Norm on External Audit

Page 1 of 18 Resolution No. CD-SIBOIF-1129-2-SEP10-2019 Dated September 10, 2019

NORM ON EXTERNAL AUDIT

The Board of Directors of the Superintendence of Banks and Other Financial Institutions,

CONSIDERING

I

That Article 42 of Law No. 561, General Law of Banks, Non-Banking Financial Institutions and Financial Groups; Article 6, letter c), of Law No. 587, Capital Markets Law; Article 58 of Law No. 733, General Law of Insurance, Reinsurance and Sureties; and Article 45 of Law No. 734, General Warehouses Law; contained in Law No. 974, Law of the Nicaraguan Legal Digest on Banking and Finance matters, published in La Gaceta, Official Journal No. 164, of August 27, 2018, and its reforms (Legal Digest Law), establish that institutions regulated by these legal frameworks must hire at least one external audit annually. Likewise, that the Board of Directors of the Superintendence may determine through general norms the minimum requirements that auditors and external audits must meet, as well as the information that must be delivered to the Superintendence on an obligatory basis regarding the status of the audited institutions and the compliance with their own functions.

II

That in accordance with the foregoing and based on the powers established in Article 10, numeral 10), of Law No. 316, Law of the Superintendence of Banks and Other Financial Institutions and its reforms, contained in Law No. 974, Law of the Nicaraguan Legal Digest on Banking and Finance matters, published in La Gaceta, Official Journal No. 164, of August 27, 2018, and its reforms, contained in the Legal Digest Law.

In exercise of its powers,

HAS ISSUED

The following:

Resolution No. CD-SIBOIF-1129-2-SEP10-2019 NORM ON EXTERNAL AUDIT

TITLE I GENERAL PROVISIONS

SINGLE CHAPTER CONCEPTS, OBJECT AND SCOPE

Article 1. Concepts.- For the purposes of this Norm, the terms indicated in this article, whether in uppercase or lowercase, singular or plural, shall have the following meanings:

Page 2 of 18

a) External Audit: Refers to the professional service performed by External Audit Firms whose main objective is to issue an independent opinion on the basic financial statements, notes, and other explanatory information; as well as to evaluate internal controls. b) Audit Committee: The Audit Committee appointed by the board of directors of the financial institution. c) Days: Calendar days, unless expressly stated that it refers to business days. d) Firm: Refers to the External Audit Firm, which is a private and independent legal entity whose main objective is to provide external audit services. e) Significant Events: Constituted by those events that expose or may potentially expose the financial institution to risks that could impact its financial situation, such that there is a possibility of affecting the fulfillment of obligations with its clients, as well as with third parties, as applicable. f) Financial Institution: Banks, non-banking financial institutions, special regime financial companies, and other legal entities subject to the supervision of the Superintendence. g) General Warehouses Law: Law 734, General Warehouses Law, published in the Gaceta, Official Journal Nos. 201 and 202, of October 21 and 22, 2010, respectively; contained in Law No. 974, Law of the Nicaraguan Legal Digest on Banking and Finance matters, published in La Gaceta, Official Journal No. 164, of August 27, 2018, and its reforms. h) Capital Markets Law: Law No. 587, Capital Markets Law, published in La Gaceta, Official Journal No. 222, of November 15, 2006; contained in Law No. 974, Law of the Nicaraguan Legal Digest on Banking and Finance matters, published in La Gaceta, Official Journal No. 164, of August 27, 2018, and its reforms. i) General Banks Law: Law 561, General Law of Banks, Non-Banking Financial Institutions and Financial Groups, published in the Gaceta, Official Journal No. 232, of November 30, 2005; contained in Law No. 974, Law of the Nicaraguan Legal Digest on Banking and Finance matters, published in La Gaceta, Official Journal No. 164, of August 27, 2018, and its reforms. j) General Law of Insurance, Reinsurance and Sureties: Law 733, General Law of Insurance, Reinsurance and Sureties, published in the Gaceta, Official Journal Nos. 162, 163 and 164, of August 25, 26 and 27, 2010, respectively; contained in Law No. 974, Law of the Nicaraguan Legal Digest on Banking and Finance matters, published in La Gaceta, Official Journal No. 164, of August 27, 2018, and its reforms. k) Accounting Framework: Refers to the Accounting Framework for Banking and Financial Institutions; Accounting Framework applicable to Insurance, Reinsurance and Surety Companies; Accounting Framework for Securities Market Financial Institutions; and Accounting Framework for General Warehouses. l) International Standards on Auditing (ISA): A compendium that collects pronouncements issued by the International Auditing and Assurance Standards Board (known by its English acronym IAASB), through which uniformity in audit practices and related services is sought to be established. m) Register: Register of External Auditors of the Superintendence. n) Internal control system: Set of policies, procedures, and control techniques established by the financial institution to provide reasonable assurance in achieving adequate administrative organization and operational efficiency, reliability of reports flowing from its information systems, appropriate identification and management of risks faced in its operations and activities, and compliance with applicable legal provisions. o) Superintendence: Superintendence of Banks and Other Financial Institutions. p) Superintendent: Superintendent of Banks and Other Financial Institutions.

Article 2. Object.- This Norm aims to regulate the minimum aspects related to external audit services that must be contracted by financial institutions supervised by the Superintendence, such as: the registration requirements for Firms interested in providing such services; the selection and contracting process of Firms by financial institutions; and the monitoring of the audit work performed by the Firms.

Article 3. Scope.- The provisions of this Norm are applicable to financial institutions under the supervision of the Superintendence, as well as to the External Audit Firms referred to in this Norm.

TITLE II REGISTER OF FIRMS

CHAPTER I REQUIREMENTS FOR REGISTRATION

Article 4. Information Requirements.- Firms wishing to provide services to supervised financial institutions must request their registration in the Register kept by the Superintendence for this purpose, accrediting compliance with the minimum information requirements established in Annex 1 of this Norm, which is an integral part of it; as well as compliance with the independence and suitability requirements provided in the following articles.

Article 5. Independence Requirements.- Firms, partners, and those who sign audit reports, directors, managers, administrators, supervisors, managers, and other members of the audit team, as well as any other official who could influence the results of the audit, must be independent of the audited financial institution on the date of signing the service contract and during the development of the audit. It is considered that independence does not exist when any of the aforementioned persons, as applicable, fall under any of the following situations:

a) When the income received by the Firm from the financial institution or from the legal entities forming the financial group to which the institution belongs, derived from the provision of all its services, represents in total 25% or more of the Firm's total income during the year immediately preceding that in which it intends to provide the service.

Page 3 of 18

b) When it has been an important client or supplier of the financial institutions or of the legal entities forming the financial group to which the institution belongs, during the two (2) years immediately preceding that in which it intends to provide the service. It is considered that a client or supplier is important when its sales or, as applicable, purchases to the financial institutions or to the legal entities forming the financial group to which the institution belongs, represent in total 20% or more of its total sales or, as applicable, total purchases. c) When it is or has been during the two (2) years immediately preceding its participation within the Firm, a director, manager, or senior executive, as well as any employee occupying a position within the two levels immediately below the latter in the financial institutions or in the legal entities forming the financial group to which the institution belongs. d) When the partners, and those who sign audit reports, directors, managers, administrators, supervisors, managers, and other members of the audit team, and any other official who could influence the results of the audit, as well as their spouses and relatives up to the second degree of consanguinity and affinity:

1. Have directly or through a legal entity, investments in shares, debt instruments, or derivative instruments on shares of the financial institution in question or of the legal entities forming the financial group to which the institution belongs.
2. Maintain with the aforementioned institutions debts for loans or credits of any nature, in amounts equal to or greater than the equivalent in national currency to one hundred thousand United States dollars. e) When the Firm or any of its partners, and those who sign audit reports, directors, managers, administrators, supervisors, managers, and other members of the audit team, as well as any other official who could influence the results of the audit, provide to the financial institution or to the legal entities forming the financial group to which the institution belongs, simultaneously with audit services, the complementary services detailed below; or when it has contracted such services for the same fiscal period to be audited:
3. Accounting and other services related to accounting records or financial statements of the supervised entity.
4. Design and implementation of financial information systems.
5. Operation of information systems.
6. Operation, supervision, design, or implementation of computer systems (hardware and software).
7. Local network administration.
8. Estimation or valuation.

Page 4 of 18

7. Actuarial.
8. Internal Audit.
9. Financial risk advisory.
10. Management or human resources.
11. Investment advisor or investment banking services.
12. Legal and specialized advice with the audit.
13. Any other service that, in the reasoned judgment of the Superintendent, may interfere with the auditor's independence. f) The income that the Firm receives or will receive for auditing the financial statements of the institutions depends on the result of the audit itself or the success of any operation carried out by them, which is supported by the opinion of said financial statements. For the purposes of determining the existence of a related party to the financial institution, the definition of related party established in the General Banks Law and the regulations governing the matter on concentration limits shall be considered.

Article 6. Suitability Requirements.- Firms, their partners, and those who sign audit reports, directors, managers, administrators, supervisors, managers, and other members of the audit team, as well as any other official who could influence the results of the audit, must be suitable persons to provide services to financial institutions. It is considered that they are not suitable when any of the aforementioned fall under any of the following situations:

a) Those who are delinquent debtors, directly or indirectly, for more than 90 days or for a number of three times during a twelve-month period, to any bank or non-banking financial institution subject to the supervision of the Superintendence; for which purpose such firm must present reports of its obligations issued by a risk center. b) Those who have been judicially declared insolvent, in bankruptcy proceedings, or bankrupt, or who have been judicially qualified as responsible for negligent or fraudulent bankruptcy. c) Those who have been administratively or judicially convicted for their participation in a serious infringement of laws and norms of a financial nature. d) Those who have been convicted of intentional crimes deserving penalties more than corrective ones. e) Those who have been sanctioned by the Comptroller General of the Republic. For the purposes of this article, the Superintendent may take into consideration whether the interested party has been or is currently sanctioned by the Tribunal of Honor of the College of Public Accountants of Nicaragua for causes derived from the exercise of independent professional practice.

Page 5 of 18

CHAPTER II REGISTRATION APPLICATIONS AND INFORMATION UPDATES

Article 7. Superintendent's Resolution on Registration Applications.- The Superintendent shall resolve on the registration application, authorizing or denying it, within a period not exceeding thirty (30) business days, counted from the presentation of the complete required information. In case of denial of registration, the Superintendent must reason it and make it known to the applicant.

Article 8. Grounds for Denial of Applications.- The Superintendent may deny the registration application in the Register of a Firm when any of the following situations occur:

a) When they present information that does not correspond to their true situation. b) When they do not complete all the required information. c) When from the analysis of the presented information it is deduced that the requirements imposed by law, this Norm, and other applicable regulations are not met.

Article 9. Withdrawal of Registration Application and Inhibition to Present New Application.- In case of registration applications whose information is incomplete or not in conformity with what is established in this Norm, the Superintendent shall communicate this to the applicants, who will have a period of thirty (30) days counted from the receipt of said communication to remedy the omission. If upon expiration of said period it has not been remedied, nor has any response been received, the corresponding application shall be considered withdrawn. When information that does not correspond to the true situation is presented, the Superintendent shall require the applicant to provide the respective clarifications or explanations, and if these are not satisfactory, the applicant shall be inhibited from presenting a new application, without prejudice to the legal responsibilities that correspond.

Article 10. Update of Information.- The Superintendent may make the necessary information requests to update the information contained in the Firm's registration file, which, in turn, is obliged to inform, at the latest within five business days counted from the event, the changes that occur in the partners, and those who sign audit reports, directors, managers, administrators, supervisors, managers, and other members of the audit team, as well as in any other official who could influence the results of the audit.

CHAPTER III SUSPENSION AND CANCELLATION OF FIRMS

Article 11. Grounds for Suspension of Registration.- The Superintendent may suspend by reasoned resolution the registration in the Register of a Firm, for up to one (1) year or during the time that the cause that gave rise to the suspension persists, when the person signing audit reports incurs in any of the following facts:

a) Fails to comply with any of the independence requirements referred to in Article 5 of this Norm. b) Fails to comply with the suitability requirement referred to in Article 6, letter a) of this Norm.

Page 6 of 18

Suspension may also proceed in case the partner, administrator, or legal representative of the Firm is in any of the situations provided for in letters a) and b) mentioned above, if facts befall them that make them fail to comply with the registration requirements in the Register; as well as, in case the Firm sends to the Superintendent, outside the period established in Article 32 of this Norm, the reports referred to in Article 27. The Superintendent, ex officio or by complaint, will collect the pertinent evidence and resolve according to the results of its own investigation, which it will make known to the respective Firm.

Article 12. Grounds for Cancellation of Registration.- The Superintendent, ex officio or at the request of a duly motivated party and supported by documentation accrediting such request, as applicable, will make effective without further procedure the cancellation of the registration in the following cases:

a) When requested by the Firm. b) By the dissolution of the Firm. c) When it has been sanctioned on a previous occasion for the same faults referred to in the preceding article. d) Fails to comply with the suitability requirements referred to in letters b), c), d) and e) of Article 6, of this Norm. e) Provides information that does not correspond to its true situation. f) Issues reports in terms that do not correspond to the true situation of the audited institution, or are malicious, inaccurate, or in a manner that promotes confusion. g) By violation of banking secrecy.

Article 13. Publications.- The suspensions or cancellations of Firms registered in the Register will be made known to the College of Public Accountants of Nicaragua and will be published in a medium of national circulation, except when it concerns the grounds established in letters a) and b) of the preceding Article 12. The list of Firms registered in the Register will be kept updated on the Superintendence's website.

TITLE III SELECTION AND CONTRACTING OF FIRMS

CHAPTER I SELECTION AND CONTRACTING PROCESS

Article 14. Firm Selection Process.- Financial institutions must hire Firms annually, at the latest within the third quarter of the year to be audited, for which they must proceed as follows:

a) Evaluate the technical and economic offers of external audit services from at least two Firms when hired for the first time or when a change of auditors has been decided. This condition is not applicable for recurring audits with the same Firm. b) The analysis of the offers, according to the minimum contracting requirements referred to in the following article, must be carried out by the Audit Committee and submitted to the consideration of the Board of Directors of the financial institution for its selection and contracting. c) Communicate to the Superintendent the name of the selected Firm within a maximum period of five (5) days counted from the signing of the contract, attaching a copy of the certification of the board of directors' minutes where the contracted Firm is approved and indicating the names and positions of the audit team members. d) The documentation supporting compliance with the contracting requirements referred to in the following article must be available to the Superintendent. The Superintendent may order the non-contracting of a selected Firm when there are technical, legal, or other reasons, duly founded, that warrant it.

Article 15. Minimum Requirements for Contracting.- Financial institutions may only contract the services of Firms that meet the following minimum requirements:

a) Be registered in the Register; b) Have the experience, infrastructure, human and technical resources, with the adequate qualification for the volume and complexity of the operations performed by the financial institution to be audited; c) Comply with the independence and suitability requirements established in this Norm.

Article 16. Minimum Conditions of Contracts.- The following minimum conditions must be incorporated into external audit service contracts:

a) The start of the audit engagement must take place no later than ninety (90) days before December 31 of each year; b) The scope of the audit engagement and the content of the reports issued by the Firms must comply with the International Standards on Auditing (ISA). c) The obligation of the Firm's partners and each member of the team that will audit the financial institution to present a notarized declaration according to Annex 2 of this Norm, which is an integral part of it. d) The delivery period of the reports must include a penalty clause indicating the monetary fines that will be deducted from the Firm for non-compliance with the quality and time of delivery of the corresponding reports, unless such non-compliance is caused by a factor attributable to the financial institution. e) The obligation of the Firm to communicate in writing and simultaneously to the Board of Directors of the financial institution and to the Superintendent, any significant event detected in the audit process. Such communication must be presented at the latest within three (3) business days following the knowledge of the significant event, without prejudice to including it in the corresponding report. f) The obligation of the Firm to make available to the Superintendent the working papers, the applied audit programs, and other documentary and electronic information supporting the reports they issue and, if applicable, substantiate the respective report, upon simple request of the Superintendent. g) The obligation of the Firm to send to the Superintendent, simultaneously with its presentation to the Board of Directors of the audited financial institution, a copy of the reports issued in compliance with this Norm. h) The commitment of the Firm not to replace the partner, manager, supervisor, or auditor in charge of the audit, without the authorization of the Board of Directors of the financial institution. Exceptions are those c

Page 7 of 18

... [Text ends abruptly in source] ...