The European Parliament,

–  having regard to the final annual accounts of the European Union Agency for Network and Information Security for the financial year 2016,

–  having regard to the Court of Auditors’ report on the annual accounts of the European Union Agency for Network and Information Security for the financial year 2016, together with the Agency’s reply(1),

–  having regard to the statement of assurance(2) as to the reliability of the accounts and the legality and regularity of the underlying transactions provided by the Court of Auditors for the financial year 2016, pursuant to Article 287 of the Treaty on the Functioning of the European Union,

–  having regard to the Council’s recommendation of 20 February 2018 on discharge to be given to the Agency in respect of the implementation of the budget for the financial year 2016 (05941/2018 – C8‑0071/2018),

–  having regard to Article 319 of the Treaty on the Functioning of the European Union,

–  having regard to Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council of 25 October 2012 on the financial rules applicable to the general budget of the Union and repealing Council Regulation (EC, Euratom) No 1605/2002(3), and in particular Article 208 thereof,

–  having regard to Regulation (EU) No 526/2013 of the European Parliament and of the Council of 21 May 2013 concerning the European Union Agency for Network and Information Security (ENISA) and repealing Regulation (EC) No 460/2004(4), and in particular Article 21 thereof,

–  having regard to Commission Delegated Regulation (EU) No 1271/2013 of 30 September 2013 on the framework financial regulation for the bodies referred to in Article 208 of Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council(5), and in particular Article 108 thereof,

–  having regard to Rule 94 of and Annex IV to its Rules of Procedure,

–  having regard to the report of the Committee on Budgetary Control (A8-0114/2018),

1.  Grants the Executive Director of the European Union Agency for Network and Information Security discharge in respect of the implementation of the Agency’s budget for the financial year 2016;

2.  Sets out its observations in the resolution below;

3.  Instructs its President to forward this decision, and the resolution forming an integral part of it, to the Executive Director of the European Union Agency for Network and Information Security, the Council, the Commission and the Court of Auditors, and to arrange for their publication in the Official Journal of the European Union (L series).

(1) OJ C 417, 6.12.2017, p. 160. (2) OJ C 417, 6.12.2017, p. 160. (3) OJ L 298, 26.10.2012, p. 1. (4) OJ L 165, 18.6.2013, p. 41. (5) OJ L 328, 7.12.2013, p. 42.

The European Parliament,

–  having regard to the final annual accounts of the European Union Agency for Network and Information Security for the financial year 2016,

–  having regard to the Court of Auditors’ report on the annual accounts of the European Union Agency for Network and Information Security for the financial year 2016, together with the Agency’s reply(1),

–  having regard to the statement of assurance(2) as to the reliability of the accounts and the legality and regularity of the underlying transactions provided by the Court of Auditors for the financial year 2016, pursuant to Article 287 of the Treaty on the Functioning of the European Union,

–  having regard to the Council’s recommendation of 20 February 2018 on discharge to be given to the Agency in respect of the implementation of the budget for the financial year 2016 (05941/2018 – C8‑0071/2018),

–  having regard to Article 319 of the Treaty on the Functioning of the European Union,

–  having regard to Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council of 25 October 2012 on the financial rules applicable to the general budget of the Union and repealing Council Regulation (EC, Euratom) No 1605/2002(3), and in particular Article 208 thereof,

–  having regard to Regulation (EU) No 526/2013 of the European Parliament and of the Council of 21 May 2013 concerning the European Union Agency for Network and Information Security (ENISA) and repealing Regulation (EC) No 460/2004(4), and in particular Article 21 thereof,

–  having regard to Commission Delegated Regulation (EU) No 1271/2013 of 30 September 2013 on the framework financial regulation for the bodies referred to in Article 208 of Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council(5), and in particular Article 108 thereof,

–  having regard to Rule 94 of and Annex IV to its Rules of Procedure,

–  having regard to the report of the Committee on Budgetary Control (A8-0114/2018),

1.  Approves the closure of the accounts of the European Union Agency for Network and Information Security for the financial year 2016;

2.  Instructs its President to forward this decision to the Executive Director of the European Union Agency for Network and Information Security, the Council, the Commission and the Court of Auditors, and to arrange for its publication in the Official Journal of the European Union (L series).

(1) OJ C 417, 6.12.2017, p. 160. (2) OJ C 417, 6.12.2017, p. 160. (3) OJ L 298, 26.10.2012, p. 1. (4) OJ L 165, 18.6.2013, p. 41. (5) OJ L 328, 7.12.2013, p. 42.

The European Parliament,

–  having regard to its decision on discharge in respect of the implementation of the budget of the European Union Agency for Network and Information Security for the financial year 2016,

–  having regard to Rule 94 of and Annex IV to its Rules of Procedure,

–  having regard to the report of the Committee on Budgetary Control (A8-0114/2018),

A.  whereas in the context of the discharge procedure, the discharge authority stresses the particular importance of further strengthening the democratic legitimacy of the Union institutions by improving transparency and accountability, and implementing the concept of the performance-based budgeting and good governance of human resources;

B.  whereas, according to its statement of revenue and expenditure(1), the final budget of the European Union Agency for Network and Information Security (the ‘Agency’) for the financial year 2016 was EUR 11 033 974,16, representing an increase of 9,64 % compared to 2015;

C.  whereas the Union's contribution for the financial year 2016 to the Agency's budget amounted to EUR°10 120 000, representing an increase of 10,53 % compared to 2015;

D.  whereas the Court of Auditors (the ‘Court’), in its report on the Agency’s annual accounts for the financial year 2016 (the ‘Court's report’), has stated that it obtained reasonable assurances that the Agency’s annual accounts are reliable and that the underlying transactions are legal and regular;

Follow-up of the 2013, 2014 and 2015 discharges

1.  Notes with concerns that:

Budget and financial management

2.  Notes that budget monitoring efforts during the financial year 2016 resulted in a high budget implementation rate of 98,47 %, representing a decrease of 1,53 % compared to 2015, and that the payment appropriations execution rate was 89,18 %, representing an decrease of 3,71 % compared to 2015;

Commitments and carryovers

3.  Notes from the Court’s report that the carry-overs of committed appropriations for Title II (administrative expenditure) were at EUR 300 000 (25 %), compared to EUR 150 000 (22 %) in 2015, i.e. EUR°150°000 more; notes that those carry-overs primarily related to investments in IT and a service car near year end - for official use only;

4.  Notes that carry-overs are often partly or fully justified by the multiannual nature of the agencies’ operational programmes, do not necessarily indicate weaknesses in budget planning and implementation and are not always at odds with the budgetary principle of annuality, in particular if they are planned in advance by the Agency and communicated to the Court;

Staff policy

5.  Observes from the establishment plan that 43 posts (out of a total of 48 posts authorised under the Union budget) were occupied on 31 December 2016, compared to 45 in 2015;

6.  Notes that on 31 December 2016, the gender balance ratio was 42,1 % female to 57,9 % male staff; notes that all three senior management positions were occupied by men; notes, however, that the gender balance among senior management changed by the end of 2017 so that two out of three Head of Unit posts were occupied by women;

7.  Notes from the Court´s report that in 2016, the Agency moved eight additional staff to Athens, reducing the number of staff in Heraklion to 14; notes from the Agency’s reply that a total of eight members of staff are expected to be in Heraklion at the end of 2017; highlights the fact that, according to the Court´s 2013 report, it is likely that costs could be further reduced if all staff were centralised in a single location; calls on the Agency to report to the discharge authority on the possible measures to improve the situation;

8.  Notes that the Agency experiences difficulties in recruiting, attracting and holding suitably qualified staff, mainly due to the types of post that are being offered (contract agents posts) and the low coefficient factor which applies to salaries of the Agency’s employees in Greece; calls on the Agency to report to the discharge authority on any measures taken to mitigate those difficulties;

9.  Notes that on average the Agency’s staff was on sick leave for six working days in 2016; observes that the number of days spent per staff member on well-being activities in 2016 was two days;

10.  Notes with satisfaction that the Agency has established a network of confidential counsellors for prevention and mediation of work-related conflicts; notes that the Agency organised internal training and awareness raising activities;

11.  Notes that the Agency has put in place a policy on protecting the dignity of the person and preventing psychological and sexual harassment and provides regular training on preventing harassment;

12.  Notes that the Agency uses official vehicles but does not allow their private use;

Prevention and management of conflicts of interests, transparency and democracy

13.  Notes with concern that only the CVs of the Chair of the management board and the executive director are available on the Agency’s webpage; notes with satisfaction that the declarations of interest of the members of the management board, of the executive director and of the permanent stakeholders group have been published;

14.  Notes that a whistleblowing policy is being discussed between the Union’s decentralised Agencies and that a common policy and guidelines will be adopted in 2018; calls on the Agency to report to the discharge authority on the implementation of that policy;

15.  Points out that the Agency has not yet provided any specific initiative to improve transparency in its contacts with lobbyists and stakeholders; calls on the Agency to enact a proactive lobby transparency policy without further delay and to report to the discharge authority on any measures taken addressing this issue; notes from the Agency's reply that they are in the process of writing a policy addressing the issue;

16.  Notes that the Agency makes public the minutes of its management board meetings as soon as they are approved;

17.  Notes that in 2016 the Agency did not receive any request for access to documents;

Main achievements

18.  Welcomes the three main achievements identified by the Agency in 2016, namely:

Internal audit

19.  Notes that the Agency had no open recommendation by the Commission’s internal audit service (IAS) in 2016; notes that in September 2016, the IAS performed an agency risk assessment which shows the next three topics for auditing: stakeholders’ involvement in the deliverables, human resources and IT; notes that the Agency will take immediate action regarding the construction of a quality management system as well as in implementation of its risk management policy; calls on the Agency to report to the discharge authority on the implementation of those actions;

Internal control

20.  Notes from the Agency that the extensive ex-post control of the financial year 2015, in line with internal control standard No 8 ‘Processes and Procedures’, resulted in a number of recommendations, all of which were addressed during 2016; acknowledges that 267 financial transactions representing 76,43 % of the 2015 Agency’s budget were controlled, resulting in one issued recommendation regarding the delay of payments; acknowledges that the delay did not generate any interest to be paid; notes with satisfaction that the Agency has focused intensively on the verification of results before transactions are initiated (ex-ante verification), in order to achieve the best control possible;

Other comments

21.  Notes that, according to the Court´s report, the 2015 external evaluation, delivered in May 2016, concluded that the Agency’s work and outputs respond to a need for network information security across the Union and within Member States and that the Agency effectively meets its stakeholders’ expectations; notes, however, that there is a need to improve communication between the Agency and its stakeholders, who find the Agency’s mandate and outreach too limited; notes from the Agency´s reply that that the management board is discussing the future of the Agency and the best way to reach the Agency’s stakeholders as well as the way to enhance the outreach of the Agency within the available human and financial resources; calls on the Agency to report to the discharge authority on the measures taken to improve the situation;

22.  Welcomes the fact that the Agency started to put in place a quality management system during 2016; notes, that the quality management manual as well as standard operation procedures and work instructions were drafted based on ISO 9001 standards; notes with satisfaction that all those documents are in the phase of revision by the management and will be implemented in 2017; calls on the Agency to report on the discharge authority on the progress made;

23.  Welcomes the fact that the Agency has been, with the aim of ensuring a cost-effective and environmentally friendly working place, recycling paper, glass and plastics, encouraging staff to avoid printing documents and has introduced an electronic system for internal workflows which has significantly reduced the use of physical files;

24.  Welcomes the fact that the Agency has, with the aim of reducing or offsetting CO2 emissions, encouraged the use of electronic means of communication as an alternative to physical travel, and implemented the ‘Greenhouse Gas Protocol (GHG) Transport tool’ for the first time in 2017 in order to compile the statistical data of business travel undertaken by Agency staff;

o
o   o

25.  Refers, for other observations of a cross-cutting nature accompanying its decision on discharge, to its resolution of 18 April 2018(2) on the performance, financial management and control of the agencies.

(1) OJ C 84, 17.3.2017, p. 7. (2) Texts adopted, P8_TA(2018)0133.