1. EN DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION Luxembourg, 21 - 22 May 2007 Risk assessment and planning Workshop on the new regulations for 2007-2013 European Court of auditors Workshop on the new regulations for 2007-2013 European Court of auditors Aderito Pinto

2. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 2 Luxembourg, 21 - 22 May 2007 Risk Assessment & Planning  Introduction  1 Risk assessment - Why, Who, When  2 Risk identification – What  3 Example of risk assessment – How  4. Risk assessment in the framework of operations  Conclusion

3. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 3 Luxembourg, 21 - 22 May 2007 1. Risk assessment – Why ?  Basis for the audit strategy  Mitigate the risks ASAP  Increase audit efficiency  Prioritise systems audit work  Select complementary sample?

4. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 4 Luxembourg, 21 - 22 May 2007 1. Risk assessment – Why ? (Legal Basis) Foreseen by Comm. Reg. 1828/2006 1)Annex V on Audit Strategy (planning systems audits) 2)Art. 17-5 (sampling) « The audit authority shall decide on the basis of professional judgement whether it is necessary to audit a complementary sample of additional operations in order to take account of specific risk factors… »

5. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 5 Luxembourg, 21 - 22 May 2007 1. Risk assessment – Why (legal basis) Annex V of Reg. 1828/2006: Model Audit Strategy under Article 62(1)(c) of Regulation (EC) No 1083/2006 –AUDIT APPROACH AND PRIORITIES “Explanation of the linkage of the risk assessment (RA) results to the audit work planned.” –RISK ASSESSMENT : Indication of procedures followed for the risk assessment take into account previous audits bodies covered risk factors taken into account, including any horizontal issues Results: identification and prioritisation of the key bodies, processes, controls and programmes and priority axes to audit

6. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 6 Luxembourg, 21 - 22 May 2007 1. Risk Assessment – Who ?  Audit Authority (AA) itself: it has to « ensure that audits are carried out» ( Article 62 -1 a) of Council Reg. 1083/2006 )  Audit Bodies doing system audits for AA  In all cases the bodies in charge of the Risk Assessment should have functional independence from assessed systems.

7. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 7 Luxembourg, 21 - 22 May 2007 1. Risk Assessment – When ? Approval of OP (e.g. 1/09/07) Audit Strategy Systems descriptions & compliance assessment 9 months (e.g. 1/06/08) 9 months (e.g. 1/06/08) Risk assessment Risk assessment- review 12 months (e.g. 1/09/08) 12 months (e.g. 1/09/08) 31/12/08 First annual control report & opinion

8. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 8 Luxembourg, 21 - 22 May 2007 2. Risk identification - What? OPs, priority axis, processes and controls… Key bodies: Certifying Authority / Managing Authority / Intermediate Bodies Key risk factors? Inherent / Control (Detection risk, any horizontal risk)

9. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 9 Luxembourg, 21 - 22 May 2007 2. Type of risks and key definitions 1.Inherent risks 2.Control risks 3.Probability of occurrence (likelihood) and its effect (impact) 4.Detection risk / Audit risk

10. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 10 Luxembourg, 21 - 22 May 2007 2. 1 Inherent risks (IR) Definition: “Inherent risk is the risk related to the nature of the activities, operations and management structures that errors or failures in financial management will occur which, if not prevent or detected and corrected by internal control procedures, will cause the accounts* to be unreliable, the underlying transactions to be materially illegal or irregular or financial management to be unsound.” (ISA 200)

11. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 11 Luxembourg, 21 - 22 May 2007 2. 1 SF DGs experience  Inherent risks (1/2) –Management reputation and turnover (at FB level) –high volume of ERDF financing and high co- financing rate for certain systems, –pressure to declare expenditure to avoid de- commitment under N+2 rule, –public works operations creating risk for compliance with procurement rules, –the type of final beneficiary/final recipient - for example, public or private; well-established or newly-formed; –…–…

12. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 12 Luxembourg, 21 - 22 May 2007 2. 1 SF DGs experience  Inherent risks (2/2) –operations involving private sector financing mechanisms such as VCF*, loans or interest subsidies, –operations involving non-tangible outputs, –revenue generating investments. –the type of measure/operation - for example global grants –…–…

13. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 13 Luxembourg, 21 - 22 May 2007 2. 2 Control Risk (CR) Definition: “ Control risk is the risk that internal control procedures will fail to prevent or detect and correct on a timely basis material errors or material failures in financial management.” (ISA 200)

14. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 14 Luxembourg, 21 - 22 May 2007 2. 2 SF DGs experience  Control risks (1/2) –high level of de-centralisation or complexity in systems with large number of intermediate bodies, –relative inexperience in managing and controlling Community funds –delay in operation of accounting systems/monitoring system. –…–…

15. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 15 Luxembourg, 21 - 22 May 2007 2. 2 SF DGs experience  Control risks (2/2) –inadequate staffing in MA/CA/IB/AA/audit bodies does not provide assurance of effective controls, –possible lack of independence of bodies performing the systems and expenditure audits –possibility that controls/audit work are not sufficient to prevent or detect errors and irregularities (insufficient quality, deficiencies in methodology, insufficient coverage etc.)

16. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 16 Luxembourg, 21 - 22 May 2007 2. 3 Occurrence and effect  Probability/likelihood: frequency of observations concerning each risky area (minor/medium/high, or % age);  Effect/impact: In Monetary Value  Risk points = Effect * Probability

17. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 17 Luxembourg, 21 - 22 May 2007 2. 4 Detection Risk / Audit Risk / Materiality -Detection risk: risk that the auditors’ substantive procedures (audits of operations) will not detect any misstatements that occur… -Audit risk: Risk of delivering an unqualified opinion on cases featuring materially significant errors… (IR x CR x DR) (See presentation on sampling)

18. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 18 Luxembourg, 21 - 22 May 2007 3. Example of a risk assessment for system audits (How) Risk assessment in 4 phases: 1.Identify sub-systems i.e. systems applying the same key controls. This could be at the level of OPs, priority (e.g. TA), organisation, “group of projects”… Use the existing information (compliance assessment, previous system audits, result of sample checks…) 2. Identify risk factors (inherent and control risks) 3. Quantify the risk giving a score (qualitative or quantitative) resulting from the relative weight of each factor. (option in adjusted monetary value) 4. Results of the risk assessment

19. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 19 Luxembourg, 21 - 22 May 2007 3.1. Identification of sub system Example 1: Risk Assessment – Sub-system – Axis STAGE 1 Select Priority Axis Operational Programme Axis 1Axis 2 Organisation 1 Organisation 2 Group of Projects 1 Group of Projects 2 Group of Projects 3 Organisation 3 Axis 3 Group of projects = old «measures »

20. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 20 Luxembourg, 21 - 22 May 2007 3.1.Identification of sub system Example 2: Risk Assessment – Sub-system - Organisation STAGE 1 Select Axis STAGE 2 Select Sub system / Organisation(s) Operational Programme Axis 1Axis 2 Organisation 1 Organisation 2 Group of Projects 1 Group of Projects 2 Group of Projects 3 Organisation 3 Axis 3

21. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 21 Luxembourg, 21 - 22 May 2007 3.1. Identification of sub system Example 3: Risk Assessment – Sub-system – group of projects STAGE 1 Select Axis STAGE 2 Select Sub system / Organisation(s) STAGE 3 Select Group of Project (s) Operational Programme Axis 1Axis 2 Organisation 1 Organisation 2 Group of Projects 1 Group of Projects 2 Group of Projects 3 Organisation 3 Axis 3

22. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 22 Luxembourg, 21 - 22 May 2007 European Commission – Structural Funds Ministry of Finance – MANAGING AUTHORITY ESFERDFEAGGFFIFG Ministry of LabourMinistry of the InteriorMinistry of Agriculture and Forestry Ministry of Labour Min.of Trade & Industry Ministry of Agriculture & Forestry Ministry of the Interior Ministry of Social Affairs and Health Ministry of Envrnmt Ministry of Transport & Communication Ministry of Education Regional Administration Authorities PROJECTS Example 4 - Complexity ? 3.1. Identification of sub system Example 4 - Complexity ?

23. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 23 Luxembourg, 21 - 22 May 2007 3.2 Risk assessment – Risk factors  Risk factors at priority axis level : Quality of Financial reporting Number of layers Financial indicators & size (claimed expenditure, budget, aid intensity, etc) Type of Intermediate bodies Type of projects Type of Final beneficiaries Aid scheme / SMEs …

24. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 24 Luxembourg, 21 - 22 May 2007 3.2. Risk Assessment – Risk factors  Risk factors at “Organisation” level : Documented procedure (manuals, flowchart…) Competence of Staff Staff turnover Workload / staff member Previous Art.13 of Comm. Reg. 1828/2006 management verifications Organisation –newly formed / well established Previous reported errors (audits…) …

25. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 25 Luxembourg, 21 - 22 May 2007 3.3 Risk Assessment – Quantify the Risk factors 1.Score each factor ( e.g. on a scale from low risk to high risk (1 to 5)) 2.Weight each factor (e.g. First – level check (Art. 13 R.1828/06) higher weighted than second level check (Art. 16 R.1828/06) 3.Quantify (option: in Monetary terms)

26. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 26 Luxembourg, 21 - 22 May 2007 3.3 Quantify the risk Example: At “Organisation” level KEY RISK FACTORS LOW 1 2 MEDIUM 3 4 HIGH 5 SCORE Documented procedures 1 1 Competence of staff & experience 3 9 Staff turnover 2 4 Workload/staff 3 3 Previous reported errors 3 3 TOTAL SCORE (MAX. 40) 20 SCORE % (divide by 40) 50% MONETARY VALUE OF “Body” (€) €200m RISK ADJUSTED MONETARY VALUE (€) €100m 1 3 2 1 1 Weight Factor

27. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 27 Luxembourg, 21 - 22 May 2007 BodyRisk % (1) Value (2) % of total Risk value (3)=(1)*(2) Ranking IB130%50061%1501 IB250%20025%1002 IB340%10012%403 IB490%202%184 Total820100%308 3.4. Indicative results of a risk assessment - example

28. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 28 Luxembourg, 21 - 22 May 2007 3.4. Indicative results of a risk assessment - example  To audit regularly:  Managing Authority / Certifying Authority (based on professional judgment)  Some Intermediate Bodies (selected based on Risk assessment)  Spread along programming period:  Other audits in order to ensure sufficient coverage and increase benefits from timely audit recommendations  Thematic audits / Follow-up audits

29. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 29 Luxembourg, 21 - 22 May 2007 3.4. Results of a risk assessment – example – cont.  Planning will take into consideration:  Duration of each Systems audit  Coordination with audits of operations  Needed Human and Financial resources  Various practical contingencies (coordination with other control bodies…)  Keep in mind the objective (Annual control report / Annual opinion)

30. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 30 Luxembourg, 21 - 22 May 2007 4. Risk assessment in the framework of operations  Risk assessment is not longer the basis of the selection of the operations.  Period 2007-2013: Random statistical sampling  Why ? In order to conclude on the overall population and on the actual functioning of the system (see presentation on sampling)

31. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 31 Luxembourg, 21 - 22 May 2007 4. Risk assessment in the framework of operations  Basis for selection of complementary sample ? –Review the coverage provided by the random sample –Professional judgement Could also apply a similar approach at project level (if feasible)

32. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 32 Luxembourg, 21 - 22 May 2007 Conclusions  Link with – Strategy (Art. 62 1 c) of R. 1083/2006), – Annual control report (Art. 62 1 d) (i) of R. 1083/2006), – Annual Audit opinion ( Art. 62 1 d) (ii) of R. 1083/2006),  Link Winding-up /closure declaration

33. DG Regional Policy & DG Employment, Social Affairs & Equal Opportunities EUROPEAN COMMISSION EN Risk assessment and planning 33 Luxembourg, 21 - 22 May 2007 Conclusions  Risk assessment a tool for selecting systems/sub-systems /organisations to be audited  Shouldn’t Risk assessment be used also for defining the scope of the system audits to be carried out ?  Questions ?