Resolution (EU) 2019/1495 of the European Parliament of 26 March 2019 with observations forming an integral part of the decision on discharge in respect of the implementation of the budget of the European Union Agency for Network and Information Security for the financial year 2017

27.9.2019 EN Official Journal of the European Union L 249/249 RESOLUTION (EU) 2019/1495 OF THE EUROPEAN PARLIAMENT of 26 March 2019 with observations forming an integral part of the decision on discharge in respect of the implementation of the budget of the European Union Agency for Network and Information Security for the financial year 2017 THE EUROPEAN PARLIAMENT, — having regard to its decision on discharge in respect of the implementation of the budget of the European Union Agency for Network and Information Security for the financial year 2017, — having regard to Rule 94 of and Annex IV to its Rules of Procedure, — having regard to the report of the Committee on Budgetary Control (A8-0129/2019), A. whereas, according to its statement of revenue and expenditure (1), the final budget of the European Union Agency for Network and Information Security (the ‘Agency’) for the financial year 2017 was EUR 11 175 224,40, representing an increase of 1,28 % compared to 2016; whereas the budget of the Agency derives mainly from the Union budget; B. whereas the Court of Auditors (the ‘Court’), in its report on the Agency's annual accounts for the financial year 2017 (the ‘Court's report’), has stated that it obtained reasonable assurances that the Agency's annual accounts are reliable and that the underlying transactions are legal and regular; Budget and financial management 1. Notes with appreciation that budget monitoring efforts during the financial year 2017 resulted in a budget implementation rate of 99,99 %, representing an increase of 1,52 % compared to 2016; notes that the payment appropriations execution rate was 88,19 %, representing a slight decrease of 0,99 % compared to 2016; Cancellation of carryovers 2. Notes with concern that the cancellations of carryovers from 2016 to 2017 amounted to EUR 90 916, representing 9,39 % of the total amount carried forward, showing an increase of 3,67 % in comparison to 2016; Performance 3. Notes with satisfaction that the Agency uses certain key performance indicators (KPIs) to assess the added value provided by its activities and to enhance its budget management, focusing more qualitative indicators for the assessment of the achievement of its operational goals and more quantitative indicators for its administrative goals; notes, furthermore, that impact indicators show that the Agency's results exceeded the targets established in the Work Programme 2017, against the framework of the ENISA Strategy 2016–2020; invites the Agency to further develop the KPIs to better assess the outcome and impact of its activities, in order to gain advise on how to provide more added value for the Agency's outputs; 4. Notes with appreciation that, in 2017, the Agency started the process of helping Member States to implement Directive (EU) 2016/1148 (2) and that it compiled a data breach severity assessment tool, in collaboration with several Member States' authorities, in order to set up a coherent framework at Union level; 5. Notes in addition that in 2017 ENISA received the EU Ombudsman Award for Good Administration for Excellence in Innovation – Transformation; 6. Notes with appreciation that the Agency and the European Centre for the Development of Vocational Training signed a service-level agreement which enables them to share conference facilities and storage space among other synergies; 7. Notes that a study on the external evaluation of the Agency's performance over the 2013 to 2016 period was carried out on behalf of the Commission in 2017; calls on the Agency to report to the discharge authority on the outcome of this study and the respective actions taken to in order to address any recommendations made; (1) OJ C 116/05, 28.3.2018, p. 20. (2) Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (OJ L 194, 19.7.2016, p. 1).L 249/250 EN Official Journal of the European Union 27.9.2019 Staff policy 8. Notes with concern that, on 31 December 2017, the establishment plan was only 87,5 % executed, with 42 temporary agents appointed out of 48 temporary agents authorised under the Union budget (compared with 48 authorised posts in 2016); notes that, in addition, 29 contract agents and three seconded national experts worked for the Agency in 2017; 9. Notes that the Agency has adopted a policy on protecting the dignity of the person and preventing harassment; acknowledges that it organised training sessions and enabled confidential counselling; 10. Notes from the Court's report that in 2016, the Agency moved eight additional staff to Athens, reducing the number of staff in Heraklion to 14; notes that according to the Agency, at the end 2017, that number was further reduced to 11 staff members; highlights the fact that in accordance with the Court's 2013 Report, it is likely that costs could be further reduced if all staff were centralised in one location; calls on the Agency to report to the discharge authority on any possible measures to address the situation; 11. Notes with concern that the Agency finds it difficult to recruit, attract and hold suitably qualified staff, mainly due to the types of post that are being offered (contract agents posts) and the low correction coefficient factor which applies to the salaries of the Agency's employees in Greece; 12. Welcomes the suggestion of the Court to publish vacancy notices also on the website of the European Personnel Selection Office in order to increase publicity; understands the concern of the Agency for what concerns translation costs; 13. Regrets that, as pointed out by the Court, the hand-over process to the new accounting officer of the Agency was improperly carried out, in particular there was no hand-over report transmitted to the new accountant; notes from the Agency's reply that informal meetings took place in order to transfer knowledge and that the Agency will implement corrective actions to ensure adequate hand-over to new staff in the future; calls on the Agency to report to the discharge authority on the implementation of the corrective actions; Prevention and management of conflicts of interests and transparency 14. Notes the Agency's existing measures on and ongoing efforts to secure transparency, prevention and management of conflicts of interests, and whistleblower protection; points out with concern, however, that only the CVs of the executive director and the Chair of the management board (MB) are published on its website, and furthermore, that the Agency publishes only the executive director's declaration of conflicts of interests on its website, but not of the other senior management members; calls on the Agency to publish the CVs of all the members of the MB and the declarations of conflicts of interests of its senior management and to report to the discharge authority on the measures taken in this regard; Other comments 15. Notes with concern that, unlike most other agencies, the Agency did not carry out a comprehensive analysis of the likely impact of the United Kingdom's decision to withdraw from the European Union on its organisation, operations and accounts; notes from the Agency's reply that it has revised some of its relevant internal processes in that regard; calls on the Agency to report to the discharge authority on the measures taken in order to mitigate any risks involved; 16. Notes the Agency's moderate efforts to ensure a cost-effective and environment-friendly working place; points out that the Agency does not have any additional measures in place to reduce or offset CO emissions; 2 17. Refers, for other observations of a cross-cutting nature accompanying its decision on discharge, to its resolution of 26 March 2019 (3) on the performance, financial management and control of the agencies. (3) Texts adopted, P8_TA(2019)0254. See page 361 of this Official Journal.