Changes from report parliamentary committee draft to plenary report

Added40. Welcomes the Court's Diversity and Inclusion Action Plan 2021-2025; notes with satisfaction the organisation of the third Disabilities Awareness Week and interinstitutional initiatives to foster inclusivity; emphasizes the ECA's efforts, including its survey on workplace accessibility, participation in the Ombudsman Award for Good Administration, and the external audit on building accessibility in compliance with Luxembourg's 2023 accessibility legislation;

Added41. Emphasises the critical role of the Court as the Union’s independent external auditor and guardian of its finances, which requires the Court to uphold the highest standards of integrity, professionalism, and accountability, serving as a model institution to inspire confidence and credibility; recalls that, in accordance with Article 285 TFEU, the members of the Court must exercise complete independence and adhere to the highest ethical principles, demonstrating integrity, objectivity, professional conduct, dignity, commitment, and loyalty;

Ethical framework and transparency

42. Welcomes the fact that the internal rules on reporting serious irregularities (whistleblowing) were updated in order to make them clearer and more detailed and to provide more information to staff; notes that there were no whistleblowing cases at the Court in 2023; notes furthermore that, in 2023, the Court also launched the process of updating the Court’s rules on conducting administrative investigations and disciplinary procedures, which was finalised in early 2024;

Change 18

Changed31.43. Notes that, in 2023, the Court organised 3 training events specifically dedicated to ethics, which attracted 60 participants; takes into account the fact that the Court’s ethics-related courses were open to all staff, including managers, and that the standard courses are compulsory for newcomers and cover public ethics and the Court’s anti-harassment policy; regrets that the ethics-related courses were not compulsory to all staff on a regular basis;

44. Appreciates the fact that the Court has organised 6 training courses on fraud, including fraud in procurement, VAT fraud, and fraud in relation to the RRF; welcomes the fact that, in June 2023, the European Anti-Fraud Office (OLAF) provided training on interviewing in cases of suspected fraud and corruption; notes that, in November 2023, the Court joined the European Public Prosecutor’s Office (EPPO) and OLAF in organising a 2-day course on public procurement fraud in the Union;

Change 19

Added45. Is concerned by media’s report that an EPPO investigation on misuse of funds by the former President of the Court is currently blocked by the decision of the Court not to lift his immunity; requests the Court to fully cooperate with EPPO on any investigations they may activate and to report on the reasons for the decision not to lift the immunity;

Added46. Calls on the Court to ensure that all Members and senior staff publish their financial interests, gifts, and hospitality declarations in a public online database, in line with best practices in EU transparency rules;

Added47. Regrets that the Court has failed to fully cooperate with EPPO by refusing to lift the immunity of its former President and by denying EPPO access to conduct a search within its premises in relation to a probe into possible wrongdoing, which could be considered an interference with the proper conduct of an investigation, according to the EPPO; recalls that, as the Union’s external auditor, the Court is bound by the principles of accountability, integrity, and transparency, as well as the principle of mutual sincere cooperation between EU's institutions; calls on the Court to ensure that immunity is not invoked to hinder legitimate judicial proceedings and to take all necessary measures to ensure full compliance with interinstitutional cooperation in the prevention and investigation of fraud;

Added48. Notes with concern that, according to media reports, the European Public Prosecutor’s Office (EPPO) has requested the lifting of immunity of several ECA staff members in 2023 and that, to date, the Court has refused to grant this request; stresses that while immunity serves to protect the independence of EU institutions, it should not be misused to shield individuals from legitimate judicial scrutiny; considers that requests for the lifting of immunity should only be refused in exceptional circumstances; calls on the Court to provide a detailed justification to the discharge authority for its decision in this case, outlining the specific legal and procedural concerns that led to the refusal, if any; further urges the Court to maintain a high level of transparency and accountability in its cooperation with EPPO and other EU bodies responsible for combating fraud and misconduct;

49. Notes that, in 2023, neither OLAF nor the European Ombudsman initiated any investigations involving the Court;

Change 20

Changed34.50. NotesWelcomes that, in 2024, the Court, jointly with the Court of Justice, invited the Commission to participate in an interinstitutional dialogue with a view to agreeing on common rules regarding the use of official cars, which is in line with the remark included in Parliament’s resolutions of 11 April 2022 on discharge in respect of the implementation of the budgets of the Court of Auditors and of the Court of Justice; emphasises the call on all Union institutions to agree on a single system to be applied horizontally, which would reduce confusion and increase transparency and efficiency in the use of public money; notes that a working group will be created in the framework of the interinstitutional Preparatory Committee for Matters relating to the Staff Regulations; appreciates the Court’s readiness to align the rules with the applicable rules of the Commission;Commission, but reiterates the criticism already expressed on previous discharge resolutions on the new decision from 2022 concerning members’ travel, missions and use of drivers and cars, which is against the general principle that the use of the car fleet outside of the strict performance of the duties of the members of the Court should not take place under any circumstance;

51. Notes that, in 2023, the Court’s Internal Audit Service (IAS) made 16 audit recommendations with regard to ethics, the transparency portal, conflicts of interest for staff, the Ethics Committee and Members of the Court; notes that out of 16 recommendations, 5 recommendations were completed by 30 July 2024, 8 recommendations will be completed by the end of 2024, and the completion of 3 recommendations has been delayed;

Change 21

Added52. Welcomes the extension of scope of information published on Members’ mission, but recalls Parliament’s request to provide information about missions for the whole mandate of the Members; welcomes the revision of the Code of Conduct of members which forbid Members from holding any honorary position in political organisation, implementing Parliament’s request for Members not to have formalised political links; takes note that conclusions of the internal audit report on ethics was to be communicated to the EP President and the Chair of the Budgetary Control Committee in the third quarter of 2024, and invites the Court to share this with the Committee of Budgetary Control in its entirety; invites the Court to publish refusal decisions in cases where Members or staff declare conflicts of interest, ensuring greater transparency in the audit process;

53. Notes that all the Members of the Court have their primary residence in Luxembourg, as required by Article 10 of the Code of Conduct for the Members and former Members of the Court of Auditors;

54. Welcomes the fact that the Court has revised the policy on public access to documents, reflecting the evolution of European case law, and simplified the procedure for dealing with requests to access documents and with confirmatory requests; recalls the fact that application of the Scandinavian principle of public access to official records in the Union was a prerequisite for some Member States to join the Union and underlines the fact that non-delivery would be detrimental to the reputation of the Union as a community based on the rule of law;

Change 22

Changed38.55. Regrets that an annual list of contracts above Directive threshold (>EUR 140 000 for services/supplies; >EUR 5 382 000 for works) concluded in 2023 is not available on the website of the Court; calls on the Court to publish that list as a separate document without undue delay and ensure user-friendly access to it;

56. Appreciates and awaits with eagerness the Court’s consolidation of all internal anti-fraud strategy rules into one joint document;

Change 23

Changed40.57. CompletelyContinues supportsto reject the rationale of the Court for its decision not to join the Transparency Register, as it does not have a vested interest in influencing decision making, beyond providing facts and objective feedback about Union programmes; notes that all of the Court’s reports are publicly available and subject to a rigorous clearing procedure with the auditees; isreiterate awareits thatstrong call for the oppositeCourt scenarioto wouldjoin addthe anEU administrativeTransparency burdenRegister in order to theadhere Courtto andbasic wouldprinciples of transparency while at the same time not resultcreating inany moreobstacles transparency;to the full independence of the Court;

Change 24

Added58. Strongly encourages the Court to reconsider its position regarding the EU Transparency Register, established by the interinstitutional agreement of 20 May 2021 between the European Parliament, the Council of the European Union, and the European Commission on a mandatory transparency register1a;

Added59. Welcomes the significant progress made in 2023 towards establishing the Document Management Ecosystem (DOME), namely the delivery and implementation by means of concrete document approval processes of both the new electronic signature and the core approval module for PASS (Process to Approve, Sign and Send documents); encourages the Court to further pursue its objectives of digitalizing the review and approval workflows and improving their efficiency;

Added60. Notes that the Court continued being actively involved in the Emerging technology group of the Interinstitutional Committee for Digital Transformation; notes that the DATA Team (Data and Technology for Audit), established in 2021, continued working on the implementation of the development plan for better use of technology in support of the Court's audit objectives; notes in particular the preparation of an analysis of AI opportunities and challenges for the Court and for its audit work; recalls the importance of improving the digitalisation of the audit work; welcomes all the efforts in this direction that the Court continues to make, whereas digitalisation combined with the increased number of on-the-spot visits, can define a system of efficient and accurate audit work;

▸9 unchanged paragraphs

Digitalisation, cybersecurity and data protection

61. Commends the Court for good progress in implementing its 2022-2024 cybersecurity plan over the past two years; notes that seven of the high-priority tasks have been completed, six are underway and one is on hold; notes that two of the medium-priority tasks have been completed, four are ongoing and three have not yet been started;

62. Appreciates the fact that the following tasks are among those completed:

1. the deployment of an EDR solution on the endpoints and adoption of a cloud-based XDR solution that correlates the telemetry sent by the EDR agents with threat intelligence data from varied sources to detect indicators of compromise;

2. a revamp of the architecture and configuration of the SIEM platform, which has improved the system‘s performance and reliability, coupled with additional sources of logs that have been added to enhance the security monitoring of the IT environment;

3. the replacement of the VPN appliances for remote access with a zero-trust cloud-based SASE service, which reduces the attack surface and allows granular remote access to applications;

4. the reinforcement of the protection against email threats by enabling new features on email security filters that allow improved detection of both spam and malicious attachments;

5. the execution of pen tests of Court departments exposed to the internet;

6. the deployment of a software tool to protect the confidentiality of sensitive information transmitted in file shares;

Change 25

Removed43. Notes with appreciation that the Court conducts at least three simulated phishing exercises per year to raise users’ awareness of that cyber threat; notes furthermore that the Court conducts a comprehensive cybersecurity risk assessment every three years;

Added63. Urges the Court to develop a cybersecurity audit framework for EU institutions and agencies, ensuring harmonized security standards and resilience measures against cyber threats;

Removed44. Notes with relief that there was no trace of data exfiltration or lateral movement of the intruder to other Court IT systems during the July 2023 cyber-incident, during which one of the perimeter security gateways was compromised by the exploitation of a software vulnerability;

Added64. Notes with appreciation that the Court conducts at least three simulated phishing exercises per year to raise users’ awareness of that cyber threat; notes furthermore that the Court conducts a comprehensive cybersecurity risk assessment every three years; Suggests to the Court to organise on a regular basis compulsory training for al staff on cyber threat including good practices for a safe use of AI;

Added65. Notes with relief that there was no trace of data exfiltration or lateral movement of the intruder to other Court IT systems during the July 2023 cyber-incident, during which one of the perimeter security gateways was compromised by the exploitation of a software vulnerability; notes that the software vulnerability had been disclosed by the vendor just two days before the incident;

▸10 unchanged paragraphs

66. Commends the work of the Cybersecurity Service for the Union institutions, bodies, offices and agencies (CERT-EU), which notified the Court of the incident, helped to investigate its scope and performed the forensic analysis; notes that, in the aftermath of the incident, the Court has restored a clean backup of the system and applied the software update that remediated the vulnerabilities exploited by the attacker; notes furthermore that in the following weeks the Court gradually applied a few additional preventive measures recommended by CERT-EU to the appliances to ensure that any possible undetected trace of the malware was eradicated;

67. Notes with appreciation that the Court reviewed and updated its Cybersecurity Incident Response Plan in 2023 and created a form for recording such incidents in the IT service management tool; highlights the fact that the form took account of the lessons learned from the July 2023 incident in that it was geared towards collecting all information that could be useful in handling a cybersecurity incident;

Buildings

68. Notes that, in 2023, the work to upgrade the technical installations on all floors of the K2 building and optimise the use of its common spaces was completed; notes that the Court has committed EUR 6 445 635,82 from a total budget of EUR 6 902 185,54; commends the Court for not exceeding the estimated budget; calls on other Union institutions to follow the exemplary budgetary management of the Court;

69. Appreciates that, in February 2023, the results of an accessibility audit of all Court buildings to meet the needs of people with reduced mobility or other disabilities conducted by an external consultant were delivered; notes that the audit covered all three buildings, the common spaces, car parks and other spaces; is aware that the actions proposed are being reviewed and would normally be the subject of a specific project, but that their implementation will depend largely on budget availability;

Environment and sustainability

70. Notes that, in 2023, the Court invested a lot of its environmental impact reduction effort in energy-saving measures such as the replacement of traditional light bulbs with LEDs, the reduction of the number of hours of ventilation and the overhaul of certain technical systems in its buildings; notes furthermore that the Court introduced special energy-saving measures in the summer of 2023, which reduced electricity consumption by 12 % compared to the summer of 2022, generating savings of EUR 26 976;

71. Notes that, in 2023, the Court signed an agreement with the Luxembourgish authorities to establish a mobility plan; looks forward to updates about that initiative;

Interinstitutional cooperation

72. Highlights the fact that, in 2023, the Court’s auditors spent 1 370 days at Union institutions, bodies, offices and agencies and at various international organisations and private audit firms, compared to 945 days in 2022;

Change 26

Added73. Calls for the formalization of an annual interinstitutional dialogue between the ECA, European Parliament, Council, and Commission on budgetary control, ensuring systematic follow-up on audit findings and improved oversight of EU expenditure;

74. Recalls once again that effective cooperation between the Court and the Commission will remain limited unless the Commission adopts the Court’s methodology for assessing error rates, which is based on an independent and comprehensive evaluation of all rule breaches, in contrast to the Commission’s focus on recoverable errors;

Change 27

Changed53.75. Welcomes the fact that the Court cooperates closely with both OLAF and the EPPO, including by organising workshops and awareness-raising events and by exchanging knowledge and experience; furthermore notes that the Court, in 2023, forwarded 20 cases of suspected fraud to OLAF and 17 such cases to the EPPO; emphasizes its position that all suspicions of fraud should be promptly referred to OLAF and EPPO for thorough investigation;

Change 28

Added76. Calls on the Court to establish a structured fraud-detection collaboration mechanism with OLAF and EPPO, including real-time data-sharing agreements and a joint audit approach for high-risk EU funding areas;

▸5 unchanged paragraphs

77. Is convinced that a single integrated IT system for data-mining and risk scoring could be a valuable source of data, which would allow the Court, OLAF and the EPPO to strengthen their audit and control efforts; stresses that unlimited access should be provided to such a system and the data contained therein, that no unjustified restrictions should be placed on that access and that the exploration and use of further digital tools and emerging technologies should immediately be allowed as part of the Court’s audits;

78. Regrets that, despite improved access to European Investment Bank (EIB) documents and information, the Court lacks a mandate to audit operations financed with the EIB’s own funds; calls for that mandate to be granted to the Court, given the EIB’s mission to pursue Union objectives and its growing role in the Union’s economic and political landscape, which extends beyond utilising the Union budget to guarantee its operations; highlights Special Report 05/2023 of the Court entitled ‘The EU’s financial landscape - a patchwork construction requiring further simplification and accountability’ in which the Court stated that a public audit mandate should be established for all types of financing for Union policies;

79. Notes that, in 2023, the Court presented 29 special reports, 1 review and 1 opinion to 22 different Council committees and working parties; further notes that the same year Court representatives participated in 23 meetings focused on the discharge of the Union budget for the 2021 and 2022 financial years;

80. Notes with appreciation that the Members and management of the Court demonstrated active engagement in 2023, presenting their work at 120 meetings with national governments and governmental bodies across 25 Member States, the majority of which involved ministers or ministries of finance; further notes that in the same year, Members and staff of the Court presented their work at 91 meetings with national or regional parliaments in 19 Member States, primarily through committees focused on budgetary, financial, audit or EU affairs; urges the Court to intensify its engagement with the governments of countries where error rates are highest, fostering greater dialogue and collaboration in order to address those issues effectively;

Communication

Change 29

Changed58.81. Notes that, in 2023, the budget allocated for the Court’s communication and promotional activities amounted to EUR 225 000 with a utilisation rate of 81,13 % (EUR 182 549,84); notes that most of the budget was spent on both media monitoring services (EUR 81 650) and press actions (EUR 12 348), followed by expenditure on stakeholder relations, which mainly comprised the cost of a policy intelligence platform (EUR 57 891), communication activities (EUR 28 002,88), social media (EUR 1 486,52) and publications (EUR1(EUR 1 171,44);

▸4 unchanged paragraphs

82. Strongly supports the Court’s growing media strategy, which resulted in a record of more than 22 000 online press articles related to its audit reports, other publications or the Court in general, thus confirming the upward trend in coverage observed over the recent years (2022: 20 000; 2021: 18 000); highlights the fact that nearly 54 000 posts on social media shows the continuation of an organic growth, with numbers for 2022 being an outlier (2022: 110 000; 2021: 49 000);

83. Welcomes the fact that, in 2023, the Court issued 45 press releases in 24 Union languages, as well as various information notes, media advisories and ready-to-use audio-statements in certain languages; notes furthermore that the Court held 21 online press briefings and 6 additional country-specific press briefings for the annual report; highlights the fact that, altogether, the Court’s briefings have attracted 590 journalists, most representing major national media outlets in the Member States;

84. Notes with appreciation that, in 2023, the Court launched a new website, receiving over one and half million visits, with around 700 000 unique visitors, which represents an increase of more than 14 % compared to 2022; welcomes the fact that, by the end of 2023, the Court’s three main social media accounts (X (ex-Twitter), LinkedIn and Facebook) had attracted over 48 000 followers, up from 45 000 in 2022 and 39 000 in 2021;

85. Highly appreciates that the Court assesses the likely impact and usefulness of its work, as perceived by the readers of its reports at Parliament, the Council, the Commission, Union agencies, Member States’ permanent representations, Member States’ agencies and SAIs, NGOs, academia, the media and other parties; in that regard, notes that, since 2018, the Court has carried out anonymised electronic surveys to ask its readers to provide qualitative feedback on selected reports and make general suggestions for its work; stresses that, in 2023, 85 % of around 1 060 respondents considered the Court’s reports useful for their work, and 78 % felt that they had an impact.