PURPOSE: to grant discharge to the European Network and Information Security Agency for the financial year 2006.

LEGISLATIVE ACT: Decision 2009/227/EC of the European Parliament on the discharge for the implementation of the budget of the European Network and Information Security Agency for the financial year 2006.

CONTENT: with the present decision, the European Parliament grants discharge to the Executive Director of the European Network and Information Security Agency for the implementation of the Authority’s budget for the financial year 2006.

This decision is in line with the European Parliament’s resolution adopted on 22 April 2008 and comprises a series of observations that form an integral part of the discharge decision (please refer to the summary of the opinion of 22/04/2008).

The European Parliament adopted, by 623 votes in favour, 38 against and 15 abstentions, a Decision to grant the Director of the European Network and Information Security Agency discharge in respect of the implementation of its budget for the financial year 2006. The decision to grant discharge also constitutes closure of the accounts of this EU agency.

At the same time, the Parliament adopted, by 623 votes in favour, 41 against and 15 abstentions, a Resolution containing the comments which form part of the decision giving discharge. The report had been tabled for plenary by Hans-Peter MARTIN (NI, AT) on behalf of the Committee on Budgetary Control.

As is the case for all EU agencies, the Parliament's Resolution is divided into two parts: part one contains general comments on EU agencies, while part two focuses on the specific case of the Agency.

1) General comments on the majority of EU agencies : the Parliament notes that the budgets of the 24 agencies and other satellite bodies audited by the Court of Auditors totalled more than EUR 1 billion and that the number of agencies is constantly increasing. The number of agencies subject to the discharge procedure evolved from 8 in 2000 to 20 in 2006. It concludes therefore that the auditing/discharge process has become cumbersome and disproportionate compared to the relative size of the agencies and that, in the future, this type of procedure should be simplified and rationalised for decentralised agencies.

On the basis of the financial analysis, the Parliament is of the following opinion:

Fundamental considerations : given the constantly increasing number of agencies, the Parliament requests that, before the creation of a new agency, the Commission provide clear explanations regarding agency type, objectives of the agency, internal governance structure, products, services, clients and stakeholders of the agency, formal relationship with external actors, budget responsibility, financial planning, and personnel and staffing policy. It also requests that each agency be governed by a yearly performance agreement which should contain the main objectives for the coming year and that the performance of the agencies be regularly audited by the Court of Auditors (and extend the financial analysis of expenditure to also cover administrative efficiency and effectiveness). More generally, the Parliament takes the view that, in the case of agencies, which are continually overestimating their respective budget needs, technical abatement should be made on the basis of vacant posts in order to reduce the assigned revenue for the agencies and therefore also lower administrative costs of the EU. It recalls that it is a serious problem that a number of agencies is criticised for not following rules on public procurement, the Financial Regulation, the Staff Regulations etc., and consider that the principal reason for this is that most regulations and the Financial Regulation are designed for bigger institutions rather than for small agencies. Therefore, it is necessary to seek a rapid solution in order to enhance the effectiveness of the legislation by grouping the administrative functions of various agencies together or by establishing implementing rules which are better adapted to the agencies. The Parliament also insists that the Commission, when drafting the Preliminary Draft Budget, take into consideration the results of budget implementation by the individual agencies in former years and revise the budget requested by the particular agency accordingly. If the Commission does not undertake this revision, the Parliament invites the competent committee to revise, itself, the budget in question to a realistic level . At the same time, the Parliament recalls that it expects the Commission to present every five years a study on the added value of every existing agency and to not hesitate to close an agency if it is deemed useless by the analysis. Such an assessment is expected as soon as possible given that this type of assessment has yet to be presented. Furthermore, the Parliament insists that recommendations of the Court of Auditors should be promptly implemented and the level of subsidies paid to the agencies should be aligned with their real cash requirements.

Presentation of reporting data : noting that there is no standard approach among the agencies with regard to the presentation of information, the Parliament recalls that it already invited the directors of the agencies to accompany their annual activity report with a declaration of assurance concerning the legality and regularity of operations, similar to the declarations signed by the Directors General of the Commission. It therefore asks the Commission to amend its standing instructions to the agencies and to produce a harmonised model for presenting information, including: i) an annual report intended for a general readership on the body's operations, work and achievements; ii) financial statements and a report on implementation of the agency’s budget; iii) an activity report of the Directors of the agency (as requested by the Parliament since 2005); iv) a declaration of assurance signed by the body's director.

General findings by the Court of Auditors : the Parliament refers to certain recurring findings by the Court, including the disbursement of subsidies paid by the Commission (not sufficiently justified estimates of the agencies' cash requirements), the non implementation of the ABAC accounting system by some agencies or the accrued charges for untaken leave which are accounted for by some agencies. It calls for rapid measures in these areas as well as improvements to the internal audit procedures of the agencies. The Parliament also calls on the agencies to consider an inter-agency disciplinary board, as some individual agencies have difficulty in setting up their own disciplinary boards due to their size. Draft inter-institutional agreement : the Parliament recalls the Commission's draft Interinstitutional agreement on the operating framework for the European regulatory agencies (see ACI/2005/2035 ), which was intended to create a framework for the creation, structure, operation, evaluation and control of the European regulatory agencies, and awaits its adoption as soon as possible. It particularly welcomes the Commission's commitment to bring forward a Communication on the future of the regulatory agencies during the course of 2008.

2. Specific points concerning the European Network and Information Security Agency : the Parliament notes that the implementation of the Agency's budget for the financial year 2006 showed a utilisation rate of 90 % of commitment appropriations and 76 % of payment appropriations, with a concentration of transactions in the last quarter of the year and a high number of transfers, meaning that the budgetary principle of specification was not strictly observed.

The Parliament also takes note of several other negative statements made by the Court, including the fact that:

the general accounting software used by the Agency makes it possible to amend entries without leaving an audit trail; the Agency has not established a system for recording invoices that ensures the accuracy of the financial information; the internal control procedures have not yet all been documented; written instructions for archiving supporting documentation to transactions were missing; a financial irregularities panel was not established.

While realising that these errors are related to the start-up phase of the Agency, the Parliament believes that the financial management of this Agency leaves much to be desired and that urgent measures must be taken. Furthermore, it notes a deficit of EUR 460 000 for the financial year 2006.

All of this is the reason for the reservations in the statement of assurance by the authorising officer and the negative evaluation of the Agency carried out on behalf of the Commission in 2007 by external evaluators (they concluded that the Agency's achievements were insufficient to produce the added value and impact initially hoped for).

Lastly, the Parliament completely rejects the Commission's proposal (see COD/2007/0249 ) to transfer the Agency's responsibilities to a new European Telecom Marketing Authority whose tasks from 2010 would include:

ensuring that the 27 national regulators work as an efficient team on the basis of common guiding principles; delivering opinions and assisting in preparing the single market measures of the Commission for the telecoms sector; addressing network and information security issues.

The Committee on Budgetary Control adopted the report by Hans-Peter MARTIN (NI, AT) recommending that the Parliament grant the Director of the European Network and Information Security Agency discharge in respect of the implementation of its budget for the financial year 2006.

The parliamentary committee notes that the final annual accounts of the Agency are as annexed to the Court of Auditors' report.

MEPs make a series of general comments on the agencies of the EU before referring to the specific case of the European Network and Information Security Agency.

1. General comments on the majority of EU agencies : MEPs note that the budgets of the 24 agencies and other satellite bodies audited by the Court of Auditors totalled more than EUR 1 billion and that the number of agencies is constantly increasing. The number of agencies subject to the discharge procedure evolved from 8 in 2000 to 20 in 2006. They conclude therefore that the auditing/discharge process has become cumbersome and disproportionate compared to the relative size of the agencies and that, in the future, this type of procedure should be simplified and rationalised for decentralised agencies.

On the basis of the financial analysis, MEPs are of the following opinion:

Fundamental considerations : given the constantly increasing number of agencies, MEPs request that, before the creation of a new agency, the Commission provide clear explanations regarding agency type, objectives of the agency, internal governance structure, products, services, clients and stakeholders of the agency, formal relationship with external actors, budget responsibility, financial planning, and personnel and staffing policy. They also request that each agency be governed by a yearly performance agreement which should contain the main objectives for the coming year and that the performance of the agencies be regularly audited by the Court of Auditors (and extend the financial analysis of expenditure to also cover administrative efficiency and effectiveness). More generally, MEPs take the view that, in the case of agencies which are continually overestimating their respective budget needs, technical abatement should be made on the basis of vacant posts in order to reduce the assigned revenue for the agencies and therefore also lower administrative costs of the EU. They recall that it is a serious problem that a number of agencies is criticised for not following rules on public procurement, the Financial Regulation, the Staff Regulations etc., and consider that the principal reason for this is that most regulations and the Financial Regulation are designed for bigger institutions rather than for small agencies. Therefore, it is necessary to seek a rapid solution in order to enhance the effectiveness of the legislation by grouping the administrative functions of various agencies together or by establishing implementing rules which are better adapted to the agencies. MEPs also insist that the Commission, when drafting the Preliminary Draft Budget, take into consideration the results of budget implementation by the individual agencies in former years and revise the budget requested by the particular agency accordingly. If this revision is not undertaken is not undertaken by the Commission, MEPs invite the competent committee to revise, itself, the budget in question to a realistic level. At the same time, MEPs recall that they expect the Commission to present every five years a study on the added value of every existing agency and to not hesitate to close an agency if it is deemed useless by the analysis. Such an assessment is expected as soon as possible given that this type of assessment has yet to be presented. Furthermore, MEPs insist that recommendations of the Court of Auditors should be promptly implemented and the level of subsidies paid to the agencies should be aligned with their real cash requirements. Presentation of reporting data : noting that there is no standard approach among the agencies with regard to the presentation of information, MEPs recall that they already invited the directors of the agencies to accompany their annual activity report with a declaration of assurance concerning the legality and regularity of operations, similar to the declarations signed by the Directors General of the Commission. They therefore ask the Commission to amend its standing instructions to the agencies and to produce a harmonised model for presenting information, including: i) an annual report intended for a general readership on the body's operations, work and achievements; ii) financial statements and a report on implementation of the agency’s budget; iii) an activity report of the Directors of the agency (as requested by the Parliament since 2005); iv) a declaration of assurance signed by the body's director. General findings by the Court of Auditors : MEPs refer to certain recurring findings by the Court, including the disbursement of subsidies paid by the Commission (not sufficiently justified estimates of the agencies' cash requirements), the non implementation of the ABAC accounting system by some agencies or the accrued charges for untaken leave which are accounted for by some agencies. They call for rapid measures in these areas as well as improvements to the internal audit procedures of the agencies. MEPs also call on the agencies to consider an inter-agency disciplinary board, as some individual agencies have difficulty in setting up their own disciplinary boards due to their size. Draft inter-institutional agreement : MEPs recall the Commission's draft Interinstitutional agreement on the operating framework for the European regulatory agencies (see ACI/2005/2035 ), which intended to create a framework for the creation, structure, operation, evaluation and control of the European regulatory agencies and insist that it be completed as soon as possible. They particularly welcome the Commission's commitment to bring forward a Communication on the future of the regulatory agencies during the course of 2008.

2. Specific points concerning the European Network and Information Security Agency : MEPs note that the implementation of the Agency's budget for the financial year 2006 showed a utilisation rate of 90 % of commitment appropriations and 76 % of payment appropriations, with a concentration of transactions in the last quarter of the year and a high number of transfers, meaning that the budgetary principle of specification was not strictly observed.

MEPs also take note of several other negative statements made by the Court, including the fact that:

the general accounting software used by the Agency makes it possible to amend entries without leaving an audit trail; the Agency has not established a system for recording invoices that ensures the accuracy of the financial information; the internal control procedures have not yet all been documented; written instructions for archiving supporting documentation to transactions were missing; a financial irregularities panel was not established.

While realising that these errors are related to the start-up phase of the Agency, MEPs believe that the financial management of this Agency leaves much to be desired and that urgent measures must be taken. Furthermore, they note a deficit of EUR 460 000 for the financial year 2006 as well as EUR 1.1 million under pre-financing that the Agency should return to the Commission in 2007.

All of this is the reason for the reservations in the statement of assurance by the authorising officer and the negative evaluation of the Agency carried out on behalf of the Commission in 2007 by external evaluators (they concluded that the Agency's achievements were insufficient to produce the added value and impact initially hoped for).

Lastly, MEPs completely reject the Commission's proposal (see COD/2007/0249 ) to transfer the Agency's responsibilities to a new European Telecom Marketing Authority whose tasks from 2010 would include:

ensuring that the 27 national regulators work as an efficient team on the basis of common guiding principles; delivering opinions and assisting in preparing the single market measures of the Commission for the telecoms sector; addressing network and information security issues.

Based on the observations contained in the revenue and expenditure account and the balance sheet of the European Network and Information Security Agency (ENISA) for the financial year 2006, as well as on the Court of Auditor's report and the Agency's replies to the Court's observations, the Council recommends the Parliament to provide the discharge on the implementation of the 2006 budget to the Director of the Agency.

In doing so, the Council confirms that EUR 1.3 million (62%) of the appropriations carried over from 2005 to 2006 (EUR 2.1 million) was used, that the appropriations carried over from 2006 to 2007 amount to EUR 0.9 million and that a total of EUR 0.7 million was cancelled.

Recalling that the Court of Auditors was able to obtain reasonable assurance that the Agency's annual accounts were, in all material aspects, reliable, the Council believes that there is a certain number of observations that must be taken into consideration when providing the discharge on the implementation of the 2006 budget, particularly regarding the following points:

· Agency management : the Council underlines that certain factors, namely a low utilisation rate, particularly for payment appropriations, a concentration of transactions in the last quarter of the year and an exceptionally high number of transfers, make it necessary to improve the financial and budgetary management of the Agency, and it calls upon the Agency to rectify this situation as soon as possible;

internal control : regarding the Court’s observations on the inadequacies of the accounting software used by the Agency, the Council encourages the Court to act on the matter in the short-term and to apply, as planned, the accounting software of the Commission. The Council also calls on the Agency to detail in writing all the internal control procedures required by the Financial Regulation, to develop written instructions for archiving supporting documentation of transactions and to create a financial irregularities panel in order to resolve the inadequacies noted by the Court.

PURPOSE: presentation of the report by the Court of Auditors on the 2006 annual accounts of the European Network and Information Security Agency (ENISA).

CONTENT: the report indicates that the appropriations entered in the Agency’s budget for the financial year in question are EUR 6.952 million , EUR 6.31 million was committed and EUR 5.37 million paid. Of this overall amount, EUR 917 000 was carried over to 2007 and EUR 665 000 was cancelled.

The Court notes that the annual accounts are reliable in all material respects and that the underlying transactions of the Agency’s accounts, taken as a whole, are legal and regular.

Analysis of the accounts by the Court : the Court indicates that the implementation of the Agency’s budget for the financial year 2006 shows a utilisation rate of 90% of commitment appropriations and 76% of payment appropriations. There was a concentration of transactions in the last quarter of the year. Furthermore, the weaknesses of the procedures for establishing the budget led to a high number of transfers. Thus, the budgetary principles of annuality and specification were not strictly observed, according to the Court.

The Court also indicates that the general accounting software used by the Agency made it possible to amend entries without leaving an audit trail. Furthermore, a system for recording invoices that ensures the accuracy of the financial information in the final accounts has not been established.

Finally, the internal control procedures required by the Financial Regulation to ensure transparency and sound financial management, have not yet all been documented. The Agency’s Management Board did not formally adopt standards for internal control and the code of professional ethics. The Court also noted the absence of written instructions for archiving supporting documentation of transactions as well as the non-existence of a financial irregularities panel.

The Agency’s replies : the Agency replies to all of the criticisms one by one and indicates, firstly, that 2006 was the Agency’s first full year of operation, and also that it intensified its activity in the second half of the year, resulting in many transactions in the last quarter. Also, in 2006, the position of budget officer remained vacant for more than five months, which affected the ability of the Agency to optimise planning and minimise the number of transfers for the year.

In addition, the Agency indicates that it has applied for ABAC, the Commission’s accounting software since 2005. Based on the schedule of the Commission, the project will be launched early in 2008. The system for recording invoices was revised before the preparation of the final accounts and has been applied since.

Lastly, ENISA indicates that it will present standards for internal control as well as a code of ethics to its Management Board for adoption. The executive director will put in place the organisational structure and all the procedures and controls necessary to their implementation.

PURPOSE: presentation of the final accounts of the European Network and Information Security Agency for the financial year 2006 (ENISA).

CONTENT: this document sets out a detailed account of the implementation of the 2006 budget, including the revenue and expenditure and the balance sheet for the year concerned.

According to this document, the final budget amounted to EUR 6.9 million (as opposed to EUR 6.3 million in 2005) consisting of a 100% Community contribution.

As regards the staffing policy, the Agency set out 44 posts in the establishment plan. 38 posts are currently occupied + 8 other posts (seconded national experts) totalling 46 posts assigned to operational and administrative tasks. Staff expenditure amounted to EUR 3.728 million (final budget appropriations paid).

In 2006, the Agency’s main task was to enhance the capability of the Community to prevent and respond to network and information security problems by building on national and Community efforts.

3 Working Groups were set up to cover:

Risk management/Risk Assessment; CERTS; Regulatory Aspects of Network & Information Security (RANIS).

Publications:

Annual report; 4 issues of ENISA Quarterly; Who’s Who on NIS database;. CD-ROM: ‘ENISA inventory of CERT activities in Europe’; CD-ROM: ‘Raising Awareness in Information Security, Insight and Guidance for Member States’; 6 Fact Sheets on ENISA and its activities; 30 press releases; The Permanent Stakeholders Group’s (PSG) ‘Vision for ENISA’ – document; The Draft ENISA Strategy 2008-2011 processed by the PSG and Management Board; A guide on how to set up a CERT; A report on CERT co-operation; ‘A Users’ Guide: How to Raise Information Security Awareness’; Package ‘Information Security Awareness; Programmes in the EU — Insight and Guidance for Member States’; Collection of Best Practices — the ‘ENISA Knowledgebase’; Study on security and anti-spam measures of providers.

Cooperation with Member States and other institutions:

15 joint events with Member States 8 responses to requests by Member States and Institutions

The complete version of the final accounts may be found at the following address: www.enisa.europa.eu

PURPOSE: presentation of the final accounts of the European Network and Information Security Agency for the financial year 2006 (ENISA).

CONTENT: this document sets out a detailed account of the implementation of the 2006 budget, including the revenue and expenditure and the balance sheet for the year concerned.

According to this document, the final budget amounted to EUR 6.9 million (as opposed to EUR 6.3 million in 2005) consisting of a 100% Community contribution.

As regards the staffing policy, the Agency set out 44 posts in the establishment plan. 38 posts are currently occupied + 8 other posts (seconded national experts) totalling 46 posts assigned to operational and administrative tasks. Staff expenditure amounted to EUR 3.728 million (final budget appropriations paid).

In 2006, the Agency’s main task was to enhance the capability of the Community to prevent and respond to network and information security problems by building on national and Community efforts.

3 Working Groups were set up to cover:

Risk management/Risk Assessment; CERTS; Regulatory Aspects of Network & Information Security (RANIS).

Publications:

Annual report; 4 issues of ENISA Quarterly; Who’s Who on NIS database;. CD-ROM: ‘ENISA inventory of CERT activities in Europe’; CD-ROM: ‘Raising Awareness in Information Security, Insight and Guidance for Member States’; 6 Fact Sheets on ENISA and its activities; 30 press releases; The Permanent Stakeholders Group’s (PSG) ‘Vision for ENISA’ – document; The Draft ENISA Strategy 2008-2011 processed by the PSG and Management Board; A guide on how to set up a CERT; A report on CERT co-operation; ‘A Users’ Guide: How to Raise Information Security Awareness’; Package ‘Information Security Awareness; Programmes in the EU — Insight and Guidance for Member States’; Collection of Best Practices — the ‘ENISA Knowledgebase’; Study on security and anti-spam measures of providers.

Cooperation with Member States and other institutions:

15 joint events with Member States 8 responses to requests by Member States and Institutions

The complete version of the final accounts may be found at the following address: www.enisa.europa.eu