1. Regional Policy FRAUD RISK ASSESSMENT AND MANAGEMENT Article 125.4 c) CPR ESIF 2014-2020 Rafael López Sánchez, Deputy Head of Unit C.1 DG Regional and Urban Policy 1

2. Regional Policy Unduly paid amounts must always be corrected Irregularity (cf. Article 2(36) CPR) Fraud suspicion (must be reported to OLAF) Fraud (adjudication by competent court) 2

3. Regional Policy Irregularities, fraud suspicions and fraud - an irregularity is non-intentional whereas fraud is committed intentionally - only a competent judicial authority can qualify suspected fraud as a case of fraud - fraud is often backed up by a meticulously premeditated scheme and may involve collusion with (corrupt) insiders - fraud and corrupt payments to facilitate the fraud may also be linked to organised crime 3

4. Regional Policy Member States' IMS reporting to OLAF on fraudulent irregularities in Cohesion Policy under 2007-2013 Regulations Number of cases EU amount (EUR) Fraud suspicions 621 604.000.000 Established fraud cases 75 13.800.000 4

5. Regional Policy Estimated financial impact of fraud (source: Member States' regulatory reporting in the IMS database) Year Volume of suspected fraud cases as % of Cohesion Policy payments in the year 20110,4% 20120,42% 20130,27% 5

6. Regional Policy How can the COM and MS work together to reduce fraud risks? - common effort to be shared between COM and Member States: COM guidance, exchange of tools, methods and best practices - the aim should be cost-effective measures to seek to mitigate economic and reputational risk of fraud 6

7. Regional Policy Why zero tolerance to fraud in ESIF? FINANCIAL RISKREPUTATIONAL RISK OPERATIONAL OBJECTIVES AT RISK 7

8. Regional Policy Recent COM proposals Proposal (COM(2012)363: Directive on fight against EU Budget crimes.  +/- identical fraud definition as in 1995 Convention  Minimum sanctions across EU proposed Proposal COM(2013)534: European Public Prosecutors Office (EPPO)  Prosecution competence for EU crimes 8

9. Regional Policy Articles 72 h) and 122 CPR MCS must prevent, detect, correct and report irregularities and fraud Article 125.4 c) CPR The MA puts in place effective and proportionate anti- fraud measures, taking into account the risks identified 9

10. Regional Policy Anti-fraud requirements in Article 125.4 c) of Regulation 1303/2013 10 "As regards the financial management and control of the operational programme, the managing authority shall put in place effective and proportionate anti-fraud measures taking into account the risks identified"

11. Regional Policy Underlying objectives of Article 125.4 c) - seek to reduce potential economic cost of fraud to both EU and national budgets - seek to reduce potential reputational cost of fraud to both EU institutions and national administrations - contribute to the objective that ESI funds are used for their intended purposes 11

12. Regional Policy Which authorities are involved? Managing authorities 1) Put in place a minimum set of effective and proportionate anti-fraud measures 2) Carry out a fraud risk assessment (self- assessment) Audit authorities 3) Verify whether the MA's fraud risk assessment is credible and provides a true and fair assessment of the risks and verify that adequate anti-fraud measures are in place to mitigate against the risks 12

13. Regional Policy Main tools suggested by the COM 1) Guidance on effective and proportionate anti- fraud measures containing a basic fraud risk assessment tool (Excel-based) 2) The specific risk scoring tool Arachne which the COM considers helpful to identify potentially risky operations 13

14. Regional Policy Recommendations for implementation of Article 125.4 c) CPR 14 COM Guidance: EGESIF_14-0021-00 16/06/2014 (in all languages on InfoRegio) 1st step: Fraud Risk Assessment Designation of authorities: procedures are in place Each year or every 2 nd year a new fraud risk assessment 2 nd step: Effective and proportionate anti-fraud measures Result of fraud risk assessment determines the intensity

15. Regional Policy MA's fraud risk assessment: COM recommendations Who: Self-assessment team (MA, …). Risk assessment results to be approved by MA senior management. When: - At designation - During programming period, annually or every second year How: - Assess the degree of fraud risk exposure in relation to 3 key processes: 1) selection of operations, 2) implementation and 3) certification and payments -When net risk (=residual risk) after controls is not assessed as tolerable, further risk mitigation is needed 15

16. Regional Policy Checks on MAs' compliance with 125.4 c) by the AA (or independent body) When: - Opinion of independent body at designation (Article 124.2 CPR) - During programming period, in connection with system audits or specialised anti-fraud audits How: - Checklist in Guidance for Member States on Designation Procedure (EGESIF_14-0013-final 18/12/2014) - Template checklist for audit authorities in EGESIF_14-0021-00 of 16/6/2014 (Annex 4) 16

17. Regional Policy Structure of the guidance note on fraud risk assessment 1) Main guidance note 2) Fraud risk assessment tool (Annex 1) 3) Detailed manual for the tool (Annex 1) 4) List of recommended mitigating controls (Annex 2) 5) Template for anti-fraud policy statement (Annex 3) 6) Template for checklist for audit authorities (Annex 4) 17

18. Regional Policy Interpretation of 'effective anti-fraud measures' applied in the guidance 1) the management and control system is effective when it complies with all EU and national rules and provides a sufficient degree of protection against fraud 2) the MA assesses the potential impact and likelihood of any known specific fraud risks and seeks to mitigate such risks 3) the audit authority reviews the effectiveness of the management and control system, the fraud risk assessment of the MA and the anti-fraud measures the MA has put in place 18

19. Regional Policy Interpretation of 'proportionate anti- fraud measures' applied in the guidance 1) the anti-fraud measures the MA puts in place should be proportionate to the fraud risks identified by the managing authority during its self-assessment 2) the overall benefit of any additional anti-fraud measures should exceed their overall costs 3) proportionate also means that any additional administrative burden stemming from Article 125(4) c should be reduced to a minimum 19

20. Regional Policy User-friendly fraud risk assessment tool 1)1) Excel-based tool with automatic risk scoring 2)2) Step-by-step manual in Annex 1 3)3) Classic risk assessment logic is used: assessment of impact and likelihood of specific fraud risks occurring 4)4) To help in the identification of risks, the tool has been pre-filled with 18 specific fraud risks (based on COM and MS experience of fraudsters’ modus operandi in Cohesion Policy and commonly recognised and recurring fraud schemes) 20

21. Regional Policy User-friendly fraud risk assessment tool 5) Simplification: when the MA concludes that it is not exposed to a particular fraud risk, there is no need to assess that risk, only indicate why a given risk is not relevant 6) Simplification: subsequent risk assessment in e g 2017, 2019 etc can be done as updates of the first risk assessment made e g in 2015 7) The Commission provides further training and advice on request on the use of the tool 21

22. Regional Policy 22

23. Regional Policy Anti-fraud cycle EFFECTIVE PREVENTION ADDITIONAL DETECTIVE EFFORTS CORRECTION OF IRREGULAR AMOUNTS PROSECUTE AS RELEVANT 23

24. Regional Policy Fraud prevention - a robust control system is key - raise awareness internally and externally about preventative and detective controls - state the anti-fraud policy visibly: DETER FRAUDSTERS - template for anti-fraud policy in the guidance (Annex 3) 24

25. Regional Policy Fraud detection - preventative techniques cannot provide absolute protection against fraud - recommendation to complement the risk assessment with data mining tools (the ARACHNE risk scoring tool is offered by the Commission) - embed fraud indicators in checklists (red flags) 25

26. Regional Policy Investigation, correction and prosecution - refer cases for investigation in accordance with internal and EU requirements (report to national competent body and OLAF) - recover affected amounts after known financial impact and reimburse to the EU budget - criminal prosecution under national criminal law 26

27. Regional Policy Fraud reporting mechanisms - mechanisms should facilitate the reporting of both suspicions of fraud and control weaknesses that may increase the MA's susceptibility to fraud - sufficient coordination on anti-fraud matters with the audit authority and competent investigative authorities in the Member State, including anti- corruption authorities 27

28. Regional Policy Communication and training about reporting mechanisms must ensure that staff - understand where they should report suspicions of fraudulent behaviour or control weaknesses - are confident that they can report in confidence and that the organisation does not tolerate retaliation against any staff member who reports suspicions (whistle-blower protection) 28

29. Regional Policy Why did the fraud case occur? Learn the lessons! Objective and self-critical examination which should result in clear conclusions about perceived weaknesses and lessons learned, with clear remedial actions as necessary, responsible individuals and deadlines 29

30. Regional Policy The tool focuses on fraud risks in relation to three key processes 1) Selection of applicants 2) Implementation and verification of the operations (including public procurement-related fraud risks) 3) Certification and payments 30

31. Regional Policy Assess and mitigate against e g the following specific fraud risks - Undisclosed conflict of interest, bribes and kickbacks at project selection stage - Deliberate avoidance of competitive procedures in public procurement (e g unjustified single source award) - Manipulation of public procurement procedures (e g rigged specifications) - Collusive bidding - False or inflated invoices 31

32. Regional Policy Basic steps in the fraud risk assessment 1) assess the ‘gross’ risk (= impact x likelihood) of specific pre-identified risks occurring under each of the three key processes (and any other identified risks) 2) identify and assess the effectiveness of controls already in place to mitigate against the identified specific fraud risks 3) assess the net risk 4) as necessary, put in place any further mitigating controls in order to reach a tolerable risk level 32

33. Regional Policy Audit authorities' verification of the fraud risk assessment during 2014- 2020 - in connection with audits on the functioning of the management and control systems, the audit authority should carry out verifications of the effective implementation of the anti-fraud measures by the MA as early as possible in the programming period. - depending on the results of such audits and on the identified fraud risk environment, follow-up audits may be carried out as often as necessary 33

34. Regional Policy Controls by Commission auditors When: - At designation - During programming period (+ audits on this topic by the European Court of Auditors?) 34

35. Regional Policy QUESTIONS AND ANSWERS 35