About the EIF

The EIF is characterised by a multi-layered control environment embedded in the EU institutional framework and aligned with the financial sector’s principles and best practices.

The EIF’s first layer of control is exercised through internal processes and procedures developed and implemented by the Executive Management by means of financial and operational controls designed to enable effective and efficient day-to-day operations, ensure reliable financial reporting, compliance with applicable rules and policies and achieve the EIF’s objectives.

In this context, the EIF’s procedural and organisational framework sets out the competences, authorities and reporting lines within the EIF, with a view to ensuring segregation of duties both horizontally, through the interaction between front office, middle office and back office services and vertically, through central control by the Board of Directors of the decision-making process in relation to all business activities.

The second layer of control consists of independent risk and compliance functions, which implement an ex-ante risk assessment and reporting framework for each transaction proposed for approval, complemented by ex-post risk monitoring where relevant (see sections on Risk Management and Legal Services).

The EIF maintains an Internal Control Framework (ICF) and produces an ICF report annually. The ICF relies in particular on a risk control matrix outlining the main risks to which the EIF is exposed. Through the ICF, the Executive Management is in a position to obtain the necessary comfort that key risks related to the EIF’s business activities are properly identified, that control objectives are defined, that significant risks are mitigated and that the controls designed to achieve these objectives are in place and are operating effectively.

Each year the ICF is complemented with an independent opinion from an external audit firm on the design and effectiveness of the key controls of the mandate-related processes throughout the year, in line with the internationally recognised ISAE-3402 standard (type 2 report).

The ICF and the ISAE-3402 reports form the basis for the confirmation by the Chief Executive to the Audit Board that the main risks have been identified and mitigated throughout the reporting period.

The risks, control objectives and agreed improvements described in the ICF are reviewed by Internal Audit, which, on the basis of the audits and the follow-up on agreed action plans performed, expresses an opinion on the achievement of the control objectives in the audited areas and on the design and effectiveness of the related internal controls.

The third layer includes both internal and external audit activities that are coordinated by the Audit Board. The Audit Board, as an oversight and controlling body, conducts its activity in accordance with the standards of the audit profession and relies on both internal and external audit assurances in order to confirm annually that, to the best of its knowledge and judgement, the operations of the EIF have been carried out in compliance with the Statutes Audit & Controls and the Rules of Procedure and that the financial statements give a true and fair view of the financial position of the EIF as regards its assets and liabilities and of the results of its operations for the financial year under review. This information is included in the annual report submitted by the Board of Directors to the EIF’s Annual General Meeting.

In order to discharge its duty in relation to the financial statements, the Audit Board may have recourse to external auditors. The audit of the financial statements of the EIF for the year ending 31 December 2021 was carried out by KPMG Luxembourg, as external auditor.

KPMG performs its audits in accordance with the International Standards on Auditing (ISA) and is committed to informing the EIF Executive Management and the Audit Board of any material weaknesses in the design or implementation of internal controls over financial information that come to its attention during the audit of the financial statements. While performing the audit of the annual accounts, KPMG is acting independently, fulfilling the duty imposed on it by the Code of Professional Ethics adopted in Luxembourg by the Commission de Surveillance du Secteur Financier (CSSF).

Internal Audit (which is outsourced to EIB Internal Audit) examines and evaluates, on an independent and objective basis, the relevance, design and effectiveness of the internal control systems and procedures within the EIF.

To that end, a yearly audit plan covering all key processes of the EIF, including those to be assessed at EIB Group level, is established, on the basis of a risk-assessment methodology, in alignment with the ICF. The plan is discussed with the Executive Management and the external auditor prior to being submitted to the Audit Board for approval.

In line with the Internal Audit Charter, Internal Audit examines the EIF’s activities in order to support the Executive Management’s statement on the design and effectiveness of internal controls, risk management and administration. Internal Audit reports on its findings by means of recommendations and agreed action plans to improve the EIF’s control and working procedures.

The Head of Internal Audit reports regularly on the execution of the internal audit programme to the Executive Management, the Audit Board and the Chairman of the Board of Directors. Internal Audit adheres to the professional and ethical guidance issued by the Institute of Internal Auditors and the Information Systems Audit and Control Association and is subject to a regular quality assurance and improvement programme that covers all aspects of the internal audit activity. Moreover, Internal Audit shall comply with the internal policy statements governing their actions.

In addition to the maintenance of an internal control environment in line with the highest standards of the financial and banking sector, the EIF is subject to periodic reviews by independent control bodies such as the European Court of Auditors (ECA), the Internal Audit Service of the EC and national or regional authorities entrusted with the task of monitoring the correct utilisation of funds under the relevant rules and within their respective remits.

The EIF’s mission is supported through a robust and coherent approach to risk management which seeks to ensure the highest quality standards for its operations and the best corporate rating from the major rating agencies.

Risk Management is based on the so-called “three-lines-of-defence” model, which permeates all areas of the EIF’s business functions and processes. These are first line – front office; second line – independent risk management and compliance; and third line – internal and external audit.

The COVID-19 pandemic continued to affect global economic instabilities and uncertainties prevailed over the reporting period. As part of EIB Group, the EIF provided a key contribution to the financial support of European SMEs in this difficult economic environment. The EIF more than doubled its pre-pandemic business volume in 2021 and this continuous high level of growth of the EIF’s transaction volumes not least challenged the capacities of Risk Management in the context of its ex-ante risk analysis of transactions and risk surveillance of EIF’s transaction portfolios.

As an additional challenge in the difficult transactional environment, EIF Risk Management also stood in the centre of intra-Group efforts to harmonise and align risk policies and procedures with best banking and market practices. This required specific contributions from EIF Risk Management to the implementing of the Group Risk Management Framework on the basis of the Group Risk Management Charter and the integration of various key risk considerations into Group documents, such as the Group ICAAP and ILAAP, the Group Risk Appetite Framework and the Group Capital Plan under the lead of the Group Chief Risk Officer.

Compliance

The EIF’s compliance risk assessment strives to protect the institution, notably against risks that could have an adverse effect on its reputation. Under the terms of its Compliance Charter, the Compliance team assesses - in line with best market practices and in line with the EIB Group’s policy framework – the (i) institutional, (ii) transactional and (iii) ethical aspects of the EIF’s compliance risk.

The principles of permanence and independence are included in the EIF Compliance Charter and materialise through the unrestricted direct access of the Chief Compliance Officer to the Chief Executive, the Deputy Chief Executive, the Board of Directors and the Audit Board.

The compliance risk assessment in the transactional area follows a risk-based approach and is reflected in the independent compliance opinion provided to the EIF decision-making bodies. It is implemented through compliance risk scorings provided in the compliance opinions, in particular on the risk of the EIF being involved (or used) in (i) money laundering and terrorism financing cases and (ii) tax avoidance schemes.

In 2021 EIF’s transaction volumes again increased significantly, in light of the EU-wide efforts to mitigate the economic fallout of the pandemic. EIF Compliance was able to maintain its standards of quality in the identification and assessment of the risks associated with transactions thanks to its staffing reinforcement in 2020 and the updates of its related Money Laundering and Terrorist Financing Risks procedures and controls.

In line with applicable best banking and market practices, the EIF continues to pursue a number of compliance initiatives across the EIB Group for the purpose of establishing a modern and robust governance framework for risk consolidation, taking into account the interests and specificities of the EIB, the EIF and at Group level.

Therefore further enhancement of EIF Risk Management, both in terms of resources and organisational setup, is needed.

Data protection

In order to ensure compliance with the data protection regulation for EU institutions and bodies (Regulation EU 2018/1725), the Data Protection Officer (DPO) took a number of initiatives, including but not limited to:

• giving regular training to staff and senior management;
• providing ongoing support to the EIF Services;
• keeping data protection procedures up to date;
• supporting the publication of relevant privacy statements and the regular update of the Records of Processing Activities (RoPA);
• implementing a tailor-made surveillance programme aimed at verifying EIF ongoing compliance with the data protection regulation;
• ensuring effective cooperation with the European Data Protection Supervisor.