About the EIF

The EIF is characterised by a multi-layered control environment embedded in the EU institutional framework and aligned with the financial sector’s principles and best practices.

The EIF’s first layer of control is exercised through internal processes and procedures developed and implemented by the Executive Management by means of financial and operational controls designed to enable effective and efficient day-to-day operations, ensure reliable financial reporting, compliance with applicable rules and policies and achieve the EIF’s objectives.

In this context, the EIF’s procedural and organisational framework sets out the competences, authorities and reporting lines within the EIF, with a view to ensuring segregation of duties both horizontally, through the interaction between front office, middle office and back-office services and vertically, through central control by the Board of Directors of the decision-making process in relation to all business activities.

The second layer of control consists of independent risk and compliance functions, which implement an ex-ante risk assessment and reporting framework for each transaction proposed for approval, complemented by ex-post risk monitoring where relevant (see sections on Risk Management and Legal Service).

The EIF maintains an Internal Control Framework (ICF) and produces an ICF report annually. The ICF relies in particular on a risk control matrix outlining the main risks to which the EIF is exposed. Through the ICF, the Executive Management is in a position to obtain the necessary comfort that key risks related to the EIF’s business activities are properly identified, that control objectives are defined, that key risks are mitigated and that the controls designed to achieve these objectives are in place and are operating effectively.

Each year the ICF is complemented with an independent opinion from an external audit firm on the design and effectiveness of the key controls of the mandate-related processes throughout the year, in line with the internationally recognised ISAE-3402 standard (type 2 report).

The ICF and the ISAE-3402 reports form the basis for the confirmation by the Chief Executive to the Audit Board that the main risks have been identified and mitigated throughout the reporting period.

The risks, control objectives and agreed improvements described in the ICF are reviewed by Internal Audit, which, on the basis of the audits and the follow-up on agreed action plans performed, expresses an opinion on the achievement of the control objectives in the audited areas and on the design and effectiveness of the related internal controls.

The third and fourth layer include internal and external audit activities that are coordinated by the Audit Board. The Audit Board, as an oversight and controlling body, conducts its activity in accordance with the standards of the audit profession and relies on both internal and external audit assurances in order to confirm annually that, to the best of its knowledge and judgement, the operations of the EIF have been carried out in compliance with the Statutes and the Rules of Procedure and that the financial statements give a true and fair view of the financial position of the EIF as regards its assets and liabilities and of the results of its operations for the financial year under review. This information is included in the annual report submitted by the Board of Directors to the EIF’s Annual General Meeting. Additionally, as of 2023, the Audit Board is also statutorily tasked with verifying that the EIF’s activities are based on sound banking principles or other sound commercial principles and practices as applicable.

In order to discharge its duty in relation to the financial statements, the Audit Board may have recourse to external auditors. The audit of the financial statements of the EIF for the year ending 31 December 2023 was carried out by KPMG Luxembourg, as external auditor.

KPMG performs its audits in accordance with the International Standards on Auditing (ISA) and is committed to informing the EIF Executive Management and the Audit Board of any material weaknesses in the design or implementation of internal controls over financial information that come to its attention during the audit of the financial statements. While performing the audit of the annual accounts, KPMG is acting independently, fulfilling the duty imposed on it by the Code of Professional Ethics adopted in Luxembourg by the Commission de Surveillance du Secteur Financier (CSSF).

Internal Audit (which is outsourced to EIB Internal Audit) examines and evaluates, on an independent and objective basis, the relevance, design and effectiveness of the internal control systems and procedures within the EIF.

To that end, a yearly audit plan covering all key processes of the EIF, including those to be assessed at EIB Group level, is established, on the basis of a risk-assessment methodology, in alignment with the ICF. The plan is discussed with the Executive Management and the external auditor prior to being submitted to the Audit Board for approval.

In line with the Internal Audit Charter, Internal Audit examines the EIF’s activities in order to support the Executive Management’s statement on the design and effectiveness of internal controls, risk management and administration. Internal Audit reports on its findings by means of recommendations and agreed action plans to improve the EIF’s control and working procedures.

The Head of Internal Audit reports regularly on the execution of the internal audit programme to the Executive Management, the Audit Board and the Chairman of the Board of Directors. Internal Audit adheres to the professional and ethical guidance issued by the Institute of Internal Auditors and the Information Systems Audit and Control Association and is subject to a regular quality assurance and improvement programme that covers all aspects of the internal audit activity. Moreover, Internal Audit shall comply with the internal policy statements governing their actions.

In addition to the maintenance of an internal control environment in line with the highest standards of the financial and banking sector, the EIF is subject to periodic reviews by independent control bodies such as the European Court of Auditors (ECA), the Internal Audit Service of the EC and national or regional authorities entrusted with the task of monitoring the correct utilisation of funds under the relevant rules and within their respective remits.

The EIB has established the Review and Evaluation Process (REP), which is based on the EBA Guidelines on Supervisory Review and Evaluation Process, while taking into account the EIB’s nature, policy mission, specific tasks and governance structure. The REP team assesses risks emanating from the EIF whenever these are deemed material from a consolidated EIB Group point of view, addressing findings and recommendations to management for follow up and implementation of relevant actions by services within agreed timelines. As part of its general review plan over the EIB Group, in 2023, the REP team reviewed selected EIF-relevant risks under the consolidated umbrella.