Regulation on the Method of Performing Internal Audit Activities of a Factoring Company - Unofficial Consolidated Text (NN No. 12/15 and 142/22)

UNOFFICIAL CONSOLIDATED TEXT REGULATION ON THE METHOD OF PERFORMING INTERNAL AUDIT ACTIVITIES OF A FACTORING COMPANY (Narodne novine No. 12/15 and 142/22) The Regulation on Amendments to the Regulation on the Method of Performing Internal Audit Activities of a Factoring Company (NN No. 142/22) entered into force and is applicable from December 15, 2022.

Regulation on the Method of Performing Internal Audit Activities of a Factoring Company – Unofficial Consolidated Text (NN, No. 12/15 and 142/22) 1 Introductory Provisions Article 1. This Regulation further specifies the method of performing internal audit activities of a factoring company.

Terms and Definitions Article 2. The terms used in this Regulation have the following meanings:

1. Agency means the Croatian Financial Services Supervisory Agency;
2. Factoring company means a legal entity that has received a permit from the Agency to conduct factoring activities;
3. Act means the Factoring Act ("Narodne novine" No. 94/14).

Internal Audit Article 3. A factoring company is obliged to organize the implementation of internal audit, which independently and objectively assesses the internal control system, provides independent and objective expert opinions and advice for improving business operations to enhance the performance of the factoring company, by introducing a systematic, disciplined approach to assessing and improving the effectiveness of risk management, control, and corporate governance.

Method of Performing Internal Audit Activities Article 4. (1) Internal audit of a factoring company is performed in accordance with internationally recognized auditing standards for internal audit, the code of professional ethics for internal auditors, and the rules of operation of internal audit. (2) For the performance of internal audit activities, a factoring company may: – employ a person within the company, – entrust the performance of internal audit activities to a natural person who is not in an employment relationship with the factoring company, – entrust the performance of internal audit activities to another legal entity. (3) A natural person employed in the company, as well as a natural person to whom internal audit activities are entrusted who is not in an employment relationship with the company, and a natural person who, as an employee of the legal entity to which the company has entrusted internal audit activities, performs internal audit in the company, must hold the title of authorized auditor or authorized internal auditor acquired in accordance with the law governing auditing, or acquired in accordance with the rules and program of the competent professional organization for the professional education of internal auditors. (4) A person performing internal audit activities may not perform other duties and tasks in the factoring company. (5) Members of the management board of the factoring company may not perform internal audit activities. (6) The factoring company is responsible for the performance of internal audit activities from paragraph 1 of this Article even when these activities are outsourced to another person.

Regulation on the Method of Performing Internal Audit Activities of a Factoring Company – Unofficial Consolidated Text (NN, No. 12/15 and 142/22) 2 Internal Audit Activities Article 5. (1) Internal audit analyzes and evaluates the activities of the factoring company and provides expert opinions, recommendations, and advice on controls to enable:

1. the performance of factoring activities in accordance with the Act and regulations adopted on the basis of the Act, as well as in accordance with internal rules governing the business operations of the factoring company,
2. the examination and evaluation of the adequacy and effectiveness of the internal control system,
3. the assessment of the application and effectiveness of the risk management system and procedures, as well as the methodology for risk assessment,
4. the assessment of the management and leadership reporting system,
5. the assessment of the correctness and reliability of the system for keeping business books, accounting records, valuation of accounting items, and financial statements and other reports in accordance with the Act and regulations adopted on the basis of the Act,
6. the verification of the reliability of the reporting system, as well as the timeliness and accuracy of reports prescribed by the Act, regulations adopted on the basis of that Act, and other regulations,
7. the assessment of the method of asset protection,
8. the assessment of the system for collecting and validity of information publicly published in accordance with Article 67 of the Act,
9. the issuance of other assessments if prescribed by the Act and regulations adopted on the basis of the Act,
10. all other activities necessary to achieve the objectives of internal audit. (2) The management board of the factoring company is obliged to provide internal audit with the necessary powers and access to all data essential for fulfilling the activities from paragraph 1 of this Article.

Internal Audit Plans Article 6. (1) A factoring company is obliged to periodically, at least once a year, identify and assess the risks to which it is or may be exposed, and document them, in accordance with the provisions of the Act and regulations governing risk management. (2) Based on the risk assessment from paragraph 1 of this Article, internal audit prepares a strategic and annual work plan, as well as individual audit plans. (3) The annual internal audit plan from paragraph 2 of this Article is prepared based on the strategic plan and includes at least: – business areas that are priority based on risk assessment, – a list of planned audits. (4) The management board of the factoring company, with the prior consent of the supervisory board, accepts the strategic and annual work plan of internal audit.

Regulation on the Method of Performing Internal Audit Activities of a Factoring Company – Unofficial Consolidated Text (NN, No. 12/15 and 142/22) 3 Internal Audit Reports Article 7. (1) Internal audit prepares individual reports on activities performed within the year. (2) The reports from paragraph 1 of this Article contain at least the following: – the subject and scope of performed activities, controls, and audits, – an assessment of the appropriateness and effectiveness of the internal control system's operation, along with recommendations for its improvement, – an assessment of the adequacy and effectiveness of the risk management system, including information on risk exposure, – illegality and irregularities, including non-compliance with internal policies and procedures, if established, – proposals, recommendations, and deadlines for eliminating established illegality and irregularities, as well as identified deficiencies and weaknesses, – persons responsible for the implementation of proposals, recommendations, and measures, – information on the status of execution of proposals, recommendations, and measures to eliminate illegality and irregularities, as well as deficiencies and weaknesses. (3) The report from paragraph 1 of this Article, internal audit delivers to the audit committee, the management board member responsible for the area that was the subject of the audit, and responsible persons of the organizational unit of the factoring company within whose competence the business area that was the subject of the audit or performed activity falls. (4) If deemed necessary, internal audit may also deliver the report from paragraph 1 of this Article to all members of the management board of the factoring company and/or the supervisory board of the factoring company.

Annual Report on the Work of Internal Audit Article 8. (1) Internal audit prepares an annual report on work in accordance with the activities it performs and established work plans. (2) Internal audit prepares the annual report on work from paragraph 1 of this Article, which contains at least the following: – the subject and scope of performed activities, – an assessment of the appropriateness and effectiveness of the internal control system's operation, – an assessment of the adequacy and effectiveness of the risk management system, including information on risk exposure, – a summary of established illegality, irregularities, and non-compliance with internal policies and procedures, – a report on the execution of proposals, recommendations, and deadlines for eliminating established illegality and irregularities, as well as deficiencies and weaknesses. (3) The report from paragraph 1 of this Article must be signed by the person responsible for the work of internal audit. (4) Internal audit delivers the report from paragraph 1 of this Article to the management, audit committee, and supervisory board of the factoring company.

Regulation on the Method of Performing Internal Audit Activities of a Factoring Company – Unofficial Consolidated Text (NN, No. 12/15 and 142/22) 4 (5) The factoring company is obliged to deliver the report from paragraphs 1 of this Article by January 31 of the current year for the previous year in accordance with the instructions on the method of data submission to the Agency. (6) If internal audit, during the performance of an audit, establishes the occurrence of illegal business operations and violation of risk management rules, thereby threatening the factoring company with illiquidity, insolvency, or endangering the safety of business operations, it must immediately notify the management and supervisory board of the factoring company. (7) If internal audit, while performing audit activities and business processes, establishes that the management board of the factoring company violates risk management rules, it is obliged to immediately notify the supervisory board of the factoring company.

Final Provisions Article 9. This Regulation enters into force eight (8) days from the date of publication in "Narodne novine".