Order on the Conduct of Audits in Financial Undertakings and Financial Groups

Order on the Conduct of Audits in Financial Undertakings and Financial Groups 1)

Pursuant to Section 199, paragraph 12, and Section 373, paragraph 4, of the Act on Financial Business, cf. Act Consolidation No. 1013 of 21 August 2024, Section 98, paragraph 10, and Section 190, paragraph 6, of the Act on Investment Firms and the like, cf. Act Consolidation No. 1163 of 13 November 2024, Section 193, paragraph 13, and Section 316, paragraph 1, of Act No. 718 of 13 June 2023 on Insurance Business, as amended by Act No. 481 of 22 May 2024, Section 160, paragraph 10, and Section 270, paragraph 1, of the Act on Share Dealing Companies and Investment Services and Activities, cf. Act Consolidation No. 232 of 1 March 2024, and Section 5, paragraph 2, and Section 14, paragraph 2, of the Act on a Ship Finance Institute, cf. Act Consolidation No. 1873 of 5 December 2023, it is hereby ordered pursuant to the authorization in Section 1, No. 5, of Order No. 44 of 19 January 2015 on the delegation of powers to the Danish Financial Supervisory Authority:

Chapter 1 Scope and Definitions

Section 1. This Order applies to financial undertakings and financial holding companies, cf. Section 5, paragraph 1, Nos. 1 and 9, of the Act on Financial Business, insurance companies, financial holding companies and insurance holding companies, cf. Section 9, paragraph 1, Nos. 1, 9 and 10, of the Act on Insurance Business, share dealing companies and share dealing holding companies, cf. Section 10, Nos. 1 and 20, of the Act on Share Dealing Companies and Investment Services and Activities, and investment firms, SIKAVs and securities funds, cf. Section 1, paragraph 2, of the Act on Investment Firms and the like.

Paragraph 2. The Order further applies to both groups as a whole, cf. Section 5, paragraph 1, No. 8, of the Act on Financial Business, Section 9, paragraph 1, No. 8, of the Act on Insurance Business, and Section 10, paragraph 1, No. 15, of the Act on Share Dealing Companies and Investment Services and Activities, as well as to the individual undertakings in groups where the parent undertaking is a financial undertaking, a financial holding company cf. Section 5, paragraph 1, Nos. 1 and 9, of the Act on Financial Business, an insurance company, a financial holding company or an insurance holding company, cf. Section 9, paragraph 1, Nos. 1, 9 and 10, of the Act on Insurance Business, and share dealing companies and share dealing holding companies, cf. Section 10, Nos. 1 and 20, of the Act on Share Dealing Companies and Investment Services and Activities.

Paragraph 3. Where this Order applies to credit institutions, it shall apply mutatis mutandis to Danmarks Skibskredit A/S.

General Provisions

Section 2. Conclusions and information pursuant to this Order shall be either unqualified, qualified or adverse. If the auditor is unable to express a conclusion on the subject matter, this shall be stated.

Paragraph 2. The auditor shall issue a qualified opinion when providing conclusions and information pursuant to this Order if the information on which the work performed is based is subject to material errors or deficiencies, or if the auditor is unable to obtain sufficient and appropriate evidence to conclude that the subject matter is free from material misstatement. The auditor's qualifications must clearly appear in the conclusion using the word "qualified", and the qualification must be clearly described and justified.

Paragraph 3. The auditor shall provide supplementary information regarding any matters pointed out by the auditor without issuing a qualification when providing conclusions and information pursuant to this Order. Supplementary information must not replace a qualification. The term "supplementary information" shall be used for supplementary information.

Paragraph 4. Conclusions and information pursuant to this Order, if issued unqualified, shall be reproduced verbatim in accordance with the instructions in Appendix 1.

Section 3. The scope and nature of the audit procedures to be performed to provide the individual conclusions and information pursuant to this Order shall be determined by the auditor taking into account good auditing practice. Appendix 2 contains a description of procedures and the like expected to be included for the auditor to provide the individual conclusions and information in this Order.

1. The Order contains provisions implementing Commission Directive 2006/73/EC of 10 August 2006 implementing Directive 2004/39/EC of the European Parliament and of the Council as regards organisational requirements and operating conditions for investment firms and defined terms for the purposes of that Directive, Official Journal of the European Communities 2006, No. L 241, page 26.

Act Gazette A 2024 Published on 14 December 2024 5 December 2024. No. 1529. Ministry of Industry, Business and Financial Affairs, Danish Financial Supervisory Authority, file no. 24-019441 CQ003087

Chapter 2 External Audit

Section 4. The external audit shall audit the annual accounts and consolidated accounts in accordance with good auditing practice and, in particular, verify that these are prepared in compliance with the requirements of legislation and any other provisions regarding the preparation of accounts.

The External Audit Protocol or Other Corresponding Reporting

Section 5. For the use of the board of directors and any audit committee in undertakings with their registered office in Denmark, the external audit shall, pursuant to Article 11 of Regulation (EU) No 537/2014 of the European Parliament and of the Council of 16 April 2014 on specific requirements regarding statutory audit of public-interest entities, credit institutions, mortgage credit institutions, insurance undertakings and undertakings which have transferable securities or other financial instruments admitted to trading on a regulated market in an EU country or an EEA country, maintain an audit protocol. The protocol shall provide an account of the audit performed during the year, which may form the basis for audit sub-conclusions. Protocol additions shall be presented at every board meeting, and any protocol addition shall be signed by the entire board of directors, any members of the external audit committee, the external auditor and the head of internal audit.

Paragraph 2. The protocol regarding the annual accounts shall provide an account of the nature and scope of the audit work performed and the conclusion thereon. In addition, the division of work between internal audit and external audit shall be discussed.

Paragraph 3. In the protocol regarding the annual accounts of parent undertakings, significant remarks on the accounting and audit matters in the individual subsidiary undertakings shall be discussed.

Paragraph 4. A copy of the protocol regarding the annual accounts shall be submitted by the undertaking to the Danish Financial Supervisory Authority simultaneously with a copy of the annual report approved by the board of directors. Protocols submitted to the Danish Financial Supervisory Authority shall be drafted in Danish or English.

Paragraph 5. For undertakings other than those mentioned in paragraph 1, the undertaking may choose to agree with the auditor that an audit protocol shall be maintained. In that case, Section 5, paragraphs 1-4, shall apply mutatis mutandis to this protocol and to the protocol regarding the annual accounts.

Paragraph 6. If the undertaking chooses to agree with the auditor that no audit protocol shall be maintained, the auditor shall, in accordance with good auditing practice, cf. Section 16 of the Act on Approved Auditors and Audit Firms and the International Standards on Auditing, provide other corresponding reporting regarding the annual accounts to the board of directors. This other corresponding reporting shall provide an account of the audit performed during the year, which may form the basis for audit sub-conclusions.

Paragraph 7. The other corresponding reporting regarding the annual accounts shall provide an account of the nature and scope of the audit work performed and the conclusion thereon. In addition, the division of work between internal audit and external audit shall be discussed.

Paragraph 8. The other corresponding reporting regarding the annual accounts shall discuss significant remarks on the accounting and audit matters in the individual subsidiary undertakings.

Paragraph 9. A copy of the other corresponding reporting regarding the annual accounts of the parent undertaking shall be submitted by the undertaking to the Danish Financial Supervisory Authority simultaneously with a copy of the annual report approved by the board of directors. The other corresponding reporting submitted to the Danish Financial Supervisory Authority shall be drafted in Danish or English.

Section 6. Conclusions, information, summaries, reproductions, assessments and remarks etc. pursuant to Sections 7-14 and 34-46 may appear in a separate protocol in the audit protocol entitled "Protocol with the Danish Financial Supervisory Authority's Special Reporting Requirements for the Audit of the Annual Accounts". If applicable, the provisions of this Order for the protocol regarding the annual accounts shall apply mutatis mutandis to this protocol. The separate protocol shall be signed by the same external auditors and the head of internal audit, and submitted on the same date as the protocol submitted pursuant to Section 5.

Summaries

Section 7. In a separate section in the protocol regarding the annual accounts or other corresponding reporting, the external audit shall summarize all remarks that the audit has given rise to present to the board of directors and any audit committee. The summary shall contain a status regarding the remarks presented for the relevant financial year as well as a status regarding the remarks that appeared as open in the protocol regarding the previous year's annual accounts or other corresponding reporting, cf. Appendix 3. If the audit has not given rise to any remarks, this shall be stated.

Paragraph 2. In a separate section in the protocol regarding the annual accounts or other corresponding reporting, the external audit shall reproduce a list prepared by the undertaking of all orders issued by the Danish Financial Supervisory Authority in the financial year, orders issued by the Danish Financial Supervisory Authority in the previous financial year but not yet complied with at the reporting date, and orders complied with in the financial year. If no orders have been issued in the financial year and all orders have been complied with by the end of the previous financial year, this shall likewise be stated. The external auditor shall review the list prepared by the undertaking and provide remarks thereon, including the auditor's position on the compliance with the orders.

Paragraph 3. In a separate section in the protocol regarding the annual accounts or other corresponding reporting, the external audit shall reproduce a list prepared by the undertaking of all criticisms and risk disclosures issued by the Danish Financial Supervisory Authority in the financial year. The external auditor shall review the list prepared by the undertaking and provide remarks thereon.

General Conclusions and Information

Section 8. In undertakings that have internal audit, it shall be concluded in the audit protocol regarding the annual accounts or other corresponding reporting whether:

1. the tasks agreed in the audit agreement have been performed, and whether the internal audit functions satisfactorily, including whether the external audit has become aware of matters that individually or collectively refute that the internal audit functions independently of the daily management, and
2. the external audit, based on the work performed by the external audit, agrees with the content of the internal audit's protocol additions regarding the financial year, and if this is not the case, in what the disagreement consists.

Section 9. The external audit shall provide information in a separate section in the protocol regarding the annual accounts or other corresponding reporting regarding the performance of any assistance or advisory tasks.

Section 10. The external audit shall provide information in a separate section in the protocol regarding the annual accounts or other corresponding reporting regarding uncorrected errors. The information shall be provided per error with an indication of the amount and effect on account items. In addition, information shall be provided regarding the total effect of uncorrected errors on profit, assets, liabilities and equity. Uncorrected errors that are clearly immaterial, whether considered individually or collectively and assessed based on any criterion regarding size, nature or circumstances, may be omitted with information regarding the threshold used. If all errors have been corrected, or if no errors were identified during the audit, this shall be stated.

Section 11. The external audit shall provide a conclusion in the protocol regarding the annual accounts or other corresponding reporting regarding whether the undertaking's administrative and accounting practices in material areas, including business processes and internal control procedures, are organized and function in a satisfactory manner. In this connection, the external auditor shall further conclude whether:

1. the undertaking's overall system, data and operational security are and function in a satisfactory manner, and
2. the external audit has become aware of matters that are in conflict with the requirements in the legislation regarding financial undertakings, investment firms, SIKAVs, securities funds, insurance companies and share dealing companies, including Section 71 of the Act on Financial Business and the order issued pursuant thereto on the management and control of the institution, Section 132 of the Act on Insurance Business and the order issued pursuant thereto on the management and control of insurance companies etc., and Sections 51-53 of the Act on Investment Firms and the like and the order issued pursuant thereto on management and control.

Section 12. The external audit shall provide the following information in the protocol regarding the annual accounts or other corresponding reporting regarding speculative provisions:

1. Whether the financial undertaking's guidelines pursuant to Section 77, paragraph 4, of the Act on Financial Business, Section 113 of the Act on Insurance Business, Section 85, paragraph 1, of the Act on Share Dealing Companies and Investment Services and Activities or the association's guidelines pursuant to Section 60, paragraph 4, of the Act on Investment Firms and the like are assessed to be satisfactory and have functioned appropriately, cf. Section 77, paragraph 5, of the Act on Financial Business, Section 114 of the Act on Insurance Business, Section 85, paragraph 2 of the Act on Share Dealing Companies and Investment Services and Activities, and Section 60, paragraph 5, of the Act on Investment Firms and the like.
2. Whether the review pursuant to Section 77, paragraph 5, of the Act on Financial Business, Section 114 of the Act on Insurance Business, Section 85, paragraph 2, of the Act on Share Dealing Companies and Investment Services and Activities, and Section 60, paragraph 5, of the Act on Investment Firms and the like has given rise to remarks.

Section 13. The external audit shall provide the following in the protocol regarding the annual accounts or other corresponding reporting regarding intra-group transactions and exposures:

1. A conclusion regarding whether business processes have been established with a view to compliance with the provision in Section 182 of the Act on Financial Business, Section 173 of the Act on Insurance Business, and Section 137 of the Act on Share Dealing Companies and Investment Services and Activities.
2. Information regarding whether material errors or deficiencies have been identified in connection with the review of transactions between the undertaking and undertakings covered by Section 2 of the Order on Intra-Group Transactions, cf. Section 14, No. 2, and provide a more detailed description of the transactions that are of significant importance or unusual nature.

Section 14. The external audit shall provide a conclusion in the protocol regarding the annual accounts or other corresponding reporting regarding the following regarding exposures to related parties:

1. Whether the exposures granted by the board of directors to and security received from board members or directors as well as undertakings in which these are direct or indirect holders of a qualifying holding, directors or board members, have been granted in accordance with the undertaking's usual business conditions and on market-based terms, cf. Section 78, paragraph 5, of the Act on Financial Business, Section 117, paragraph 5 and Section 118, of the Act on Insurance Business, and Section 88, paragraph 5, of the Act on Share Dealing Companies and Investment Services and Activities.
2. Whether the financial undertaking, insurance company or share dealing company has exposure to commercial undertakings where employees of the board of directors or other employees of the financial undertaking, insurance company or share dealing company own or participate in the management or operation of these, cf. Section 80, paragraph 1, 2, and 8, 2nd sentence, of the Act on Financial Business, Section 121, paragraph 1, Section 122, paragraph 1 and Section 125, paragraph 1, of the Act on Insurance Business, and Section 89, paragraph 1, Section 90, paragraph 1 and Section 93, of the Act on Share Dealing Companies and Investment Services and Activities.

Other Provisions

Section 15. Section 11, Nos. 1 and 2, Sections 12-14, Section 21, paragraph 1, and Section 27 do not apply to subsidiary undertakings that are not covered by Section 1, paragraph 1, or 3.

Paragraph 2. Sections 12-14 do not apply to audit protocols or other corresponding reporting for financial holding companies and insurance holding companies.

Section 16. If the undertaking has an internal audit that meets the provisions in Chapter 3, the external audit and the head of internal audit may agree that conclusions, reproductions and assessments etc. pursuant to Sections 34, 35 and 37, Section 39, No. 1, and Sections 41, 42 and 46 shall only appear in the internal audit's protocol. The agreement on this shall appear in the audit agreement, cf. Section 24.

Chapter 3 Internal Audit

Section 17. The board of directors may decide that an internal audit shall be established, cf. however paragraph 3. If no internal audit has been established, the board of directors shall discuss the need to establish an internal audit at least once a year taking into account the undertaking's complexity, including whether the undertaking outsources and insources activities. The board of directors' decision shall appear in the board of directors' meeting minutes.

Paragraph 2. If a board of directors decides pursuant to paragraph 1 that an internal audit shall be established, the provisions regarding internal audit shall apply.

Paragraph 3. In undertakings that have had an average of 125 or more full-time employees at the balance sheet date in the two most recent financial years, an internal audit shall be established.

Paragraph 4. For groups, paragraphs 1 and 3 shall apply mutatis mutandis.

Paragraph 5. Paragraphs 3 and 4 do not apply to investment firms, SIKAVs and securities funds.

Section 18. The internal audit shall function independently of the daily management.

Paragraph 2. The internal audit is led by a head of internal audit. The appointment and dismissal of the head of internal audit may only be made by the board of directors. The appointment and dismissal of the head of internal audit may be made for the group as a whole.

Paragraph 3. The head of internal audit must have a theoretical education corresponding to what is required to become an approved auditor.

Paragraph 4. The head of internal audit must have participated in audit work for at least 3 years within the last 5 years at the time of appointment.

Paragraph 5. The Danish Financial Supervisory Authority may grant dispensation from the requirements in paragraphs 3 and 4 in special cases.

Section 19. The board of directors may appoint one or more deputy heads of internal audit.

Paragraph 2. The board of directors may appoint a deputy head of internal audit as a substitute for the head of internal audit.

Paragraph 3. Section 18, paragraphs 2-5, Section 20, paragraphs 1-3, and Section 21 regarding the head of internal audit shall apply mutatis mutandis to deputy heads of internal audit.

Section 20. When a head of internal audit takes up office, this shall be reported to the Danish Financial Supervisory Authority no later than 1 month after taking up office.

Paragraph 2. The board of directors shall, when reporting to the Danish Financial Supervisory Authority on the appointment of the head of internal audit, cf. paragraph 1, provide a declaration that the head of internal audit meets the requirements pursuant to Section 18, paragraphs 3 and 4.

Paragraph 3. When a head of internal audit leaves office, the board of directors and the head of internal audit shall no later than 1 month after leaving office send their respective statements to the Danish Financial Supervisory Authority regarding the background thereof.

Paragraph 4. In connection with the declaration required in paragraph 2, the board of directors shall inform whether the head of internal audit signs the annual accounts pursuant to Section 30.

Paragraph 5. The board of directors shall inform the Danish Financial Supervisory Authority of any change in the decision regarding whether the head of internal audit signs the annual accounts.

Paragraph 6. The board of directors shall inform the Danish Financial Supervisory Authority of the decision to discontinue the internal audit.

Section 21. The audit performed by internal audit shall cover all material and risk-bearing areas in the undertaking, cf. Appendix 4.

Paragraph 2. The head of internal audit shall have access to all information that this finds necessary for the conduct of the audit, including the board of directors' minutes.

Paragraph 3. The head of internal audit and employees in the internal audit must not participate in other work in the undertaking or group than audit, cf. Appendix 4.

Paragraph 4. Internal audit must not undertake tasks when there are circumstances suitable to raise doubt in a well-informed third party regarding the independence of the internal audit.

Paragraph 5. The head of internal audit must not come into a situation where the person declares, concludes or provides information on matters or documents that the head of internal audit, employees in the internal audit or consultants used by the head of internal audit have prepared the basis for.

Section 22. Audit and deputy heads of internal audit must, pursuant to Section 77, paragraph 10, of the Act on Financial Business, Section 116 of the Act on Insurance Business, and Section 87 of the Act on Share Dealing Companies and Investment Services and Activities, not have economic interests in the undertaking or group in which they are employed.

Section 23. In undertakings and groups respectively that have an internal audit, there shall be a job description approved by the board of directors. The job description can be prepared for the group as a whole and adopted by the boards of directors of the individual group undertakings. The job description must at a minimum contain provisions regarding:

1. the internal audit's general powers, responsibilities and tasks, including that the audit performed by internal audit shall cover all material and risk-bearing areas in the undertaking,
2. the employees' qualifications,
3. how and to what extent the head of internal audit and employees in the internal audit are ensured continuous further education,
4. that the appointment and dismissal of employees in the internal audit shall be made or approved by the head of internal audit, and that the employees' education shall be approved by the head of internal audit,
5. the internal audit's budget, and that this is approved by the board of directors, which shall appear in a board of directors' protocol addition, and
6. information regarding agreements between the undertaking's management and the internal audit regarding the performance of special audit tasks. One-off tasks and tasks of a temporary nature need only appear in the internal audit's protocol.

Paragraph 2. The internal audit may only undertake work tasks, cf. paragraph 1, No. 1, which it has sufficient competencies and resources to perform.

Section 24. In undertakings and groups respectively that have an internal audit, the audit work shall be performed in accordance with good auditing practice and in accordance with an audit agreement between the external audit and the head of internal audit. The audit agreement can be prepared for the group as a whole. The audit agreement must contain:

1. an overall description of which audit tasks shall be performed and which of these tasks are the responsibility of the external audit and the internal audit respectively,
2. guidelines for cooperation between the external audit and the internal audit, including for the work the external audit shall perform in connection with the control of the internal audit's work, and
3. a description of how and to what extent information is exchanged between the internal and external audit regarding the audit performed.

Paragraph 2.