The European Parliament decided to grant discharge to the Executive Director of the European Union Agency for Network and Information Security (ENISA) for the financial year 2017 and to approve the closure of the accounts for the financial year in question.

Noting that the Court of Auditors has stated that it has obtained reasonable assurances that the Agency’s annual accounts for the financial year 2017 are reliable and that the underlying transactions are legal and regular, Parliament adopted by 494 votes to 127 with 13 abstentions, a resolution containing a series of recommendations, which form an integral part of the decision on discharge and which add to the general recommendations set out in the draft resolution on performance, financial management and control of EU agencies :

Agency’s financial statements

Parliament noted the final budget of the Agency for the financial year 2017 was EUR 11 175 224.40, representing an increase of 1.28 % compared to 2017.

Budget and financial management

Budget monitoring efforts during the financial year 2017 resulted in a budget implementation rate of 99.99 %, representing an increase of 1.52 % compared to 2016. Payment appropriations execution rate was 88.19 %, representing a slight decrease of 0.99 % compared to 2016. The cancellations of carryovers from 2016 to 2017 amounted to EUR 90 916, representing 9.39 % of the total amount carried forward, showing an increase of 3.67 % in comparison to 2016.

Members also made a series of observations regarding performance, staff policy, procurement and internal controls.

In particular, they noted that:

- the Agency started the process of helping Member States to implement Directive (EU) 2016/1148 c oncerning measures for a high common level of security of network and information systems across the Union and that it compiled a data breach severity assessment tool, in collaboration with several Member States’ authorities, in order to set up a coherent framework at Union level;

- on 31 December 2017, the establishment plan was only 87.5 % executed, with 42 temporary agents appointed out of 48 temporary agents authorised under the Union budget;

- the Agency finds it difficult to recruit, attract and hold suitably qualified staff, mainly due to the types of post that are being offered (contract agents posts) and the low correction coefficient factor which applies to the salaries of the Agency’s employees in Greece;

- unlike most other agencies, the Agency did not carry out a comprehensive analysis of the likely impact of the United Kingdom’s decision to withdraw from the European Union on its organisation, operations and accounts.

The Committee on Budgetary Control adopted the report by Petri SARVAMAA (EPP, FI) on discharge in respect of the implementation of the budget of the European Union Agency for Network and Information Security (ENISA) for the financial year 2017.

The committee called on the European Parliament to grant the Executive Director of the Agency discharge in respect of the implementation of the agency’s budget for the financial year 2017.

Noting that the Court of Auditors stated that it had obtained reasonable assurance that the annual accounts of the Agency for the financial year 2017 were reliable and that the underlying transactions were legal and regular, Members called on Parliament to approve the closure of the Agency’s accounts.

They made, however, a number of recommendations that needed to be taken into account when the discharge is granted, in addition to the general recommendations that appear in the draft resolution on performance, financial management and control of EU agencies :

Agency’s financial statements

Members noted the final budget of the Agency for the financial year 2017 was EUR 11 175 224.40, representing an increase of 1.28 % compared to 2017.

Budget and financial management

Budget monitoring efforts during the financial year 2017 resulted in a budget implementation rate of 99.99 %, representing an increase of 1.52 % compared to 2016. Payment appropriations execution rate was 88.19 %, representing a slight decrease of 0.99 % compared to 2016.

The cancellations of carryovers from 2016 to 2017 amounted to EUR 90 916, representing 9.39 % of the total amount carried forward, showing an increase of 3.67 % in comparison to 2016.

Members also made a series of observations regarding performance, staff policy, procurement and internal controls.

In particular, they noted that:

- the Agency started the process of helping Member States to implement Directive (EU) 2016/1148 c oncerning measures for a high common level of security of network and information systems across the Union and that it compiled a data breach severity assessment tool, in collaboration with several Member States’ authorities, in order to set up a coherent framework at Union level;

- on 31 December 2017, the establishment plan was only 87.5 % executed, with 42 temporary agents appointed out of 48 temporary agents authorised under the Union budget;

- the Agency finds it difficult to recruit, attract and hold suitably qualified staff, mainly due to the types of post that are being offered (contract agents posts) and the low correction coefficient factor which applies to the salaries of the Agency’s employees in Greece;

- unlike most other agencies, the Agency did not carry out a comprehensive analysis of the likely impact of the United Kingdom’s decision to withdraw from the European Union on its organisation, operations and accounts.

Having examined the revenue and expenditure accounts for the financial year 2017 and the balance sheet as at 31 December 2017 of the European Union Agency for Network and Information Security (ENISA), as well as the Court of Auditors' report on the annual accounts of the Agency for the financial year 2017, accompanied by the Agency's replies to the Court's observations, the Council recommended the European Parliament to give a discharge to the Executive Director of the Agency in respect of the implementation of the budget for the financial year 2017.

The Council welcomed the Court's opinion that, in all material respects, the Agency's annual accounts present fairly its financial position as at 31 December 2017 and the results of its operations and its cash flows for the year then ended, in accordance with the provisions of the Agency's Financial Regulation, and that the underlying transactions for 2017 are legal and regular in all material respects.

Nevertheless, the following observations were made:

- accounting : the Council regretted the weaknesses found by the Court in the Agency's accounting environment. It called on the Agency to take appropriate actions mainly to ensure the hand-over between staff members;

- Brexit : the Council encouraged the Agency to take into account any possible financial impact of the withdrawal of the United Kingdom from the EU on its organisation, operations and accounts.

PURPOSE: presentation of the EU Court of Auditors’ report on the annual accounts of the European Network and Information Security Agency for the year 2017, together with the Agency’s reply.

CONTENT: the Court of Auditors carried out the audit on the annual accounts of the European Network and Information Security Agency (ENISA).

In brief, the Agency’s main task is to enhance the Union’s capability to prevent and respond to network and information security problems by building on national and Union efforts.

Statement of assurance and reliability of the accounts

The Court considered that:

- the Agency’s annual accounts present fairly, in all material respects, its financial position as at 31 December 2017 and the results of its operations and its cash flows for the year then ended, in accordance with the provisions of its Financial Regulation and the accounting rules adopted by the Commission’s accounting officer;

- the transactions underlying the annual accounts for the year ended 31 December 2017 are legal and regular in all material respects.

The report also makes a series of observations on the budgetary and financial management of the Agency, accompanied by the latter’s response. The main observations may be summarised as follows:

The Court’s observations

Reliability of the accounts

The new accounting officer of the Agency took over duties on 1 December 2017. The hand-over process was improperly carried out. In particular, there was no hand-over report transmitted to the new accountant.

Performance

On 29 March 2017 the United Kingdom (UK) notified the European Council of its decision to withdraw from the European Union (Brexit). Unlike most of the other agencies, the Agency did not carry out a comprehensive analysis of the likely Brexit impact on its organisation, operations and accounts.

The Agency’s replies

Reliability of the accounts

While the hand-over to the new accounting officer was never formalised, informal meetings have taken place with previous acting accounting officer to transfer knowledge. Updated training on software was also received by the new accounting officer to provide a good understanding of the accounting system. Nevertheless, ENISA will implement corrective actions to ensure that adequate hand-over between in- and out-going staff members.

Performance

ENISA has not performed a formal operational and financial impact analysis of Brexit as it should not have any significant direct impact on ENISA’s budget, operation and administration. Nevertheless, relevant internal processes have been revised (i.e. procurement and recruitment) in the Brexit context.

Lastly, the Court of Auditors’ report contains a summary of the Agency’s key figures in 2017:

Budget

EUR 11 million.

Staff

70 including officials, temporary and contract staff and seconded national experts.

PURPOSE: presentation by the Commission of the consolidated annual accounts of the European Union for the financial year 2017, as part of the 2017 discharge procedure.

Analysis of the accounts of the European Union Agency for Network and Information Security (ENISA) .

CONTENT: the organisational governance of the EU consists of institutions, agencies and other EU bodies whose expenditure is included in the general budget of the Union.

This Commission document concerns the EU's consolidated accounts for the year 2017 and details how spending by the EU institutions and bodies was carried out. The consolidated annual accounts of the EU provide financial information on the activities of the institutions, agencies and other bodies of the EU from an accrual accounting and budgetary perspective.

It is the responsibility of the Commission's Accounting Officer to prepare the EU's consolidated annual accounts and ensure that they present fairly, in all material aspects, the financial position, the result of the operations and the cash flows of the EU institutions and bodies with a view to granting discharge.

Discharge procedure : the final step of a budget lifecycle is the discharge . It is the decision by which the European Parliament ‘ releases ’ the Commission from its responsibility for management of a given budget by marking the end of that budget's existence. It is granted by the European Parliament on the recommendation of the Council.

The decision is based in particular on the European Court of Auditors reports, in particular its annual report, in which the Court provides a Statement of Assurance (DAS) on the legality and regularity of transactions (payments and commitments).

The procedure results in the granting, postponement or refusal of discharge.

The final discharge report including specific recommendations to the Commission for action is adopted in plenary by the European Parliament and are subject to an annual follow up report in which the Commission outlines the concrete actions it has taken to implement the recommendations made.

All EU institutions and other agencies, bodies and joint undertakings are subject to their own discharge procedures.

The European Union Agency for Network and Information Security : ENISA, which is located in Heraklion (EL), was established under Regulation 460/2004/EC of the European Parliament and of the Council with a view to enhancing the Union's capability to prevent and respond to network and information security problems.

In 2017, the previous work and impact of ENISA was reviewed by external consultants which resulted in a successful outcome being that ENISA has made a positive contribution to cybersecurity in Europe over the last several years.

As regards the Agency’s accounts , these are presented in detail in the document on the consolidated annual accounts of the European Union for 2017:

Commitment appropriations :

available: EUR 11 million; made: EUR 11 million.

Payment appropriations :

available: EUR 12 million; made: EUR 11 million.

For further details on expenditure, please refer to the final accounts of the ENISA .

PURPOSE: presentation by the Commission of the consolidated annual accounts of the European Union for the financial year 2017, as part of the 2017 discharge procedure.

Analysis of the accounts of the European Union Agency for Network and Information Security (ENISA) .

CONTENT: the organisational governance of the EU consists of institutions, agencies and other EU bodies whose expenditure is included in the general budget of the Union.

This Commission document concerns the EU's consolidated accounts for the year 2017 and details how spending by the EU institutions and bodies was carried out. The consolidated annual accounts of the EU provide financial information on the activities of the institutions, agencies and other bodies of the EU from an accrual accounting and budgetary perspective.

It is the responsibility of the Commission's Accounting Officer to prepare the EU's consolidated annual accounts and ensure that they present fairly, in all material aspects, the financial position, the result of the operations and the cash flows of the EU institutions and bodies with a view to granting discharge.

Discharge procedure : the final step of a budget lifecycle is the discharge . It is the decision by which the European Parliament ‘ releases ’ the Commission from its responsibility for management of a given budget by marking the end of that budget's existence. It is granted by the European Parliament on the recommendation of the Council.

The decision is based in particular on the European Court of Auditors reports, in particular its annual report, in which the Court provides a Statement of Assurance (DAS) on the legality and regularity of transactions (payments and commitments).

The procedure results in the granting, postponement or refusal of discharge.

The final discharge report including specific recommendations to the Commission for action is adopted in plenary by the European Parliament and are subject to an annual follow up report in which the Commission outlines the concrete actions it has taken to implement the recommendations made.

All EU institutions and other agencies, bodies and joint undertakings are subject to their own discharge procedures.

The European Union Agency for Network and Information Security : ENISA, which is located in Heraklion (EL), was established under Regulation 460/2004/EC of the European Parliament and of the Council with a view to enhancing the Union's capability to prevent and respond to network and information security problems.

In 2017, the previous work and impact of ENISA was reviewed by external consultants which resulted in a successful outcome being that ENISA has made a positive contribution to cybersecurity in Europe over the last several years.

As regards the Agency’s accounts , these are presented in detail in the document on the consolidated annual accounts of the European Union for 2017:

Commitment appropriations :

available: EUR 11 million; made: EUR 11 million.

Payment appropriations :

available: EUR 12 million; made: EUR 11 million.

For further details on expenditure, please refer to the final accounts of the ENISA .