General Provisions Applicable to Entities and Issuers Supervised by the National Banking and Securities Commission that Hire External Audit Services for Basic Financial Statements

GENERAL PROVISIONS APPLICABLE TO ENTITIES AND ISSUERS SUPERVISED BY THE NATIONAL BANKING AND SECURITIES COMMISSION THAT HIRE EXTERNAL AUDIT SERVICES FOR BASIC FINANCIAL STATEMENTS

Published in the Official Gazette of the Federation on April 26, 2018.
Updated with the reform published in the same Gazette on November 15, 2018.

The National Banking and Securities Commission, prior to the agreement of its Board of Directors and based on the provisions of Articles 21, second paragraph, 40, second paragraph, 101, fourth and fifth paragraphs, and 125 of the Credit Institutions Law; 53, third and fourth paragraphs of the General Law of Organizations and Auxiliary Credit Activities; 30 and 67, fourth and fifth paragraphs of the Credit Unions Law; 77, third and fourth paragraphs and 77 Bis 1, first paragraph of the Investment Funds Law; 18, third paragraph, 46 Bis, first paragraph, and 118, fourth and fifth paragraphs of the Savings and Popular Credit Law; 31, fraction XI, and 34, fourth and fifth paragraphs of the Law to Regulate the Activities of Savings and Loan Cooperative Societies; 126, 210, fourth and fifth paragraphs, 243, first paragraph, 252, 279, first and last paragraphs, 318, first paragraph, and 343 of the Securities Market Law; 52, first paragraph of the Organic Law of the National Financial Institution for Agricultural, Rural, Forestry, and Fisheries Development; 33, first paragraph of the Law of the National Institute for the Consumption Fund for Workers; 19 Bis, fraction I and 66, fractions II and IV of the Law of the National Housing Fund for Workers; 190, second paragraph of the Law of the Institute of Security and Social Services for State Workers, as well as 4, fractions VI, XXXVI, and XXXVIII, 16, fraction I, and 19 of the Law of the National Banking and Securities Commission, and

CONSIDERING

That it is necessary to update the regulation regarding the audited financial statements of various entities subject to the supervision of the National Banking and Securities Commission in order to improve the quality of the external audit services contracted by these financial entities and persons subject to the supervision of the Commission itself, since the financial information contained in their financial statements is the instrument through which their financial stability and solvency are verified, which allows for adequate supervision and, at the same time, for shareholders and other interested parties to have relevant information about these entities and persons;

That it is necessary to strengthen the communication channels of the governing bodies of the various entities subject to the supervision of the National Banking and Securities Commission with the external auditor, with the objective of providing means and mechanisms that allow their constant and efficient interaction aimed at improving the content and quality of the reports, including the disclosure of significant matters, and other documentation that these external auditors prepare, providing confidence and certainty to the Mexican financial system;

That it is essential that the audit committee of the aforementioned entities, or to whom the corresponding functions are assigned, strengthens and documents its functions related to external audit, and that it is convenient to include the obligation of external auditors to present to said committee a report with significant information on the development of the external audit, which facilitates the evaluation of the performance of the external audit functions;

That in order to safeguard independence in the exercise of the external auditor's work, it is indispensable to incorporate requirements that must be met for such purposes, as well as those applicable to the legal entity in which the auditor works;

That with the object of strengthening the national financial system, it is required that external audit work meet the highest quality standards, so that the information derived from them is accurate, transparent, and reliable for the various financial entities and persons subject to the supervision of the National Banking and Securities Commission, as well as for financial authorities and the market in general, therefore, norms are incorporated aimed at ensuring this end, and

That it has been considered indispensable to incorporate in a single normative instrument the provisions applicable to the financial entities and persons mentioned, regarding external audit services that ensure the transparency and reliability of their financial information, systematizing their integration and homogenizing the terminology used, in order to thereby provide legal certainty regarding the regulatory framework to which the aforementioned entities or persons must adhere in the development of external audit practices, which will also facilitate consultation, compliance, and observance of the provisions applicable to them, has resolved to issue the following:

GENERAL PROVISIONS APPLICABLE TO ENTITIES AND ISSUERS SUPERVISED BY THE NATIONAL BANKING AND SECURITIES COMMISSION THAT HIRE EXTERNAL AUDIT SERVICES FOR BASIC FINANCIAL STATEMENTS

Chapter I
General Provisions
Chapter II
On the Requirements that Audit Firms and Independent External Auditors Must Meet
Chapter III
On the Applicable Standards for the Performance of External Audit Work, as well as the Content of the External Audit Report and Other Communications and Opinions
Chapter IV
On the Contracting of the Audit Firm
Chapter V
On the Substitution of the Audit Firm and the Independent External Auditor
Chapter VI
On the Follow-up of the Work of the Audit Firm and the Independent External Auditor
Chapter VII
On the Evaluation of the Work of the Audit Firm and the Independent External Auditor
Chapter VIII
On the Submission of the External Audit Report, as well as Other Communications and Opinions to the Commission
Chapter IX
On the Powers of the Commission

Chapter I
General Provisions

Article 1.- These provisions aim to establish the requirements that Audit Firms and Independent External Auditors must meet when providing external audit services for Basic Financial Statements to Entities and Issuers; the applicable standards for the performance of external audit work, the content of External Audit Reports and other communications and opinions mentioned in Article 15 of these provisions, prepared by said Audit Firms and Independent External Auditors, as well as the rules regarding the contracting, substitution, monitoring, and evaluation of external audit work.

These provisions are applicable to the following Entities:
I. General warehouses.
II. Stock exchanges.
III. Brokerage firms.
IV. Exchange houses.
V. Central counterparties for securities.
VI. Development Entities.
VII. National Financial Institution.
VIII. Capital investment funds.
IX. Development banking institutions.
X. Multiple banking institutions.
(1) XI. Financial technology institutions.
XII. Securities depository institutions.
XIII. Development Agencies.
XIV. Savings and loan cooperative societies, with operation levels I to IV, except for those savings and loan cooperative societies with operation levels I and II that are exempt from auditing their annual Basic Financial Statements, provided that the value of their assets is lower than what is determined in Article 32-A of the Federal Tax Code as the condition for legal entities to opt to audit their Basic Financial Statements for tax purposes under Article 52 of said Code.
XV. Investment fund share distribution societies.
XVI. Regulated multiple-object financial societies.
XVII. Popular financial societies and community financial societies with operation levels I to IV, as well as rural financial integration agencies.
These provisions shall not apply to popular financial societies, community financial societies with operation level I, and rural financial integration agencies that are exempt from auditing their annual Basic Financial Statements, provided that the value of their assets and their accumulated taxable income is lower than what is determined in Article 32-A of the Federal Tax Code as the condition for legal entities to opt to audit their Basic Financial Statements for tax purposes under Article 52 of said Code.
XVIII. Investment fund operating societies.
XIX. Investment fund share valuation societies.
XX. Credit unions.
Additionally, these provisions shall be applicable to Issuers.

Article 2.- For the purposes of these provisions, the following shall be understood:
I. Independent External Auditor: the public accountant or licensed public accountant who meets the characteristics and requirements contained in Chapter II of these provisions, who signs the External Audit Report, other communications, and opinions required pursuant to Article 15 of these provisions, on behalf of the Audit Firm providing the external audit services contracted by the Entity or Issuer.
II. Commission: the National Banking and Securities Commission.

(2) III. Audit Committee: the committee constituted by the Board of Directors in accordance with the laws and applicable provisions for stock exchanges, brokerage firms, Development Entities, National Financial Institution, multiple banking institutions, development banking institutions, financial technology institutions, Development Agencies, savings and loan cooperative societies, multiple-object financial societies that maintain links under the General Law of Organizations and Auxiliary Credit Activities, credit unions, popular financial societies, community financial societies, as well as rural financial integration agencies. In cases where the specially applicable provisions for Entities do not contemplate the obligation to have an Audit Committee, the functions referred to in these provisions shall be the responsibility of the Board of Directors of said Entities, which may assign them to the person or area it designates, provided that it is independent of the general management or its equivalent, as well as of the Independent External Auditor and Audit Firm, and has technical knowledge and experience in accounting and auditing.
IV. Auxiliary Supervision Committee: the body of the Auxiliary Supervision Fund of Savings and Loan Cooperative Societies and Protection of their Savers or of the Federations responsible for exercising auxiliary supervision of savings and loan cooperative societies, popular financial societies, community financial societies, and rural financial integration agencies under the Law to Regulate the Activities of Savings and Loan Cooperative Societies and the Savings and Popular Credit Law, respectively.
V. Board of Directors: the board of directors or board of trustees of the Entities or Issuers.
With respect to Development Entities and Development Agencies, to the following administrative bodies or units:
a) The Board of Directors referred to in the Law of the National Institute for the Consumption Fund for Workers, or its substitute, in the case of INFONACOT. b) The Executive Commission or Board of Directors referred to in the Law of the Institute of Security and Social Services for State Workers, or their substitutes, according to the powers granted to these collegiate bodies under said Law in the case of FOVISSSTE. c) The General Assembly or Board of Directors referred to in the Law of the National Housing Fund for Workers, or their substitutes, according to the powers granted to these collegiate bodies under said Law in the case of INFONAVIT. d) The technical committee or equivalent body of Development Entities, or its substitute as established in applicable legal provisions. With respect to Issuers of fiduciary development certificates, real estate certificates, indexed certificates, investment project certificates, and investment in energy and infrastructure certificates referred to in the General Provisions applicable to securities issuers and other market participants, published in the Official Gazette of the Federation on March 19, 2003, and their respective modifications, to the technical committee of the trust constituted in accordance with applicable provisions. With respect to Issuers that do not have any of the administrative bodies mentioned above, to the person or corporate body that has the competence to decide on the contracting of the Audit Firm responsible for the external audit of the Issuer in question. (2) For the case of financial technology institutions, the term shall apply indistinctly to the board of directors or the sole administrator, as applicable.

VI. Consortium: the set of legal entities linked by one or more natural persons who, integrating a Group of Persons, have Control over the former.
VII. Control: the capacity of a person or Group of Persons to carry out any of the following acts:
a) Impose, directly or indirectly, decisions in general meetings of shareholders, partners, or equivalent bodies, or appoint or dismiss the majority of directors, administrators, or their equivalents, of a legal entity. b) Maintain ownership of rights that allow, directly or indirectly, to exercise voting rights regarding more than fifty percent of the share capital of a legal entity. c) Direct, directly or indirectly, the administration, strategy, or main policies of a legal entity, whether through ownership of securities or by contract or any other form.
VIII. Audit Firm: the legal entity whose activity is the provision of audit services for Basic Financial Statements, in which Independent External Auditors work.
IX. Issuer: that considered as such under the Securities Market Law.
(1) X. Entities: the entities referred to in fractions I to XX of the previous Article 1.
XI. Development Entities: public funds and trusts constituted by the Federal Government for economic development that carry out financial activities, as referred to in Article 3° of the Credit Institutions Law.
XII. Basic Financial Statements: the consolidated basic financial statements or, if applicable, the individual basic financial statements that are required from Entities or Issuers in accordance with the provisions applicable to them.
XIII. Audit Team: that considered as such under the professional ethics code issued by the Mexican Institute of Public Accountants, A.C.
XIV. National Financial Institution: the National Financial Institution for Agricultural, Rural, Forestry, and Fisheries Development.
XV. FOVISSSTE: the Housing Fund of the Institute of Security and Social Services for State Workers.
XVI. Group of Persons: persons who have agreements, of any nature, to make decisions in the same sense. It is presumed, unless proven otherwise, that they constitute a Group of Persons:
a) Persons who have kinship by blood, affinity, or civil status up to the fourth degree, spouses, concubine, and concubine. b) Societies that are part of the same Consortium or Business Group, and the person or group of persons who have Control over said societies.
XVII. Business Group: the set of legal entities organized under schemes of direct or indirect participation in share capital, in which the same society maintains Control over said legal entities. Financial groups constituted in accordance with the Law to Regulate Financial Groupings shall also be considered as Business Groups.
XVIII. INFONACOT: the National Institute for the Consumption Fund for Workers.

XIX. INFONAVIT: the National Housing Fund for Workers.
XX. External Audit Report: the opinion on Basic Financial Statements or the document prepared by an Independent External Auditor expressing an opinion on the Basic Financial Statements as a result of an external audit performed in accordance with the ISA.
XXI. ISA: the International Standards on Auditing issued by the International Auditing and Assurance Standards Board of the International Federation of Accountants.
XXII. Development Agencies: INFONACOT, FOVISSSTE, and INFONAVIT, jointly.
XXIII. SEDI: the electronic system for sending and disseminating information authorized by the Commission to the stock exchanges in question.
XXIV. STIV-2: the Information Transfer System on Securities referred to in the General Provisions applicable to securities issuers and other market participants, published in the Official Gazette of the Federation on March 19, 2003, and their respective modifications.
The terms "associated," "parent," and "subsidiary" used in these provisions shall have the meaning established for this purpose by the Financial Information Standards issued by the Mexican Council of Financial Information Standards, A.C.

Article 3.- Entities and Issuers must contract the services of an Audit Firm that has Independent External Auditors who meet the requirements provided in these provisions, to carry out the external audit of their Basic Financial Statements and the issuance of the External Audit Report, as well as for the preparation of the communications and opinions mentioned in Article 15 of these provisions.
The Entities, through their Audit Committee, as well as the Issuers, must monitor and document that, prior to the annual designation or ratification of the contracting of the Audit Firm providing such services, these adhere to what is established in these provisions.
In the case of capital investment funds, the contracting of the Audit Firm referred to in the first paragraph of this article shall be the responsibility of the investment fund operating society that administers its assets.
The provisions of this article shall not apply to the contracting of the Audit Firm or Independent External Auditor carried out for development banking institutions, National Financial Institution, Development Entities, INFONACOT, and FOVISSSTE when these are designated by the Secretariat of Public Function in accordance with applicable provisions.

Chapter II
On the Requirements that Audit Firms and Independent External Auditors Must Meet

Article 4.- The Independent External Auditor who audits the Basic Financial Statements of Entities or Issuers must meet the following requirements:
I. Be a partner of the Audit Firm contracted by the Entity or Issuer to provide external audit services for Basic Financial Statements, which must comply with what is provided in Articles 9 and 10 of these provisions.
II. Have a valid registration issued by the General Administration of Federal Fiscal Audit of the Tax Administration Service or have a valid certification as a public accountant issued by the professional college recognized by the Ministry of Public Education to which they belong.
III. With respect to Entities, have a minimum professional experience of five years in external audit work related to the financial sector or ten years in other sectors. In the case of Issuers, have a minimum of ten years of experience in external audit work.
The provisions of this article shall not apply to development banking institutions, National Financial Institution, Development Entities, INFONACOT, and FOVISSSTE when the Audit Firm or Independent External Auditor is designated by the Secretariat of Public Function in accordance with applicable provisions.
With respect to INFONAVIT, the requirements for the external auditor established by the Law of the National Housing Fund for Workers shall apply, and this article shall not be applicable.

Article 5.- The Independent External Auditor, in addition to the date of celebration of the service provision contract, during the development of the audit or other assurance work required under these provisions and until the issuance of the External Audit Report, as well as the other communications and opinions mentioned in Article 15 of these provisions, must meet the following requirements:
I. Be independent in terms of Article 6 of these provisions.
II. Not have been expelled, nor be suspended from their rights as a member of the professional association to which they belong, if applicable.
III. Not have been convicted by an irrevocable sentence for a property or intentional crime that warranted corporal punishment.
IV. Not be disqualified from exercising commerce or holding an employment, position, or commission in public service or in the Mexican financial system, nor have been declared bankrupt or in commercial bankruptcy without having been rehabilitated.
V. Not have records of suspension or cancellation of any certification or registration required to function as an Independent External Auditor, due to causes attributable to the person and originating from intentional or bad faith conduct.
VI. Not have been, nor have an offer to be, a director or executive of the Entity or Issuer in question, or, if applicable, its parent, subsidiaries, associates, entities with which joint control agreements are made, or legal entities belonging to the same Business Group or Consortium.
VII. Not have any pending litigation with the Entity or Issuer in question, or, if applicable, with its parent, subsidiaries, associates, entities with which joint control agreements are made, or legal entities belonging to the same Business Group or Consortium.
The provisions of this article shall not apply to development banking institutions, National Financial Institution, Development Entities, INFONACOT, and FOVISSSTE when the Audit Firm or Independent External Auditor is designated by the Secretariat of Public Function in accordance with applicable provisions.
With respect to INFONAVIT, the requirements for the external auditor established by the Law of the National Housing Fund for Workers shall apply, and this article shall not be applicable.

Article 6.- The Audit Firm, the Independent External Auditor, and the individuals who are part of the Audit Team providing external audit services for the Basic Financial Statements of Entities or Issuers, must be and remain independent on the date of signing the service contract, during the development of the external audit, and until the issuance of the External Audit Report and the communications and opinions indicated in Article 15 of these provisions.

Independence shall be considered non-existent when the Audit Firm, the Independent External Auditor, and the individuals who are part of the Audit Team, fall into any of the following circumstances:

I. The income received by the Audit Firm from the Entity or Issuer or, as applicable, from its parent company, subsidiaries, associates, entities with which joint control agreements are made, or legal entities belonging to the same Business Group or Consortium, derived from the provision of their services, represents 10% or more of the total income of the Audit Firm during the year immediately preceding that in which the service is to be provided.

II. The Audit Firm, Independent External Auditor, or any partner or member of the Audit Team, has been an important client or supplier of the Entity or Issuer or, as applicable, of its parent company, subsidiaries, associates, entities with which joint control agreements are made, or legal entities belonging to the same Business Group or Consortium, during the year immediately preceding that in which the service is to be provided.

A client or supplier is considered important when its sales or purchases to the Entity or Issuer or, as applicable, to its parent company, subsidiaries, associates, entities with which joint control agreements are made, or legal entities belonging to the same Business Group or Consortium, represent 10% or more of their total sales or, as applicable, total purchases.

III. The Independent External Auditor or any partner of the Audit Firm in which they work, are or have been during the year immediately preceding their appointment as Independent External Auditor, board members, general managers, or employees holding a position within the two levels immediately below the latter in the Entity or Issuer, in its parent company, subsidiaries, associates, entities with which joint control agreements are made, or legal entities belonging to the same Business Group or Consortium.

IV. As applicable, the Audit Firm, Independent External Auditor, any partner or member of the Audit Team, the spouse, concubine, concubin, or economic dependent of the aforementioned natural persons, hold investments in shares or debt securities issued by the Entity or Issuer or, as applicable, by its parent company, subsidiaries, associates, entities with which joint control agreements are made, or legal entities belonging to the same Business Group or Consortium, hold credit instruments representing such values or derivatives that have them as underlying assets, except for fixed-term deposits, including withdrawable deposit certificates on predetermined days, bank acceptances, or promissory notes with yield payable at maturity, provided that these are contracted under market conditions.

The provisions of this subsection shall not apply to:

a) The holding of shares representing the share capital of variable income investment funds and debt instruments.

b) The holding of shares representing the share capital of a joint-stock company, registered in the National Securities Register under the Commission's responsibility, through trusts constituted for that sole purpose in which they do not intervene in investment decisions, or in titles referring to indices or baskets of shares, or in credit instruments representing shares of the share capital of two or more joint-stock companies issued under trusts.

V. The Audit Firm and the Independent External Auditor, any partner or member of the Audit Team, the spouse, concubine, concubin, or economic dependent of the aforementioned natural persons, maintain with the Entity or Issuer or, as applicable, with its parent company, subsidiaries, associates, entities with which joint control agreements are made, or legal entities belonging to the same Business Group or Consortium, debts for loans or credits of any nature, except for credit card debts, financing for the purchase of durable consumer goods, mortgage credits for the acquisition of real estate, and personal and payroll credits, provided that they are granted under market conditions.

VI. As applicable, the Entity or Issuer, its parent company, subsidiaries, associates, entities with which joint control agreements are made, or legal entities belonging to the same Business Group or Consortium, hold investments in the Audit Firm conducting the audit.

VII. As applicable, the Audit Firm or the Independent External Auditor, any partner or member of the Audit Team, provides the Entity or Issuer, in addition to the external audit of Basic Financial Statements, any of the following services:

a) Preparation of the Basic Financial Statements including their notes, as well as the accounting of the Entity or Issuer, its parent company, subsidiaries, associates, entities with which joint control agreements are made, or legal entities belonging to the same Business Group or Consortium, as well as the data used as support to prepare the aforementioned Basic Financial Statements, their notes, or any item thereof, and any other type of service whose object is the preparation of said financial statements.

b) Direct or indirect operation of financial information systems, or administration of their technological infrastructure related to financial information systems.

c) Design or implementation of internal controls over financial information, as well as policies and procedures for risk management.

d) Supervision, design, or implementation of computer systems, whether hardware or software, that concentrate data supporting the Basic Financial Statements or generate significant information for their preparation.

e) Valuations, appraisals, or estimates, except those related to transfer pricing studies for tax purposes or that do not form part of the evidence supporting the external audit of Basic Financial Statements.

f) As applicable, administration of the Entity or Issuer, temporary or permanent, participating in decisions.

g) Internal audit.

h) Recruitment and selection of personnel to occupy positions of general manager or of the two levels immediately below this, or any person whose position allows them to exercise influence over the preparation of accounting records or Basic Financial Statements on which the Independent External Auditor must express an opinion.

i) Litigation before courts, or when the Audit Firm, the Independent External Auditor, or any partner or employee of the Audit Firm, hold a general power with authority over ownership, administration, or litigation and collection granted by the Entity or Issuer.

j) Preparation of opinions that, according to the laws regulating the Mexican financial system, must be issued by licensed lawyers.

k) Any service provided whose documentation could form part of the evidence supporting the external audit of Basic Financial Statements or any other service that implies or could imply conflicts of interest regarding the external audit work of Basic Financial Statements, as indicated in the ethical codes referred to in subsection X of this article.

Promoting joint-stock companies for stock market investment that, at the time of requesting registration in the National Securities Register under the Commission's responsibility, were receiving the services referred to in subsections b), c), and f) above from the Independent External Auditor auditing their Basic Financial Statements or from the Audit Firm in which they work or any partner or member of the Audit Team, may continue to receive them during the fiscal year in which they obtain registration in the cited Register of their shares or credit instruments representing them; this period may be extended by the Commission for one occasion and for up to one additional year.

Likewise, the litigation services before courts provided for in subsection i) above may be received until the total resolution of the dispute, provided that the procedure before the competent court was initiated before the registration as a promoting joint-stock company for stock market investment takes effect.

VIII. The income that the Audit Firm receives or will receive for auditing the Basic Financial Statements of the Entity or Issuer depends on the result of the audit itself or the success of any operation carried out by said Entity or Issuer that has the External Audit Report as its basis.

IX. The Audit Firm of which the Independent External Auditor is a partner, has overdue accounts receivable from the Entity or Issuer for fees from audit services or for any other service already provided to the Entity or Issuer, on the date of issuance of the Audit Report.

X. The Audit Firm, the Independent External Auditor, or any partner or member of the Audit Team, falls into any of the circumstances provided for in the professional ethical code of the recognized college of professionals by the Ministry of Public Education to which they belong or, in its absence, the one issued by the Mexican Institute of Public Accountants, A.C. or the one that replaces it, or the circumstances contemplated in the Code of Ethics issued by the International Federation of Accountants, as grounds for partiality in judgment to express their opinion, provided that such circumstances are more restrictive than those contained in these provisions.

XI. When the Audit Firm or the Independent External Auditor identify threats that are not reduced through safeguards to an acceptable level to provide the external audit service, in accordance with the ethical codes referred to in subsection X of this article.

The Audit Firm and the Independent External Auditor are responsible for complying with the independence requirements referred to in this article.

The Independent External Auditor must report to the Issuer and, in the case of Entities, to the Audit Committee, as soon as they become aware of these facts, the threats to independence that arise during the development of the external audit of Basic Financial Statements, as well as the safeguards applied.

The provisions of this article shall not apply to development banking institutions, National Financial Institution, Development Entities, INFONACOT, and FOVISSSTE, when the Audit Firm or the Independent External Auditor is designated by the Ministry of Public Function in accordance with applicable provisions. Regarding INFONAVIT, the provisions of the Law of the National Housing Fund for Workers shall apply.

Article 7.- The Independent External Auditor in their capacity as a partner of the Audit Firm responsible for the external audit of Basic Financial Statements of the Entity or Issuer concerned, as well as the engagement quality control reviewer and the manager of the Audit Team, shall not participate in the external audit of Basic Financial Statements of any Entity or Issuer for more than five consecutive years, and may be reappointed after a minimum interruption of two years. During the two-year period referred to, the Independent External Auditor, as well as the manager of the Audit Team, shall not provide services other than the external audit of Basic Financial Statements to the Entity or Issuer so that they can be reappointed as such in the Entity or Issuer.

Regarding promoting joint-stock companies for stock market investment, the five-year period referred to in this article shall begin to run from the date of registration of the shares representing their share capital or credit instruments representing them. Nevertheless, said companies must disclose this situation in their public information prospectuses and, once the shares are placed, through their annual report.

Additionally, rotation of personnel involved in the execution of the audit must be carried out, at the discretion of the Independent External Auditor responsible for the external audit of Basic Financial Statements of the Entity or Issuer concerned.

Article 8.- The documentation and working papers belonging to the Audit Firm responsible for the external audit of Basic Financial Statements that support the External Audit Report, as well as all information and other evidence used to prepare the corresponding report and other communications and opinions indicated in Article 15 of these provisions, must be preserved, physically or through images in digital format, on optical or magnetic media that allow their extraction and reading, for a minimum period of five years counted from the closing of the documentation and working papers of the external audit. The Audit Firm and the Independent External Auditor shall have a maximum period of sixty natural days, from the date on which the External Audit Report and other communications and opinions are issued, to conclude the closing of the documentation and working papers of the external audit.

During the course of the audit and within the five-year period indicated, the Audit Firm and the Independent External Auditor are obligated to keep available to the Commission the information contained in the documents and working papers or any other record with which the external audit work of Basic Financial Statements is documented and which support the preparation of the External Audit Report and, as applicable, the other communications and opinions indicated in Article 15 of these provisions. Such information or records may be reviewed jointly with the Independent External Auditor or with the manager in charge of the audit, for which the Commission itself may require their presence in order to expand on the reports or supply the evidence that served as the basis for the formulation of the opinion or report prepared in accordance with these provisions.

Article 9.- The Audit Firm, in external audits of Basic Financial Statements, as well as in the issuance of communications and opinions indicated in Article 15 of these provisions, must maintain a quality control system referred to in International Standard on Quality Control 1 "Quality control for firms that perform audits and reviews of financial statements and other assurance and related services engagements" and in International Standard on Auditing 220 "Quality Control for Audits of Financial Statements" or those that replace them, issued by the International Auditing and Assurance Standards Board of the International Federation of Accountants, as well as in the "Quality Control Standard" or the one that replaces it, issued by the Mexican Institute of Public Accountants, A.C., in accordance with what is provided in the methodologies contained in the cited standards.

The Audit Firm and the Independent External Auditor must ensure that a quality control review of the audit engagement is carried out in accordance with the standards indicated in the previous paragraph, prior to the issuance of the External Audit Report, as well as the opinion referred to in subsection II of Article 15 of these provisions.

Such review must be documented in the working papers of the external audit referred to in the first paragraph of Article 8 of these provisions, and be available to the Audit Committee during the execution of the audit.

Article 10.- The Audit Firm must have an updated manual on the quality control system, referred to in the standards indicated in Article 9 of these provisions, for the provision of audit services and the attestation work required in accordance with these provisions.

The aforementioned manual on the quality control system must:

I. Be approved by the person in charge of the quality control system and by the general manager or equivalent of the Audit Firm.

II. Contain policies and procedures to ensure that all external audit work and the other communications and opinions indicated in Article 15 of these provisions, are carried out in accordance with the standards referred to in the first paragraph of Article 14 of these provisions, as well as with the guidelines of the professional ethical codes referred to in subsection X of Article 6 of these provisions.

III. Provide, at least, for the following policies, procedures, and mechanisms:

a) Those applicable to all levels of personnel performing external audit work for the issuance of the External Audit Report and the other communications and opinions to be rendered, in accordance with Article 15 of these provisions.

b) Those necessary to assign appropriate professional personnel with the necessary capacity and competence and who have knowledge of the business of the Entity or Issuer concerned and the standards applicable to them to perform the assigned work.

c) Those that allow having reasonable assurance that the work required in accordance with these provisions is performed consistently and in accordance with professional standards and applicable regulatory requirements, as well as to issue appropriate reports to the circumstances.

d) Those corresponding to the objective evaluation, when required, of significant judgments made by the Audit Team, as well as of the conclusions reached for the formulation of the External Audit Report and other communications and opinions required in accordance with Article 15 of these provisions.

e) Those relating to the preservation of evidential documents that allow demonstrating the implementation of the quality control system, as well as the timely closing of working papers after having issued the External Audit Report and the communications and opinions required in accordance with Article 15 of these provisions.

f) Those that clearly determine the functions and responsibilities of the Independent External Auditor and the partners and employees in charge of carrying out the external audit, which include obtaining confidentiality commitments from said persons.

g) Those relating to the evaluation of the professional capacity and competence of personnel involved in the external audit.

h) Those that allow having reasonable assurance that the Audit Firm and its personnel comply with applicable ethical requirements.

i) Those relating to permanent communication between the personnel in charge of the quality control system with the Independent External Auditor, partners, and employees in charge of carrying out the audit, in order to request information that allows the Audit Firm to identify the degree of compliance with the independence requirements established in these provisions.

j) Those that allow verifying that the information contained in the working papers or databases adequately supports the opinion, communication, or report issued.

k) Those corresponding to the acceptance and continuity of clients and specific engagements.

l) Those designed to provide reasonable assurance that internally generated consultations on complex or controversial issues are carried out and documented.

m) Those applicable to quality reviews, establishing the nature, scope, and timing of such reviews and the documentation requirements, as well as the criteria for the eligibility of quality reviewers.

n) Those that provide reasonable assurance that the quality control system operates effectively.

ñ) Those that allow identifying that reasonable time is dedicated and sufficient resources are assigned for the proper performance of external audit functions.

o) Those that allow identifying and, as applicable, reporting to the Audit Committee the threats to independence and, as applicable, the safeguards applied.

p) Those that allow identifying and reporting, as applicable, to the Audit Committee and the Commission, the non-compliance of the Audit Firm and the Audit Team with professional ethical codes and independence standards established in these provisions.

q) Those relating to disciplinary procedures that ensure compliance with the policies, procedures, and mechanisms indicated in this article.

r) Those applicable to the rotation of members of the audit team.

applicable provisions. In the case of INFONAVIT, the provisions of the Law of the National Housing Fund for Workers Institute shall apply.

Article 11.- The Firm shall ensure that the quality control system referred to in the standards indicated in the first paragraph of Article 9 of these provisions complies, at least, with the following:

I. Have sufficient resources for its development, as well as mechanisms that allow preserving the documentation generated by said system.

II. Be adequate and proportional to the magnitude and complexity of its activities and those of the Independent External Auditor, as well as those of the Entities and Issuers audited.

III. Ensure that, when contracting third-party external audit services, the quality control or the capacity of the competent authorities to supervise compliance with their obligations and those of the Independent External Auditor under these provisions is not affected.

IV. Have systems that allow its partners and employees to have periodic information about the Entity or Issuer in question, regarding which they must maintain independence.

V. Include internal permanent training programs for its partners and persons who are part of the Audit Team, which ensure the acquisition of technical knowledge related to the audited sector, auditing standards and the applicable financial information framework, ethical and independence standards, as well as those necessary to carry out the external audit work of the Entities and Issuers audited. Likewise, it must have a record of said programs with the necessary observations that allow identifying and following up on the development of each partner and employee.

The Firm shall ensure that it has personnel in charge of the quality control system to monitor compliance with the requirements regarding said system established in these provisions.

The provisions of this article shall not apply to development banking institutions, National Financial Institution, Development Entities, INFONACOT and FOVISSSTE, when the Firm or the Independent External Auditor is appointed by the Secretariat of Public Function in accordance with applicable provisions. In the case of INFONAVIT, the provisions of the Law of the National Housing Fund for Workers Institute shall apply.

Article 12.- The Firm shall participate in a quality evaluation program that contemplates, at least, the following:

I. The degree of compliance with ISA and, where applicable, the Attestation Standards referred to in Article 14 of these provisions.

II. The content and degree of compliance with the manual referred to in Article 10 of these provisions.

The provisions of this article shall not apply to development banking institutions, the National Financial Institution, Development Entities, INFONACOT and FOVISSSTE, when the Firm or the Independent External Auditor is appointed by the Secretariat of Public Function in accordance with applicable provisions. In the case of INFONAVIT, the provisions of the Law of the National Housing Fund for Workers Institute shall apply.

Article 13.- The Firm shall be responsible for ensuring that its personnel complies with the professional standards and quality requirements applicable, technical capacity and for the development of their work referred to in the applicable provisions.

Additionally, the Firm shall be responsible, together with the Independent External Auditor, for the content of the External Audit Report, as well as for the other communications and opinions indicated in Article 15 of these provisions.

In the event that threats to independence or non-compliance with the standards established in the ethical codes referred to in fraction X of Article 6 of these provisions are identified, the Independent External Auditor must document them in the audit working papers.

Chapter III
Of the applicable standards for the performance of external audit work, as well as the content of the External Audit Report and other communications and opinions

Article 14.- Independent External Auditors, for the performance of external audit work on Basic Financial Statements of Entities and Issuers, as well as in the issuance of the opinions indicated in Article 15 of these provisions, must adhere to the ISA issued by the International Auditing and Assurance Standards Board of the International Federation of Accountants, as well as to the Assurance Engagements Framework and the Attestation Standards, issued by the Auditing and Assurance Standards Commission of the Mexican Institute of Public Accountants, A.C., as appropriate to the class of service provided.

The External Audit Report of the Entities must communicate those matters that, in the opinion of the Independent External Auditor, are relevant to the audit, basing their determination on ISA 701 "Communication of Key Audit Matters in the Auditor's Report".

Article 15.- The Independent External Auditor shall provide the Entity or Issuer in question with the communications and opinions described below:

I. In the case of Entities or Issuers, a communication of observations.

The Independent External Auditor must include in the communication required under this fraction the identification of observations corresponding to substantive procedures, internal control evaluation and other matters, ordered by relevance, in the opinion of the Independent External Auditor.

The Independent External Auditor of investment fund operating companies that manage equity and debt instrument investment funds shall be obligated to provide a single communication containing the relevant information of said funds, in accordance with the requirements established in this fraction.

II. In the case of investment fund operating companies that manage equity and debt instrument investment funds, an opinion on the reasonableness of the Basic Financial Statements of each fund managed by said companies.

The opinion required under this fraction must be prepared in accordance with ISA and must communicate those matters that, in the opinion of the Independent External Auditor, are relevant, basing their determination on ISA 701 "Communication of Key Audit Matters in the Auditor's Report".

III. In the case of share valuation companies of investment funds, an opinion on compliance with what is established in the General Provisions applicable to investment funds and the persons who provide services to them, published in the Official Journal of the Federation on November 24, 2014 and its respective modifications, regarding the determination of the valuation price of the shares representing the social capital of the funds to which they provide their services.

For these purposes, the Independent External Auditor must carry out sampling procedures, which allow obtaining a reasonable basis from which to reach conclusions on the entire population.

The opinion required under this fraction must be prepared in accordance with the methodology established in Bulletin 7040 "Examinations on compliance with specific provisions", or its substitute, issued by the Auditing and Assurance Standards Commission of the Mexican Institute of Public Accountants, A.C.

Once the communication referred to in fraction I of this article is received, the Entity must prepare an action plan containing preventive and corrective measures to address the observations, indicating the compliance deadline. Said action plan must be made known to its Audit Committee, the Independent External Auditor and sent to the Commission, within ninety (90) natural days following the receipt of the communication referred to in fraction I of this article. Issuers shall be obligated to prepare and inform their Audit Committee and the Independent External Auditor of the aforementioned action plan within the mentioned ninety (90) natural days.

Chapter IV
Of the hiring of the Firm

(1) Article 16.- The Board of General Deposit Warehouses, Stock Exchanges, Brokerage Firms, Exchange Houses, Securities Central Counterparties, Multiple Banking Institutions, Securities Deposit Institutions, Financial Technology Institutions, Savings and Loan Cooperative Societies, Share Distribution Companies of Investment Funds, Regulated Multiple-Object Financial Societies, Community Financial Societies, Popular Financial Societies, Rural Financial Integration Bodies, Share Valuation Companies of Investment Funds, Investment Fund Operating Companies and Credit Unions, as well as Issuers, and Investment Fund Operating Companies regarding the investment funds they manage, in relation to external audit services of Basic Financial Statements, must approve:

I. The appointment or, where applicable, annual ratification of the Firm in charge of external audit.

II. The replacement of the Firm or the Independent External Auditor in charge of the audit.

III. The hiring of services other than external audit of Basic Financial Statements.

IV. The amount of remuneration, both for the external audit service and for services other than external audit of Basic Financial Statements.

The matters that must be authorized by the Board under this article shall be presented through the Audit Committee of the Entities.

In the case of development banking institutions, Development Entities, INFONACOT, FOVISSSTE and National Financial Institution, they shall only be obligated to inform their Board about the appointment of the Firm and the Independent External Auditor carried out by the Secretariat of Public Function, which must be done through the Audit Committee or the General Manager. In the case of INFONAVIT, the provisions of the Law of the National Housing Fund for Workers Institute shall apply.

Article 17.- Entities shall inform and remit to the Commission through their General Manager, equivalent body or attorney-in-fact, no later than fifteen (15) business days following the hiring of the corresponding Firm, a copy authenticated by the Board Secretary, regarding the agreement by which said body approves the appointment of the Firm for its hiring and, where applicable, its annual ratification.

In the case of Development Entities, development banking institutions, INFONACOT, FOVISSSTE and National Financial Institution, they shall inform the Commission through their head, the appointment of the Firm, within thirty (30) business days following the receipt of the notification of said appointment made by the Secretariat of Public Function.

Issuers, to comply with what is stated in the first paragraph of this article, must disclose to the stock exchanges in which their securities are listed through SEDI, and send within the same timeframe referred to in the first paragraph of this article to the Commission through STIV-2, the appointment of the Firm that provides them with external audit services for Basic Financial Statements.

In the case of Savings and Loan Cooperative Societies, Popular Financial Societies, Community Financial Societies and Rural Financial Integration Bodies, a copy of said agreement must additionally be sent to the Auxiliary Supervision Committee, within the timeframe and under the terms indicated in the first paragraph of this article.

Article 18.- Entities and Issuers must remit to the Commission through their General Manager, equivalent body or attorney-in-fact, a copy of the contract for the provision of external audit services of Basic Financial Statements, as well as for the issuance of the communications and opinions indicated in Article 15 of these provisions, in which the fiscal year for which the Firm will provide its services is indicated.

The copy of the contract signed by the parties must be sent within thirty (30) business days following the date of its celebration.

The respective contract shall expressly establish the following obligations on the part of the Firm:

I. That it must provide the Entity or Issuer in question with the information and documentation that it requires and that allows it to prove to the Commission compliance with the obligations established in these provisions.

II. That in the event that the Entity or Issuer changes the Firm to which the Independent External Auditor belongs, this one in its capacity as predecessor auditor, according to the term defined in ISA, must provide the Independent External Auditor in its capacity as successor auditor, upon request received by the Entity or Issuer in question, access to the working papers of the external audit of the last audited period, within thirty (30) business days following the receipt of the request.

III. That in the event that it decides to cease providing the external audit service, it must provide a report under the terms indicated in Article 25 of these provisions.

Issuers shall be obligated to send the information referred to in this article to the Commission through STIV-2.

In the case of Savings and Loan Cooperative Societies, Popular Financial Societies, Community Financial Societies and Rural Financial Integration Bodies, a copy of the contract must additionally be sent to the Auxiliary Supervision Committee, within the timeframe and under the terms indicated in the first and second paragraphs of this article.

The provisions of the third paragraph, fractions I to III of this article, shall not apply to development banking institutions, National Financial Institution, Development Entities, INFONACOT and FOVISSSTE, when the Firm or the Independent External Auditor is appointed by the Secretariat of Public Function in accordance with applicable provisions.

Article 19.- Entities and Issuers must inform the Commission through their General Manager, equivalent body or attorney-in-fact, of the class of services other than external audit of Basic Financial Statements that they may have hired with the Firm, as well as the amount of remuneration paid for said services, exposing the reasons why this does not affect the independence of the Firm and the Independent External Auditor. For this latter purpose, Entities and Issuers shall take into account the importance that the result of the service provided might have on the Basic Financial Statements of the Entity and Issuer, as well as the remuneration paid for said services in relation to the corresponding remuneration for external audit services.

The information referred to in the previous paragraph must be provided to the Commission and, where applicable, to the Auxiliary Supervision Committee within thirty (30) business days following the Board session of the Entity in which said hiring is approved and prior to the provision of services other than external audit of Basic Financial Statements referred to in this article.

Issuers must disclose through STIV-2 the information referred to in the first paragraph of this article, within thirty (30) business days following the Board session of the Issuer in which the hiring of services other than external audit of Basic Financial Statements is approved and prior to the provision of these.

Article 20.- The Audit Committee of Entities, for the hiring of the Firm, must at least perform the following activities:

I. Validate, prior to the appointment of the Firm, that both this and the Independent External Auditor comply with the personal, professional and independence requirements established in applicable laws and these provisions for the provision of the mentioned external audit service and, where applicable, services other than external audit of Basic Financial Statements.

II. Obtain from the Firm, the statement on compliance with the quality control standard corresponding to the audited exercise, presented before the professional college recognized by the Secretariat of Public Education to which said Firm belongs or, when the college in question does not require such statement, the one issued by the Firm itself regarding compliance with the obligation referred to in Article 10 of these provisions.

III. Opine, prior to the appointment of the Firm, regarding whether the resources proposed to execute the external audit program are reasonable considering the scope of the audit, the nature and complexity of the operations of the Entity in question, as well as the structure of the latter.

IV. Review the terms of the audit engagement, prior to the signing of the service provision contract.

The provisions of this article shall not apply to the Audit Committee of Development Entities, development banking institutions, INFONACOT, FOVISSSTE and National Financial Institution, when the Firm or the Independent External Auditor is appointed by the Secretariat of Public Function in accordance with applicable provisions. In the case of INFONAVIT, the provisions of the Law of the National Housing Fund for Workers Institute shall apply.

Article 21.- The Audit Committee of Entities, for purposes of the appointment or annual ratification of the Firm, must validate the knowledge and professional experience of the Independent External Auditor, the manager and audit manager who will participate in the external audit, as well as compliance with the requirements established in these provisions by the Firm, Independent External Auditor and personnel participating in the external audit, considering, in addition, the complexity of the business of the audited Entity.

For purposes of the appointment and annual ratification of the Firm, the Audit Committee must have a documented process, which is transparent and impartial and that allows it to evaluate compliance with the requirements referred to in the first paragraph of this article. In cases where the Audit Committee intends to propose the appointment of another Firm, it must previously evaluate, at least, two options and duly justify the preference for one of them, such that there is a possibility of choosing considering compliance with the aforementioned requirements.

The provisions of this article shall not apply to the Audit Committee of Development Entities, development banking institutions, INFONACOT, FOVISSSTE and National Financial Institution when the Firm or the Independent External Auditor is appointed by the Secretariat of Public Function in accordance with applicable provisions. In the case of INFONAVIT, the provisions of the Law of the National Housing Fund for Workers Institute shall apply.

Article 22.- The Audit Committee, for the development of the obligations contemplated in these provisions, may rely on persons from areas independent of the General Management or its equivalent. The activities performed by the Audit Committee in accordance with these provisions and the results obtained from them must be documented.

Chapter V
Of the replacement of the Firm and the Independent External Auditor

Article 23.- The Audit Committee of Entities must evaluate the possible replacement of the Firm or, where applicable, the Independent External Auditor when they cease to meet the necessary requirements for the development of their work.

The provisions of this article shall not apply to development banking institutions, Development Entities, National Financial Institution, INFONACOT and FOVISSSTE, when the Firm or the Independent External Auditor is appointed by the Secretariat of Public Function in accordance with applicable provisions. In the case of INFONAVIT, the provisions of the Law of the National Housing Fund for Workers Institute shall apply.

Article 24.- The replacement of the Firm or the Independent External Auditor carried out by an Entity must be reported in writing to the Commission by the General Manager, equivalent body or attorney-in-fact, within five (5) business days following the Board session in which the replacement was approved, exposing the reasons that motivated it and attaching the appropriate documentation to comply with these provisions.

Savings and Loan Cooperative Societies, Popular Financial Societies, Community Financial Societies and Rural Financial Integration Bodies must additionally inform the Auxiliary Supervision Committee within that same timeframe.

In the case of development banking institutions, FOVISSSTE, INFONACOT, Development Entities and National Financial Institution, the replacement of the Firm and the Independent External Auditor that provide external audit services for Basic Financial Statements must be reported in writing to the Commission, within five (5) business days following the date on which said replacement was carried out by the Secretariat of Public Function, exposing the reasons that motivated it.

In the case of Issuers, they must disclose to the stock exchanges in which their securities are listed through SEDI, and send within the same timeframe referred to in the first paragraph of this article to the Commission through STIV-2, the replacement of the Firm and the Independent External Auditor that provide external audit services for Basic Financial Statements, indicating the causes of said replacement.

In the event that the replacement referred to in this article is carried out, the Commission and, where applicable, the Auxiliary Supervision Committee, may consult with the Firm or Independent External Auditor to know their point of view regarding the reasons that motivated their replacement.

Regarding Issuers, the Commission may order that the reasons for the replacement be made known to the investing public, through the SEDI of the stock exchange in which their securities are listed, when it deems it pertinent.

Article 25.- The Firm that decides to terminate the provision of external audit services referred to in these provisions shall inform the Commission, within ten business days following the date on which it ceases to provide the said service, of the reasons that motivated its decision and shall deliver to the Commission itself and to the Entity or Issuer in question, a communication of the external audit work performed up to that moment.

Regarding cooperative savings and loan societies, popular financial societies, community financial societies, and rural financial integration organisms, the report shall additionally be sent to the Auxiliary Supervision Committee, under the terms indicated in the first paragraph of this article.

Chapter VI
On the Follow-up of the Work of the Firm and the Independent External Auditor

Article 26.- The Audit Committee of the Entities shall follow up on the external audit activities of Basic Financial Statements, as well as on the issuance of the communications and opinions indicated in Article 15 of these provisions, keeping the Board informed regarding the performance of such activities.

Likewise, the Audit Committee shall supervise the activities of the Independent External Auditor, who at the request of said Audit Committee shall have to inform about the activities and development of the audit.

Article 27.- The Audit Committee of the Entities, in the follow-up of external audit activities, shall carry out, at least, the following activities:

I. Contribute to ensuring that the internal audit area or the internal auditor facilitate the development of external audit activities.

II. Foster that the Entity has policies that allow it to have personnel in charge of the preparation, review, and authorization of accounting, as well as of the Basic Financial Statements and their notes, subject to external audit, and with knowledge of the accounting regulation applicable to the said Entity.

III. Regarding external audit:

a) Know, at the beginning of the external audit work, the approach of the review, taking into consideration the level of materiality, the scope of the planned audit, and the significant issues identified.

b) Monitor that, during the development of the external audit, the Independent External Auditor has all the necessary documentation in a timely manner to perform its functions, having access to the documentation related to the work of third parties hired by the Entity in question, if such documentation is necessary for the performance of the external audit.

c) Maintain effective communication with the Independent External Auditor that allows informing the latter of any matter that, if applicable, has an impact on regulatory capital, as well as the relevant matters for the development of the external audit.

During the course of the external audit, it must know the point of view of the Independent External Auditor regarding the important issues identified by the latter and how they impact the approach of the external audit.

d) Inform the Commission, when it has knowledge, of the non-compliance or risks that affect the independence of the Firm and the Independent External Auditor, through a detailed report.

e) Summon the Independent External Auditor, as an invited guest with the right to speak but without voting, to the sessions of said committee, when deemed appropriate due to the topics to be discussed.

f) Review with the Independent External Auditor, prior to the issuance of the External Audit Report, the letter of representations issued by the general director or their equivalent or by any member of the Entity's administration, prepared in accordance with International Standard on Auditing 580 "Written Representations", placing special emphasis on the matters in which the Independent External Auditor required specific declarations on any item of the Basic Financial Statements.

g) Evaluate, prior to the conclusion of the external audit work, the compliance of the Independent External Auditor with the initial audit program, and in case there were changes, evaluate their reasonableness.

IV. Monitor that the necessary corrective measures are implemented to address in a timely manner the findings and recommendations of the Independent External Auditor.

Article 28.- The Independent External Auditor may attend as an invited guest with the right to speak, but without voting, to the sessions of the Audit Committee, when the latter deems it appropriate due to the topic to be discussed, having to withdraw when said committee deems it convenient.

Article 29.- In cases where the provisions applicable to the Entities contemplate the obligation to have a responsible area for internal audit, said area shall facilitate to the Independent External Auditor the information it has available due to its functions and that is necessary for the performance of the external audit, and keep at its disposal the report of the results of its reviews presented both to the Board and, if applicable, to the Audit Committee.

Article 30.- The general director or whoever performs the equivalent functions of the Entities, shall keep at the disposal of the Independent External Auditor the reports presented to the Board, regarding the deviations detected with respect to the objectives, guidelines, policies, procedures, strategies, and current regulations in credit matters, in case the Entity grants credits.

Article 31.- Entities that, under the terms of the law regulating them, can grant credits, shall keep at the disposal of the Independent External Auditor the minutes or summaries of the credit committee, if they have them, as well as the documents signed by the persons of the Entity in question for the approval of credits specified in their credit manual.

Likewise, the reports that Entities are obliged to present to the Audit Committee, under the terms of the provisions applicable to them, regarding the deviations they detect with respect to the objectives, guidelines, policies, procedures, strategies, and current regulations in credit matters, shall be at the disposal of the Independent External Auditor, who may request them at any time during the external audit work.

Article 32.- Entities and Issuers shall obtain from the persons and officials responsible for signing their audited Basic Financial Statements, in terms of what is provided in the provisions applicable to the said Entities and Issuers, a declaration in which they manifest the following:

I. That they have reviewed the information presented in the audited Basic Financial Statements to which these provisions refer.

II. That the audited Basic Financial Statements do not contain information on false facts, as well as that they have not omitted any fact or relevant event, of their knowledge, that might be necessary for their correct interpretation in light of the provisions under which they were prepared.

III. That the audited Basic Financial Statements and the additional information to them, present fairly in all material aspects the financial situation and the results of the operations of the Entity or Issuer in question.

IV. That internal controls have been established and maintained, as well as procedures regarding the disclosure of relevant financial information.

V. That internal controls have been designed with the objective of ensuring that material aspects and information related to the Entity or Issuer in question, its parent, subsidiaries, associates, entities with which they enter into agreements with joint control, or legal entities belonging to the same Business Group or Consortium are made known to the administration.

VI. That they have revealed to the Firm, to the Independent External Auditors and, if applicable, to the Audit Committee, through timely communications, the significant deficiencies detected in the design and operation of internal control that could adversely affect, among others, the function of recording, processing, and reporting financial information.

VII. That they have revealed to the Firm, to the Independent External Auditors and, if applicable, to the Audit Committee, any alleged fraud or irregularity that is of their knowledge and involves the administration or any other employee who plays an important role, related to internal controls.

The declaration referred to in this article must be sent to the Commission by the Entities jointly with the External Audit Report, the audited Basic Financial Statements and their notes, within ninety natural days from the closing of the exercise to which the said report and the information in question correspond.

For the case of cooperative savings and loan societies, popular financial societies, community financial societies, and rural financial integration organisms, the said declaration must be sent additionally to the Auxiliary Supervision Committee, within the term and in the terms indicated in the previous paragraph.

Regarding Issuers, the said declaration must be sent to the stock exchange in which they list their securities through the SEDI, within the term established in fraction II of Article 36 of these provisions for dissemination to the investing public, and subsequently on the same date to the Commission through the STIV-2 jointly with the External Audit Report corresponding to the immediate previous fiscal year.

Chapter VII
On the Evaluation of the Work of the Firm and the Independent External Auditor

Article 33.- The Audit Committee shall be responsible for establishing operation policies within the Entity in question, for the periodic evaluation of the Firm and the Independent External Auditor who provide the external audit services of the Basic Financial Statements and the issuance of the communications and opinions indicated in Article 15 of these provisions, as well as the manner in which it will be carried out taking into account what is provided in Article 34 next of these provisions.

Article 34.- The Audit Committee of the Entities shall carry out, at least, the following activities in the evaluation of external audit activities:

I. Evaluate, at the end of the external audit engagement, the performance of the Firm and the Independent External Auditor, as well as the quality of the External Audit Report and, if applicable, of the communications and opinions indicated in Article 15 of these provisions, derived from the external audit service in compliance with these provisions.

II. Review with the Independent External Auditor, the results of the communications and opinions indicated in the previous fraction, in order to understand their reasoning to reach their conclusions.

III. Annually inform the Board, the following:

a) The evaluation of services other than the external audit of Basic Financial Statements or complementary ones that, if applicable, the Firm in charge of performing the external audit provides.

b) The result of the evaluation regarding the compliance, by the Firm and the Independent External Auditor, of the independence requirements established in Article 6 of these provisions.

c) The results of the review of the External Audit Report and the accompanying Basic Financial Statements, as well as of the communications and opinions of the Independent External Auditor indicated in Article 15 of these provisions.

d) The mention and follow-up of the implementation of preventive and corrective measures derived from the observations of the external audit, according to the action plan referred to in the last paragraph of Article 15 of these provisions.

e) The results of the evaluation of the performance of the Independent External Auditor, as well as of the quality of the External Audit Report and, if applicable, of other communications and opinions, carried out in compliance with what is provided in the previous fraction I of this article.

Likewise, the measures taken to guarantee the independence of the Firm and the Independent External Auditor, as well as of the personnel who participated in the audit, shall be contemplated.

f) The measures adopted due to complaints made by shareholders, board members, relevant executives, employees, and in general, any third party on topics related to external audit.

The Audit Committee of the Entities may request from the Firm and the Independent External Auditor, the documentation that evidences the compliance with the obligations and requirements established in accordance with these provisions, in relation to the contracted audit service, without prejudice to the fact that said committee must meet with the latter, at least, once a year.

Article 35.- The Independent External Auditor shall be obliged to provide to the Audit Committee of the Entities, as well as to the Issuers, a communication, prior to the issuance of the External Audit Report.

The scope of the mentioned communication shall comprise at least the following:

I. The name of the Independent External Auditor and of the persons with a hierarchical level equal to or lower than this who participated in the external audit and, if applicable, the activities that were part of the external audit that were performed by specialists or other persons who do not belong to the Firm in charge of the external audit, as well as their names and organizations to which they belong.

II. The description of the policies and procedures implemented to prevent and address threats to independence, as well as to guarantee the quality of the external audit.

III. The quantitative level of materiality and tolerable error applied, both to the Basic Financial Statements as a whole, as well as to specific items of operations or account balances, as well as the qualitative factors considered for their determination.

IV. The description of the nature, scope, and timing of the procedures performed in the external audit. Such description shall contain at least the following:

a) The significant processes of the Entity or Issuer that the Independent External Auditor has evaluated, and their relationship with the item or concept of the Basic Financial Statements reviewed, including off-balance sheet accounts.

b) The risks of material misstatement, as this term is defined in the ISAs, identified, associated with the item or concept of the Basic Financial Statements, including off-balance sheet accounts, as well as the controls related to them, regarding which the Independent External Auditor has had knowledge, during the development of the audit.

c) The control tests performed by the Independent External Auditor, associated with the identified risks of material misstatement, as well as the description of the methodology to determine the size of the samples and the results obtained.

d) The conclusion of the Independent External Auditor on the evaluation of the operating effectiveness of relevant internal controls and its effect on the design of the nature, timing, and scope of substantive procedures, as this term is defined in the ISAs, applied to the items or concepts of the Basic Financial Statements, including off-balance sheet accounts.

e) The conclusion of the Independent External Auditor on the evaluation of the congruence between the information contained in the systems or applications and the accounting records that have been subject to their review indicating the item or concept of the financial statements associated, including off-balance sheet accounts.

f) The substantive procedures, as this term is defined in the ISAs, performed by the Independent External Auditor on the items or concepts of the Basic Financial Statements, including off-balance sheet accounts, which in their opinion they consider significant and that contain the description of the methodology to determine the size of the samples, the scope or percentage of review, and the results obtained from said procedures.

g) The substantive procedures related to the closing process of the Basic Financial Statements of the Entity or Issuer.

V. The description of the transformations, mergers, spin-offs, or the performance of additional operations outside the normal course of business or that come from unusual circumstances during the audited period, as well as, if applicable, the accounting policies adopted for their recognition.

VI. Regarding the consolidated Basic Financial Statements, a list of the subsidiaries and the percentages of participation and, if applicable, the exclusion criteria applied by the Entities or Issuers to the non-consolidated entities, indicating if said criteria adhere to the applicable accounting standards.

VII. The explanation of whether the indispensable information or documentation for the development of the external audit that were requested from the personnel of the Entities or Issuers was received, and if they were provided in a timely manner.

VIII. The significant difficulties that have arisen in the execution of the audit and, if applicable, any refusal for the Independent External Auditor to issue an External Audit Report with a modified opinion, as this term is defined in the ISAs.

IX. Those matters that in the opinion of the Independent External Auditor are relevant for the external audit based for its determination on ISA 701 "Communication of Key Audit Matters".

X. The main observations made in the immediate previous fiscal year to the audited one, indicating if the deficiencies in question have been or have not been resolved by the Entity or Issuer in question.

XI. The significant internal control deficiencies identified.

XII. The nature and amount of the audit adjustments proposed by the Independent External Auditor, without prejudice to whether they are incorporated or not into the audited Basic Financial Statements.

XIII. The description of the nature, frequency, and scope of the communications with the Audit Committee, the general direction or equivalent, and the Board or equivalent body, indicating the dates of the meetings, as well as the relevant agreements and conclusions obtained.

The Independent External Auditor of the investment fund operating societies that manage variable income investment funds and debt instruments shall be obliged to provide a single report containing the relative information of said funds, in accordance with the requirements established in this article.

The Independent External Auditor and the Firm shall be obliged to provide the Audit Committee with the information that said committee requires them to fulfill their obligations provided in these provisions.

Chapter VIII
On the Presentation of the External Audit Report, as well as other communications and opinions to the Commission

Article 36.- Entities and Issuers shall present to the Commission the External Audit Report together with the declaration referred to in Article 32 of these provisions, including the audited Basic Financial Statements prepared, approved, and signed in accordance with applicable provisions and their relative notes, as well as the opinion referred to in fraction II of Article 15 and the communication referred to in Article 35 of these provisions.

Regarding cooperative savings and loan societies, popular financial societies, community financial societies, and rural financial integration organisms, additionally they shall present the information indicated in the previous paragraph to the Auxiliary Supervision Committee.

The delivery of the External Audit Report, including the Basic Financial Statements and their relative notes, as well as the opinion referred to in fraction II of Article 15 and the communication referred to in Article 35 of these provisions, shall be carried out:

I. Within ninety natural days following the closing of the fiscal year, regarding the Entities.

II. Within the timeframe and through the communication channels established in the General Provisions applicable to securities issuers and other market participants, published in the Official Gazette of the Federation on March 19, 2003, and their respective modifications, in the case of Issuers.
The communication referred to in Article 35 of these provisions shall not be sent to SEDI nor disclosed to the investing public in STIV-2.
In the case of Development Agencies and Development Entities, the foregoing shall apply unless the corresponding legal provisions provide for a longer timeframe for the approval of audited Basic Financial Statements, in which case they must be delivered no later than ten business days following the expiration of said timeframe.

Article 37.- Entities and Issuers must obtain from the Independent External Auditor a declaration stating the following:
I. That it complies with the requirements set forth in Articles 4 and 5 of these provisions, as well as that it is a public accountant or holds a degree in public accounting. Likewise, they must incorporate the numbers and issuance dates of the current registrations issued by the General Administration of Federal Fiscal Audit of the Tax Administration Service, including that of the Firm in which it works or, if applicable, the certificate number issued by the professional college recognized by the Secretariat of Public Education to which it belongs.
II. That from the date on which external audit services are provided, during the development of the external audit and until the issuance of the External Audit Report, as well as of the communications and opinions required pursuant to Article 15 of these provisions, it complies with the requirements referred to in Articles 4 and 5, as well as that the Firm adheres to what is provided in Articles 6, 9, and 10, in relation to Article 14 of these provisions.
III. That the Firm has documentary evidence of the implementation of the quality control system referred to in Article 9 of the provisions and participates in a quality evaluation program that meets the requirements contemplated in Article 12 of these provisions.

The Independent External Auditor, when making the declaration referred to in this article, will grant its express consent to provide the Commission with the information it requires, in order to verify compliance with the aforementioned requirements. Likewise, the Firm must be obligated to preserve the information supporting compliance with the aforementioned requirements, physically or through digital format images, on optical or magnetic media, for a minimum period of five years counted from the conclusion of the audit, and indicate the number of years the Independent External Auditor has performed the audit of Basic Financial Statements of the Entity or Issuer in question, as well as the number of years the Firm itself has provided external audit services.

The development banking institutions, National Financial Institution, Development Entities, INFONACOT, and FOVISSSTE will not be subject to what is stated in this article, when the Firm or the Independent External Auditor is appointed by the Secretariat of the Public Function in accordance with the applicable provisions.
In the case of INFONAVIT, the requirements established by the Law of the National Housing Fund for Workers for the external auditor shall apply, and this article shall not be applicable to them.

Article 38.- Entities must obtain from the Independent External Auditor and provide to the Commission the declaration referred to in Article 37 of these provisions together with the communications and opinions established in fractions I and III of Article 15, within one hundred twenty natural days following the close of the fiscal year.

In the case of Issuers, they must obtain from the Independent External Auditor the declaration provided for in Article 37 and the final communication of observations referred to in fraction I of Article 15 of these provisions, within five months following the close of the fiscal year. Issuers must provide the Commission with said declaration through STIV 2 within five months following the close of the fiscal year. Issuers must deliver to the stock exchanges in which their securities are listed through SEDI, the declaration referred to in Article 37 for dissemination to the investing public within the timeframe established in the previous paragraph of this article.

Article 39.- The Firm and the Independent External Auditor of Issuers, on the date the prospectus, supplement, or informational brochure is presented, and, if applicable, the annual information referred to in the General Provisions applicable to securities issuers and other market participants, published in the Official Gazette of the Federation on March 19, 2003, and their respective modifications, must deliver to the Issuer in question and, through them, to the stock exchanges in which the corresponding securities are listed, for dissemination to the investing public, a document in which they manifest their consent for the Issuer itself to include in the annual report and prospectus, supplement, or informational brochure, the External Audit Report issued for that purpose.

The foregoing, understanding that it must previously be ensured that the information contained in the Basic Financial Statements included in the prospectus, supplement, informational brochure, or annual report in question, as well as any other financial information contained in said documents whose source comes from the aforementioned Basic Financial Statements or from the External Audit Report presented for that purpose, coincides with the audited information, in order for said information to be made known to the public.

The Independent External Auditor may deliver to the Issuer a single document containing the information indicated in this article and that indicated in Article 37 of these provisions, provided that it meets all requirements and is signed on the date the External Audit Report is issued and for each fiscal year subject to review.

Article 40.- The Firm and the Independent External Auditor, in any case, when during the course of the audit they find irregularities or any other situation that, based on their professional judgment, could endanger the stability, liquidity, or solvency of the audited Entities, or if acts have been committed to the detriment of their assets, regardless of whether they have effects on the financial information, without prejudice to penalties or sanctions in accordance with applicable legislation, when they have knowledge of these facts, they must present a detailed report on the observed situation to the President of the Board or equivalent body, the Audit Committee, the Commission, and the Auxiliary Supervision Committee, as applicable. In the case of Issuers, they must inform the Commission with the same opportunity indicated in this article when it comes to irregularities or any other situation that does not adequately reflect the financial situation or could affect the continuity of the business.

The following detected facts shall be considered, in an illustrative but not exhaustive manner, as irregularities: non-compliance with applicable regulations, destruction, alteration, or falsification of physical or electronic accounting records, and the performance of activities not permitted by applicable legislation, highlighting among these those related to credits whose resources have been destined for the payment of capital contributions, among others.

The good faith communication to the Commission by the Firm and the Independent External Auditor of the irregularities or situations referred to in this article shall not constitute a breach of any contractual or legal restriction on the disclosure of information, in addition to being considered as confidential and reserved information by the Commission.

Chapter IX
Of the Powers of the Commission

Article 41.- The Commission may observe the Firm and the Independent External Auditor regarding omissions or deviations from these provisions.

Article 42.- The Commission may, in terms of what is provided in the respective laws of the financial system, require the appearance of the Independent External Auditor once it has received notification from the Entity or Issuer of the hiring of the Firm in terms of these provisions and prior to the start of audit work to share relevant information regarding the scope of the audit. This same requirement may be made before the External Audit Report is issued.

Article 43.- When, as a result of its supervisory powers over the financial information of the Entity or Issuer, as well as the review of the documents and working papers supporting the external audit of the Basic Financial Statements, pursuant to what is established in the law or general provisions that are applicable, the Commission detects that the Basic Financial Statements might not reasonably reflect the financial situation of the Entity or Issuer, said Commission may require the Entity or Issuer in question to hire an independent third party that meets the characteristics and requirements contained in Chapter II of these provisions, in order to prepare a report on a specific item or concept or on the Basic Financial Statements as a whole.

The Commission must attend to the materiality of the items or concepts of the Basic Financial Statements and the gravity of the deficiencies identified in the External Audit Report, document the elements that support its finding, and determine the norm that will be applicable for the preparation of the report referred to in the previous paragraph.

TRANSITORY PROVISIONS

FIRST.- These Provisions shall enter into force on August 1, 2018, except for Articles 1 and 25 which shall enter into force the day following the publication of this instrument in the Official Gazette of the Federation.

SECOND.- Articles 24 and 40 of these Provisions shall enter into force the day following their publication in the Official Gazette of the Federation in the case of securities depository institutions, stock exchanges, central securities counterparties, and securities issuers considered as such in terms of the Securities Market Law, as well as regulated multiple-object financial societies that maintain patrimonial links with popular financial societies, community financial societies, savings and loan cooperatives, or credit unions.

THIRD.- Firms in which the independent external auditors that entities and issuers subject to the supervision of the National Banking and Securities Commission have hired for the auditing of their financial statements and the issuance of additional reports and opinions in accordance with the provisions in force before August 1, 2018, are obligated to preserve, physically or through digital format images, on optical or magnetic media that allow their extraction and reading, the documentation and working papers, as well as all the information and other elements of judgment used to prepare the corresponding report, for a minimum period of five years counted from the close of the documentation and working papers of the external audit.

The firm and the independent external auditor will have a maximum period of sixty natural days, from the date the opinion on the financial statements and other reports and opinions are issued in accordance with the provisions in force before August 1, 2018, to conclude the closing of the documentation and working papers of the external audit.

Additionally, during the course of the audit and within the five-year timeframe indicated, the firm and the independent external auditor are obligated to make available to the National Banking and Securities Commission the information referred to in the previous paragraph.

The documents prepared for the auditing of financial statements and the issuance of additional reports and opinions in accordance with the provisions in force before August 1, 2018, may be reviewed jointly with the independent external auditor, for which the National Banking and Securities Commission itself, in accordance with applicable laws, may require their presence in order for them to supply or expand the reports or elements of judgment that served as the basis for the formulation of their opinion or report.

FOURTH.- The firm hired by entities and issuers subject to the supervision of the National Banking and Securities Commission for the auditing of their financial statements and the issuance of additional reports and opinions in accordance with the provisions in force before August 1, 2018, will be responsible for ensuring that its personnel complies with professional norms and applicable quality requirements, technical capacity, and for the development of their work in accordance with applicable provisions, and will be responsible, together with the independent external auditor, for the content of the opinion, as well as for the other additional reports and opinions that in accordance with the provisions in force must be delivered.

In the event that threats to independence or non-compliance with the norms established in the professional code of ethics are identified, which it observes in accordance with applicable provisions, the independent external auditor must document them in the audit working papers.

FIFTH.- The National Banking and Securities Commission may require the appearance of independent external auditors hired by entities and issuers subject to the supervision of said Commission for the auditing of their financial statements and the issuance of additional reports and opinions in accordance with the provisions in force before August 1, 2018.

SIXTH.- The independent external auditors of entities and issuers subject to the supervision of the National Banking and Securities Commission must prepare the opinions and communications referred to in Articles 15 and 35 of these Provisions, for the 2019 exercise with the 2018 information that they presented to said Commission.

SEVENTH.- From the day following the publication of these provisions in the Official Gazette of the Federation, when as a result of the supervisory powers over the financial information of general warehouses of deposit, stock exchanges, brokerage houses, exchange houses, central securities counterparties, funds and public trusts constituted by the Federal Government for economic promotion that carry out financial activities, referred to in Article 3 of the Law of Credit Institutions, National Financial Institution for Agricultural, Rural, Forestry and Fisheries Development, capital investment funds, development banking institutions, multiple banking institutions, securities depository institutions, Housing Fund of the Institute of Security and Social Services of State Workers, National Fund for Worker Consumption, National Housing Fund for Workers, savings and loan cooperatives with operation levels I to IV, societies distributing shares of investment funds, regulated multiple-object financial societies, popular financial societies, and community financial societies with operation levels I to IV, rural financial integration agencies, societies operating investment funds, societies valuing shares of investment funds, credit unions, or securities issuers, as well as from the review of the documents and working papers supporting the external audit of basic financial statements, the National Banking and Securities Commission detects that the basic financial statements might not reasonably reflect the financial situation of the entity or issuer, said Commission may require the entity or issuer in question to hire an independent third party that meets the characteristics and requirements contained in Chapter II of these provisions, in order to prepare a report on a specific item or concept or on the basic financial statements as a whole.

The National Banking and Securities Commission must attend to the materiality of the items or concepts subject to the basic financial statements, document the elements that support its finding, and determine the norm that will be applicable for the preparation of the report referred to in the previous paragraph.

TRANSITORY PROVISION
(Resolution that modifies the general provisions applicable to entities and issuers supervised by the National Banking and Securities Commission that hire external audit services for basic financial statements, published in the Official Gazette of the Federation on November 15, 2018)

UNIQUE.- This Resolution shall enter into force on January 1, 2020, so that financial technology institutions will present their audited financial statements in accordance with this Resolution regarding the financial statements corresponding to the year 2020 that are presented in the year 2021.

CONSIDERING
(Published on November 15, 2018)

That in attention to Article 78 of the General Law of Regulatory Improvement and with the purpose of reducing the compliance cost of this modifying resolution, the National Banking and Securities Commission through a resolution published in the Official Gazette of the Federation on January 22, 2018, reformed the General Provisions applicable to credit institutions to extend the timeframe to which multiple banking institutions are subject to constitute their entire operational risk capital requirement, having to constitute it from November 1, 2020, and not from January 1, 2018 as originally planned;

That on March 9, 2018, the "Decree by which the Law to Regulate Financial Technology Institutions is issued and various provisions of the Credit Institutions Law, the Securities Market Law, the General Law of Auxiliary Credit Organizations and Activities, the Law for Transparency and Ordering of Financial Services, the Law to Regulate Credit Information Societies, the Law for Protection and Defense of Financial Services Users, the Law to Regulate Financial Groupings, the Law of the National Banking and Securities Commission, and the Federal Law for Prevention and Identification of Operations with Resources of Illicit Origin" was published in the Official Gazette of the Federation;

That the Law to Regulate Financial Technology Institutions provides the faculty for the National Banking and Securities Commission to establish the characteristics and requirements that independent external auditors, the legal entity of which they are partners, as well as the persons who are part of the audit team, must meet; determine the content of the opinions and other reports that independent external auditors must render; issue measures to ensure adequate alternation of said auditors in financial technology institutions, as well as indicate quality control requirements and, in general, professional or business relationships that they provide or maintain with the financial technology institutions they audit or evaluate, as the case may be, and

That given the obligation that the Law to Regulate Financial Technology Institutions establishes for financial technology institutions to audit their annual financial statements, it is convenient to consider said financial technology institutions within the regulatory framework applicable to the rest of the financial entities subject to the supervision of the National Banking and Securities Commission, has resolved to issue the following:

REFERENCES

Reformed by Resolution published in the Official Gazette of the Federation on November 15, 2018.
Added by Resolution published in the Official Gazette of the Federation on November 15, 2018.

General Provisions Applicable to Entities and Issuers Supervised by the National Banking and Securities Commission that Hire External Audit Services for Basic Financial Statements

Similar documents from other regulators