Decision in case 1324/2017/LM on how the European Commission appointed the Director General of its Internal Audit Service
Case 1324/2017/LM - Opened on Monday | 04 December 2017 - Decision on Tuesday | 23 July 2019 - Institution concerned European Commission (No maladministration found )
The case concerned how the European Commission appointed its internal auditor, who had formerly served as the Commission’s accounting officer. The complainant contended that, according to international audit standards, internal auditors should not assess activities for which they were responsible over the course of the previous year. Thus, the Commission should not have appointed the former accounting officer as internal auditor before this ‘cooling off period’ of one year had elapsed.
The Commission argued that the cooling off period did not apply to this case. However, in order to avoid any perception that there could be a conflict of interest, the Commission ensured that the internal auditor would not be in charge of any audit related to his previous responsibilities.
The Ombudsman found that the Commission had put in place adequate measures to prevent any conflict of interest arising. She thus closed the inquiry with a finding of no maladministration.
Background to the complaint
1. The Internal Audit Service (IAS) is a Directorate of the European Commission that provides independent advice, opinions and recommendations on the quality and functioning of internal control systems in the European Commission and EU Agencies. The Director-General of the Internal Audit Service (IAS) functions as the internal auditor of the Commission. The internal auditor is to act independently when producing audit reports.
2. A new internal auditor and Director General of IAS was appointed as of 1 March 2017. From 2012 to 2017, this person was the Commission’s accounting officer and Deputy Director-General of the Commission’s Directorate General for Budget. The Directorate General for Budget is the Commission’s department responsible for managing the budget of the European Union. The Commission's accounting officer is responsible for implementing payments, collecting revenue, keeping the accounts, preparing and presenting the Commission’s and the EU’s accounts, as well as laying down the accounting rules and methods.
3. The Commission announced the appointment of the new internal auditor in November 2016. In January 2017, the complainant wrote to the Commission, arguing that the newly appointed internal auditor was in a conflict of interest situation because he would be reviewing budget management decisions taken by himself in his previous position as accounting officer. The Commission informed the complainant that the internal auditor had communicated to IAS staff that he would not participate in the review of any of his previous decisions. The Commission also stated that its Audit Progress Committee, which supervises the work of IAS, had been informed of these arrangements.
4. The complainant did not consider the measures taken by the Commission to be sufficient and turned to the Ombudsman in July 2017.
5. The Ombudsman opened an inquiry to assess whether the measures put in place by the Commission ensure organisational independence.
6. In the course of the inquiry, the Ombudsman’s inquiry team met with the relevant departments of the Commission and inspected the Commission's file on the matter. The Ombudsman also received the Commission’s reply to the complaint, as well as the complainant’s comments on the Commission's reply.
The general measures put in place by the Commission
Arguments presented to the Ombudsman
7. The complainant argued that budget management is a shared responsibility of both the authorising officer and its accounting officer. One of the duties of the accounting officer is to determine whether the information on which payments are based is sound. The accounting officer must thus be regarded as responsible for certain budget management decisions.
8. In the complainant’s view, the Commission therefore failed to ensure compliance with international audit standards by allowing someone to take up the post as internal auditor immediately after having worked as accounting officer. According to the complainant, this has happened several times in the Commission. In accordance with international audit standards, “internal auditors must be objective” and “have an impartial, unbiased attitude and avoid any conflict of interest”. International audit standards further require that “internal auditors must refrain from assessing specific operations for which they were previously responsible. Objectivity is presumed to be impaired if an internal auditor provides assurance services for an activity for which the internal auditor had responsibility within the previous year”. The complainant therefore argued that, to respect international audit standards, there must be a gap of at least one year before someone who has worked as an accounting officer can be appointed internal auditor.
9. The complainant stated that, as the internal auditor is responsible for drafting the IAS’s work programme, this would allow him to cover up possible problematic aspects of his previous responsibilities as accounting officer. The complainant thus considered the appointment particularly worrying. In the complainant’s view, the Commission should have organised a proper selection procedure and published a vacancy notice in the Official Journal of the EU.
10. The Commission maintained that the newly appointed internal auditor is carrying out his duties in full compliance with the EU’s Financial Regulation and the International Standards for the Professional Practice of Internal Auditing (IPPF Standards).
11. In this regard, the Commission argued that it is the authorising officer, and not the accounting officer, who is responsible for implementing the budget, ensuring the legality of budget implementation and putting in place specific internal control systems for budget management decisions. Furthermore, IAS does not directly check the Commission’s accounts. It is the task of the European Court of Auditors to audit the Commission’s accounts.
12. Nevertheless, the Commission put in place arrangements to avoid any actual or potential conflicts of interests. The newly appointed internal auditor signed a note on 7 March 2017, in which he informed IAS staff about the measures taken by the Commission to avoid any “potential or only perceived conflict of interests” as regards his former responsibilities as accounting officer. In particular, he stated that “I shall not be involved in any preparation, or direct or indirect supervision of audit work or in any validation of audit documents (...) that relate to operations that I was responsible for before joining the IAS”. He informed IAS staff that a Director in IAS would be carrying out the audit tasks during a one-year cooling-off period, in accordance with international audit standards.
13. In addition, the arrangement to have a Director to carry out audits of operations for which the internal auditor was previously responsible continued to apply for another year following the one-year cooling-off period. In line with these arrangements, for the period March 2017 to March 2019, the Director was in charge of all audits related to the internal auditor’s previous roles. In that regard, the Director carried out the risk assessment and selection of audits on the operations for which the internal auditor was previously responsible. The internal auditor was not involved at all in these audits. The IAS informed the auditees of these arrangements in the documents defining the scope of the relevant audits, the so-called “audit scoping memorandums”.
14. The Commission further stated that the Audit Progress Committee had found the measures taken to address the risk of conflicts of interest adequately in line with international audit standards and best practice.
15. Regarding the procedure for appointing the internal auditor, the Commission explained that he was appointed through a “transfer” from one post to another, in accordance with the rules of the EU Staff Regulations. Advertising the post in the Official Journal would not have been useful, as the most suitable candidates for this kind of post have a thorough knowledge of the Commission’s budget management procedures and thus already work at the Commission.
The Ombudsman's assessment
16. According to the EU Financial Regulation, an institution’s internal auditor may not be at the same time that institution’s accounting officer (or authorising officer). The same person may thus not carry out operational functions at the same time as checking those functions. However, the Financial Regulation does not prohibit an accounting officer from subsequently becoming an internal auditor. At the same time, as correctly pointed out by the complainant, international audit standards set out that “internal auditors must refrain from assessing specific operations for which they were previously responsible. Objectivity is presumed to be impaired if an internal auditor provides assurance services for an activity for which the internal auditor had responsibility within the previous year”. The complainant seems to consider this to mean that there must be a gap of at least one year between working as an accounting officer and being appointed internal auditor. The Ombudsman does not agree with that interpretation of the international audit standards. The Ombudsman’s understanding is that, if an accounting officer subsequently becomes an internal auditor, the institution has to put in place measures to safeguard the objectiveness of the auditing and to ensure that the internal auditor’s function is carried out in an objective, impartial and unbiased manner. In a case like this one, which concerns the very top management of the Commission’s Internal Audit, the measures have to be particularly rigorous, also bearing in mind the importance of public perception.
17. The Ombudsman has carefully considered the detailed explanations provided by the Commission, both in its written reply and during the meeting with the Ombudsman’s inquiry team. She finds that the Commission has put in place appropriate measures to avoid potential conflicts of interest and to safeguard the objectiveness of the internal auditor’s function (the internal auditor has committed not to review work that he was previously responsible for).
18. The Ombudsman welcomes the fact that the Commission chose to apply specific measures for two years. She, however, expects that the Internal Auditor will recuse himself, if, even after that two year period has expired, he finds himself in the situation of auditing operations he was responsible for while working as accounting officer.
19. Regarding the procedure for appointing the internal auditor, the Commission may appoint senior management either by publishing vacant posts, or by reassigning managers who already occupy a post of the same type. The internal auditor post is a director-general level post. The person appointed internal auditor already held a post of a sufficiently high grade. It was thus possible to reassign him to the post of internal auditor, without any need to publish a vacancy. This explains why, previously, the Commission has appointed accounting officers as internal auditors.
On whether the person to whom internal auditing tasks were temporarily assigned was sufficiently independent
Arguments presented to the Ombudsman
20. Regarding the measure taken by the Commission to have a Director do the internal auditing related to the internal auditor’s previous role as accounting officer, the complainant pointed out that the Director is a direct subordinate of the internal auditor and that the internal auditor may thus influence the Director’s career. The complainant argued that this casts doubt on the factual objectivity with which the Director can carry out the audit of operations for which his manager was previously responsible. The complainant contended that it is particularly worrying that the internal auditor signed the Director’s staff appraisal for the year 2017. Criticizing the work carried out by the internal auditor in his previous role could have led to a less favourable appraisal report for the Director.
21. The Commission referred to the definition of conflict of interests laid down by the Organisation for Economic Cooperation and Development (OECD). According to the OECD definition, a conflict to interest “involves a conflict between the public duty and private interests of a public official, in which the public official has private-capacity interests which could improperly influence the performance of their official duties and responsibilities”. The Commission stated that the mere fact that an EU staff member, in the exercise of his duties, has to deal with matters that may affect interests of his manager does not give rise to a conflict of interest.
22. Nevertheless, the Commission considered the staff appraisal as a ‘merely procedural step’. The Director’s appraisal report for 2017 was a carryover of the report for 2016, which was signed by the Commission First Vice President who was his line manager at the time. The content of the report for the year 2017 is thus identical with that for the year 2016.
23. The Commission further stated that EU staff members and qualified auditors are subject to high ethical standards. EU staff members are required to fulfill their obligations in spite of potential negative reactions from managers. A staff member who receives an order that he or she considers to be irregular or likely to give rise to serious difficulties must inform his line manager. He shall not suffer any prejudice on that account. Furthermore, EU staff members have to inform the hierarchy or the European Anti-Fraud Office (OLAF) of facts liable to constitute possible illegal activity. Therefore, it would be a serious breach of the obligations under the Staff Regulations if an EU staff member is penalised, by way of a less favourable staff appraisal report, for having fulfilled his or her obligations under the same Regulations. Were such a situation to arise, the EU staff member has recourse to an appeal procedure. For senior managers, such as the Director, the appeal procedure would involve the responsible Commissioner.
The Ombudsman's assessment
24. Although the risk expressed by the complainant exists in theory, the applicable rules and procedures provide sufficient checks and balances to prevent this from happening in practice. In this context, the Ombudsman considers that the fact that the internal auditor signed the Director’s appraisal report does not amount to maladministration.
25. However, she notes that, at the beginning of 2018, the Commission was still not in a position to answer the question how the staff appraisal procedure for the two senior managers in question would be organized for the year 2017. In particular, it could not say who would sign the Director’s staff appraisal report for 2017. The Ombudsman encourages the Commission, for the future, to ensure, to the extent possible, that staff members know in advance who will be responsible for their appraisal.
Based on the inquiry, the Ombudsman closes this case with the following conclusion:
There was no maladministration by the Commission in how it appointed the Director General of its Internal Audit Service.
The complainant and the European Commission will be informed of this decision.
 See, in this respect, point 3.5 of the Communication to the Commission from President Juncker and First Vice-President Frans Timmermans: Governance in the European Commission available at https://ec.europa.eu/info/sites/info/files/c_2017_6915_final_en.pdf
 The Audit Progress Committee (APC) oversees the work of the IAS. The APC consists of nine members, that is six Commissioners and three external persons who are designated after an external procedure (see APC mission charter). It is chaired by First Vice-President Timmermans. It meets regularly and assesses the audit planning and the final audit report of the IAS, which is addressed to the audit APC secretariat.
 The authorising officer in each institution is responsible for implementing revenue and expenditure operations and for ensuring compliance with the requirements of legality and regularity.
 In accordance with Article 68 of the Financial Regulation. The Financial Regulation is Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council of 25 October 2012 on the financial rules applicable to the general budget of the Union and repealing Council Regulation (EC, Euratom) No 1605/2002, available at: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:02012R0966-20160101&from=EN. See also Article 52 of Commission delegated Regulation (EU) No 1268/2012 of 29 October 2012 on the rules of application of Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council on the financial rules applicable to the general budget of the Union (‘Rules of Application’).
 Article 98(1) of the Financial Regulation states that “[e]ach institution shall establish an internal auditing function which shall be performed in compliance with the relevant international standards. The internal auditor appointed by the institution shall be accountable to the latter for verifying the proper operation of budgetary implementation systems and procedures. The internal auditor may be neither authorising officer nor accounting officer” (emphasis added).
 International Standards for the Professional Practice of Internal Auditing (IPPF Standards).
 Standard 1100 “Independence and objectivity” of the International Standards for the Professional Practice of Internal Auditing https://na.theiia.org/translations/PublicDocuments/IPPF-Standards-2017-German.pdf
 Standard 1120 “Individual objectivity”.
 See standard 1130 A.1 “Impairment to independence and objectivity”.
 In particular, Standard 1130 A.1 of the IPPF Standards, available at: https://na.theiia.org/standards-guidance/Public%20Documents/IPPF%202013%20English.pdf
 Article 66(1) of the Financial Regulation.
 Article 287 Treaty on the Functioning of the European Union (TFEU).
 Point 1130.A1 of the “International Standards for the Professional Practice of Internal Auditing” provides that “Internal auditors must refrain from assessing specific operations for which they were previously responsible. Objectivity is presumed to be impaired if an internal auditor provides assurance services for an activity for which the internal auditor had responsibility within the previous year”.
 On 1 March 2018, the internal auditor issued a new note to IAS staff in this regard.
 Minutes of meeting of 7 March 2018, inspected by the Ombudsman’s inquiry team.
 See Article 7 of the Staff Regulations of Officials and the Conditions of Employment of Other Servants of the European Economic Community and the European Atomic Energy Community:http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A01962R0031-20140501
 Article 98 of the Financial Regulation.
 See point 4 of the Compilation Document on Senior Officials Policy.
 A Deputy Director-General post.
 Article 21(a) of the Staff Regulations.
 Article 22(a) of the Staff Regulations.