Paul DE SPIEGELEER Administrator Budgetary & Financial Affairs, Humanitarian aid department (ECHO), European Commission

HOOFDSTUK 3 AUDIT VAN NGO-PROJECTEN GEFINANCIERD DOOR DE EUROPESE UNIE CHAPITRE 3 L AUDIT DES PROJETS ONG FINANCES PAR L UNION EUROPEENNE Paul DE SPIEGELEER Administrator Budgetary & Financial Affairs, Humanitarian aid department (ECHO), European Commission Willy SWARTJES Auditor EuropeAiD Audit of External Operations (AIDCO), European Commission

Executive summary (NL) In 2007 bedroeg het totale bedrag aan financiële steun voor extern beleid van de Europese Commissie bijna 11 miljard euro (op verplichtingenbasis). Deze financiële steun was bestemd voor de ontwikkeling van en steun aan meer dan 160 landen, gebieden en organisaties over de gehele wereld en vertegenwoordigde ruim 8 % van de totale Gemeenschapsbegroting (inclusief middelen voor het Europees Ontwikkelingsfonds). Van de totale financiële steun in 2007 werd ongeveer 8 miljard euro beheerd door EuropeAid en ongeveer 1 miljard euro door het Directoraat-generaal Humanitaire hulp. De officiële ontwikkelings- en humanitaire hulp van de EU - Lidstaten plus Commissie - vertegenwoordigt zo'n 60 % van de mondiale ontwikkelingshulp. De Europese Commissie beheert ongeveer 20 % van de mondiale steun. 1. Directoraat-generaal Humanitaire hulp (DG ECHO) Het Directoraat-generaal Humanitaire hulp (DG ECHO) is verantwoordelijk voor het verstrekken van noodhulp aan de slachtoffers van conflicten en natuurrampen ten behoeve van de bevolking van derde landen, met name de meest kwetsbare groepen en bij voorrang in de ontwikkelingslanden. Voor de uitvoering van deze taak doet DG ECHO beroep op een beperkt aantal humanitaire organisaties, zijnde niet-gouvernementele organisaties gevestigd binnen de Europese Unie en internationale organisaties zoals de agentschappen van de Verenigde Naties of het Internationale Rode Kruis. Om in aanmerking te kunnen komen voor de financiering door DG ECHO dienen deze humanitaire organisaties een erkenningprocedure te doorlopen waarbij onder meer wordt nagegaan of zij over de vereiste capaciteiten op het gebied van administratief en financieel beheer beschikken alsmede over de nodige ervaring en operationele capaciteiten. DG ECHO verleent voornamelijk financiering voor kortetermijnprojecten waarbij een snelle terbeschikkingstelling van de fondsen cruciaal is voor de uitvoering van de projecten. Om deze reden is de auditstrategie van DG ECHO, en dit in tegenstelling tot de andere Commissiediensten, hoofdzakelijk toegespitst op een ex-post verificatie (d.w.z. na het einde van de projecten en nadat de eindbetalingen reeds werden overgemaakt). Deze strategie is gebaseerd op een cyclische audit van alle (op datum van heden 168) NGO s die partner zijn van DG ECHO. Iedere NGO wordt om de twee tot drie jaar onderworpen aan een audit die is toegespitst op enerzijds een analyse en evaluatie van de werking van het interne controlesysteem en de procedures van de NGO en anderzijds een controle van de uitgaven voor een steekproef van een aantal projecten gefinancierd door DG ECHO. Deze audits worden uitgevoerd op de hoofdzetel van de NGO door een extern auditkantoor met vertegenwoordigers in alle landen van de EU. Het huidige kadercontract voor deze audits heeft een looptijd van vijf jaar vanaf augustus 2006, jaarlijks opzegbaar.

Naast deze audits op de zetel van de NGO worden ook steekproefsgewijs ieder jaar een beperkt aantal audits op het terrein (= plaats waar de humanitaire operaties worden uitgevoerd) georganiseerd. Deze audits worden uitgevoerd hetzij door het externe auditkantoor, hetzij door personeel van de Commissie. Deze audits uitgevoerd in opdracht van DG ECHO zijn typische project audits: enerzijds wordt nagegaan of de interne controle- en de financiële rapporteringsystemen voldoende garanties bieden vanuit het perspectief van een donor (bv. om zogenaamde double funding te vermijden) en anderzijds wordt bij de verificatie van de projectuitgaven ook nagegaan of alle contractuele voorwaarden werden nageleefd, zoals bv. inzake de specifieke objectieven van het contract, de in het budget aanvaarde kostencategorieën, of de uitgaven vallen binnen de vooropgestelde duurtijd, het naleven van de overeengekomen aanbestedingsprocedures, enz. Vanuit deze optiek is het mogelijk dat bepaalde controleprocedures als ontoereikend worden aanzien of sommige uitgaven niet worden aanvaard in het kader van de project audit terwijl anderzijds voor de jaarrekening een goedkeurende verklaring werd afgeleverd. Meer informatie over de activiteiten van DG ECHO en over de audits van de door deze dienst gefinancierde projecten is te vinden op de volgende websites: http://ec.europa.eu/echo/news/index_en.htm http://ec.europa.eu/echo/funding/audit_en.htm.

2. EuropeAid Co-operation Office EuropeAid Co-operation Office of de Dienst voor Samenwerking EuropeAid is verantwoordelijk voor de uitvoering en het beheer van de buitenlandse hulp en steun aan derde landen die uit de Gemeenschapsbegroting en het Europees Ontwikkelingsfonds (EOF) wordt gefinancierd. EuropeAid is werkzaam in het kader van de meerjarenprogramma s die worden vastgesteld door het Directoraat-generaal (DG) Ontwikkeling voor de landen in Afrika, het Caribisch gebied en de Stille Oceaan (ACS) en het DG Buitenlandse betrekkingen (RELEX) voor de andere regio s in de wereld. EuropeAid werkt vanuit het hoofdkantoor in Brussel via EU Delegaties in meer dan 120 landen over de hele wereld. EuropeAid omvat zeven directoraten en zes eenheden. Vier van de operationele directoraten zijn geografisch en één thematisch (horizontale acties) georganiseerd. De overige twee zijn belast met de kwaliteit van de acties en de organisatie (resources). De vijf operationele Directoraten zijn: A: Europa, zuidelijk Middellandse-Zeegebied, Midden-Oosten en nabuurschapsbeleid B: Latijns-Amerika C: Afrika ten zuiden van de Sahara, het Caribisch gebied en de Stille Oceaan (m.n. beheer EOF) D: Azië F: thematische activiteiten (begrotingslijnen) o.a.: democratie en mensenrechten, voedselhulp, milieu, asiel en migratie, sociale ontwikkeling en non-state actors (o.a. NGO s). EuropeAid is verantwoordelijk voor de volledige activiteitencyclus, de Project Management Cycle, die voortvloeit uit de algemene programmering door DG Ontwikkeling en DG RELEX: identificatie van projecten/acties en financieringsbesluit, formulering, uitvoering d.m.v. overeenkomsten, contracten en betalingen en evaluatie en audits. EuropeAid hecht sterk aan een sterk en gezond financieel beheer van de gefinancierde acties en ziet via accountantscontroles (audits) toe op de rechtmatigheid, regelmatigheid en doeltreffendheid van de gebruikte fondsen. EuropeAid s jaarlijks controleplan (Annual Audit Plan) voorziet in risk-based audits (gepland op basis van een risicoanalyse) en verplichte audits (op basis van specifieke voorwaarden in overeenkomsten en contracten). Het merendeel van de door de Commissie en EuropeAid georganiseerde audits betreft financiële audits die vaak in combinatie met een systeemcontrole worden uitgevoerd. Het doel van de financiële audit is een accountantsoordeel over het financieel verslag voor een project (of een contract) waarbij het naleven van de criteria en vereisten in overeenkomsten en contracten essentieel is. De kernvraag is: zijn de EU-fondsen aangewend in

overeenstemming met de voorwaarden in de overeenkomsten en contracten voor de betreffende activiteiten? De systeemaudits zijn gericht op het ontwerp en de werking van de interne controlesystemen van begunstigden van externe steunprojecten. Verder maakt EuropeAid ook gebruik van zogenaamde expenditure verifications (verificaties van de uitgaven). Dit zijn financiële controles gebaseerd op het concept van agreed-upon procedures (overeengekomen specifieke werkzaamheden) die resulteren in een verslag van feitelijke bevindingen. De nadruk ligt op de subsidieerbaarheid (eligibility) van de door begunstigden gedeclareerde kosten. De begunstigden van subsidie- en bepaalde dienstencontracten (fee-based) zijn contractueel verplicht (onder bepaalde voorwaarden) om deze controles te laten uitvoeren en een verslag aan EuropeAid (of een delegatie) over te maken om een voorschot- of eindbetaling voor hun project te krijgen. Er zijn geen specifieke vereisten voor de accountantscontrole of audit van NGO s. De specifieke vereisten die van toepassing zijn vloeien voort uit het type van overeenkomst(en) of contract(en) die voor een bepaald project of actie zijn afgesloten en het type audit (met name financieel maar vaak ook systeemgericht) dat de Commissie vraagt. EuropeAid werkt sinds een aantal jaren met specifieke terms of reference voor audit- en verificatieopdrachten en stelt ook duidelijke eisen aan de auditors en auditkantoren die deze opdrachten uitvoeren. Deze moeten aan specifieke voorwaarden voldoen om opdrachten te kunnen uitvoeren. Daarnaast wordt van hen verwacht dat ze de terms of reference (en daarmee ook IFAC-standaarden) respecteren en dat ze de door EuropeAid voorgeschreven modellen van controleverklaringen gebruiken. Het is essentieel dat de auditors die dit soort opdrachten uitvoeren een goede understanding van de engagement context verwerven. Dit betekent dat de auditor voldoende kennis moet verwerven van de specifieke voorwaarden en criteria voor het betreffende project (bv. subsidieerbaarheid van kosten, aanbestedingsprocedures indien van toepassing) en de relevante omstandigheden zoals de aard van de activiteiten, de vereiste verslaggevingen en de specifieke kenmerken van de acties. Meer informatie over de activiteiten van EuropeAid en over de accountantscontrole (audits) van externe steunprojecten is te vinden op de volgende websites: Terms of reference and guidance for audits and related services engagements: http://ec.europa.eu/europeaid/work/frameworkcontract/audit2006/terms_of_reference_en.htm. European Commission external cooperation programmes: http://ec.europa.eu/europeaid/index_en.htm.

Executive summary (FR) En 2007, le montant total du soutien financier de la Commission européenne pour la politique extérieure s élevait à près de 11 milliards d euros (crédits d'engagements). Ce soutien financier était destiné à plus de 160 pays, régions et organisations dans le monde entier et représentait un peu plus de 8 % du budget communautaire total (y compris les ressources pour le Fonds européen de développement). Environ huit milliards d euros du soutien financier total de 2007 étaient gérés par EuropeAid tandis que près d un milliard d euros était géré par la Direction générale de l Aide humanitaire. L aide au développement et l aide humanitaire de l Union européenne - Etats Membres et Commission représentent approximativement 60 % de l aide mondiale au développement. La Commission européenne gère environ 20 % de ce soutien mondial. 1. Direction générale de l Aide humanitaire (DG ECHO) La Direction générale de l Aide humanitaire (DG ECHO) est responsable de l assistance et de l aide d urgence aux victimes de conflits et de catastrophes naturelles. Cette aide est orientée vers les populations des pays tiers, à savoir les groupes les plus fragiles, avec une priorité vers les pays en voie de développement. Pour mener à bien cette mission, la DG ECHO fait appel à un nombre limité d organisations humanitaires, à savoir des organisations non gouvernementales établies dans l Union européenne et des organisations internationales comme les agences spécialisées des Nations Unies ou la Croix-Rouge internationale. Pour faire appel au financement de la DG ECHO, ces organisations humanitaires doivent introduire une procédure de reconnaissance par laquelle l on examine notamment si elles disposent des capacités requises sur le plan de la gestion administrative et financière ainsi que de l expérience et des capacités opérationnelles. La DG ECHO fournit essentiellement un financement pour des projets à court terme pour lesquels une mise à disposition rapide de fonds s avère cruciale pour la mise en œuvre des projets. C est la raison pour laquelle la stratégie d audit de la DG ECHO, contrairement à celle des autres services de la Commission, est principalement axée sur une vérification expost (c.-à-d. après la fin des projets et après que les paiements finaux aient été effectués). Cette stratégie est basée sur un audit cyclique de toutes les ONG partenaires de la DG ECHO (168 à ce jour). Chaque ONG est soumise, tous les deux à trois ans, à un audit qui porte, d une part, sur une analyse et une évaluation du fonctionnement du système de contrôle interne et des procédures de l ONG et, d autre part, sur un contrôle des dépenses, réalisé sur un échantillon d un certain nombre de projets financés par la DG ECHO. Ces audits sont réalisés au siège de l ONG par une société d audit externe ayant des représentants dans tous les pays de l Union Européenne. Le contrat-cadre régissant ces audits actuellement a débuté en août 2006, a une durée de cinq ans et est résiliable annuellement. A côté des audits au siège des ONG, un nombre limité d audits de terrain (c.-à-d. sur le lieu où les opérations humanitaires se déroulent) sélectionnés par échantillonnage sont réalisés chaque année. Ces audits sont réalisés soit par la société d audit externe, soit par le personnel de la Commission.

Les audits réalisés pour le compte de la DG ECHO sont typiquement des audits de projets : d une part, l on vérifie si les systèmes de contrôle interne et de reporting financier offrent des garanties suffisantes pour le donateur (par exemple afin d éviter le financement double) et, d autre part, l on examine lors de la vérification des dépenses liées aux projets si toutes les conditions contractuelles ont été respectées, comme par exemple les objectifs spécifiques du contrat, les catégories de coût autorisées dans le budget, si les dépenses portent sur la durée établie, le respect des procédures d appel d offres, etc. De ce point de vue, il est possible que certaines procédures de contrôle soient considérées comme insuffisantes ou que certaines dépenses ne soient pas admises dans le cadre de l audit du projet, même si une opinion favorable est déjà délivrée pour les comptes annuels. Vous trouverez davantage d informations sur les activités de la DG ECHO et sur les audits des projets financés par ce service sur les sites internet suivants : http://ec.europa.eu/echo/news/index_en.htm http://ec.europa.eu/echo/funding/audit_en.htm 2. Office de coopération EuropeAid L'Office de coopération EuropeAid est responsable de la mise en œuvre et de la gestion de l aide et du soutien extérieur aux pays tiers financés par le budget communautaire et le Fonds européen de développement (FED). EuropeAid exerce ses activités dans le cadre de programmes pluriannuels définis par la Direction générale (DG) du développement pour les pays d Afrique, des Caraïbes et du Pacifique (ACP) et la DG Relations extérieures (RELEX) pour les autres régions dans le monde. EuropeAid agit depuis son siège à Bruxelles par le biais de délégations européennes dans plus de 120 pays à travers le monde. EuropeAid comporte sept directions et six unités. Quatre des directions opérationnelles sont organisées géographiquement et une autre direction supervise les opérations thématiques (actions horizontales). Les deux dernières directions sont chargées de la qualité des opérations et des questions d organisation (ressources). Les cinq directions opérationnelles sont : A. l'europe, le sud de la Méditerranée, le Moyen-Orient et les pays participant à la politique de voisinage ; B. l Amérique latine ; C. l Afrique subsaharienne, les Caraïbes et le Pacifique (notamment gestion FED) ; D. l Asie. F. activités thématiques (lignes budgétaires), entre autres : démocratie et droits de l homme, aide alimentaire, environnement, politique d asile et de migration, développement social et acteurs non étatiques (notamment ONG).

EuropeAid est responsable de la gestion de l intégralité du cycle des projets, le Project Management Cycle, qui résulte du programme général des DG Développement et Relations extérieures : identification des projets / opérations et des décisions de financement, formulation, exécution au moyens d accords, de contrats et de paiements, évaluation et audits. EuropeAid accorde une grande importance à une gestion financière solide et saine des opérations qu elle finance et exerce une surveillance sur la légitimité, la régularité et l efficacité des fonds utilisés par le biais de contrôles comptables ('audits'). Le plan annuel d audit d EuropeAid prévoit des audits programmés sur la base d une analyse de risque et des audits obligatoires sur la base de conditions spécifiques prévues dans les accords et les contrats. La majorité des audits organisés par la Commission et EuropeAid consiste en des audits financiers, souvent réalisés en combinaison avec un contrôle systémique. L objectif de l audit financier est d émettre une opinion comptable sur le rapport financier relatif à un projet (ou à un contrat) pour lequel la conformité avec les critères et exigences repris dans les accords et contrats est essentielle. La question centrale est la suivante : les fonds européens sont-ils alloués en accord avec les conditions reprises dans les accords et contrats relatifs aux activités concernées. Les audits systémiques portent sur le design et le fonctionnement des systèmes de contrôle interne des bénéficiaires de projets. De plus, EuropeAid utilise également ce qu'on appelle les 'expenditure verifications' (vérifications de dépenses). Il s agit de contrôles financiers basés sur le concept d 'agreedupon procedures' (procédures convenues au préalable) qui résultent en un rapport de conclusions factuelles. L accent est mis sur l éligibilité des frais déclarés par les bénéficiaires. Les bénéficiaires de contrats de subventions et de certains contrats de services (fee-based) doivent contractuellement (sous certaines conditions) faire réaliser ces contrôles et transmettre un rapport à EuropeAid (ou à une délégation) avant de recevoir un acompte ou le paiement final pour leur projet. Il n y a pas d exigences spécifiques pour le contrôle comptable ou l audit des ONG. Les exigences de contrôle découlent du type d accord(s) ou de contrat(s) conclus pour un projet ou une opération déterminée et du type d audit (notamment financier mais également systémique) que la Commission requiert. EuropeAid travaille depuis plusieurs années avec des mandats ('terms of reference') spécifiques en matière d audit et de missions de vérification et impose également des exigences claires aux auditeurs et cabinets d audit qui exécutent ces missions. Ceux-ci doivent répondre à des conditions spécifiques pour pouvoir accomplir des missions. Il est, en outre, attendu de ceux-ci qu ils respectent les mandats susmentionnés (et de ce fait également les normes de l IFAC) et que ceux-ci utilisent les modèles de rapport d audit prescrits par EuropeAid.

Il est essentiel que les auditeurs réalisant ce type de mission acquièrent une bonne compréhension du cadre dans lequel ils vont réaliser leurs travaux. Cela signifie que l auditeur doit acquérir une connaissance suffisante des conditions et critères spécifiques du projet concerné (par exemple, éligibilité des coûts, procédures d appel d offres si d application, etc.) et des circonstances pertinentes comme la nature des activités, le 'reporting' exigé et les caractéristiques spécifiques des opérations. Vous trouverez davantage d informations sur les activités d EuropeAid et sur les contrôles comptables (audits) des projets de soutien externe sur les sites internet suivants : Mandats et guidance pour les audits et autres engagements http://ec.europa.eu/europeaid/work/frameworkcontract/audit2006/terms_of_reference_en.htm European Commission external cooperation programmes http://ec.europa.eu/europeaid/index_en.htm

EUROPEAN COMMISSION AUDIT OF NGO-PROJECTS FUNDED BY THE EUROPEAN COMMISSION IN THE AREA OF EXTERNAL AID

PREFACE The European Union (EU) is composed of the 27 Member States and the supranational institutions, including the European Commission (EC). The EU is the world s biggest aid donor. The Commission is headed by the College of Commissioners and organised into departments (Directorates General DG) having responsibility for one or several policy areas. The Commission s EuropeAid co-operation office manages EU external aid programmes and ensures that development assistance is delivered worldwide. EuropeAid's main mission is to implement the Commission s external aid instruments, both those funded by the Union s budget and the European Development Fund. Whilst the vast majority of the external aid programmes are implemented by the by the EuropeAid Office (together with or via the EC's delegation in third world countries), there are some exceptions such as: pre-accession and aid for the Western Balkans (implemented by the Directorate General for Enlargement DG ELARG), humanitarian aid (implemented by the Directorate General for Humanitarian Aid - DG ECHO), macro-financial aid (implemented by the Directorate General for Economic and Financial Affairs DG ECFIN) and the Common Foreign and Security Policy and the rapid reaction facility (implemented by the Directorate General for External Relations - DG RELEX). A substantial part of the aid financed by EuropeAid and DG ECHO is implemented through non governmental organisations. The purpose of this document is to provide to the interested reader (auditors, auditees, Commission staff, controllers, etc) a brief summary of the activities of the two DGs and in particular of their audit strategy and procedures forming a part of the control framework to ensure that aid given is used for purposes intended, cost-effective and is in compliance with the rules and regulations in force). Further documentation or information can be obtained with the contact points and on the weblinks mentioned at the end of the sections.

Directorate General For Humanitarian Aid (ECHO) 1. Presentation The European Union as a whole (i.e., the Member States and the European Commission) is the largest single donor of humanitarian assistance in the world. The Directorate General for Humanitarian Aid is the service of the European Commission responsible for this activity. Through its humanitarian aid budget, DG ECHO provided humanitarian assistance in 2008 to an estimated 120 million beneficiaries in third countries. DG ECHO is responsible for the formulation of humanitarian aid policy and the financing of the provision of humanitarian assistance to the victims of conflicts or disasters, both natural and man-made, in third countries. Its mandate is to save and preserve life, reduce or prevent suffering and safeguard the integrity and dignity of populations affected by humanitarian crises. The EC's intervention in the area of humanitarian aid highlights the presence of the European Union in the area of international solidarity and generates a knock-on effect to the aid provided by other donors. DG ECHO does not implement assistance programmes itself. It is a donor and implements its mission by funding Community humanitarian actions through partners which have signed the Framework Partnership Agreement (FPA) such as European Non Governmental Organisations (NGOs) and International Organisations (Red Cross family) or the Financial and Administrative Framework Agreement (FAFA) for the UN agencies (mainly UNICEF UNHCR and WFP) 1, or Specialised Agencies of Member States. In 2008, DG ECHO had signed a Framework Partnership Agreement with 168 European NGOs. DG ECHO s task through these partners is to ensure that goods and services reach crisis zones quickly. Goods may include essential supplies including food aid, shelters, medical equipment, medicines and fuel. Services may include medical, psychosocial, protection, communication, coordination and water sanitation teams or logistical support. In 2008, through its Directorate-General for Humanitarian Aid, the Commission provided humanitarian assistance to the victims of natural or man-made disasters in third countries, in over 60 countries for a total amount of 937 million. This humanitarian assistance was implemented through NGOs (44%); UN-organisations (46%) and International Organisations (10%). 1 Respectively : United Nations Children's Fund, United Nations Refugee Agency, United Nations World Food Program

2. Overall Control Framework of DG ECHO The management of EC's funds is delegated to individual officials who as the delegated and sub-delegated Authorising Officers are responsible for the use of the funds. The use of the funds must accord with the Financial and other regulations in force. These regulations place several obligations on the Authorising Officers which results in them having to account for the sound financial management and the regular and legal use of the funds. To enable this, a comprehensive control system has been put in place. 2.1. Internal control The correct implementation of DG ECHO-funded operations is ensured through several layers of checks and controls at the various stages of the project cycle of humanitarian operations. The main aspects of the control strategy developed by DG ECHO, its supervision and monitoring procedures and the ex-ante and ex-post controls are described below: Strict selection and quality control mechanisms for partners under the Framework Partnership Agreement (FPA) signed with NGOs and International organisations 2 defining the requirements for financial credentials and expertise of implementing partners. Regular and ad hoc assessments of FPA partners ensure that these requirements are maintained continuously. For UN organisations, financial management and control requirements are defined in the EC/UN Financial Administrative Framework Agreement (FAFA); Strictly needs based systems for identification of actions to be funded; Day-to-day control of progress of projects. Each contract is monitored by the desk and field expert via a project appraisal worksheet; Project monitoring through a network of DG ECHO field experts (technical assistants) worldwide. These specialists are based in the field in order to facilitate and maximise the impact of operations funded by the European Commission, regardless of where the project is implemented. These experts closely monitor projects and establish regular reports; Regular field visits to projects by geographical desks, auditors and DG ECHO Management; Obligation for partners to produce reports after the end of the operation to justify their expenses; Thorough analysis of these reports and control of eligible expenditure by both operational and financial desk officers of DG ECHO. Various procedures, such as the use of check-lists and double checking, have been set up to ensure that all financial transactions are in conformity with financial rules, comply with sound financial management and are recorded correctly in the accounting system. Expenditure which is not sufficiently supported in final reports is disallowed and discounted in the final payment; DG ECHO undertakes approximately ten evaluations on average each year, focusing on major country operations (i.e. operations funded for a total of about 50 million and which have not been evaluated in the past three years), partners and thematic issues; 2 Mainly International Federation of the Red Cross, The international Committee of the Red Cross and the International Organisation on Migration.

DG ECHO-funded activities implemented by external parties (partners and contractors) are, as part of the control activity, subject to financial audit. DG ECHO's audit strategy is based on a 2-track approach: audits are performed both at DG ECHO partners' headquarters on a cyclical basis for finalised projects and in the field for ongoing projects. Audit recommendations are an important tool feeding information back for improvements to partners internal control systems. Furthermore, audit findings related to the eligibility of expenditures are analysed by DG ECHO officials and appropriate follow-up actions, such as recovery of funds, are taken. DG ECHO has an internal audit capacity (IAC). The IAC provides an independent and objective opinion on the quality of the internal control systems and assists the Director General and management in controlling risks and monitoring compliance. The controls listed above should not be seen in isolation. Each of them contributes in providing the overall reasonable assurance on the legality and regularity of the transactions. The overview of the operations of internal control is provided by the Director Generals in the Annual Activity Reports which are summarised and synthesised and placed before the College Of Commissioners as a prelude to the discharge given by the Budget Authority. 2.2. External control DG ECHO's operations and its financial management are further audited by the Internal Audit Service (IAS) of the European Commission and the European Court of Auditors. The mission of the Internal Audit Service (IAS) is to audit the internal control systems that exist within the European Commission. The IAS, in its annual Internal Audit Report 2007, reported on the follow-up work carried out within DG ECHO on the NGOs funding and monitoring and supervision tools. The European Court of Auditors (ECA) carries out the audit of the EU finances. Its observations and recommendations are published in its annual and special reports to the European Parliament and the European Council 3. Finally, the specialised committees of the Budget Authority exercise control over the financial management in the EC services and organise yearly hearings with the Commissioners concerned to decide on the discharge of the Commission. 3 The annual report 2007 is published on http://eca.europa.eu/portal/pls/portal/docs/1/1569525.pdf

3. Audit Strategy & Methodology This section describes the working methodology in regard to the audits of NGOs, which the External Audit Sector of DG ECHO (EAS - unit B/1) undertakes. The objective of the audit function is to assess whether grants, which are direct financial contributions provided by ECHO to partners and beneficiaries ("partners") on the basis of written agreements, have been spent in accordance with laid down rules, and to provide recommendations to improve the financial management of its partners and the procedures and practices applicable to grant management. DG ECHO's audit domain may be classified according to the procedures they fall under: audit of Partner Headquarters and field audits. The section below considers the salient points of audit in each domain. 3.1 Objectives of the audits The objective of the risk based financial audit is to validate the use of the Communities Funds. The audit ascertains whether: Expenses fit into one of the categories of the contractual budget agreed, budget chapters/total have either not been exceeded; Expenses are adequately supported by original documentation and have been properly accounted for; Expenses have been incurred during the eligibility period; Expenses charged to the agreement have been duly authorised, in accordance with the contractual requirements of the ECHO grant to the Partner; The method applied for the conversion of local currencies into Euro is consistent with standard accounting practices; Expenses are not expressly considered ineligible by the contractual basis of the project (e.g. capital investment costs - debts); For assets declared as used, the inventory systems demonstrate proof of the existence of the assets during the lifetime of the grant agreement. The internal control systems of the DG ECHO Partner indicates a control environment that is: adequate adequate in most respects adequate in some respects or inadequate, and That the DG ECHO Partner adheres to the principles of the governing FPA/FAFA and the Council Regulation (EC) No. 1257/96 of 20 June 1996 concerning humanitarian aid.

3.2 Audit Strategy The results of the audit work, interalia, underpin the Director General's Annual Declaration that the funds at his disposal have been used regularly and legally for the purposes intended. The results also input into DG ECHO's annual assessment of Partners and Control Mechanism applied. In order to fulfil the objectives on regular and systematic basis and in light of the staff and financial resources available DG ECHO implements a risk based audit strategy. The strategy for auditing NGOs itself has three elements based on audit types: Partners are audited at the headquarters on a cyclical basis. In the early years the audit cycle covered a two year period and following two completed cycles, DG ECHO is implementing a three year cycle for all partners except those who for various reasons need to be examined sooner; The FPA 2008 specifies two different control mechanisms; the so-called "A and P" Control Mechanism. The main difference between the two is that for the "A Control Mechanism" each Grant Agreement will be audited in depth from a financial perspective and to a lesser extent from an organisational perspective; for the "P Control Mechanism" this will be the other way around where the focus of the audit will place greater emphasis on the internal organisation of the Partner plus an element of substantive testing. The audit cycle as well might have a different time-frame. The strategy differentiates between the HQ audits which focus on completed projects or actions and the interim Field audit of ongoing projects in the field. The interim Field audits combined with monitoring activities by ECHO experts in addition to an accountability function provide advices to partners and early warning to DG ECHO. The results of interim field audits are carried forward to and linked to the eventual HQ audits. The info obtained from HQ audits is used in the field to test compliance with procedures. The audit strategy is primarily risk based and based on, inter alia: The results of previous audits; The risk assessment of its activities undertaken by ECHO; The requests and feedback received from ECHO units; On the cyclical coverage of partners and countries of operation. An annual audit plan is established by building on the audit strategy of DG ECHO. The annual audit plan bases itself on the Partner's level of risk as determined by the adequacy of Internal Control (as identified in previous audits) and the number of grant agreements signed.

3.3 Areas of audit a) DG ECHO Partners HQ audits As the headquarters of an organisation plays a key role in defining procedures to be applied both at field and HQ levels and generally comprises a finance department in charge of controlling financial returns submitted to donors, it is inevitable that the majority of auditing effort of the DG ECHO is focussed on the control systems and supporting documents at the Partners headquarters. Generally in the Commission, the final payment is preceded by an audit of the payment claim (audit certificate). However, where payment delays would be counter-productive to the principle of sound financial management, or be detrimental to the implementation of humanitarian aid policy, the financial rules of the Commission allow derogating from this rule. Such derogation is available for the audit of public bodies and international organisations and for humanitarian aid grants where a Framework Partnership Agreement is in place, provided that a system of control offering equivalent guarantees for such payments is in place. Within DG ECHO, the system controls introduced through the operation of the FPA, combined with the systematic audits currently in place as part of the framework audit contract provides greater assurance and is more effective in the use of limited resources than the adhoc audits of individual payments of final balances. A DG ECHO HQ Audit is a detailed review of procedures and validation of expenditure claimed from DG ECHO and undertaken by audit staff who have specific in-depth knowledge of DG ECHO s procedures, practices and outlook. These audits are based on internationally accepted auditing standards. The audits performed by DG ECHO are sufficiently specific, complete, intensive and thorough enough to give the level of assurance that is reasonable to arrive at a view that funds made available have been used for purposes intended in compliance with the rules and regulation in force. In line with the audit strategy all partners are audited over a three to four year cycle with some depending on appreciation of risk being audited more frequently. This cycle has been chosen to ensure that records covering a five year period are available especially as the maximal project implementation time is 18 months. At each audit visit, the actions taken as a result of the recommendations are also subject to audit review. All costs and documentation are drawn together at DG ECHO Partners headquarters and the majority of auditing is therefore carried out at the DG ECHO Partners headquarters. Since July 2002, the detailed auditing at Headquarters Offices has been contracted to a firm of professional accountants with world-wide representation. In August 2006 a second Framework Audit Contract was signed after the first came to an end. Each contracted audit consists of an evaluation of the internal control system of the DG ECHO Partner to determine the level of substantive testing along with substantive testing and validation on average 5 grant agreements that the DG ECHO Partner had with DG ECHO.

The number of projects may vary due to the totality of agreements between DG ECHO and the DG ECHO Partner concerned and an appreciation of financial risk faced by DG ECHO. The DG ECHO audit sector supervises the process and takes delivery of the audit results, which are then actioned, as appropriate, by DG ECHO staff. The audit process is presented by means of a flow chart at the end of this section. This contracting out of audits allows DG ECHO to achieve high audit coverage of its projects. Further, it is important to note that due to this high coverage the probability of identifying risks is larger reducing DG ECHO's vulnerability towards the EC control authorities (ECA and European Parliament) and safeguarding DG ECHO's budget. Due to this high level coverage and the recommendations proposed a further consequence can be that the administrative procedures of DG ECHO Partners are similarly raised to a qualitatively higher level. With the new FPA 2008, it is foreseen for the coming years to lengthen the cycle for those partners where the results of the first two HQ audits were satisfactory, the stability of their systems were confirmed and the audit recommendations were being followed up and who have been assessed as "P" Partner to three to four years. b) DG ECHO Partners Interim Field audits The DG ECHO Partner implements the activities that are the subject of grants from DG ECHO by means of field projects or actions. This is therefore an essential area of audit as this is where the real work is carried out by the DG ECHO Partner. Audits cover financial, administrative and operational aspects of the projects with visits and testing at on-going projects and local and regional DG ECHO Partner offices and various project locations (e.g. refugee camps, health structures and distribution points). The projects to be audited are subjected to a multi criterion analysis combined with a perception of attached risks. In general, these audits have been outsourced to the contracted external audit company. However, in case of specific needs or requests these audits may also be undertaken by DG ECHO audit staff. At the request of the ECA, the number of field audits carried out has been nearly doubled from 20-25 per annum to around 40-50. This number is considered to be cost-effective and allows most partners to be checked in the field at least once every three to four years. c) Ex-Ante Audits To become an ECHO Partner, organisations have to apply via 'APPEL', a web-based tool. It is standard practice of DG ECHO to put these new organisations into the first possible batch of HQ audits when these organisations have received agreements to verify the procedures of the new Partner and to verify the final claim as well as to give training to the new Partner via the audit process.

3.4 Methodology Each audit is conducted in line with generally accepted auditing standards. Programs have been developed to guide the audit; files are drawn up with supporting documentation leading to conclusions and a report is issued for each audit. The audit methodology is being continuously developed in order to ensure more efficient, productive and effective audits. Within the confines of business confidentiality, all audits are carried out in openness and transparency with the involvement of the auditees at each stage of the process. The audits are facilitated by exchanges of information not only from the partners to ECHO, but also from ECHO to the partners. The majority of ECHO s audit reports have been completed with agreement between ECHO and the auditee on their contents. The results of the audits are discussed with the senior management of the partner concerned, including the actions that they intend to take. At the next audit visit the actions taken as a result of the recommendations will be subject to audit review. The audit approach for all audits charged to the Audit Contractor is determined by DG ECHO and is reported to DG ECHO on the adherence by the DG ECHO Partner to the prevailing conditions of the governing FPA. The Audit Contractors are not mandated to decide whether any mitigating circumstances arose during the implementation of the projects subject to audit. The audit report is solely on the basis of regularity and legality whether the conditions of the respective FPA and the grant agreements have been adhered to and on the existence of incurred costs supported by documents and included in the partners' accounting system. Any mitigating circumstances of which the Audit Contractor became aware are to be reported to DG ECHO who then will make the final decision on the eligibility of the costs subject to such circumstances. Any such costs may be reported to DG ECHO as disallowed/not accepted by the audit and therefore potentially recoverable. 3.5 Indication of Past Results Whilst the vast majority of ECHO partners have been found to have met at least a minimum standard of financial control and accounting, a need for certain improvements has been noted. In particular, many ECHO partners could improve the quality of financial information available for internal decision-making along with an improvement in the level of financial control and accounting between headquarters and field offices.

3.6 Resources and Reporting The audit sector (EAS) in DG ECHO comprises 4 auditors and 2 support staff and forms part of Directorate B Resources, Finances, Legal affairs. In addition to internal staff, ECHO B.1 is endowed with sufficient budgetary resources to contract audits to outside firms. The current Framework Audit Contract runs from August 2006 for (renewable annually) up to a maximum of five years. The calls for tender for the issue of new contracts are published in the Official Journal of the EU as and when appropriate. DG ECHO s management safeguards the sector s operational independence. EAS has regular monthly reporting from the Audit Contractors on the progress of the ongoing audits in a reporting format agreed upon. An annual report on the overview of the audit activities and audit results is also submitted to DG ECHO's management. Some key indicators in respect of the output of these financial audits in 2008: o 62 headquarter audits completed; o 28 field audits finalised by DG ECHO officials on projects under way; o 9 ECHO office audits; o 3 UN headquarters verifications; o 6 UN field verifications; o 5 Humanitarian Procurement Centres assurance reviews; o The total value of the sample of projects for which headquarter and field audits were finalised in 2008 was 355 million. In relation to the average annual implemented budget over the last years the audit sample, which is checked in detail by external auditors, covers about 25% of the volume of operations funded by DG ECHO; o Following these and previous years audits and in addition to the preventive benefits, DG ECHO issued recovery orders for an amount of 4.1 million in 2008. 3.7 Relationship with the European Court of Auditors and OLAF The EAS of DG ECHO B/1 co-operates in case of need with both the European Court of Auditors (ECA) and with the European Anti-Fraud Office (OLAF). In the past, joint field audits have been undertaken with ECA and DG ECHO. As part of its normal actions the ECA undertakes Quality Assessments of the EAS and Audit Contractor. The Audit Contractor is obliged to inform DG ECHO immediately in cases of fraud and equivalents as stated in Article I.11.3 of the Framework Audit Contract. Where sufficient grounds exist DG ECHO will then provide this information to OLAF who should decide on the next steps.