Sittings · Document

DRAFT REPORT (2023/2165(DEC)) 2024-01-15

On discharge in respect of the implementation of the budget of the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) for the financial year 2022

Committee on Budgetary Control · Rapporteur: Petri Sarvamaa

PR_DEC_Agencies

1. PROPOSAL FOR A EUROPEAN PARLIAMENT DECISION

on discharge in respect of the implementation of the budget of the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) for the financial year 2022

(2023/2165(DEC))

– having regard to the final annual accounts of the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) for the financial year 2022,

– having regard to the Court of Auditors’ annual report on EU agencies for the financial year 2022, together with the agencies’ replies,

– having regard to the statement of assurance as to the reliability of the accounts and the legality and regularity of the underlying transactions provided by the Court of Auditors for the financial year 2022, pursuant to Article 287 of the Treaty on the Functioning of the European Union,

– having regard to the Council’s recommendation of … February 2024 on discharge to be given to the Agency in respect of the implementation of the budget for the financial year 2022 (00000/2024 – C90000/2024),

– having regard to Article 319 of the Treaty on the Functioning of the European Union,

– having regard to Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the financial rules applicable to the general budget of the Union, amending Regulations (EU) No 1296/2013, (EU) No 1301/2013, (EU) No 1303/2013, (EU) No 1304/2013, (EU) No 1309/2013, (EU) No 1316/2013, (EU) No 223/2014, (EU) No 283/2014, and Decision No 541/2014/EU and repealing Regulation (EU, Euratom) No 966/2012, and in particular Article 70 thereof,

– having regard to Regulation (EU) 2018/1726 of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA), and amending Regulation (EC) No 1987/2006 and Council Decision 2007/533/JHA and repealing Regulation (EU) No 1077/2011, and in particular Article 47 thereof,

– having regard to Commission Delegated Regulation (EU) 2019/715 of 18 December 2018 on the framework financial regulation for the bodies set up under the TFEU and Euratom Treaty and referred to in Article 70 of Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council, and in particular Article 105 thereof,

– having regard to Rule 100 of and Annex V to its Rules of Procedure,

– having regard to the opinion of the Committee on Civil Liberties, Justice and Home Affairs,

– having regard to the report of the Committee on Budgetary Control (A90000/2024),

1. Grants the Executive Director of the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) discharge in respect of the implementation of the Agency’s budget for the financial year 2022 / Postpones its decision on granting the Executive Director of the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) discharge in respect of the implementation of the Agency’s budget for the financial year 2022;

2. Sets out its observations in the resolution below;

3. Instructs its President to forward this decision, and the resolution forming an integral part of it, to the Executive Director of the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA), the Council, the Commission and the Court of Auditors, and to arrange for their publication in the Official Journal of the European Union (L series).

2. PROPOSAL FOR A EUROPEAN PARLIAMENT DECISION

on the closure of the accounts of the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) for the financial year 2022

(2023/2165(DEC))

– having regard to the Court of Auditors’ annual report on EU agencies for the financial year 2022, together with the agencies’ replies,

– having regard to Article 319 of the Treaty on the Functioning of the European Union,

– having regard to Rule 100 of and Annex V to its Rules of Procedure,

– having regard to the opinion of the Committee on Civil Liberties, Justice and Home Affairs,

– having regard to the report of the Committee on Budgetary Control (A90000/2024),

1. Approves the closure of the accounts of the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) for the financial year 2022 / Postpones the closure of the accounts of the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) for the financial year 2022;

2. Instructs its President to forward this decision to the Executive Director of the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA), the Council, the Commission and the Court of Auditors, and to arrange for its publication in the Official Journal of the European Union (L series).

3. MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION

with observations forming an integral part of the decision on discharge in respect of the implementation of the budget of the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) for the financial year 2022

(2023/2165(DEC))

– having regard to its decision on discharge in respect of the implementation of the budget of the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) for the financial year 2022,

– having regard to Rule 100 of and Annex V to its Rules of Procedure,

– having regard to the opinion of the Committee on Civil Liberties, Justice and Home Affairs,

– having regard to the report of the Committee on Budgetary Control (A90000/2024),

A. whereas, according to its statement of revenue and expenditure, the final budget of the European Union Agency for the Operational Management of LargeScale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) (the ‘Agency’) for the financial year 2022 was EUR 351 630 151, representing an increase of 62,41 % compared to 2021; whereas the Agency’s budget derives almost exclusively from the Union budget;

B. whereas the increase in the budget of the Agency for 2022 is mainly justified by the Agency’s additional tasks related to the management of new large-scale IT systems and the interoperability of IT systems;

C. whereas the Court of Auditors (the ‘Court’) in its report (the ‘Court’s report’) on the annual accounts of the Agency for the financial year 2022, states that it has obtained reasonable assurance that the Agency’s annual accounts are reliable and the underlying transactions as regards revenue are legal and regular in all material aspects; whereas the Court identified a total amount of payments of EUR 17,8 million made in 2022 of which EUR 10,9 million for payments linked to three specific contracts found irregular and EUR 6,8 million considered not to be compliant with the provisions of the associated framework contracts, representing in total 4,80 % of the payment appropriations available in 2022, thereby exceeding the materiality threshold set for the audit and resulting in a qualified opinion on the legality and regularity of payments underlying the accounts; whereas, except for those non-compliant payments, the Court concludes that the underlying transactions as regards payments for the year ended 31 December 2022 are legal and regular in all material respects;

Budget and financial management

1. Notes that the budget-monitoring efforts during the financial year 2022 resulted in a budget implementation rate of 91,13 % in commitment appropriations, which represents a decrease of 8,87 % compared to 2021; notes, furthermore, with concern, that the payment appropriations execution rate was 86,71 %, representing a decrease of 7,94 % compared to 2021;

2. Notes with concern from the Court’s report that the Agency had carried over EUR 14,4 million (23 %) of available 2022 commitment appropriations to 2023, whereas that amount included EUR 13,7 million (or 95 %) of appropriations under Title II, related to administrative expenditure (97 % in 2021); observes the recurrence of carry-overs of appropriations leading the Court to recall that recurrent high rates of carry-overs contradict the budgetary principle of anuality and are indicative of structural issues in the implementation of the budget or weak budgetary planning; takes note of the Agency’s reply that in 2022 carry-overs were performed for administrative activities which were necessary or recurrent, providing reassurance on the respect of sound financial management for the underlying operations; notes from the Agency's report with regard to the follow-up measures taken in light of the discharge in respect of the implementation of the budget of the Agency for the financial year 2021 (hereinafter The ‘Agency's follow-up report’) that the Agency has drawn up an action plan that includes several measures implemented as of 2023 with a view to respect the anuality principle and to reduce the level of carry-overs; notes in this context that the signature in Q4 2023 of the new framework contract for the provision of external support services is essential to reach those objectives; expects that the implementation of that action plan will lead to a significant improvement and calls on the Agency to report to the discharge authority on the progress made in that regard;

Performance

3. Welcomes the fact that the Agency uses certain tools as key performance indicators to assess the added value provided by its activities and to improve its budget management; notes that the Annual Work Programme for 2022 included 135 activities, with 90 activities delivered (67 %), 16 ongoing (12 %), 20 ongoing and delayed (15 %), and 9 activities postponed (7 %); notes the Agency’s new approach whereby its activities have been streamlined into portfolios and programmes to reflect the Agency’s operating model and interdependencies between projects and activities; invites the Agency to identify and report on the improvements achieved with that new approach;

4. Commends that the Agency adopted all statutory corporate programming documents and mandatory corporate reports, in line with regulatory requirements an within legal deadlines, such as the Single Programming Document 2023-2025; notes that the Agency also adopted a strategy implementation roadmap to align its strategic operational objectives and to monitor the implementation of the Agency’s long-term strategy for 2021-2027; notes further the Agency’s efforts to improve its multiannual and annual planning processes through a new tool (Anaplan); notes that the Agency used the Common Assessment Framework (CAF) to analyse its strengths and weaknesses which led to the delivery in April 2022 of a Self-Assessment Report with an action plan to serve the roadmap detailing the Agency’s priorities for operational development; notes that the Agency applied for the label of “Effective CAF user”;

5. Welcomes the Agency's continuing support in the implementation of Union policies in the areas of free movement of people and goods, common travel visa, border control, immigration and asylum, as well as in the cooperation between national law enforcement and judicial authorities, including with respect to combating organised crime, human smuggling and trafficking, and terrorism; expects a significant contribution of the Agency to the digitalisation of justice in order to improve cooperation between Union’s judicial authorities and providing better access to justice for Union citizens and businesses;

6. Recalls the Agency’s key role in ensuring the stable operation and continuous availability, as well as the evolution and maintenance of the Union's justice and home affairs (JHA) information systems such as the Schengen Information System (SIS), the Visa Information System (VIS) and the European Asylum Dactyloscopy database (Eurodac); recalls that those systems are critical in the areas of border control and law enforcement cooperation, visa insurance and checks and the examination of asylum applications; notes that in 2022, excluding some incidents that resulted in short-term unavailability and delays, all core business systems complied with their respective service-level agreements, with SIS availability at 99,94 %, VIS at 99,69 %, and Eurodac at 99,88 %;

7. Commends the entry into operation of the renewed SIS in March 2023 (postponed from November 2022); notes the progress made, however with delays at various levels, with regard to analysis, design, development and /or testing of the new JHA systems, namely the Entry/Exit System (EES), the European Travel Information and Authorisation System (ETIAS) and the European Criminal Records Information System on third-country nationals (ECRIS-TCN), as well as regarding the integration of those systems, including the shared biometric matching service; notes further that 947 carriers (both from inside and outside the Union) and 54 software providers for carrier registered with the Agency or applied for the registration in order to set-up system-to-system connections for EES and ETIAS; commends in this context the organisation of the industry roundtable titled “EES, ETIAS and Carriers Getting Ready for the Entry into Operation” and the carriers registration and awareness campaign to increase awareness and boost registration; acknowledges that VIS is undergoing major changes in line with the revised VIS Regulation; notes in this context that in 2022 the Agency launched two projects (Revised VIS and VIS interoperability) structuring the VIS evolution;

8. Notes further the progress made with regard to the new interoperability (IO) architecture that will integrate all the information systems managed by the Agency in order to improve information exchange and collaboration between law enforcement and judicial authorities across the Union; notes in this context, from the Agency’s 2022 Consolidated Annual Activity Report (CAAR), that while the Agency remained committed to delivering those new systems, the hindering effects of the supply chain disruptions, combined with the difficulties of some of the Agency's contractors to abide by the implementation schedules, resulted in delays that necessitated the review and revision of original plan; notes that such delays, in particular regarding the entry into operation of the EES central system, cornerstone of the interoperability architecture, have had immediate impact (“domino effect”) on the timeliness and execution of all interconnected projects; notes from the Agency’s follow-up report the measures taken to address this issue by endorsing a new strategy for the implementation of the EES, the minimum viable product approach and a new Interoperability Roadmap, with the full revision of the IO timeline comprised of a number of waves that aim to deliver the Interoperability Architecture components with intermittent releases every 6-9 months spanning to 2026; notes from the declaration of assurance of the Agency’s executive director that the extended timelines for the entry into operation of the EES programme is likely to impact the resources required to complete the development;

9. Notes that the Agency continued to deliver several other closely related statutory objectives, such as training for Member States on the use of JHA information systems, preparing statutory reports on their technical performance, annual statistics and lists of designated authorities; commends in this context that in 2022 the Agency delivered 48 trainings activities that reached over 3 000 participants, upgraded its e-learning platform and finalised its Member States Training Roadmap and the associated action plan; notes further that the Agency continued to expand its role in the EU's justice domain by starting preparations for the takeover of the e-CODEX system (a platform facilitating cross-border judicial proceedings through secure transmission of information), published a report on how the digitalisation of international travel will affect travellers headed to the Union, and co-authored a report with Eurojust on using artificial intelligence solutions to support cross-border cooperation in criminal justice;

Efficiency and gains

10. Notes from the Agency’s follow-up report, CAAR, the Agency’s replies to Parliament’s written questions, as well as from the Court’s report the measures it has taken to improve its energy efficiency and environmental performance, including with regard to climate neutrality objectives; notes in this context that in 2022 the Agency started to gradually implement its own environmental management system (MES), based on the principles of EMAS and the Commission’s European Green Deal Action Plan and adopted its environmental policy; notes that the full implementation of the EMS and, consequently, the EMAS registration are foreseen to be achieved by 2024; welcomes the Agency's participation in the EUAN Greening Network which offers the opportunity to benefit from materials from other Agencies with more experience in EMAS implementation; notes further that the Agency uses green public procurement criteria in business areas such as facility management, hardware projects and IT infrastructure and projects; commends the Agency for reporting on its environmental performance through a KPI that indicates the Agency’s carbon footprint; notes that the baseline for volumetric indicators for water, energy, paper consumption and waste production will be set in 2023 to be used for the calculation and evaluation of those indicators from then on;

11. Notes from the Agency's written replies to the Parliament’s horizontal questions that the Agency has concluded Service Level Agreements (SLA) with several Agencies for providing support in business continuity matters, as well as increasing efficiency in other areas of cooperation; notes in this context that the Agency has SLAs with Frontex and EUAA for hosting their disaster recovery sites and an annual SLA with Europol for the organisation of Joint Europol and eu-LISA Security Committee meetings; calls on the Agency to continue its cooperation with other agencies so that all available resources can be used; commends the Agency for its cooperation with the European Union Agency for Cybersecurity (ENISA) through an SLA that covers support services offered by ENISA on the planning, execution and evaluation of annual cybersecurity exercises;

12. Notes that in February 2022, the Agency adopted a Sourcing Strategy to clarify and harmonise its human resources planning in order to optimise the use of resources, in particular to balance the overall composition of the Agency’s human resources (i.e. the share of in-house staff to external service providers); notes further that the Agency achieved efficiency gains using existing reserve lists created during previous selection procedures and grouped profiles and longer reserve lists to cover several posts within one recruitment procedure;

13. Commends the Agency for the progress made in 2022 towards the digitalisation of its processes; notes in the area of human resources that the Agency implemented new SYSPER modules (the HR reporting and ATS); notes in the area of procurement that the Agency became familiar with the Public Procurement Management Tool (PPMT) and its requirements in order to meet the onboarding prerequisites which was successfully completed in 2023; notes the Agency applies the eSubmission module for calls for tender above EUR 15 000; notes further that the physical signature from tenderers has been discontinued since the introduction of that module ; calls on the Agency to step up its efforts towards the full implementation of the PPMT; notes lastly that in the area of prevention and management of conflicts of interest, the Agency digitalised the submission of the mandatory declarations or requests to implement the relevant rules;

Staff policy

14. Notes that, on 31 December 2022, the establishment plan was 89,3 % implemented, with 192 temporary agents (193 in 2021) appointed out of the 215 temporary agents authorised under the Union budget (compared to 213 authorised posts in 2021); notes that, in addition, 121 contract agents (CA) and 11 seconded national experts (SNEs) worked for the Agency in 2022, out of 167 CA and 11 SNEs authorised; notes that the number of budgeted CA posts increased by 35, from 132 to 167, due to the budget authorisation for the new tasks entrusted to the Agency (revised VIS, ETIAS, and Interoperability); notes that despite the efforts of the Agency, the staff turnover increased from 5,5 % in 2022 to 7,1 % in 2022 and the occupancy rate dropped at 82 %, lower than the Agency’s target of 94 %, in particular due to the number of short duration and lower grade posts that the Agency has to offer;

15. Notes with concern the composition of the Agency’s senior and middle management with respect to gender, with 12 men (86 %) and 2 women (14 %), of the management board with 50 men (82 %) and 11 women (18 %), and within the staff overall with 209 men (67 %) and 101 women (33 %); notes from the Agency’s follow-up report that the Agency continues the efforts to improve its overall gender balance focusing on communication and on the recruitment procedures to attract a higher number of female applicants; welcomes the Agency’s participation in 2022 in the online global career fair ‘Women in Tech’; welcomes further the appointment of the new Executive Director, thus reaching gender balance in senior management positions; calls on the Agency to continue its efforts towards gender balance at all levels through concrete actions that attract applications from women for posts offered by the Agency;

16. Commends the Agency for its efforts in the area of human resources (HR) striving to attract a diverse pool of candidates, to position the Agency as an employer of choice and to maintain talented staff; notes in this context that, in 2022, the Agency represented the EU Agencies Network (EUAN) at the virtual career fair for International Organisations and intensified its Employer Branding activities through dedicated campaigns such as testimonials of staff members in social media; commends the Agency for launching an Internal Mobility Programme Pilot, aimed at capitalising on existing staff members’ competencies and fostering continuous professional growth within the Agency for its people; notes in this context that the Agency started developing its competency-based HR management strategy and revising its competency framework which will have an impact on vacancy notices and assessments of candidates;

17. Commends the Agency’s policy for zero-tolerance on harassment; takes note that, in 2022, 3 administrative inquiries related to harassment were performed and concluded internally, with an additional case taken before the court; calls on the Agency to proceed swiftly with holding those responsible for misconduct accountable; notes that, as of 2022, the Agency has signed a contract with an external law firm in order to be able to deal promptly with an increasing demand for administrative inquires, including those linked to sexual and/or psychological harassment or to other disciplinary matters; notes that the Agency completed the selection of the new Confidential Counsellors, with five new counsellors selected and trained to support the organisation in promoting further respect and dignity at the workplace, to staff seeking assistance in a situation perceived as psychological or sexual harassment;

18. Notes the Agency’s measures to improve its employees experience and well-being; notes that a mental health programme for staff and their families was initiated, which includes a self-care subscription service, webinars and individual counselling sessions; notes that, upon derogation received in anticipation of Model decision, the Agency did not apply by analogy the Commission’s decision of 24 March 2022 on working time and hybrid working; notes that as of September 2022, the Agency applied a decision of the executive director on interim hybrid working arrangements; takes note that meanwhile the Agency adopted Model decision on 16 November 2023 with effective date of 1 January 2024; notes lastly, with appreciation, that the Agency has adopted the ‘Charter on diversity and inclusion’;

Procurement

19. Highlights from the Court’s report the observations that led to a qualified opinion due to the irregularity of several payments made in 2022 for a total of EUR 17,8 million in connection with seven specific contracts, representing 4,8 % of the total payment appropriations available in 2022; notes that the irregularity of those payments is mainly linked to deviations from the corresponding framework contracts; notes from the Agency’s replies to Parliament’s written questions that the irregularities with regard to payments made in 2022 can be grouped under three categories, namely: - amendment of fixed term contracts (EUR 6,5 million); - extension of specific contracts beyond the maximum allowed time period (EUR 3,7 million); - and lack of details on requirements in specific contracts (EUR 7,5 million); notes that some of those irregular payments, totalling EUR 10,5 million, relate to three specific contracts based on which payments were also made in 2021 and found irregular by the Court in its annual report on Union agencies for that year; notes from the statements made by the executive director of the Agency during the meeting of the Committee on Budgetary Control of 29 November 2023 (hereinafter ‘the statements of the executive director”) that six of the seven specific contracts identified in the Court’s report have expired without outstanding payments; notes from the Agency’s replies to the Court’s observations the measures it has taken to address them;

20. Notes with grave concern that 2022 was the third year in a row for which the Court issued a qualified opinion regarding the Agency’s procurement and contract management area; notes from the Agency’s replies to Parliament’s written questions, from the Agency’s follow-up report and from the statements of the executive director, the Agency’s action plan for an in-depth review of its processes in order to identify and remove the root causes of the recurrent observations of the Court in that area; expects therefore a lasting improvement as a result of implementing that action plan, in particular given that six of the seven specific contracts deemed by the Court irregular have expired without outstanding payments;

21. Highlights from the Court’s report that in 2022, just as in 2021, the Agency made payments based on a specific contract (of an amount of EUR 40 million) that did not properly implement the associated framework contract because it did not specify the details of the services acquired (quantities, date of deliveries); notes that under that contract the Agency paid EUR 7,5 million in 2022; acknowledges from the Agency’s comments included in the note of 13 November 2023 titled “2022 Discharge - ECA findings on eu-LISA. Brief note for MEPs” that the root cause of the indeterminate nature of that contract, signed at the end of 2018, was the need to preserve funding for the EES-VIS interoperability, for which the budgetary planning, outside the Agency’s control, shifted significantly from the actual adoption of the relevant legislation; notes that without that contract, the associated amount, necessary for the interoperability, would have been lost; notes from the Agency’s reply to the Court’s observation the corrective measures that the Agency has taken through an amendment to that contract whereby a more detailed description of services provided was added; notes that the Agency did not extend that contract, which expired in 2022; recalls in this context that delays in the adoption and implementation of relevant legal acts are key factors in determining the level of detail and precision that the Agency is able to offer when initially establishing framework contracts; notes from the Agency’s follow-up report the view that the shortening of the preparation of the implementing acts would have a direct impact on the Agency’s capacity to better plan its procurement and limit contractual changes;

22. Notes from the Court’s report that the Agency used a negotiated procedure to award a contract, without prior publication of a contract notice; notes that the Agency justified this decision on grounds of extreme urgency, against the advice of the Agency’s procurement and legal services; notes the reasons of the Court as to why the use of that procedure was not justified; notes nevertheless the Agency’s reply that a risk of maintenance gap of several months would have materialised because the timelines for implementing the EES programme formally changed at a later stage and the overall time necessary for the contract award and for transition to a new contractor was estimated to be of at least eight months; considers in this context that the Agency’s approach was a sensible one; notes from the Agency’s reply that the awarded contract has meanwhile expired;

23. Notes further from the Court’s report two observations regarding the Agency’s management and control systems; notes the first observation with regard to the acquisition of hardware (EUR 27,7 million) for which the price lists of the hardware vendors were not obtained and ex-ante checks were not performed; notes the second observation with regard to the procurement of a transversal operations framework contract (estimated value of EUR 490 million) whereas for six meetings of the evaluation committee no records of meetings had been kept and only the final report hand been signed; calls on the Agency to improve its internal control systems to avoid such shortcomings in the future;

24. Notes that the Agency has eight observations from the Court’s previous years reports (2017, 2018 and 2021) with status ‘open’; urges the Agency to close those observations without delay and inform the discharge authority of the progress made in this regard;

Prevention and management of conflicts of interest and transparency

25. Notes that the Agency has implemented decisions on the prevention and management of conflicts of interest for its staff and on the outside activities during and after service of the Agency; welcomes that all staff members have to submit the declarations of interest once in two years, with the exception of staff members involved in financial circuits and staff in senior management positions who have to submit such declarations annually; notes further that all Agency’s staff has the obligation to also submit such declarations at any time when the situation changes; notes that the Agency publishes on its website the declarations of interest and the CVs of the staff in senior management positions; welcomes that as of 2022, both declarations of interest and CVs of the management board members and their alternates are published;

26. Notes that in March 2022, the Agency adopted the revised guidelines on whistleblowing; takes note of the Agency’s statement that in 2022 it has increased the clarity and visibility of the separate communication channels available to the staff, such as confidential counsellors or for whistleblowing; welcomes further the adoption of the guidelines on public access to documents; welcomes the entering into force as of September 2022 of the Agency’s decision 09/08/2022 establishing a transparency register whereby meetings between the Agency’s senior management and economic operators are published on the Agency’s website;

Internal control

27. Acknowledges the importance of external audits on data protection compliance to ensure a high level of protection in connection with the Agency’s processing of personal data; notes that, in 2022, the Agency continuously followed up on implementing recommendations identified in the audits conducted by the European Data Protection Supervisor (EDPS) on SIS, VIS and Eurodac; notes that, in 2022, a new EPDS inspection was carried out on Eurodac, VIS and SIS II, whereas the audit focused on the overall IT security governance, security incidents and data breaches and methodology and practices for the secure development and testing of the systems, focusing on access control management in the different environments; takes note from the Agency's follow-up report that the status of the 2018 EDPS audit on VIS and SIS is ‘completed’ as all 43 recommendations have been completed, while the status of the 2019 EDPS audit on Eurodac is ‘partially implemented’ with 23 out of 29 recommendations completed;

28. Welcomes the Agency’s annual self-assessment of its internal control system in 2022 resulting in 81 % of the Agency’s internal control monitoring criteria being achieved or partially achieved; notes that the conclusion of that assessment is that the internal control system is present, functioning and effective, although some improvements are needed with regard to e.g. enforcement of accountability, ex-ante controls and contract management, among other; notes that a major deficiency on principle 10 ‘Selects and develops control activities’ under the component ‘Control activities’ persists for a third year in a row; notes that, in 2022, the Agency continued to strengthen its controls on information management with the revision of the Agency's document long-term preservation policy and document preservation procedures, and with the adoption of Guidelines on Public Access to Documents; calls on the Agency to continue its efforts to reduce weaknesses in the area of control activities in order to mitigate risks related to the achievement of policies, operational and internal control objectives;

29. Notes that at the end of 2022 the implementation rate of audit recommendations stemming from various audit and investigative bodies was 63 % with 20 recommendations implemented out of 32 recommendations due (12 recommendations were past the due date); notes that in total 33 recommendations were open at the end of 2022 out of which three were critical; calls on the Agency to implement the outstanding recommendations and to report to the discharge authority about the progress made;

30. Notes that, in 2022, the Agency requested the European Anti-Fraud Office (OLAF) to assess two cases of alleged fraud in recruitment procedures and one case of the possible existence of fraudulent activities on the part of a staff member; notes that, in response to all three requests, OLAF decided not to open an investigation case; notes that, in 2022, the Agency addressed recommendations from OLAF investigations related to cases OC/2020/0441-A2 and OC/2017/1121/A2; welcomes the adoption of the Agency’s Anti-Fraud Strategy 2022-2024 together with an action plan that comprises 12 actions;

Other

31. Notes that in 2022 the Agency was focused on ensuring the visibility of the Agency’s achievements and increasing public awareness of its role in serving the interests of the Union citizens and delivering IT services to its stakeholders; commends in this context the Agency for the completion of its new online portal ‘Discover eu-LISA 2.0’ which provides stakeholders with an updated overview on the Agency's core tasks and business areas and for the publication of a special booklet to commemorate its 10th anniversary, with the latter being marked by the organisation, in cooperation with the Czech Presidency of the Council, of the Agency’s annual conference '10 Years as The Digital Heart of Schengen' hosting 20 speakers and reuniting 388 participants; commends the Agency for having received in 2022 the Forbes Social Award for its innovative and inspirational initiatives in the field of public communication, standing out for its strong ethical vocation and its use of innovative communication strategies, techniques and tools; notes the improvement of the Agency’s social media metrics in 2022;

32. Notes that, in 2022, the Agency adopted a large number of security and business continuity plans for its core business systems, in order to guarantee a higher level of cybersecurity and resilience required by the legal instruments and organised a cybersecurity exercise to verify the effectiveness of the security measures implemented for the protection of the central SIS; notes that the Agency substantially increased the level of monitoring of the corporate IT systems connected to the internet due to the increased cyber threat level derived from the Russia's illegal invasion of Ukraine;

° °

33. Refers, for other observations of a cross-cutting nature accompanying its decision on discharge, to its resolution of [...] 2024 on the performance, financial management and control of the agencies.