirement for health reasons. (b) Repurchase value Caisse Nationale de Prévoyance ("CNP") 20) Administrative procedures for the transfer are ongoing and a draft protocol has been prepared but not yet signed. (c) IT roadmap 21) We concur with the overall accounting treatment applied by the Office. The documentation of the amortisation period should include an assessment of how the useful life of the asset was determined and if there are specific business reasons justifying a deviation. (d) Process for determining actuarial assumptions 22) For financial reporting purposes several actuarial assumptions including demographic and financial ones have to be made in order to calculate the provisions. The assumptions are mainly determined by the HR Policy department and the actuary. Several of the previous year's parameters were changed, which had an impact on the financial statements. CA/20/17 e 3/98

9 2.2. Internal control system (a) Internal control system regarding financial statements 23) The Office has an internal control system in place for all processes relating to financial statements. However, the controls performed are not always appropriately documented. 24) Although the internal control system regarding the financial statements is on a high security level we recommend steps for further improvement. 25) In SAP, batch interfaces had been run on error and were not completely deleted. 26) Electronically received invoices (e.g. via ) were printed out, while the original file was not saved in its digital format. (b) RFPSS governance 27) RFPSS assets are well managed, the procedures and controls implemented are properly functioning and the values of the Funds and the results of the Funds management have been calculated correctly Business administration Purchase-to-pay process 28) In our opinion, the EPO needs to change the multitude of purchase-to-pay processes present in the organisation, with the aim of abandoning control steps outside the electronic workflow, removing paper documentation and integrating the internal controls within SAP. 29) This will result in reduced workload, increased transparency on the application and quality of the internal controls, uniform and improved documentation, enable easier follow-up by management and reduce processing time for purchases. 30) We see no reason why the EPO, as an organisation at the forefront of IT technology, should not be also at the cutting edge of computerisation of administrative tasks. Hence, the project should define challenging aims at or exceeding the observed best practices. The project should establish quantitative goals as performance indicators for the purchase-to-pay process. CA/20/17 e 4/98

10 2.4. IT (a) IT roadmap 31) From the outset, the IT roadmap has evolved to include aspects that were not included in its original mandate in June 2011 (security roadmap, Stream 3 of IM transformation, ergonomics support and change management). 32) Due to the delay of the reengineered patent grant process based on the CMS platform, which had already occurred in previous years, the IT roadmap will not be completed before the end of 2018 as originally planned, but the IM department is confident it will deliver the IT roadmap in the course of No further delay is expected in 2017 and development is being done according to the project plan. 33) Based on the proposed budget of the IT roadmap of EUR 140m, actual spending is at EUR 100m. According to the actual costs incurred and the planned budget for upcoming years, the IM department is confident the IT roadmap will be completed within the agreed budget of EUR 140m. (b) IT UNIP project 34) After a time of uncertainty it was decided to have the activation phase included again into the current UNIP project and to finish the activation phase by 5 July 2017 to support the Unitary Patent Process (UPP). The project is planned to finish before December 2017 after guarantee period and closure phase. 35) The UNIP project (P525) lists 56 products managed in 5 phases. A sample testing showed that required documentation was provided for these products. 36) We noted that the total project budget increased from EUR 5.3m to EUR 6.2m (in the exception report dated 6 November 2016) and from EUR 6.2m to EUR 6.9m (in the exception report dated 19 January 2017). That is a total increase of EUR 1.6m (29%) since March 2016 due to new requirements by business. (c) IT incident management 37) The EPO incident management procedure describes the handling, follow-up and escalation procedures of incidents. The supporting documentation provides a clear description of incident classifications, roles and responsibilities. CA/20/17 e 5/98

11 38) Incidents are clustered in 5 urgency categories and response time has been defined for each category. A specific tool (iet) is used to track all incidents and to support the complete incident management process from registration until close down. 39) During the audit, a sample of "uncritical" incidents (Cat 4 or 5) had been reviewed and evaluated if the chosen category was plausible. Our review showed no discrepancy. (d) IT risk management 40) For each project initiated within the automation governance at the EPO, the Information Security department provides support during the project initiation phase for managing the security risks and evaluating potential impacts and risks. If necessary, Risk Management will support the Information Security department until the completion of the project. 41) Risks are defined based on experience and knowledge of the IM Security department staff. A formal definition of risk evaluation has not been made. At the time of the audit 129 IT risks and 45 operational risks had been identified. Responsibilities are defined, as each risk has been assigned to a risk owner. 42) A security project aimed at bringing information security into line with the ISO27001 standard was finished in 2016 as part of the IT roadmap Buildings 43) The New Main in The Hague is currently delayed until 4/2018, from 8/2017 in last year's report. The total completion is delayed until 1/2020. Given this delay, we expect the completion of the move into the building at the end of 2018, as the leases will terminate at the end of ) The contingency funds for the New Main are mostly committed. In our opinion the risk of insufficient funds is significant. 45) The revised time schedule of the renovation in Berlin has been pushed to 1/2020. The question remains whether the premises are well suited for the EPO. Hence, the Office should explore other possibilities to ensure suitable office space in Berlin. CA/20/17 e 6/98

12 2.6. Academy 46) Following the 2013 external audit report and the study of the Academy conducted by the EPO's controlling office in 2014, it should be underlined that the Academy has undergone major reforms in the last few years that have helped streamline its organisation and increased its efficiency. 47) Against a backdrop of increasingly strained human resources, several challenges still need to be addressed by the Academy, regarding especially the quality of its strategic planning, of its budgeting processes, of its reporting tools, and the role of its supervisory board: The Academy should consider updating its overall strategy and sectorial priorities; The Supervisory Board should focus on its strategic role and the monitoring and evaluation procedure regarding the overall work and effectiveness of the Academy; The budgeting process should be based on assessment of needs; The Academy should consider developing a set of performance objectives and indicators that would reflect its ability to reach its strategic goals; Its resources and expenditure should be presented more transparently and exhaustively in EPO financial reporting. CA/20/17 e 7/98

13 II. DETAILED REPORT A. PRELIMINARY REMARKS 48) The Board of Auditors of the European Patent Organisation (hereinafter "the Board") reports herein under Article 79 FinRegs on the 2016 reporting period. 49) The accounts reached us in good time before 31 March 2017, in compliance with Article 70 FinRegs. 50) Under Article 75 FinRegs and following a public invitation to tender, we also commissioned certain tasks from the following audit firms: KPMG Deutsche Treuhand-Gesellschaft Aktiengesellschaft Wirtschaftsprüfungsgesellschaft, Munich (for audit of EPO accounts, business administration and IT) BDO AG Wirtschaftsprüfungsgesellschaft, Hamburg (for buildings and RFPSS). 51) Pursuant to Article 76(2) FinRegs the checks were intended in particular to establish whether: the terms of the budget and other budgetary provisions were adhered to, the annual accounts as defined in Article 69 FinRegs were properly substantiated and all transactions properly recorded, securities and cash on deposit and in hand accorded with the amounts in the cash accounts, procedures were efficient and economical and whether work could be performed more efficiently with fewer staff or other resources, or in other ways. 52) Pursuant to Article 7(1)(c) of the Regulations for the Reserve Funds for Pensions and Social Security (RFPSS), we recommend that the Fund Administrator be discharged in respect of the 2016 accounting period. Our comments on the RFPSS can be found in section I.C.2.2(b) of the summary above and in section II.D.2 of this detailed report. 53) In accordance with Article 76 FinRegs, we or the above firms carried out checks on the EPO premises. Petty cash at all sites was closed before 1 January ) We would like to take the opportunity to thank the President and the EPO staff consulted for their help and constructive co-operation. CA/20/17 e 8/98

14 B. AUDIT OPINION We have audited the financial statements, comprising the statement of financial position, statement of comprehensive income, statement of changes in equity, statement of cash flows and notes (Article 69(1)(a) FinRegs), together with the bookkeeping system of the European Patent Organisation (EPO), Munich, for the accounting period 1 January to 31 December 2016, as disclosed in CA/60/17. Responsibility for maintaining books and records and preparing the financial statements in accordance with Article 50(g) of the European Patent Convention (EPC) and the Financial Regulations (FinRegs), as described in note 2.1 of CA/60/17 ("Basis of Preparation"), lies with the President of the Office. Under Article 1(3) FinRegs, the EPO's generally accepted accounting principles are the International Financial Reporting Standards (IFRSs) as promulgated by the International Accounting Standards Board (IASB). We conducted our audit of the financial statements in accordance with Article 49 EPC and the relevant FinRegs provisions especially Article 79 FinRegs and drawing on the audit principles adopted by Germany's Institut der Wirtschaftsprüfer (institute of auditors). Those standards require that we plan and perform the audit such that misstatements materially affecting the presentation of the net assets, financial position and results of operations in the financial statements in accordance with the applicable accounting provisions of the FinRegs are detected with reasonable assurance. Knowledge of the business activities and the economic and legal environment of the EPO and expectations as to possible misstatements are taken into account in the determination of audit procedures. The effectiveness of the accounting-related internal control system and the evidence supporting the disclosures in the books and financial statements are examined primarily on the basis of sample checks within the framework of the audit. The audit includes assessing the accounting principles used and significant estimates made by the President of the EPO, as well as evaluating the overall presentation of the annual financial statements. We believe that our audit provides a reasonable basis for our opinion. Our audit has not led to any reservations. In our opinion, based on the findings of our audit, the financial statements comply with the IFRSs as promulgated by the IASB and give a true and fair view of the net assets, financial position and results of operations of the EPO in accordance with these standards. Munich, 20 April 2017 Board of Auditors H. Schuh O. Hollum F. Angermann CA/20/17 e 9/98

15 C. COMMENTS ON THE ACCOUNTS 1. THE EPO'S FINANCIAL AND ECONOMIC POSITION 1.1. Introductory remarks 55) Every Board report analyses the EPO's financial situation. Our task under Article 79 FinRegs of ascertaining whether its financial management is sound involves not only verifying compliance with economy, efficiency and effectiveness but also scrutinising its specific self-financing model. The EPO must manage its resources in such a way that it does not need to call on the member states' guarantee. 56) In CA/D 5/11 the Administrative Council did away with the Article 1(3) FinRegs exception, with retroactive effect from 1 January Since then, the EPO has had to apply the IASB accounting principles in their entirety. 57) This change in its financial reporting procedure has had two major effects: (a) the RFPSS assets are shown as assets and the DBO as a liability, which leads to significantly higher total assets and liabilities; (b) the "corridor" approach, used when accounting for financial and actuarial fluctuations in the liabilities and assets of the social-security schemes, has been discontinued, making the annual accounts much more volatile. 58) The 2016 estimates and figures are based on CA/60/17 (financial statements) and CA/10/17 (budget implementation statement). Any minor differences between the figures appearing in those statements and those quoted here can be attributed to rounding of the former figures for the purposes of this report. 59) For the detailed balance-sheet and income-statement figures, see Annexes I/1 and I/2, taken from CA/60/17. Annex III compares the budget estimates as adopted in 2015 and subsequently restated ("IFRS forecast") with actual income and expenditure as per CA/10/17. CA/20/17 e 10/98

16 1.2. Financial statement figures in brief (a) Balance sheet (in EUR '000s) Non-current assets Current assets Total assets Non-current liabilities Current liabilities Total liabilities Equity ) As at 31 December 2016, non-current assets were approx. EUR 9 771m. Of the EUR 1 082m increase, EUR 700m came from RFPSS net assets and EUR 269m from bonds. 61) As at 31 December 2016, non-current liabilities amounted to approx. EUR m, an increase of EUR 3 827m over the 2015 figure. They included EUR m for defined benefit liabilities (pensions and similar obligations), which rose by EUR 3 883m. 62) Current assets were down by EUR 32m, while current liabilities were up by EUR 64m. 63) As a result of all these changes, negative equity increased by EUR 2 841m, from EUR m to EUR m. CA/20/17 e 11/98

17 Non-current liabilities 64) Defined benefit liabilities account for by far the largest share of non-current liabilities. 65) The defined benefit liabilities are as follows: (in EUR '000s) Active staff Staff entitled to deferred pension Pensioners Total Pension liability LTC insurance Health insurance Death and invalidity Total ) The pension liability (EUR m) breaks down as follows: (in EUR '000s) Pensions Tax adjustment / partial compensation Invalidity allowance Family allowances Total ) The large increase in defined benefit liabilities can be attributed almost entirely to significant reductions in discount rates. Discount rate Pension liability 3.57% 3.89% 1.61% 2.60% 1.82% LTC insurance 3.77% 4.10% 1.75% 2.78% 2.00% Health insurance 3.55% 3.90% 1.61% 2.69% 1.82% Death and invalidity 2.89% 3.17% 1.32% 1.97% 1.28% CA/20/17 e 12/98

18 68) The calculations in CA/60/17 (note 20.1) show that a 1% increase in the discount rate would reduce defined benefit liabilities by EUR 4 260m, whereas a 1% reduction would increase them by EUR 5 935m. Liability Current value 1% increase 1% decrease Pensions LTC insurance Health insurance Death and invalidity Total Difference ) Despite the heavily reduced discount rates, the inflation parameters were the same as in 2015, except that for medical costs: Inflation Future salary increases 2.50% 2.50% 2.50% 2.50% 2.50% Future pension increases 2.50% 2.50% 2.50% 2.50% 2.50% Medical costs 3.10% 3.20% 3.10% 3.06% 2.64% (b) Economic situation, factoring in the present value of future national renewal fees 70) The present value of future national renewal fees cannot be shown under IFRSs because there is no legal obligation to pay them. 71) With no eligible future income to set against the EPO's non-current liabilities from its future business, its balance sheet looks rather lopsided. To counteract that, the present value of future national renewal fees needs to be borne in mind. The figures shown in the table below are taken from CA/60/17. CA/20/17 e 13/98

19 72) With the present value of future national renewal fees at EUR 4bn, there is an imputed shortfall of EUR 7bn. (in EUR '000s) RFPSS net assets Present value of future renewal fees Net business assets Defined benefit liabilities Balance ) A similar picture emerges when the present value of future national renewal fees is compared with equity: (in EUR '000s) Equity Present value of future national renewal fees ) For a long-term view, see the actuarial valuation as at 31 December 2014 (CA/53/15) and the Office's comments on it (CA/54/15). See also the financial study in CA/79/16 (including Add. 1 and Add. 2). (c) Income statement Profit / loss Operating result Financial result CA/20/17 e 14/98

20 (in EUR '000s) Operating result Financial result Profit / loss for the year Other comprehensive income Total comprehensive income ) At EUR -9m, the operating result, albeit still negative, is up by EUR 136m on the 2015 figure. This improvement is mainly down to a EUR 88m increase in revenue and a EUR 24m fall in employee benefit expenses. 76) The financial result is EUR 149m, which is EUR 225 higher than in ) The loss of EUR 2 981m under other comprehensive income can be attributed almost exclusively to the reduced discount rates (e.g. the discount rate for pension liabilities fell from 2.60% to 1.82%). The effect of this was as follows: (in EUR '000s) Revised financial Revised demographic assumptions assumptions Total Pensions LTC insurance Healthcare insurance Death and invalidity Total CA/20/17 e 15/98

21 (d) Statement of cash flows 78) The inflow from operating activities is EUR 520m, the outflow from investing activities EUR 566m. Taking into account the EUR 4m outflow from financing activities, there has been a net decrease of EUR 51m in cash and cash equivalents, which is EUR 48m more than in Cash flows (in EUR '000s) from Operating activities Investing activities Financing activities Net increase/decrease in cash and cash equivalents SPECIFIC ACCOUNTING REMARKS 2.1. Post-employment benefit and other long-term employee benefit obligations 79) The following paragraphs should be read in connection with our audit report issued on the financial statements for the reporting period ending 31 December 2015 (CA/20/16) as well as note "28. Contingencies and risks" to the financial statements (CA/60/17). 80) As at 31 December 2016, post-employment benefit obligations of the Office amount to EUR m and exceed total assets by EUR 9 189m. They are summarised in the following table: Post-employment benefit obligations in EURm Gross DBO (undiscounted) As per financial statements (discounted) Gross DBO (undiscounted) As per financial statements (discounted) Pension obligation LTC insurance Sickness insurance Death and invalidity Total Source: 2016: CA/60/17; 2015: CA/60/16 CA/20/17 e 16/98

22 81) We draw attention to the major assumptions and uncertainties as follows: (a) Decrease in interest rate 82) According to IAS 19, the interest rate used for discounting the defined benefit obligations ("DBO") is determined by reference to market yields at the end of the reporting period. In the case of the Office, it is based on the "iboxx EURO Corporates AA" index and therefore subject to general market fluctuations. The determination of the discount rate applied by the Office is in line with the requirements of IAS ) The discount rate used as at 31 December 2016 for pension obligations is 1.82% (previous year: 2.60%). This decrease is the main reason for the net actuarial losses (re-measurements of DBO) of EUR 2.981m that have led to an increase in equity. The method used for determining the rate has been applied consistently. We consider the discount rate used by the Office to be appropriate. (b) Decrease in service costs ) Current service costs are measured using the opening DBO, i.e. the liability as at 31 December They are determined applying an actuarial calculation. Given the higher discount rates at the end of the financial year 2015, the opening DBO has been comparatively low. Due to the mechanics of IAS 19 and as expected at the end of 2015, current service costs for pension obligations have significantly decreased to EUR 604m (compared with EUR 845m in 2015), leading to an improvement in the (negative) operating result under IFRSs for Obviously, this is partially offset by a negative impact on financial result in 2016 as the interest costs have increased from EUR 271m in 2015 to EUR 355m in CA/20/17 e 17/98

23 (c) Impact of changes in schemes applicable since 2015 (1) Return to tax adjustment 85) At the end of 2014, the Office proposed the replacement of the partial compensation scheme by the former tax adjustment (CA/95/14 Rev. 1), which had been in place until 31 December The proposal was accepted by the BFC and the Administrative Council at their respective meetings in November and December It is applicable from 1 January 2015 onwards to all pensioners who began active service before 1 January There has not been any impact on the financial statements as at 31 December 2016 or as at 31 December 2015, because, for accounting purposes, the Office had treated the partial compensation according to the former tax adjustment rules (in place until 31 December 2008). As at 31 December 2016 liabilities of EUR 2 926m have been provided for regarding the tax adjustment. 86) We concur with the accounting treatment applied by the Office and we draw attention to the disclosures made in note 28, describing the tax risks on partial compensation. Moreover, we highlight that the matter is primarily a legal and political issue rather than an accounting issue. 87) Regarding the measurement of the tax adjustment, please refer to section (5) below. (2) New career scheme 88) The following paragraphs should be read in connection with our management letter issued on the financial statements for the reporting period ending December 31, ) In CA/D 10/14, the Administrative Council decided to revise the ServRegs on remuneration. The new scheme has been applicable from 1 January 2015 onwards and is relevant for financial reporting in the following respects: CA/20/17 e 18/98

24 The actuarial calculation of the DBO includes an estimate of future salary increases (estimating the salary of the employee upon retirement) which incorporate promotions and step enhancements, as these are considered "regular" at the EPO. Under the new career scheme, regular promotions and step enhancements based on seniority are replaced by a performance-based scheme. The Office assessed the impact on the DBO as low, since under the new career scheme, salary increases might slow down but might not significantly change the salary upon retirement for the majority of the employees in service as at 31 December No past experience is available regarding actual promotion and step enhancement patterns and therefore no sufficiently reliable estimate - better than the already observable pattern under the old scheme - is possible. According to the IFRSs, such a change in plan is to be immediately recognised through P/L. However, based on the arguments above, any change (through P/L) would be too aggressive. We consider this an acceptable estimate of the Office. 90) Moreover, a bonus scheme was implemented for honouring exceptional performance. The bonus element does not give rise to any pension entitlement and does therefore not increase any pension obligation. The bonus payment (EUR 8.1m) was accrued correctly. We concur with the financial approach taken by the Office for the annual closing (3) Invalidity and sickness scheme 91) The Administrative Council approved the modifications of the ServRegs and PenRegs governing the invalidity and sickness scheme in March 2015 (CA/14/15 Rev. 1). 92) For a detailed description of the reform measures, please refer to our audit report issued on the financial statement audit for the reporting period ending on 31 December (4) Tax issues relating to post-employee benefits 93) The Office faces several uncertainties in connection with the taxability of invalidity allowances and pensions for the years 2008 respectively 2009 until By reintroducing the former tax adjustment scheme in place until year-end 2008 as well as the sickness and invalidity reform, the Office has taken measures to limit its risk exposure. The reflection of the tax adjustment in the defined benefit obligation is described in section (c)(1) above. For all other relevant elements, the accounting impacts can be summarised as follows: CA/20/17 e 19/98

25 Taxation of invalidity allowance 94) With the reform of the sickness and invalidity scheme, the risk exposure has been limited to staff being non-active between 1 January 2008 and 31 December 2015 (CA/14/15 Rev.1) 95) The number of non-active staff members that have been classified as pensioners during that period amounts to 209 as at 31 December ) A provision was recognised in 2015, as former invalids had contacted the Office in this matter, asking for support in court proceedings as well as reimbursement of taxes paid. Following decisions by German and Dutch tax authorities and courts in 2016 that confirmed the exemption from national income tax, the provision was reversed. Nevertheless, the Office assured the Association of the European Patent Office Pensioners that the former invalids will be entitled to a compensatory payment covering the difference resulting from tax impacts between the invalidity allowance and the pension and therefore a corresponding amount has been recognised as another employee-related liability as at 31 December ) Its appropriateness remains to be monitored as the response rate is one of the main estimates within the calculation. Taxation of partial compensation 98) Although the Office is not a party to the legal proceedings, it provides legal support to pensioners who have been approached by national tax authorities claiming taxes on partial compensation. The German Federal Fiscal Court ruled by final judgment of July 2015 that the partial compensation is nationally taxable. The appeal before the Dutch Supreme Court is still pending. 99) The Office did not commit itself towards the pensioners to bear all financial consequences of national taxation. In 2015, the Office decided to "phase-out" the support measures provided. 100) For accounting purposes, the Office maintains its position that no reimbursement of taxes paid on partial compensation will be made to pensioners as there is neither a legal nor a constructive obligation. No provision has been recognised and the potential risk ("contingent liability" in accounting terms) is appropriately disclosed in note 28 ("contingencies and risks") in the notes to the financial statements. 101) Moreover, by re-introducing the former tax adjustment scheme, the Office has limited its risk exposure and therefore the materiality of the issue for accounting purposes. CA/20/17 e 20/98

26 Salary Savings Plan 102) All staff members entering the Office since 1 January 2009 are compulsorily members of the "Salary Savings Plan", a deferred compensation model. The contributions are paid by the Office (two thirds) and by the employees themselves (one third) and are subject to internal tax under Article 16(1) EPO-PPI. Consequently, the Office takes the position that no national tax can be imposed additionally and has not provided for any potential risk for reimbursement of taxes as at 31 December (5) Valuation of the tax adjustment 103) For valuation purposes regarding the tax adjustment on pensions (incl. retirement for health reasons), the Office has not undertaken a detailed assessment regarding the country of tax-residence of pensioners and their tax status, but has taken a "loading factor" of 21% on the defined benefit obligation for current and future pensioners (incl. pensioners for health reasons) respectively. The actual payment for tax adjustments (former partial compensation respectively) is based on the PenRegs and derived from theoretical national income tax according to the Inter-Organisations Section of the Co-ordinated Organisations, considering the fiscal situation of the beneficiaries regarding marital status and country of residence. 104) The load factor is derived from historical information by dividing actual payments for tax adjustments by actual payments for pensions. This calculation method has remained unchanged since At year-end 2016, the load factor was verified and revised. Historical information has been used to undertake a sanity check by identifying a trend. Since 2008, a minimum of 20.4% and a maximum of 21.8% have been observed. Based on these observations, the load factor has been set at 21%, which also had been applied in the previous year. 105) For accounting purposes, the Office assumes that the country of residence in the case of retirement (incl. retirement for health reasons) mirrors the country of residence as well as tax status of EPO's current retired workforce. 106) We concur with the method applied by the Office, but highlight the level of estimate involved and recommend an annual analysis of the appropriateness of the load factor. CA/20/17 e 21/98

27 (6) Summary 107) To summarise, we concur with the accounting treatment for post-employment and other long-term benefit obligations applied by the Office, but highlight the level of estimate involved. Amongst other factors, the calculation of the defined benefit obligations is significantly affected by the discount rate, the mortality tables, the load factor of the tax adjustment and the assumption of the last salary at the end of the career as well as the probability of becoming a pensioner for health reasons Repurchase value Caisse Nationale de Prévoyance ("CNP") 108) In its capacity as legal successor of the Institut International des Brevets ("IIB"), the Office accounts for the repurchase value of funds of former IIB-members for pension payments as well as outstanding interest thereon of EUR 58.6m (31 December 2015: EUR 56.6m). The increase is due to accrued interest for Since July 2007 no payments or reimbursements have been made by CNP to the Office. The amount is confirmed by CNP in its yearly statement provided to the EPO. Since 2000, the EPO has aimed at a transfer of these funds from CNP to the Office and a subsequent contribution to the RFPSS. The Office has terminated the contract with CNP, negotiations have been held and a conclusion had almost been reached in 2007, subject to all ex-iib members concerned approving the transfer (condition set by CNP). Progress has been made and approval has been obtained from all relevant ex-iib members in the meantime. An internal legal analysis performed by the Office in 2010 has not revealed any concern regarding the Office's entitlement to these assets. Administrative procedures for the transfer are ongoing and a draft protocol has been prepared, but not signed yet. The Office expects that the payment might be received in the course of IT roadmap 109) In 2011, the IT Roadmap project has been initiated to develop and implement improvements in the patent grant process through integrated IT tools. 110) For accounting purposes the EPO then performed an initial analysis of the three streams of the project to define the intangible assets which will be generated and qualify for recognition under IFRSs (IAS 38). Stream 1 comprises short-term efficiency projects as well as reengineering of the patent grant process. Stream 2 involves investments designed to improve the efficiency and quality of the tools used by the examiners. Both streams are eligible for capitalisation. Stream 3 mainly deals with a new infrastructure. As in prior years, there are no eligible costs incurred on Stream 3 in financial year 2016 (i.e. no costs capitalised as at 31 December 2016 regarding Stream 3). CA/20/17 e 22/98

28 111) Costs capitalised under IFRSs are summarised in the following table: Total Stream ,280 9,337 9,428 5,369 5,424 38,107 internal costs 87 3,369 1,955 2,443 1,220 1,415 10,489 external costs 182 4,911 7,382 6,985 4,149 4,009 27,618 Stream ,985 2,019 1,423 3, ,829 internal costs 74 1, ,834 external costs , , ,995 Total thereof IT systems thereof construction in progress thereof written off 38,107 23,658 14,449 3,160 10,489 6,857 2, ,641 11, ,829 8,324 1, ,834 3, ,995 5, ) External costs of EUR 4 954k and EUR 2 403k for Stream 1 and Stream 2 respectively were expensed in In 2016 the unitary patent was excluded from the IT roadmap asset strategy; EUR 1 055k was consequently written off. Due to the change of the software integrator some work can no longer be used so there was a write-off of EUR 2 105k for the edossier. 113) We concur with the overall accounting treatment applied by the Office, but noticed the following issue which could have a financial statement impact: The Office applies an amortisation period of ten years for Stream 1 and five years for Stream 2 respectively. 114) Recommendation: The documentation should include an assessment of how the useful life of the asset was determined and if there are specific business reasons justifying a deviation. This decision should be made in the process of capitalisation and complement the documentation in the summary file. CA/20/17 e 23/98

29 2.4. Process for determining actuarial assumptions 115) The EPO has several defined benefit plans in place. For financial reporting purposes several actuarial assumptions including demographic assumptions (e.g. mortality rates, probability of becoming a pensioner for health reasons, probability to get married etc.) as well as financial assumptions (e.g. discount rate, medical cost inflation, salary increases etc.) have to be taken in order to calculate the obligations. These involve a certain level of estimate as well as expertise in the field of actuarial calculations, accounting knowledge and in-depth know-how of the relevant postemployment benefit schemes. 116) The assumptions are mainly determined by the HR Policy department and the actuary. In the course of our audit, we identified that several of the previous year's parameters were changed, which had an impact on the financial statements. 117) Recommendation: Going forward, we recommend implementing a checklist of all actuarial assumptions and stating if / how these have been changed compared to prior period as well as the expected effect on the DBO. This list should be discussed between the HR Policy and Finance departments and the actuary. The purpose is to ensure that all changes in assumptions are known upfront and can be assessed regarding their relevance for financial reporting. In addition it would facilitate the reasonableness checks of the results of the actuarial calculation that are undertaken by the HR Policy and Finance departments. 3. GENERAL COMMENTS ON BUDGET IMPLEMENTATION 3.1. Forecast income statement 118) The IFRS plan figures as per CA/D 1/15 and CA/10/17 and the actual ones as per CA/60/17 are juxtaposed in Annex III/1. 119) The 2016 operating result was negative (EUR -9m), and so EUR 71m below the forecast figure of EUR +62m. Income was EUR 159m (9.1%) and expenses were EUR 230m (13.7%) higher than forecast. 120) At EUR 149m, the financial result was EUR 235m higher than forecast. This was because finance revenue was EUR 164m higher and finance costs EUR 71m lower than expected. 121) Other comprehensive income was EUR 2 980m below the forecast of zero. CA/20/17 e 24/98

30 3.2. Forecast balance-sheet figures 122) The IFRS plan figures as per CA/D 1/15 and CA/10/17 and the actual ones as per CA/60/17 are juxtaposed in Annex III/2. 123) Assets deviated from plan by EUR 479m (4.8%), with non-current assets EUR 724m (8.0%) over and current assets EUR 245m (24.4%) under plan. Overall, RFPSS net assets were EUR 370m and securities, current and non-current, EUR 470m over plan, whereas cash and cash equivalents were EUR 122m under plan. 124) Liabilities were EUR 9 337m (78.9%) over plan. This is attributable to the higher defined benefit liability of EUR 9 364m Comparison of budget as adopted and as implemented 125) The basic figures (as per CA/10/17) for comparing the budget as adopted and as implemented are given in Annex II. 126) In CA/D 1/15 the AC adopted an authorisation budget within the meaning of Article 25(1)(a) FinRegs totalling EUR 2 132m. The actual outturn was EUR 2 202m, i.e. EUR 70m (3.3%) higher. 127) Income from patents (Chapters 50 to 54) was EUR 95m (5.4%) over, and other income (Chapters 55, 57 and 58) EUR 19m (-7.8%) under plan. 128) There were underspends in all operating expenditure chapters. They totalled EUR 171m, including EUR 118m for staff, EUR 23m for IT equipment maintenance, EUR 10m for general operating expenditure and EUR 9m for co-operation and meetings. 129) There was a budget surplus (Chapter 49) of EUR 408m, which is EUR 309m higher than budgeted (EUR 99m). 130) For the RFPSS, income was EUR 23m (7.2%) and expenditure EUR 8m (3.3%) under plan. The transfer to the RFPSS was EUR 15m (20.1%) under plan. CA/20/17 e 25/98

31 3.4. Appropriation transfers 131) The appropriation transfers under Article 34 FinRegs are shown in Annex II/4. The figures are taken from CA/10/ ) Transfers under Article 34(1) FinRegs (within the same chapter) totalled less than EUR 1m. 133) Transfers under Article 34(2) FinRegs (between chapters and not exceeding 20% of the amounts under the chapters concerned) were also less than EUR 1m. 134) There were no transfers under Article 34(3) FinRegs (decision by the BFC or AC). CA/20/17 e 26/98

32 D. INTERNAL CONTROL SYSTEM 1. BOOKKEEPING AND FINANCIAL STATEMENTS 1.1. Control tables 135) The Office has an internal control system in place for all processes relating to financial statements. However, the controls performed are not always documented appropriately. Furthermore, no consistent description in a standardised form is available yet. Recommendation: In order to rely on the effectiveness of the controls, it is recommended that consideration be given to implementing a template for a process description and a controls matrix, both in line with the internationally applied COSO framework. Such a template should be updated on a regular basis (at least once a year for annual closing) and serve as a tool for monitoring the internal control process IT general controls 136) We performed our audit procedures for the systems in scope SAP FIPS, EPASYS and Fee Capturing System (FCS). 137) The following areas have been subject of our audit: Access to programs and data Program changes / development IT operations (a) Audit and findings 138) The administration of access rights, user identification and general security parameters were the subject of our audit procedures. 139) Changes to the applications follow the Automation Governance process for demand management. The process is applicable for all demands to change existing or to set up new services. All changes must be created in the Change Management Tool and follow the IT Change Management Process. We selected a sample of 15 changes performed in each application and noted that only for 13 changes could a ticket be provided, whereas supporting documentation had been provided for the remainder. The Office explained this circumstance. CA/20/17 e 27/98

33 140) The SAP system is locked for direct changes but we noted that it had been opened several times during the year in order to replace contents in debugging mode. 141) We audited system openings during the year. (b) Recommendations 142) Recommendation: Although the internal control system regarding the financial statements is on a high security level, we recommend that Application Management further improve access, log files and system openings. Detailed information was directly given to the Office IT operations 143) We examined whether backup procedures are in place for all applications in scope and whether data is backed up on a regular basis, and noted no deviations. 144) We noted in SAP, that batch interfaces had been run on error and were not completely deleted. 145) Recommendation: For Application Management, a process considering a follow-up of batch jobs with error status, especially files older than 6 months, should be implemented in order to evaluate if relevant postings are affected Archiving 146) We noted that electronically received invoices (e.g. via ) were printed out, while the original file was not saved in its digital format. This procedure is not in accordance with the German tax regulations ( 145 to 147 Abgabenordnung) and other regulations valid in some of the EPO member states, especially regarding withholding tax and thus might bear the risk that the withholding tax is not reimbursed by the German tax authorities. 147) Recommendation: We recommend that the General Management Service define an archiving strategy and implement an appropriate archiving solution for storing electronic invoices. The archiving solution should ensure that legal and tax requirements are met in all aspects and that storage over the full legal retention time is ensured. CA/20/17 e 28/98

34 2. RFPSS GOVERNANCE 2.1. IT upgrade including control of user profiles and execution of compliance checks 148) The bookkeeping system CAMRA (including the trading system ANTARES) has been upgraded in This includes an easy to use audit trail on all activities. This audit trail allows the compliance officer to check changes to the user profiles at any time. 149) Consequently the past issue that the IT administrator could change user profiles without any independent check has been resolved Proper working of the internal control system 150) The control system was audited by reviewing a sufficient sample of transactions in terms of proper function of the internal control system, documentation, segregation of duties and physical delivery. The four-eye-principle was checked regarding the execution of an order, the upload to NEOLINK and the corresponding entry in CAMRA. Furthermore the physical delivery was verified by reconciling the CAMRA and custodian bank account. 151) The transaction process uses different single steps which are all well-documented on the relevant pages. 152) Recommendation: A rearrangement of the process (e.g. using an electronic workflow) should be considered to simplify and augment the efficiency of this investment process. 153) Recommendation: The value of the IT systems and providers should be reviewed against fees paid and alternatives available at least every 10 years Daily compliance checks 154) All daily compliance checks of the year 2016 were audited by the Board. The audit result is that every working day a compliance check was performed and the document produced by the system was signed on the front page by an authorised person and in most cases the front page indicates whether there was a breach of rules in the report. All daily reports were passed to the Fund Administrator for review. Moreover, all exceptions indicated in those reports were included in the weekly reports and in the quarterly reports of the compliance officer. There were only passive breaches of the rules and they were removed within the time frame given by the regulations. CA/20/17 e 29/98

35 155) Not all front pages of the daily compliance reports indicated that there was an exception in that report. Although there is no formal rule on that detail, it would make the review by the Fund Administrator easier if, in 100% of all breaches, those breaches were indicated on the front page of that daily report. 156) Recommendation: All breaches of the rules should be indicated on the front page of the daily compliance report Reporting of accruing interest and dividends 157) The processes of accruing interest and dividends were audited and one example for each process was tested in order to ensure the correct calculation. One day before due date, CAMRA is calculating the interest or dividend receivable. This data recorded in the system is entered as receivable into the books. Data of dividends are recorded in CAMRA only upon announcement. This receivable is then reconciled with incoming payments. 158) Based on its tests the Board has found the calculations of CAMRA to be correct Interface with Bloomberg for market values at year end 159) All year-end market values of all individual investments are checked by accounting from the custodian bank statements (BNP Paribas) against CAMRA. 160) If there are differences, the values in CAMRA are checked against Bloomberg. No feedback is given to, or clarification sought from, BNP. The main reason is that the EPO does not use a special service by BNP to provide accurate year-end rates. 161) The completeness and accuracy of the manual work of accounting was audited including proof that exceptions have been properly clarified. 162) No exceptions were found to report on. CA/20/17 e 30/98

36 E. OPERATIONS 1. PURCHASE-TO-PAY PROCESS (a) Audit procedure 163) The purchasing audit was performed in two steps: Process Mining, a data-based analysis of ERP transaction data to identify actual process flows at any level of detail. Manual audit procedures based on samples that were drawn from the population previously analysed through the process mining tool. This procedure allowed for the identification of performance-related indicators and governance-related findings in the purchase-to-pay cycle. (b) Findings 164) The main issue identified during the work performed was the high number of efficiency related findings. While compliance related topics are handled very well by the EPO, efficiency suffers, in particular due to the large amount of manual process steps as well as the under-utilisation and inconsistent use of SAP. 165) The following picture illustrates the findings by plotting the process steps and the flow of transactions. CA/20/17 e 31/98

37 Cases within the MM module, i.e. invoice items with a reference to a purchase order item 10% of cases 34% of cases 100% of cases The left-hand side shows the "the happy path", i.e. the most efficient process with no deviations, no exceptions and basically no problems. In the middle, there is an illustration of the Office's most common purchase-to-pay processes. The right-hand side shows the total transactions in this audit. We can see that only 10% are following the most efficient path. The right-hand picture in our view clearly illustrates the need for a major overhaul of the procedures. CA/20/17 e 32/98

38 166) Based on further study and analysis of the transactions and the process flow, these are some of our observations, listed in order of importance (high, medium, low): Finding High Unauthorised corrections of purchase orders after clearing open items Unauthorised corrections of POs after invoice receipt. Medium High number of transactions without the involvement of Central Procurement Rare usage of MM module in SAP (50.2% vs. better practice of 85%) Low High number of manually posted invoices High number of payment terms in SAP SAP system not used to full capacity No central supplier evaluation High number of process steps performed outside of SAP High number of late payments No transparency and monitoring regarding lost discounts Invoices dated with the date prior to the date of purchase order creation in SAP Several manual changes of payment terms SPE Process not completely implemented Category of Finding Internal controls Internal controls Process efficiency Internal controls Process efficiency Process efficiency Process efficiency Process efficiency Process efficiency Process efficiency Process efficiency Process efficiency Internal controls Process efficiency Internal controls Process efficiency 167) Both the audit sampling and other audit procedures have shown that there is no significant control risk within the procedures. Generally speaking, the deviation from the happy path adds to inefficient procedures, consumes staff-hours, increases processing time and prevents cost savings (early payment discounts). 168) It can clearly be seen that there are many variations in the process. Even if some of them are unavoidable, the EPO is very far from the best practice in organising the process. 169) As an example, we have identified best practice in Germany for the number of payment terms defined in SAP. Best practice is around eight to ten. The EPO uses 59 different payment terms, and this high number of payment terms increases the risk of applying the incorrect one, thus potentially generating errors, exceptions and more procedural steps and work to correct. CA/20/17 e 33/98

39 170) A detailed report has been submitted to management. 171) During the audit, it became apparent that the Office's Purchasing Department is aware of many of the issues that were raised. For many of them, actions had already been initiated. (c) Recommendation 172) In order to make the purchase-to-pay process more efficient, the EPO needs to reduce the multitude of purchase-to-pay processes present in the organisation, with the aim of abandoning control steps outside the electronic workflow, removing paper documentation and integrating the internal controls within the SAP system. 173) At present, the SAP system is under-utilised. There is much room for improvement by using electronic workflows, electronic documentation and forms and other possibilities present in the SAP system. 174) This will result in reduced workload and increased transparency in the application and quality of the internal controls, and will enable easier follow-up and reduced processing time for purchases. 175) Recommendation: We recommend that the EPO initiate a project to implement major changes in the purchase-to-pay process, and fully utilise the possibilities of electronic procedures. 2. REVIEW AND INTERNAL APPEALS PROCEDURE 2.1. New e-tool 176) The procurement process for the selected tool was completed at the end of The implementation phase started in 2017 with the goal that the business will have an operational tool by July All departments which are involved in the review and internal appeals procedures were involved during the process of selecting a suitable solution and were able to give input regarding the requirements. 177) The concept of the tool follows the principle of a case management system which can monitor the requests and internal appeals from start to finish, improve the interaction with other teams, help to deal with the documents and provide the outcome and statistics. 178) The new tool uses different categories for the requests compared to previous years. CA/20/17 e 34/98

40 2.2. Update of figures (a) Conflict Resolution Unit 179) In 2016, the number of requests for review registered by the Conflict Resolution Unit (CRU) decreased in comparison to previous years (decrease of 15% whereas the total number of requesters decreased by approx. 85%). The decreasing number of cases and requesters are related to the fact that no major reforms took place in Number of requesters Number Number of Number Number of of cases requesters of cases requesters Number of cases Total Regulations / policies (%) 922 (86%) 96 (43%) (96%) 105 (49%) 356 (60%) 62 (34%) 180) As the new tool implemented different categories, we do not have comparable figures from before Number of requesters Number of cases Categories 2016 Career / Promotions / Step advancement / Bonus Salary / Allowances / payments Pensions / Incapacity Leave / working time Disciplinary procedure Staff Committee Rights / Collective rights Investigation / Dignity 4 4 Cigna / LTC 4 4 Transfer / appointment / contract 2 2 Other Total CA/20/17 e 35/98

41 181) Outcome of the CRU CRU outcome Number of requesters Number of cases Number of requesters Number of cases Number of requesters Number of cases Allowed Allowed in part Decision maintained Forwarded to AC Forwarded to MC No action needed / No registration Rejected as irreceivable (in whole or in part) Withdrawn Implied rejection Pending Total (b) Appeals Committee 182) In 2016, it was possible to increase the outcome of the Appeals Committee (ApC) compared with 2015 (increase of approx. 23% of the cases and 167% of appellants). This increase was reached by clustering the hearings according to the topic. 183) Outcome of the ApC ApC outcome Cases Appellants Cases Appellants Cases Appellants Allow Allow in Part Reject Total ) The number of appeals pending before the ApC decreased in 2016 compared to Therefore, the internal backlog decreased. Over the past few years, a positive trend showing the decrease in the backlog could be noted. CA/20/17 e 36/98

42 185) The processing time for the creation of the ApC opinion and the creation of the final decision has not decreased significantly. This is due to the high workload of the Employment Law Department (D 5.3.2) and the creation of the position paper. The number of available staff was decreasing in 2016 (from FTE to FTE). New employees (4 headcount) joined the department in 2016 and six headcounts have left the EPO (seconded, unpaid leave or resigned). This also means that the new staff needed to be trained and a take-over of the tasks needed to be organised. 186) The high workload situation (not only related to internal appeals) and the structure of the contracts (restricted contracts) were mentioned as reasons for this current staff situation within the department. 187) The follow rate for the already taken decisions was 100% (for the cases with a final decision). However, in this table, the number of cases and appellants without a decision are not included. In total 78 cases are currently waiting for the decision. 188) Average processing time In months Appeal Date Position Date Position Date Hearing Hearing ApC opinion ApC Opinion Final Decision by President (9.80) Total Average Time: Appeal Date Final Decision 189) The processing time from the creation of the position paper to the hearing does not really increase. The reason for this increase shown in the table above is related to the fact that the office worked on the oldest cases in 2016 ("cut-the-trail" action cases from were closed). For those cases the Position Paper was already created in Therefore, the total average processing time cannot be compared with the last years. 190) The ApC also provided a calculation of the average length of total procedure including the withdrawals and cases handled within a summary procedure of The average time in 2016 was months. The time needed between the position paper and the recommendation was 9.80 months. CA/20/17 e 37/98

43 (c) Final decision 191) We noted that the number of final decisions taken by the President decreased. The reason for that was the announcement of the ILOAT judgment No on in which the ILOAT found that the ApC's composition in 2015 had not been in accordance with the applicable provisions. As of then, all final decisions were stopped by the President. Outcome Cases Appellants Cases Appellants Cases Appellants Allowed Allowed in part Dismissed Total ILOAT judgments 192) The CRU is mostly impacted by Judgment No on the appointing authority competent to examine a request for review filed against a regulatory decision taken by the Council. Until the delivery of the judgment, these requests were handled by the Administrative Council as the competent reviewing authority. The ILOAT has now ruled that the remaining requests, regardless of the requesters' appointing authority, should be addressed to the President. As a result, the number of cases to be processed by the President (and consequently the CRU) in the management review process will increase. It was decided to withdraw all previous decisions impacted by the judgment. These cases need to be registered by the CRU for the management review process and addressed to the President for the review. 193) Judgment No states that the composition of the Appeals Committee was irregular. There was another judgment in July 2016 (No. 3694) with the same decision. Based on these judgments the President decided to withdraw all decisions taken on internal appeals based on an opinion rendered by the Appeals Committee in a composition considered irregular by the ILOAT. 194) Around 140 cases (with 157 appellants) are affected by this decision. This number may increase if further affected cases will be identified. However, there is also the possibility that an employee decides to withdraw his/her case. 195) In view of this judgment, 73 cases (133 appellants) do not have a final decision from the President yet, as the opinion from the ApC was issued in autumn CA/20/17 e 38/98

44 196) All cases (213 cases with a total number of 290 appellants) will be resubmitted to a newly constituted ApC for a new opinion. So far, no deadline has been defined. 3. IT 3.1. IT roadmap assessment 197) The IT roadmap (CA/46/11) was presented at the Administrative Council's June 2011 meeting and sets out the strategic directions for IT at the EPO. The roadmap has been defined following the financial and IT studies performed by external parties in The IT study identified the risk of delay as a result of aging systems that were no able to cope with rapid change on the longer term. As a result, the Office proposed to start a programme to reassert its position in a changing and increasingly competitive patent market (based upon the efficiency scenario in the financial study). IT roadmap projects are divided into three categories: Stream 1 comprises short-term efficiency projects as well as reengineering of the patent grant process. Stream 2 involves investments designed to improve the efficiency and quality of the tools used by the examiners. Stream 3 mainly deals with new infrastructure. 198) In 2016 two updated reports were provided by the IM Organisation in CA/T 9/16 (June 2016) and CA/T 14/16 (October 2016): The Office is still confident that the IT roadmap can be delivered as approved by the AC in CA/46/11 and CA/46/14 IM is continuously implementing the re-engineered patent-granting process and improving the search tools. 199) A total of 82% of the projects initiated since the start of the IT roadmap are closed (Status closed and closed premature) compared to 70% in Ten new projects were started during 2016 which had not been included as roadmap projects in 2015: three projects are related to stream 1 of the IT roadmap and 7 projects are related to stream ) An overview of outstanding tasks and projects to be implemented by the end of the IT roadmap in 2019 could not be provided. According to IM, the detailed planning of all tasks and projects to be implemented by the end of the IT roadmap is currently being finalised and will be submitted to the executive board in July for validation. For the time being, the EPO is implementing the operational plan validated and updated every year. CA/20/17 e 39/98

45 201) Due to the delay of the reengineered patent grant process based on the CMS platform which had been implemented already in previous years, the IT roadmap will not be completed until end of 2018 as originally planned, but the IM department is confident that the roadmap can be delivered in the course of ) After some delay within the CMS development in 2015 and 1016 due to the change of supplier, development is expected to being done according to the project plan. 203) Based on the proposed IT roadmap budget of EUR 140m, actual spending is at EUR 100m. From a budget perspective, currently 71.3% of the planned budget has been spent. (in EUR '000) ITR MANDATE AUTOMATION CA/46/ docs ALL ACTUALS AUTOMATION PLAN - ACTUALS 2016 AUTOMATION PLAN 2017 AUTOMATION ("draft CA/T 8/16") PLAN 2018 AUTOMATION ("draft CA/T 8/16") ITR AUTOMATION TOTAL ( ) ITR TOTAL Stream Stream Stream Other ) The planned budget for work that has not been executed in 2016 is shifted into the budget planning for A remaining EUR EUR will be shifted in ) The actual costs per project vary, even for years with closed booking periods. The comparison revealed five discrepancies in 2011, 16 in 2012, six in 2013, and seven in 2014 (between EUR 377k and EUR -649k). Explanations had been provided by the IM department for all deviations greater than EUR 200k. 206) According to the actual costs occurred and the planned budget for upcoming years, the IM department is confident of completing the IT roadmap within the agreed budget of EUR 140m. 207) Recommendation: We recommend that costs to a project should be linked strictly to a project and the finance and accounting system to ensure data integrity for all views. 208) The original planned project budget and budget development due to exception reports should be shown in each exception report to provide the development of project budget over time. CA/20/17 e 40/98

46 209) Recommendation: All exception reports should be sequentially numbered IT UNIP project 210) The UNIP project experienced some uncertainty during 2016 until the decision of the British government to ratify the Unified Patent Court Agreement in spring It was then decided to have the activation phase included again in the current UNIP project and to finish the activation phase by 5 July 2017 to support the Unitary Patent Process (UPP). The project is planned to finish in December 2017 after guarantee period and closure phase had been finished. 211) Several exception reports had been published to follow up on the political decisions. Exception reports are stored in the documentation repository based on Lotus Notes database Babylon as described in the Project Management Handbook. 212) These decisions are taken by the Programme Operational Board and communicated to the Executive Board (chaired by the President, with VP1 VP2, VP5 and the CIO). The project is also reporting to the UPP board acting at office-wide level chaired by VP5 with all bodies represented. 213) The UNIP project (P525) product breakdown structure lists 56 products which are managed in the phases "Requirements A", "Design Specification B", "Development Packages C", "Testing D" and "Handover E". According to the project manager all products except five have been completed in the "Development Packages B" phase. A sample testing showed that required documentation could be provided for these products. The IM department is confident to finish the implementation in the time agreed. 214) We noted that the total project budget increased from EUR to EUR (exception report dated 6 November 2016) and then to EUR (exception report dated 19 January 2017). That is a total increase of EUR (29%) since March 2016, which has been explained in the exception report of November 2016 due to new requirements by business Decommission of legacy systems 215) As a result of the development of the IT roadmap, some processes and applications will be transferred to new technologies and new systems are developed. Formerly used legacy systems will then become obsolete in future and a decommissioning strategy for these systems needs to be defined. CA/20/17 e 41/98

47 216) Decommissioning of legacy system has not yet been addressed by the EPO, as these systems need to run for additional years to support the current patent grant process. 217) According to the IM department a decommissioning strategy will be evaluated in 2019 as the current focus is on the delivery of the new platform to complete the e2e digitalisation. This needs to be ready before IM has the resources available to establish the plan for decommissioning. Currently no urgent need for decommissioning of systems has been identified because all systems are needed for the coming years. It is planned to establish a decommissioning strategy in 2018/ ) Recommendation: We recommend that a decommissioning and archiving strategy should be defined to ensure that legal requirements for data retention can be met in future IT incident management 219) The EPO incident management procedure describes the handling, follow-up and escalation procedures of incidents. The supporting documentation provides a clear description of incident classifications, roles and responsibilities. 220) Incidents are clustered in five urgency categories and a response time has been defined for each category. A tool (iet) is used to track all incidents and to support the complete incident management process from registration until close down. 221) During the audit a sample of "uncritical" incidents (Cat 4 or 5) was reviewed and evaluated as to whether the chosen category is plausible. Our audit showed no discrepancy. Additionally a sample of incidents was reviewed as to whether they had been addressed in time. No deviations were noted. The IT incident management procedure appears to be relevant and correctly managed IT risk management 222) For each project initiated within the automation governance at the EPO, the Information Security department provides support during the project initiation phase for managing the security risks and evaluating potential impacts and risks. If necessary, Risk Management will support the Information Security department throughout the whole project. CA/20/17 e 42/98

48 223) Risks are defined based on experience and knowledge of the staff from the IM Security department. A formal definition of risk evaluation has not been issued. At time of the audit 129 IT risks and 45 operational risks had been identified, and each risk has been assigned to a risk owner. 224) A security project has been issued in 2016 as part of the IT roadmap, whose goal is to bring Information Security into line with the ISO27001 standard. 225) Even the IM information security team is involved in every project within the automation governance at EPO we noted that currently no strict link is existing to an EPO overall risk management (business risks) as this is not known by IM. 226) A security project had been finished in 2016 as part of the IT roadmap. Goal of the project was to bring Information Security into line with the ISO27001 standard. 227) Currently the Office is not in the ISO27001 certification process, but this process is planned to start in ) Recommendation: a. We recommend that a clear risk evaluation procedure and documented risk rating should be defined to make the risk management more transparent and traceable and to ensure that fund decisions are made. b. We recommend using a standardised framework such as COSO or CoBIT to structure risk and controls. This would ensure that all relevant domains and risks are covered. c. We recommend that risks should be registered and managed by using one tool to avoid double work and to ensure a complete overview. d. We recommend that a systematic approach should be implemented by the Organisation-wide risk management to establish a direct reporting line from IM risk management and to ensure that IM is informed about business risks in a timely manner. CA/20/17 e 43/98

49 4. BUILDING PROJECTS 4.1. Building investments in The Hague (a) Project organisation 229) The general project organisation remained unchanged but not the composition of the project team. This is caused by retirement and personal situations. Currently, besides the project manager, there is only one team member who has been working on the project from the beginning. The project team is aware of the risk that changes in the project team can affect the project and this issue is part of the risk evaluation. 230) The organisation is as follows: 231) Continuity and sufficient staffing is essential for the project. Because the project is in an important phase and due to the complexity of the project it is important for the project team to have the team member's workload in mind to consider a staff increase if necessary. 232) The project is still regularly audited by an external Quality Assurance (Ernst & Young, latest report: 01/2017). The internal project manager has postponed his retirement and will stay until mid-2018 (completion of the new building) but will retire before the end of the project. There is currently no succession plan for this function. In order to handle future claims and determine variation orders financial impact it is important the ensure continuity of the knowledge until the end, which is after the planned retirement of the current project manager. 233) Recommendation: We recommend ensuring a timely transfer of knowledge from the current EPO project manager CA/20/17 e 44/98