The Commission's assessment shall cover the internal control environment of the national programme, the management and control activities of the Responsible Authority, and the control and audit activities of the Audit Authority and shall be based on verification of compliance with the key requirements set out in Table 1 of the Annex.

Compliance with the key requirements referred to in paragraph 1 according to the categories set out in Table 2 of the Annex shall be used to assess the effective functioning of each competent authority and to reach an overall conclusion on the management and control system. Any mitigating or aggravating factors shall be taken into account in the overall conclusion on the management and control system.

Wherever it is assessed that any of the key requirements 2, 4, 5, 8, 11, 12 or 14 in Table 1 of the Annex, or two or more of the other key requirements in that Table fall into categories 3 or 4 set out in Table 2 of the Annex, it shall be considered as a type of serious deficiency in the effective functioning of the management and control system.