Kiri

Agreement number: INEA/CEF/TRAN/M2019/2098304 Action number: 2019-EU-TMC-0282-S CEF general model grant agreement: update April 2017 Annex VII: November 2017 Terms of Reference for an Independent Report of Factual Findings on costs declared under a Grant Agreement financed under the Connecting Europe Facility (CEF) This document sets out the ‘Terms of Reference (ToR)’ under which Ministry of Economic Affairs and Communications of the Republic of Estonia (‘the Beneficiary’) agrees to engage Deloitte Audits Latvia SIA (‘the Auditor’) to produce an independent report of factual findings (‘the Report’) concerning the Financial Statement(s)1 drawn up by the Ministry of Economic Affairs and Communications of the Republic of Estonia for the CEF grant agreement INEA/CEF/TRAN/M2019/2098304, for the action entitled “Rail Baltica - 1435 mm standard gauge railway line development in Estonia, Latvia and Lithuania (Part IV)”, duration from 01.03.2020. to 31.12.2023. (‘the Agreement’), and to issue a Certificate on the Financial Statements’ (‘CFS’) referred to in Article II.23.2 of the Agreement based on the compulsory reporting template stipulated by the Commission. The Agreement has been concluded under the Connecting Europe Facility (CEF) Transport sector between the Beneficiary and the Innovation and Networks Executive Agency (INEA) (‘the Agency’), under the powers delegated by the European Commission (‘the Commission’). The Agency is mentioned as a signatory of the Agreement with the Beneficiary only. The Agency is not a party to this engagement. 1.1. Subject of the engagement The coordinator must submit to the Agency the request for interim payment within 8 months following the end of the reporting period which should include, amongst other documents, a CFS for each beneficiary, each Affiliated Entity and Implementing Body, for which a total contribution of EUR 325 000 or more is requested, as reimbursement of actual eligible costs and unit costs calculated on the basis of its usual cost accounting practices (see Article II.23.2 of the Agreement). The CFS must cover all reporting periods of the beneficiary, Affiliated Entity or Implementing Body indicated above. The Beneficiary must submit to the coordinator the CFS covering the total declared costs for itself, its Affiliated Entity(ies) and its Implementing Body(ies), if the CFS must be included in the request for interim payment according to Article II.23.2 of the Agreement. The CFS is composed of two separate documents:  The Terms of Reference (‘the ToR’) to be signed by the Beneficiary and the Auditor;  The Auditor’s Independent Report of Factual Findings (‘the Report’) to be issued on the Auditor’s letterhead, dated, stamped and signed by the Auditor (or the competent public officer) which includes the agreed-upon procedures (‘the Procedures’) to be performed by the Auditor, and the standard factual findings (‘the Findings’) to be confirmed by the Auditor. If the CFS must be included in the interim report according to Article II.23.2 of the Agreement, the request for interim payment relating to the Agreement cannot be made without the CFS. However, the payment for reimbursement of costs covered by the CFS does not preclude the Commission, the Agency, the European Anti-Fraud Office and the European Court of Auditors from carrying out checks, reviews, audits and investigations in accordance with Article II.27 of the Agreement. 1 By which costs under the Agreement are declared (see template ‘Model Financial Statement(s)’ in Annex VI to the Grant Agreement). Agreement number: INEA/CEF/TRAN/M2019/2098304 Action number: 2019-EU-TMC-0282-S CEF general model grant agreement: update April 2017 Annex VII: November 2017 1.2. Responsibilities The Beneficiary:  must draw up the Financial Statement(s) for the action financed by the Agreement in compliance with the obligations under the Agreement. The Financial Statement(s) must be drawn up according to the Beneficiary’s accounting and book-keeping system and the underlying accounts and records;  must send the Financial Statement(s) to the Auditor;  is responsible and liable for the accuracy of the Financial Statement(s);  is responsible for the completeness and accuracy of the information provided to enable the Auditor to carry out the Procedures. It must provide the Auditor with a written representation letter supporting these statements. The written representation letter must state the period covered by the statements and must be dated;  accepts that the Auditor cannot carry out the Procedures unless it is given full access to the Beneficiary’s staff and accounting as well as any other relevant records and documentation. The Auditor:  is qualified to carry out statutory audits of accounting documents in accordance with Directive 2006/43/EC of the European Parliament and of the Council of 17 May 2006 on statutory audits of annual accounts and consolidated accounts, amending Council Directives 78/660/EEC and 83/349/EEC and repealing Council Directive 84/253/EEC or similar national regulations. The Auditor:  must be independent from the Beneficiary, in particular, it must not have been involved in preparing the Beneficiary’s Financial Statement(s) or providing consultancy advice on the related operations and underlying transactions;  must plan work so that the Procedures may be carried out and the Findings may be assessed;  must adhere to the Procedures laid down and the compulsory report format;  must carry out the engagement in accordance with this ToR;  must document matters which are important to support the Report;  must base its Report on the evidence gathered;  must submit the Report to the Beneficiary. The Agency sets out the Procedures to be carried out by the Auditor. The Auditor is not responsible for their suitability or pertinence. As this engagement is not an assurance engagement, the Auditor does not provide an audit opinion or a statement of assurance. 1.3. Applicable Standards The Auditor must comply with these Terms of Reference and with2:  the International Standard on Related Services (‘ISRS’) 4400 Engagements to perform Agreed-upon Procedures regarding Financial Information as issued by the International Auditing and Assurance Standards Board (IAASB); 2 Supreme Audit Institutions applying INTOSAI-standards may carry out the Procedures according to the corresponding International Standards of Supreme Audit Institutions and code of ethics issued by INTOSAI instead of the International Standard on Related Services (‘ISRS’) 4400 and the Code of Ethics for Professional Accountants issued by the IAASB and the IESBA. Agreement number: INEA/CEF/TRAN/M2019/2098304 Action number: 2019-EU-TMC-0282-S CEF general model grant agreement: update April 2017 Annex VII: November 2017  the Code of Ethics for Professional Accountants issued by the International Ethics Standards Board for Accountants (IESBA). Although ISRS 4400 states that independence is not a requirement for engagements to carry out agreed-upon procedures, the Agency requires that the Auditor also complies with the Code’s independence requirements. The Auditor’s Report must state that there is no conflict of interests in establishing this Report between the Auditor and the Beneficiary, and must specify - if the service is invoiced - the total fee paid to the Auditor for providing the Report. 1.4. Reporting The Report must be written in English in accordance with Article 4.3 of the Agreement. Under Article II.27 of the Agreement, the Commission, the Agency, the European Anti-Fraud Office and the Court of Auditors have the right to audit any work that is carried out under the action and for which costs are declared from the European Union budget. This includes work related to this engagement. The Auditor must provide access to all working papers (e.g. recalculation of hourly rates, verification of the time declared for the action) related to this assignment if the Commission, the Agency, the European Anti-Fraud Office or the European Court of Auditors requests them. 1.5. Timing The Report must be provided by 10th August 2022. 1.6. Other terms 1.6.1. Audit has been carried out according to contract agreement between RB Rail AS and Deloitte Audits Latvia SIA No.1.19/LV-9, dated 30.01.2020., Article 3.5.1. 1.6.2. Parties shall comply with the Data Protection Legislation when processing Personal Data. Confirmation of Personal Data Processing included in Annex I of this Agreement. Deloitte Audits Latvia SIA Ministry of Economic Affairs and Communications of the Republic of Estonia Represented by Inguna Staša Represented by Ahti Kuningas Member of the Management Board Acting Secretary General Signed electronically with a qualified electronic Signed electronically with a qualified electronic signature and a time stamp signature and a time stamp Signature of the Auditor Signature of the Beneficiary Agreement number: INEA/CEF/TRAN/M2019/2098304 Action number: 2019-EU-TMC-0282-S CEF general model grant agreement: update April 2017 Annex VII: November 2017 Annex I: Confirmation of Personal Data Processing We, Sabiedrība ar ierobežotu atbildību “Deloitte Audits Latvia”, registration no. 40003606960, the legal address of which is 4A Grēdu Street, LV-1019 (hereinafter – the Auditor), and Ministry of Economic Affairs and Communications of the Republic of Estonia, hereinafter referred to as the “the Beneficiary”, hereby inform that: when rendering the audit services under the Agreement, the Auditor will process personal data as follows: 1. the Personal Data provided by the Beneficiary or its staff members and representatives will be processed by the Auditor as a Controller, for the purpose of, or in connection with: (i) the provision of the audit services; (ii) compliance with the applicable legal, regulatory or professional requirements; (iii) addressing requests and communications from competent authorities; (iv) Contract administration, financial accounting, internal compliance and risk analysis, and client relationship purposes; (v) utilization of systems and applications (hosted or internal) for information technology and information system services (the “Purposes”). 2. The Personal Data may include data regarding the Beneficiary’s representatives, personnel, project team members, suppliers and contractors, as well as the Personal Data included in the information obtained by the Auditor in relation to the Agreement. 3. For the Purposes indicated above, the Personal Data may be disclosed/transferred to and processed by the Recipients of Personal Data (including the Personal Data Controllers and Personal Data Processors) as indicated in the applicable the Auditor’s Privacy Statement. The transfers of Personal Data may include transfers outside of the European Economic Area (EEA) but only provided that the legal obligations as stipulated by the Data Protection Legislation for such transfers are fulfilled. 4. Clause 3 is a summary of the applicable Auditor’s privacy statement (the “Privacy Statement”) and is not a complete reflection of the Privacy Statement, which is available at: https://www2.deloitte.com/ce/en/pages/about-deloitte/articles/deloitte-ce-privacy-statement- for-clients.html. 5. To the extent that it does not involve a disproportionate effort, the Beneficiary shall ensure that the Privacy Statement is brought to the attention of data subjects (its relevant staff members, representatives, contractors and clients). 6. The deliverables and the working documentation related to the provision of audit services, shall be retained for a period of 10 years following the expiration of the contractual relationship or as required by the relevant anti-money laundering regulations or any other applicable laws and regulations. 7. Each party shall comply with the Data Protection Legislation when processing Personal Data. The Beneficiary confirms that all the Personal Data provided to the Auditor has been collected lawfully, fairly and in a transparent manner. 8. In order to ensure order in the exchange of personal data, the Auditor and Beneficiary shall transfer the personal data to the other by means of enhanced security, using encryption between e-mail servers, provided that the legal obligations for such transfer and processing are fulfilled and that the technical, organizational and personal security measures are maintained on the same level as required by the applicable laws. Agreement number: INEA/CEF/TRAN/M2019/2098304 Action number: 2019-EU-TMC-0282-S CEF general model grant agreement: update April 2017 Annex VII: November 2017 9. The terms used in this confirmation have the following meanings: a) “Controller” means a controller or data controller (as defined in the Data Protection Legislation). b) “Data Protection Legislation” means the following legislation to the extent applicable from time to time: (a) national laws implementing the Data Protection Directive (95/46/EC) and the Directive on Privacy and Electronic Communications (2002/58/EC); (b) the General Data Protection Regulation (2016/679); and (c) any other similar national privacy law. c) “Processor” means a data processor or processor (as defined in the Data Protection Legislation). d) “Recipient” means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed (as further defined in the Data Protection Legislation). 10. This Confirmation signed in two copies, one of which remains at the Beneficiary’s disposal, one for delivery to the Auditor. On behalf of the Auditor: Inguna Staša, Member of the Board Signed electronically with a qualified electronic signature and a time stamp Signature of the Auditor By signing, the Beneficiary confirms that it agrees with the above-mentioned personal data processing rules: Ministry of Economic Affairs and Communications of the Republic of Estonia Represented by Ahti Kuningas Acting Secretary General Signed electronically with a qualified electronic signature and a time stamp Signature of the Beneficiary  Agreement number: INEA/CEF/TRAN/M2019/2098073 Action number: 2019-EU-TMC-0280-W CEF general model grant agreement: update April 2017 Annex VII: November 2017 Terms of Reference for an Independent Report of Factual Findings on costs declared under a Grant Agreement financed under the Connecting Europe Facility (CEF) This document sets out the ‘Terms of Reference (ToR)’ under which Ministry of Economic Affairs and Communications of the Republic of Estonia (‘the Beneficiary’) agrees to engage Deloitte Audits Latvia SIA (‘the Auditor’) to produce an independent report of factual findings (‘the Report’) concerning the Financial Statement(s)1 drawn up by the Ministry of Economic Affairs and Communications of the Republic of Estonia for the CEF grant agreement INEA/CEF/TRAN/M2019/2098073, for the action entitled “Rail Baltica - 1435 mm standard gauge railway line development in Estonia, Latvia and Lithuania (Part V)”, duration from 01.03.2020. to 31.12.2023. (‘the Agreement’), and to issue a Certificate on the Financial Statements’ (‘CFS’) referred to in Article II.23.2 of the Agreement based on the compulsory reporting template stipulated by the Commission. The Agreement has been concluded under the Connecting Europe Facility (CEF) Transport sector between the Beneficiary and the Innovation and Networks Executive Agency (INEA) (‘the Agency’), under the powers delegated by the European Commission (‘the Commission’). The Agency is mentioned as a signatory of the Agreement with the Beneficiary only. The Agency is not a party to this engagement. 1.1. Subject of the engagement The coordinator must submit to the Agency the request for interim payment within 8 months following the end of the reporting period which should include, amongst other documents, a CFS for each beneficiary, each Affiliated Entity and Implementing Body, for which a total contribution of EUR 325 000 or more is requested, as reimbursement of actual eligible costs and unit costs calculated on the basis of its usual cost accounting practices (see Article II.23.2 of the Agreement). The CFS must cover all reporting periods of the beneficiary, Affiliated Entity or Implementing Body indicated above. The Beneficiary must submit to the coordinator the CFS covering the total declared costs for itself, its Affiliated Entity(ies) and its Implementing Body(ies), if the CFS must be included in the request for interim payment according to Article II.23.2 of the Agreement. The CFS is composed of two separate documents:  The Terms of Reference (‘the ToR’) to be signed by the Beneficiary and the Auditor;  The Auditor’s Independent Report of Factual Findings (‘the Report’) to be issued on the Auditor’s letterhead, dated, stamped and signed by the Auditor (or the competent public officer) which includes the agreed-upon procedures (‘the Procedures’) to be performed by the Auditor, and the standard factual findings (‘the Findings’) to be confirmed by the Auditor. If the CFS must be included in the interim report according to Article II.23.2 of the Agreement, the request for interim payment relating to the Agreement cannot be made without the CFS. However, the payment for reimbursement of costs covered by the CFS does not preclude the Commission, the Agency, the European Anti-Fraud Office and the European Court of Auditors from carrying out checks, reviews, audits and investigations in accordance with Article II.27 of the Agreement. 1 By which costs under the Agreement are declared (see template ‘Model Financial Statement(s)’ in Annex VI to the Grant Agreement). Agreement number: INEA/CEF/TRAN/M2019/2098073 Action number: 2019-EU-TMC-0280-W CEF general model grant agreement: update April 2017 Annex VII: November 2017 1.2. Responsibilities The Beneficiary:  must draw up the Financial Statement(s) for the action financed by the Agreement in compliance with the obligations under the Agreement. The Financial Statement(s) must be drawn up according to the Beneficiary’s accounting and book-keeping system and the underlying accounts and records;  must send the Financial Statement(s) to the Auditor;  is responsible and liable for the accuracy of the Financial Statement(s);  is responsible for the completeness and accuracy of the information provided to enable the Auditor to carry out the Procedures. It must provide the Auditor with a written representation letter supporting these statements. The written representation letter must state the period covered by the statements and must be dated;  accepts that the Auditor cannot carry out the Procedures unless it is given full access to the Beneficiary’s staff and accounting as well as any other relevant records and documentation. The Auditor:  is qualified to carry out statutory audits of accounting documents in accordance with Directive 2006/43/EC of the European Parliament and of the Council of 17 May 2006 on statutory audits of annual accounts and consolidated accounts, amending Council Directives 78/660/EEC and 83/349/EEC and repealing Council Directive 84/253/EEC or similar national regulations. The Auditor:  must be independent from the Beneficiary, in particular, it must not have been involved in preparing the Beneficiary’s Financial Statement(s) or providing consultancy advice on the related operations and underlying transactions;  must plan work so that the Procedures may be carried out and the Findings may be assessed;  must adhere to the Procedures laid down and the compulsory report format;  must carry out the engagement in accordance with this ToR;  must document matters which are important to support the Report;  must base its Report on the evidence gathered;  must submit the Report to the Beneficiary. The Agency sets out the Procedures to be carried out by the Auditor. The Auditor is not responsible for their suitability or pertinence. As this engagement is not an assurance engagement, the Auditor does not provide an audit opinion or a statement of assurance. 1.3. Applicable Standards The Auditor must comply with these Terms of Reference and with2:  the International Standard on Related Services (‘ISRS’) 4400 Engagements to perform Agreed-upon Procedures regarding Financial Information as issued by the International Auditing and Assurance Standards Board (IAASB); 2 Supreme Audit Institutions applying INTOSAI-standards may carry out the Procedures according to the corresponding International Standards of Supreme Audit Institutions and code of ethics issued by INTOSAI instead of the International Standard on Related Services (‘ISRS’) 4400 and the Code of Ethics for Professional Accountants issued by the IAASB and the IESBA. Agreement number: INEA/CEF/TRAN/M2019/2098073 Action number: 2019-EU-TMC-0280-W CEF general model grant agreement: update April 2017 Annex VII: November 2017  the Code of Ethics for Professional Accountants issued by the International Ethics Standards Board for Accountants (IESBA). Although ISRS 4400 states that independence is not a requirement for engagements to carry out agreed-upon procedures, the Agency requires that the Auditor also complies with the Code’s independence requirements. The Auditor’s Report must state that there is no conflict of interests in establishing this Report between the Auditor and the Beneficiary, and must specify - if the service is invoiced - the total fee paid to the Auditor for providing the Report. 1.4. Reporting The Report must be written in English in accordance with Article 4.3 of the Agreement. Under Article II.27 of the Agreement, the Commission, the Agency, the European Anti-Fraud Office and the Court of Auditors have the right to audit any work that is carried out under the action and for which costs are declared from the European Union budget. This includes work related to this engagement. The Auditor must provide access to all working papers (e.g. recalculation of hourly rates, verification of the time declared for the action) related to this assignment if the Commission, the Agency, the European Anti-Fraud Office or the European Court of Auditors requests them. 1.5. Timing The Report must be provided by 10th August 2022. 1.6. Other terms 1.6.1. Audit has been carried out according to contract agreement between RB Rail AS and Deloitte Audits Latvia SIA No.1.19/LV-9, dated 30.01.2020., Article 3.5.1. 1.6.2. Parties shall comply with the Data Protection Legislation when processing Personal Data. Confirmation of Personal Data Processing included in Annex I of this Agreement. Deloitte Audits Latvia SIA Ministry of Economic Affairs and Communications of the Republic of Estonia Represented by Inguna Staša Represented by Ahti Kuningas Member of the Management Board Acting Secretary General Signed electronically with a qualified electronic Signed electronically with a qualified electronic signature and a time stamp signature and a time stamp Signature of the Auditor Signature of the Beneficiary Agreement number: INEA/CEF/TRAN/M2019/2098073 Action number: 2019-EU-TMC-0280-W CEF general model grant agreement: update April 2017 Annex VII: November 2017 Annex I: Confirmation of Personal Data Processing We, Sabiedrība ar ierobežotu atbildību “Deloitte Audits Latvia”, registration no. 40003606960, the legal address of which is 4A Grēdu Street, LV-1019 (hereinafter – the Auditor), and Ministry of Economic Affairs and Communications of the Republic of Estonia, hereinafter referred to as the “the Beneficiary”, hereby inform that: when rendering the audit services under the Agreement, the Auditor will process personal data as follows: 1. the Personal Data provided by the Beneficiary or its staff members and representatives will be processed by the Auditor as a Controller, for the purpose of, or in connection with: (i) the provision of the audit services; (ii) compliance with the applicable legal, regulatory or professional requirements; (iii) addressing requests and communications from competent authorities; (iv) Contract administration, financial accounting, internal compliance and risk analysis, and client relationship purposes; (v) utilization of systems and applications (hosted or internal) for information technology and information system services (the “Purposes”). 2. The Personal Data may include data regarding the Beneficiary’s representatives, personnel, project team members, suppliers and contractors, as well as the Personal Data included in the information obtained by the Auditor in relation to the Agreement. 3. For the Purposes indicated above, the Personal Data may be disclosed/transferred to and processed by the Recipients of Personal Data (including the Personal Data Controllers and Personal Data Processors) as indicated in the applicable the Auditor’s Privacy Statement. The transfers of Personal Data may include transfers outside of the European Economic Area (EEA) but only provided that the legal obligations as stipulated by the Data Protection Legislation for such transfers are fulfilled. 4. Clause 3 is a summary of the applicable Auditor’s privacy statement (the “Privacy Statement”) and is not a complete reflection of the Privacy Statement, which is available at: https://www2.deloitte.com/ce/en/pages/about-deloitte/articles/deloitte-ce-privacy-statement- for-clients.html. 5. To the extent that it does not involve a disproportionate effort, the Beneficiary shall ensure that the Privacy Statement is brought to the attention of data subjects (its relevant staff members, representatives, contractors and clients). 6. The deliverables and the working documentation related to the provision of audit services, shall be retained for a period of 10 years following the expiration of the contractual relationship or as required by the relevant anti-money laundering regulations or any other applicable laws and regulations. 7. Each party shall comply with the Data Protection Legislation when processing Personal Data. The Beneficiary confirms that all the Personal Data provided to the Auditor has been collected lawfully, fairly and in a transparent manner. 8. In order to ensure order in the exchange of personal data, the Auditor and Beneficiary shall transfer the personal data to the other by means of enhanced security, using encryption between e-mail servers, provided that the legal obligations for such transfer and processing are fulfilled and that the technical, organizational and personal security measures are maintained on the same level as required by the applicable laws. Agreement number: INEA/CEF/TRAN/M2019/2098073 Action number: 2019-EU-TMC-0280-W CEF general model grant agreement: update April 2017 Annex VII: November 2017 9. The terms used in this confirmation have the following meanings: a) “Controller” means a controller or data controller (as defined in the Data Protection Legislation). b) “Data Protection Legislation” means the following legislation to the extent applicable from time to time: (a) national laws implementing the Data Protection Directive (95/46/EC) and the Directive on Privacy and Electronic Communications (2002/58/EC); (b) the General Data Protection Regulation (2016/679); and (c) any other similar national privacy law. c) “Processor” means a data processor or processor (as defined in the Data Protection Legislation). d) “Recipient” means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed (as further defined in the Data Protection Legislation). 10. This Confirmation signed in two copies, one of which remains at the Beneficiary’s disposal, one for delivery to the Auditor. On behalf of the Auditor: Inguna Staša, Member of the Board Signed electronically with a qualified electronic signature and a time stamp Signature of the Auditor By signing, the Beneficiary confirms that it agrees with the above-mentioned personal data processing rules: Ministry of Economic Affairs and Communications of the Republic of Estonia Represented by Ahti Kuningas Acting Secretary General Signed electronically with a qualified electronic signature and a time stamp Signature of the Beneficiary