EUROPEAN COMMISSION Directorate-General for Development and Cooperation EuropeAid Resources in Headquarters and in Delegations Audit and Control AUDIT OF EXTERNAL OPERATIONS PILLAR ASSESSMENTS CONTRACTED BY ENTITIES REQUESTING TO BE ENTRUSTED WITH IMPLEMENTATION OF THE EU BUDGET UNDER INDIRECT MANAGEMENT GUIDANCE NOTE Service: DEVCO.R2 Audit and Control Date: November 2013 TABLE OF CONTENTS INTRODUCTION... 2 1 RESPONSIBILITIES OF THE ENTITY AND MAIN REQUIREMENTS... 3 2 PREPARATORY PHASE... 4 3 PLANNING AND CONDUCT... 5 4 REPORTING... 6 5 FOLLOW-UP... 6
Introduction Context Article 58 of the Financial Regulation ('FR') applicable to the General Budget of the European Union ('EU') sets out the methods of implementation of the budget including 'indirect management'. Under indirect management the Commission can entrust budget implementation tasks to the countries, organisations and bodies (further referred to as 'Entities') indicated in Article 58 of the FR. The following Entities may be concerned: - Third countries or the bodies they have designated. Example: Ministry of Interior, Kingdom of Cambodia; - International organisations and their agencies. Example: UNDP (United Nations development Programme); - Public law bodies. Examples: DFID, KfW; - Bodies governed by private law with a public service mission to the extent that they provide adequate financial guarantees. Example: British Council. These Entities shall guarantee a level of protection of the financial interests of the EU equivalent to that required under the FR when they manage EU funds. They must meet requirements with regard to seven 'Pillars' relating to the internal control system, the accounting system, an independent external audit and rules and procedures for providing financing from EU funds through grants, procurement and financial instruments and Sub-Delegation. Hence, Entities wishing to work with EU funds under the indirect management mode must therefore be made subject to a comprehensive Pillar Assessment. Based on the results of the Pillar Assessment the Commission will decide whether it can entrust budget implementation tasks to the Entity and whether it can conclude specific agreements (i.e. Indirect Delegation Agreements) with the Entity. The purpose of this paper is to provide guidance and support for the management of Pillar Assessments contracted by Entities requesting to be entrusted with implementation of the EU Budget under Indirect. These entities will be referred to as the 'Entity' throughout this document. This guidance relates to the terms of reference ('ToR') for a Pillar Assessments contracted by an Entity requesting to be entrusted with implementation of the EU budget under indirect management. These ToR are distinctively different from the ToR for a Pillar Assessments contracted by the European Commission. Questions on aspects of the management of Pillar Assessments, terms of reference, reporting issues etc. can be addressed to the Audit and Control Unit of EuropeAid (DEVCO.R2). Key contacts: Ms Cristiana Bessa Mr Willy Swartjes Cristiana.LIMA-DA-ROCHA-BESSA@ec.europa.eu; or Willy.swartjes@ec.europa.eu 2
1 Responsibilities of the Entity and Main Requirements Independent Auditor The Entity must contract an independent external Auditor to perform the Pillar Assessment. The Auditor must be an independent external auditor who is a registered member of a national accounting or auditing body or institution which in turn is member of the International Federation of Accountants (IFAC) and who is certified to perform (statutory) audits. The Auditor must be functionally independent of the Entity concerned and hence the Internal Auditor of an Entity subject to assessment is not eligible to perform a Pillar Assessment. The Entity may want to contract an audit firm which has signed an Audit Framework with the Commission. This has some distinct advantages. First, these audit firms are international professional audit firms of an established reputation. They have signed an Audit Framework Contract with the Commission and this means that they have been subject to a comprehensive evaluation procedure. Moreover, most audit firms have extensive experience with performing audits and audit related engagements for Commission services and EU Delegations. This means that they have a good knowledge of Commission procedures and rules as well as of the external aid context in which the Commission operates. Finally, some audit firms already performed Pillar Assessments for the Commission. Using these audit firms is not compulsory but recommended. Terms of Reference The use of the Terms of Reference (ToR) for a Pillar Assessment contracted by an Entity requesting to be entrusted with implementation of the EU budget under indirect management including its (technical) annexes is compulsory. Start of the Pillar Assessment Entities shall inform DEVCO.R2 if they plan to start and contract a Pillar Assessment and send a copy of the completed ToR (basic document and Annex 1) to DEVCO.R2 if so requested. Provide information and access to staff of the Entity It is the responsibility of the Entity to provide all information deemed necessary or relevant by the Auditor to perform the Pillar assessment and to ensure access to relevant staff. Draft Pillar Assessment report The Entity shall send a copy of the draft Pillar Assessment Report to the European Commission (i.e. the Commission service concerned at EuropeAid or a EU Delegation) to allow the Commission to comment on the draft report. Final Pillar Assessment report The Entity shall send a copy of the final Pillar Assessment Report to e European Commission (i.e. the Commission service concerned at EuropeAid or a EU Delegation) and to DEVCO.R2. 3
2 Preparatory Phase Terms of reference The use of the standard model ToR and annexes for Pillar Assessments is compulsory. These ToR consist of: - A basic ToR document setting out the main conditions - Annex 1 Engagement Context Key Information for a Pillar Assessment - Annex 2 Assessment Questionnaire and Criteria - Annex 2a Assessment Questionnaire (indicative questions) - Annex 3 Other Questions - Annex 4 Assessment Procedures - Annex 5 Pillar Assessment Report Entities can remove, adapt or replace text where this is indicated or requested i.e. where engagement specific information needs to be completed or where certain options are provided. Refer to: http://myintracomm.ec.europa.eu/dg/devco/finance-contracts-legal/audit/pages/audit-framework-contracts.aspx The format, structure and prescribed wording of the ToR must be respected at all times and not be removed or changed. INSTRUCTIONS FOR USING THE ToR All grey shaded text in <italics> is guidance which should be removed. All text in [ ] should be completed. The prescribed text and wording of these Terms of Reference should be respected at all times and cannot be changed. 4
Other specific aspects of the preparatory phase Use of Annex 1 - Engagement Context Key Information for a Pillar Assessment Entities must complete Annex 1 so that Auditors can obtain a preliminary understanding of the engagement which is sufficient for submitting a meaningful offer to the Commission. The Entity must provide a duly completed Annex 1 for the Pillar Assessment along with the terms of reference to the Auditors / Contractors to whom the Entity sends a request for an offer to perform the Pillar assessment. Use of Annex 2a - Assessment Questionnaire (indicative questions) In a first phase the Entity must complete relevant questions in Annex 2a in order to submit a completed Annex 2a Questionnaire to the Auditor / Contractor contracted by the Entity to perform the Pillar assessment. This will help the Auditor to properly prepare and plan the assessment and it will substantially facilitate the performance of the assessment procedures. Attention: The Entity is requested to complete questions indicated with 'to be completed by Entity, 'TBCBE'. Key questions must only be completed by the Auditor based on his / her professional judgment and the assessment procedures and tests performed. The Entity will provide a completed Annex 2a questionnaire to the Auditor / Contractor as soon as possible after the Auditor has been contracted by the Entity but prior to the start of the Auditors' assessment procedures In a second phase Annex 2a will become a support tool for the Auditor to design, plan and perform the assessment procedures and to take into account the criteria which the European Commission deems essential or important for the Entity subject to assessment to comply with. The Auditor uses the information in the Annex 2a Questionnaire and the results of the assessment procedures to complete Annex 2 Assessment Questionnaire and Criteria and to draw a conclusion for each pillar subject to assessment. 3 Planning and Conduct There are no specific aspects for the planning and conduct phase. The Entity can make the arrangements it deems necessary to communicate with the Auditor and to monitor the work of the Auditor during the planning and conduct phase of the engagement. 5
4 Reporting There are no specific aspects for the reporting phase. The Entity can make the arrangements it deems necessary for communicating with the Auditor and for reviewing the draft and final assessment report issued by the Auditor. Entities are informed that for audits and similar engagements contracted by European Commission services the period between the closing meeting of the Entity and the Auditor and the submission by the Auditor of the final report to the Commission does normally not exceed 98 calendar days or 14 weeks. The Entity must send a copy of the final Pillar Assessment Report to DEVCO.R2. 5 Follow-up Recommendations and action plan in the Pillar Assessment Report In the Pillar Assessment report the Auditor provides conclusions (Pillar compliant YES or NO) as well as critical recommendations and a roadmap for the Entity to remedy any material i.e. important pillar deficiencies in systems, controls, rules and procedures in order to become compliant with the Pillar. The Entity must implement the measures proposed in the Auditor's assessment report and this will be subject to re-assessment by the Auditor at a later stage. When the Entity considers that the measures have been introduced, it may arrange for a re-assessment of the Pillar(s) concerned. Such a re-assessment must cover a re-assessment of the Pillar for which the Entity was initially not compliant and an update assessment of the Pillars for which the Entity was initially found to be compliant. Other mitigating measures Article 60.1.c of the Financial Regulation applicable to the General Budget of the European Union provides that the Commission can take measures to supervise and support the implementation of the tasks entrusted to the Entity. In practice this means that the Commission's Authorising Officer may request the Entity to apart from the recommendations made by the Auditor in the Pillar Assessment report implement certain mitigating measures which allow the Commission to entrust implementation tasks to the Entity even if the Entity is not or not yet fully compliant with a specific Pillar. Such conditions must be specified and included in agreements (i.e. Indirect Delegation Agreements) that the Commission concludes with the Entity for the implementation of specific programmes, projects or actions. A typical example could be that the Authorising Officer would require from the Entity to apply PRAG procedures in case the Entity is not compliant with the procurement Pillar or to require a programme estimates framework. These additional measures should make it possible for the Commission and the Entity to cooperate under the indirect management mode rather than having a (temporary) total suspension of cooperation. 6