About the EIF

The EIF is characterised by a multi-layered control environment embedded in the EU institutional framework and aligned with the financial sector's principles and best practices.

The EIF's first layer of control is exercised through internal processes and procedures developed and implemented by the Executive Management by means of financial and operational controls designed to enable effective and efficient day-to-day operations, ensure reliable financial reporting, compliance with applicable rules and policies, and achieve the EIF's objectives.

In this context, the EIF's procedural and organisational framework sets out the competences, authorities and reporting lines within the EIF, with a view to ensuring segregation of duties both on a horizontal level, through the interaction between front office, middle office and back office services and, on a vertical level, through central control by the Board of Directors of the decision-making process in relation to all business activities.

The second layer of control consists of independent risk and compliance functions which implement an ex-ante risk assessment and reporting framework for each transaction proposed for approval, complemented by ex-post risk monitoring where relevant (see sections on Risk Management and Legal Service).

The EIF maintains an Internal Control Framework (ICF) and produces an ICF report annually. The ICF relies in particular on a risk control matrix outlining the main operational risks to which the EIF is exposed. Through the ICF, the Executive Management is in a position to obtain the necessary comfort that key risks related to the EIF's business activities are properly identified, that control objectives are defined, that significant risks are mitigated and that the controls designed to achieve these objectives are in place and are operating efficiently.

In 2018, the ICF was complemented with an independent opinion from Deloitte on the design and effectiveness of the key controls of the mandate-related processes throughout the year, in line with the internationally recognised ISAE-3402 standard (type 2 report).

The ICF and the ISAE-3402 report form the basis for the confirmation by the Chief Executive to the Audit Board that the main risks have been identified and mitigated.

The risks, control objectives and agreed improvements described in the ICF are reviewed by Internal Audit, which, on the basis of the audits and the follow-up on agreed action plans performed, expresses an opinion on the achievement of the control objectives in the audited areas and the design and effectiveness of the related internal controls.

The third layer includes both internal and external audit activities which are coordinated by the Audit Board. The Audit Board, as an oversight and controlling body, conducts its activity in accordance with the customary standards of the audit profession and relies on both internal and external audit assurances in order to confirm annually that, to the best of its knowledge and judgement, the operations of the EIF have been carried out in compliance with the Statutes and the Rules of Procedure, and that the financial statements give a true and fair view of the financial position of the EIF as regards its assets and liabilities, and of the results of its operations for the financial year under review. This information is included in the annual report submitted by the Board of Directors to the EIF's Annual General Meeting.

In order to discharge its duty in relation to the financial statements, the Audit Board may have recourse to external auditors. The audit of the financial statements of the EIF for the year ending 31 December 2018 was carried out by KPMG Luxembourg, as external auditor.

KPMG Luxembourg SC performs its audits in accordance with the International Standards on Auditing (ISA) and is committed to inform the EIF Executive Management and the Audit Board of any material weaknesses in the design or implementation of internal controls over financial information that come to its attention during the audit of the financial statements. While performing the audit of the annual accounts, KPMG is acting independently, mirroring the duty imposed on it by the Code of Professional Ethics adopted in Luxembourg by the Commission de Surveillance du Secteur Financier (CSSF).

Internal Audit (which is outsourced to EIB Internal Audit) examines and evaluates the relevance, design and effectiveness of the internal control systems and procedures within the EIF.

To that end, a yearly audit plan covering all key operational activities of the EIF is established, on the basis of a risk-assessment methodology, in alignment with the ICF. The plan is discussed with the Executive Management and the external auditor prior to being submitted to the Audit Board for approval.

Internal Audit examines the EIF's activities in order to support the Executive Management's statement on the design and effectiveness of internal controls, risk management and administration. Internal Audit reports on its findings by means of recommendations and agreed action plans to improve the EIF's control and working procedures.

The Head of Internal Audit reports regularly on the execution of the internal audit programme to the Executive Management, the Audit Board and the Chairman of the Board of Directors. Internal Audit adheres to the professional and ethical guidance issued by the Institute of Internal Auditors and the Information Systems Audit and Control Association, and is subject to a regular quality assurance and improvement programme that covers all aspects of the internal audit activity. Moreover, Internal Audit shall comply with the internal policy statements governing their actions.

In addition to the maintenance of an internal control environment in line with the highest standards of the financial and banking sector, the EIF is subject to periodic reviews by independent control bodies such as the European Court of Auditors (ECA), the Internal Audit Service of the European Commission and national or regional authorities entrusted with the task of monitoring the correct utilisation of funds under the relevant rules and within their respective remits.

The EIF’s mission is supported through a robust and coherent approach to risk management which seeks to ensure the highest quality standards for its operations and the best corporate rating from the major rating agencies.

Risk management is embedded in the EIF’s corporate culture and is based on the so-called “three-lines-of-defence” model, which permeates all areas of the EIF’s business functions and processes. These are: first line – front office; second line – independent risk management and compliance; and third line – internal and external audit.

During the reporting period of 2018, a variety of key projects were successfully concluded, in particular, on data management related to risk management, the applicability and implementation of best market practices in the management of financial and non-financial risks and the valuation process and reporting under IFRS 9.

With a view to further developing the EIF’s second line of defence in the area of cybersecurity risks, an Information Security Officer was recruited. In parallel, the EIF has proceeded to implement the new data protection regulation for EU institutions and bodies.

EIF Risk Management continued to advise EIF Executive Management and to develop proposals on active capital management, planning and optimisation with a view to responding to the rapid increase of the EIF’s business volumes. To further support the related workload, Risk Management (RM) pursued and finalised a project with external consultants concerning data management and systems for the enhancement of the efficiency of the EIF’s risk management, with corresponding implementation action extending into 2019.

In 2018, RM further progressed in the elaboration of a methodology to assess and monitor the policy return/impact objectives of EIF-managed third party mandates and developed an impact rating for inclusive finance activities. These initiatives shall be further pursued in 2019 with a view to arriving at a comprehensive scoring of non-financial risks related to policy impact on mandate and transactional level.

In line with the EIB Group action plan to identify a best practices framework applicable to the activities of the EIB Group, the EIF has, on the basis of and closely linked to its compliance monitoring programme, established a Best Market Practices Framework consisting of Best Market Practices Guidelines and a Best Market Practices Handbook as well as the related governance. Furthermore, RM has actively participated in various EIB Group initiatives on the identification of applicable best banking and market practices, in particular, in relation to data management, data aggregation and risk reporting under the “Principles for effective risk data aggregation and risk reporting” of the Basel Committee for Banking Supervision (BCBS 239).

Compliance The EIF’s compliance risk assessment strives to protect the institution against risks that could have an adverse effect on its reputation. Under the terms of its Compliance Charter, the Compliance team assesses - in line with best market practices and in line with the EIB Group’s policy framework – the (i) institutional, (ii) transactional and (iii) ethical aspects of the EIF’s compliance risk. In the Compliance area, an EIB Group Policy Framework has been defined between the EIF's and the EIB's respective Compliance functions and was updated in March 2018.

Ensuring the permanence of the compliance function as well as the independence of the compliance risk assessment, as a matter of best practice, is a key requirement for any financial institution. In the EIF, the principles of permanence and independence are included in the EIF Compliance Charter and it materialises through the unrestricted direct access of the Head of Compliance to the Chief Executive, the Deputy Chief Executive, the Board of Directors and the Audit Board.

The compliance risk assessment in the transactional area follows a risk-based approach and is reflected in the independent compliance opinion provided to the EIF decision-making bodies. It is formalised by the compliance risk scorings provided in the compliance opinions, in particular for the risk of EIF being involved (or used) in (i) money laundering and terrorism financing cases, and (ii) tax avoidance schemes. Data protection The Data Protection Officer (DPO), considering the complexity and variety of changes introduced by the new data protection regulation for EU institutions and bodies that came into force in December 2018 (Regulation EU 2018/1725), adopted a holistic approach.

In accordance with the guidelines issued from time to time by the European Data Protection Supervisor, the DPO focused on the following areas of intervention:

The review and update of the privacy notices;

The analysis of the existing processing operations and the identification of the most risky ones requiring a Data Protection Impact Assessment;

The adjustment of the inventory of records in line with the new requirements, and

The definition of the new standard contractual clauses for the outsourcing agreements.

The DPO provided regular trainings to EIF Staff and senior management through dedicated sessions and awareness-raising initiatives.

The EIF is supported by a strong in-house legal team whose remit, within its area of responsibility, is to pursue the strategic goals and protect and preserve the legal integrity of the Fund. This is achieved through the provision of legal advice based on the expertise and specialist knowledge of the team throughout the lifecycle of all the EIF’s transactional activities and in connection with institutional, strategic and policy-related matters, objectives, which are reflected in the legal team’s internal structure.

With regard to transactions, in order to address increasing business volumes and the strategic goal of achieving performance gains through specialisation, the transactions team is split into two divisions, one focused on debt transactions and the other on equity transactions.

The legal service's transaction teams work on all stages of transaction implementation, including (i) structuring and product development, (ii) review of proposals to the Investment and Risk Committee and the EIF’s Board of Directors, (iii) contractual negotiations and (iv) active portfolio management, in each case in close collaboration with other EIF services.

In terms of institutional and corporate matters, the legal service supports the implementation of good corporate governance, coordinates and advises on contractual arrangements at institutional level. The legal service aims to ensure that the EIF conducts its activities in accordance with its Statutes, mission and values, applicable law and relevant contractual obligations.

It further aims to ensure a smooth functioning of the EIF’s corporate bodies, under the coordination of the EIF’s Secretary General. As a European Union body, a member of the EIB Group and a financial institution, institutional matters concerning the EIF include a wide range of areas and at times necessitate cooperation with the EIF’s shareholders as well as specific and proactive attention to the development of EU policy, and legislative and governance frameworks.

In addition, the legal service is called upon to advise on numerous structuring, corporate, governance and regulatory matters relating to third party mandates, including external structures (funds-of-funds), for which the EIF acts as manager and/or adviser. In order to create the necessary interface between the EIF’s institutional role, its mandate management activity and transaction delivery, the activities of the transactions and the corporate and institutional teams are closely coordinated with the aim of providing seamless advice and expertise across the EIF’s business.