CNB Bulletin No. 17/2011 Regarding the Evaluation of Auditors of Financial Institutions

CNB Bulletin No. 17/2011 of 30 December 2011 Classification No. 2 2 4 1 1 5 6 0 OFFICIAL INFORMATION OF THE CZECH NATIONAL BANK of 27 December 2011 regarding the evaluation of an auditor of a bank, credit union, insurance company or reinsurance company by the Czech National Bank I. Purpose of the Official Information The purpose of this Official Information is to provide information about the Czech National Bank’s approach to exercising the power to reject an auditor1 in respect of a) banks pursuant to Article 22(4) of Act No. 21/1992 Coll., on Banks, as amended (hereinafter referred to as the “Act on Banks”), b) credit unions (hereinafter referred to as “credit union”) pursuant to Article 8b(3) of Act No. 87/1995 Coll., on Credit Unions and Certain Related Measures and on the Amendment of Czech National Council Act No. 586/1992 Coll., on Income Taxes, as amended, (hereinafter referred to as the “Credit Unions Act”), c) insurance companies and reinsurance companies pursuant to Article 82(3) and (4) of Act No. 277/2009 Coll., on Insurance, as amended (hereinafter referred to as the “Insurance Act”),2 especially with regard to the grounds for rejecting an auditor selected by them and also to the procedure for rejecting an auditor. II. Grounds for rejecting a selected auditor Legal framework of the requirements applying to an auditor

1. Under Article 22(1) of the Act on Banks, the aim of the activities of a bank auditor shall be to independently and competently audit compliance with the bank’s duties as regards (a) the proper keeping of accounts and compiling of financial statements, (b) the introduction and maintenance of a management and control system that is proportionate to the nature, scale and complexity of the bank’s activities, and

1 Article 2(e) of Act No. 93/2009 Coll., on Auditors and on the Amendment of Some Other Acts (Act on Auditors), as amended. 2 Under Article 82(2) of the Insurance Act, the duty to give notification of the auditor selected applies to domestic insurance companies, domestic reinsurance companies and insurance companies or reinsurance companies from third countries if they carry on business in the Czech Republic though branches. 1

CNB Bulletin No. 17/2011 of 30 December 2011 (c) the disclosure of information pursuant to Article 11a of the Act on Banks. The activities of an auditor have the same aim under the Credit Unions Act and the Insurance Act, even though the scope of the audit activities is defined more narrowly.3 2. The Act on Banks does not specify the grounds on which the Czech National Bank should reject an auditor, except for a requirement for the non-existence of a special relation (see Article 22(5) of the Act on Banks). The existence of a special relation is also grounds for rejecting an auditor under the Credit Unions Act, which stipulates two other grounds for rejecting an auditor, namely failure by the auditor to prove that he/she audited financial statements of banks, credit unions or other financial institutions in the course of at least two accounting periods, and that his/her licence to provide auditor’s services has not been suspended. 3. The Insurance Act contains more detailed rules for insurance and reinsurance companies. Under Article 82(4) of the Insurance Act, the Czech National Bank shall reject an auditor if (a) the auditor has, or in the last two years has had, personnel or ownership links with the insurance company or reinsurance company in which he/she is to perform the audit, or for other reasons fails to provide a guarantee of independent auditing activity, (b) the auditor’s experience in the accounting and auditing of insurance companies or reinsurance companies or his/her previous practice does not ensure proper auditing in the relevant insurance company or reinsurance company, (c) the auditor failed to draw attention in audit reports in a proper and timely manner to serious shortcomings in financial statements or to non-compliance with duties arising under legal regulations. 4. Where the Czech National Bank rejects an auditor, it does so in accordance with the spirit and purpose of the law.4 If persons carrying on audits or other auditing activities for a bank do not have the necessary expertise and experience or are not independent of the bank, the audit cannot fulfil its objective, i.e. the auditor’s reports can hardly draw the attention of the Czech National Bank or the public to any problems in the bank. The same applies to credit unions, and the same objective is also evident from Article 82(4) of the Insurance Act.

Summary of grounds for rejecting an auditor 5. The Czech National Bank sees the specific grounds on which an auditor may be rejected in breaches of the requirements laid down in the financial market legislation and also of the general requirements for independence and proper performance of activities by the auditor.5 3 Under the Credit Unions Act, the management and control system is audited only once every three calendar years, while under the Insurance Act the selected auditor should audit the financial statements, not the management and control system. 4 Decision of the High Court in Prague, file number 7 A 131/2001: “where the law stipulates no other rule setting a limit on the freedom of cognition of administrative authorities, the limits on their free movement should be sought solely in the purpose of the law”. 5 In particular the requirements contained in the Act on Auditors (Articles 14, 21 and 45). 2

CNB Bulletin No. 17/2011 of 30 December 2011 6. The grounds for rejecting an auditor thus include in particular: a) a conflict of interest of the auditor which might limit his/her independence of judgement, in particular the existence of a special relation6 between the auditor and the audited entity and/or the existence of personnel or ownership links between the auditor and the audited entity7 (see “Independence of the auditor” below), b) insufficient experience and practice of the auditor, a key audit partner or persons significantly involved in audit activities. 8 In the case of credit unions, moreover, the grounds include failure to prove that the auditor audited financial statements of credit unions, banks or other financial institutions in the course of at least two accounting periods9 (see “Other prerequisites of the auditor” below). c) a serious error made by the auditor in the past, consisting in the auditor’s failure to draw attention in audit reports in a proper and timely manner to serious shortcomings in financial statements or to non-compliance with duties arising under legal regulations,10 and, in the case of banks and credit unions, also to other facts if they indicate that the objective of the audit will not be achieved properly (see “The making of serious errors by the auditor” below).

7. The Czech National Bank assesses from the above perspectives not only the auditor, but, to the necessary extent, also persons significantly involved in the provision of audit services for the auditor, i.e. typically persons responsible for the performance of audit11 and other services under the laws regulating the financial market, be they employees or other persons working for the auditor and engaged in such activities. For the purposes of assessing the auditor, administrative staff, IT staff and the like shall not be deemed significantly involved. Independence of an auditor
8. The independence of an auditor carrying on auditing activity in financial institutions that are subject to supervision by the Czech National Bank must not be called into question. The statutory requirements for preventing personnel and ownership links formulated in the laws regulating the financial market and the requirements laid down in Articles 14 and 45 of the Act on Auditors are aimed at ensuring this objective.
9. As regards banks, an obligatory audit may not be performed by an auditor having a special relation to the bank. A special relation arises, for example, in the case of a bank’s auditor, or a responsible partner, who is a member of the bank’s statutory body, a member of the bank’s supervisory board or the kin12 of members of these bodies of the bank, or a person having a qualifying holding in the bank.13 As in the case of banks, the existence of a special relation is grounds for rejecting an auditor in credit unions (Article 8b(3) in conjunction with Article

6 Article 19 of the Act on Banks and Article 8b(4) of the Credit Unions Act. 7 Article 82(4)(a) of the Insurance Act and Article 14 of the Act on Auditors. 8 Article 82(4)(b) of the Insurance Act; in other cases this follows from the purpose of the law. 9 Article 8b(3) of the Credit Unions Act. 10 Article 82(4)(c) of the Insurance Act. 11 See Article 2(b) of the Act on Auditors. 12 Article 116 of the Civil Code. 13 See Article 17a(3) of the Act on Banks. 3

CNB Bulletin No. 17/2011 of 30 December 2011 8b(4) of the Credit Unions Act), although the term special relation is defined differently in the Credit Unions Act.14 10. The Insurance Act requires the Czech National Bank to reject an auditor who has, or in recent years has had, personnel or ownership links with the audited entity or for other reasons fails to provide a guarantee of independent auditing activity. 11. As the absence of a special relation, or personnel or ownership links, does not ipso facto imply independence, compliance with other requirements for independence must also be insisted upon.15 The provisions of Articles 14 and 45 of the Act on Auditors are crucial in this respect. Account is also taken of the independence of persons significantly involved in the provision of audit services for the auditor. 12. Audits and other auditing activities may not by performed by an auditor who has a special relation to an audited bank or credit union, or by an auditor who has ownership and personnel links with an insurance company or a reinsurance company, as mentioned above, and also a) by an auditor who otherwise (e.g. outside the definition of special relation) participates in the decision-making of the audited entity (Article 14(1) of the Act on Auditors), regardless of whether he/she does so in the position of member of the statutory body or any other managerial position, b) by an auditor, or by a person forming a network with the auditor,16 who has direct or indirect financial, business, employment or other links, including the provision of non-audit services, with the audited unit, from which it can be inferred that the independence of the auditor is jeopardised (Article 14(2) of the Act on Auditors), Example 1 An auditor or a person who has links with the auditor is unsuitable if he/she provided the audited entity with internal audit services or other services relating to the audited activities (e.g. implementation of, or cooperation on, the bank’s system for preparing and creating statements for the Czech National Bank) in the past two years; any Chinese walls play no role. Example 2 Also unsuitable is a person who was a member of the statutory body or a senior manager of the audited entity for at least a year in the past five years and who is to be responsible for performing audit activities in the auditor.17 c) by an auditor, or, in the case of an auditing company, by a key audit partner18 who failed to comply with the rules of obligatory rotation.19 These rules may not be circumvented by transferring the key audit partner to another auditor.

14 See Article 8b(4) of the Credit Unions Act, under which members of a credit union and their bodies as well as senior officers of the credit union and their kin are deemed persons having a special relation to the credit union. 15 See also Article 82(4)(a) of the Insurance Act. “The Czech National Bank shall reject an auditor if…for other reasons he/she fails to provide a guarantee of independent auditing activity”. 16 Article 2(i) of the Act on Auditors. 17 The five-year time test is based on a similar requirement for the independence of a non-executive director contained in Annex II to Commission Recommendation 2005/162/EC on the role of non-executive or supervisory directors of listed companies and on the committees of the (supervisory) board. 18 As regards Article 45(3) of the Act on Auditors, compliance with the conditions is assessed only for key audit partners responsible for performing the order, not for other persons. 19 “When performing an audit order, the key audit partner responsible for performing the obligatory audit of a public interest entity must be exchanged no later than seven years after the commencement of the obligatory 4

CNB Bulletin No. 17/2011 of 30 December 2011 Other prerequisites of an auditor 13. A responsible auditor and other persons significantly involved in the provision of audit services for the auditor shall have appropriate experience with auditing banks, credit unions or other financial institutions (e.g. investment firms). Gaining appropriate experience is conditional on the need for relevant training and knowledge. In the case of insurance companies and reinsurance companies, given the specifics of these institutions, a knowledge of insurance and insurance risks is required. 14. The Czech National Bank shall assess whether the expertise of the auditor, or the group to which the auditor belongs, is sufficient. In this respect, the expertise may include specialised support provided by a parent, partner or otherwise linked audit company. 15. The Czech National Bank may also assess the prerequisites of the auditor on the basis of the auditor’s methodology, as the auditor’s knowledge, experience and especially ability to perform an audit of the necessary quality and scope can be inferred from his/her methodology and procedures. In this respect, the Czech National Bank is interested in the completeness of the methodology and puts special emphasis on the methodology for the relevant audited area (banks, credit unions, insurance companies, reinsurance companies), the level of detail of the methodology, and the quality and detail of the relevant recognised principles and procedures applied by the auditor. Another important criterion is whether the methodology ensures traceability of the auditor’s procedures. The making of serious errors by an auditor 16. The grounds for rejecting an auditor may include the making of serious errors from which it can be inferred, in the context of other circumstances (such as the auditor failing to make remedy or making a partner against whom disciplinary action has recently been taken responsible for the performance of activities), that the activities of the auditor will not be performed to the appropriate standard. Likewise, the Czech National Bank may also assess the making of less serious but repeated errors by the auditor as a serious error. 17. The grounds for rejection include, for example, the fact that the auditor failed to comply with duties in accordance with the Act on Auditors: Article 20 (the essential elements of the auditor’s report, e.g. a missing description of facts having an impact on the duration of the accounting unit) and Article 21(3) and (6) (the information duty and the duty to cooperate with the Czech National Bank), a disciplinary measurement has been imposed on the auditor for a serious negligent breach of duties stipulated in the Act on Auditors, or serious errors of the auditor are found during an inspection of the auditor. 18. In other sectors, reference may be made corroboratively to the Insurance Act, according to which the Czech National Bank shall reject an auditor who failed, in a proper and timely manner, to report serious shortcomings in financial statements or failure by an insurance company or reinsurance company to comply with duties. audit and may not perform audit activities in this public interest entity again until at least two years have elapsed.” (Article 45(3) of the Act on Auditors). 5

CNB Bulletin No. 17/2011 of 30 December 2011 III. Procedure for giving notification of an auditor and for the exercising of powers by the Czech National Bank

1. A bank, credit union, insurance company or reinsurance company is obliged to give notification of a selected auditor to the Czech National Bank, which is entitled to reject the auditor within 30 days of receipt of this notification. In the case of credit unions, moreover, if the Czech National Bank does not reject an auditor within the set time limit, express fiction of approval of the auditor shall apply. For completeness, to observe the 30-day time limit for rejection the Czech National Bank need only provide a copy of the written rejection decision for serving (Article 71(2)(a) of the Administrative Procedure Code). A decision addressed to a legal entity entered in the Commercial Register will be delivered to its data box.20
2. The Czech National Bank will reject an auditor who fails to comply with the prerequisites in an administrative proceeding to which the reporting financial institution and the selected auditor are parties. It opens the administrative proceeding ex officio under Article 46 of the Administrative Procedure Code. In the notice of opening of the proceeding, it informs the financial institution of the opportunity to familiarise itself with the documents relating to the decision and express its opinion before the decision is issued. Given the short time limit for rejection, the Czech National Bank does not extend the time limit for familiarisation with the contents of the file and for submitting an opinion. The decision to reject the auditor usually rules out suspensory effect of an appeal.21
3. If the auditor is rejected, the bank, credit union, insurance company or reinsurance company is obliged to give notification of a newly selected auditor to the Czech National Bank. The Czech National Bank may reject an auditor repeatedly. The other approach, i.e. that only the first auditor notified may be rejected, corresponds neither to the letter nor to the purpose of the law and would easily lead to the audit being performed by an auditor who is not independent or who cannot perform an audit of the necessary scope and quality for professional reasons (lack of knowledge and experience).
4. An auditor selected by the statutory body of a bank, credit union, insurance company or reinsurance company at the recommendation of the audit committee, where established, i.e. an auditor proposed to the general meeting or members’ meeting for approval but not necessarily approved by the general meeting or members’ meeting, may be submitted in the notification to the Czech National Bank.22 Moreover, the intention to select a particular auditor may be informally consulted with the Czech National Bank before the Czech National Bank is notified of such auditor.
5. The Czech National Bank’s assessment of an auditor may be based on these facts: a) the results of an inspection conducted by the Czech National Bank in the reporting bank, credit union, insurance company, reinsurance company or other financial

20 Act No. 300/2008 Coll., on Electronic Acts and Authorised Conversion of Documents, as amended. 21 In the case of banks, the ruling out of suspensory effect applies ipso facto pursuant to Article 41 of the Act on Banks. In the case of other financial institutions, the ruling out of suspensory effect pursuant to Article 85(2)(a) of the Administrative Procedure Code will usually apply. 22 Identically, the reply to Question 8 on the Act on Auditors published on 12 November 2009 on the Czech National Bank’s website, or Pihera, V., Smutný, A., Sýkora, P. Zákon o bankách, komentář. C. H. Beck, Prague, 2011, p. 209. The Czech National Bank adopted the same opinion for insurance companies in a reply regarding the notification of an auditor of an insurance company – the term “selected auditor” of 3 February 2010 available on the Czech National Bank’s website. 6

CNB Bulletin No. 17/2011 of 30 December 2011 institution and other information and documents obtained by the Czech National Bank in the course of supervision and when comparing such information with the auditor’s reports, b) documents submitted by the reporting bank, credit union, insurance company, reinsurance company or auditor, c) the results of meetings with the auditor at which the auditor presents his/her procedures and methodology, d) the Czech National Bank’s experience with the auditor, i.e. whether he/she cooperated with the Czech National Bank as required by law (Article 21(6) of the Act on Auditors) and whether he/she duly fulfilled the information duty (Article 21(3) of the Act on Auditors), e) the results of a quality inspection of the auditor (Articles 24 and 31(2)(i) of the Act on Auditors), f) decisions to impose disciplinary action (Article 26 of the Act on Auditors), g) the proposal of the statutory body for the appointment of the auditor is contrary to the recommendation by the audit committee (where the deviation from the recommendation is not sufficiently justified). 6. In the area of insurance, the information to be reported to the Czech National Bank is specified in Article 82(8) of the Insurance Act. 7. Unlike the Insurance Act, the Act on Banks and the Credit Unions Act do not laid down requirements for notifications; however, since the rejection criteria are similar in all cases, the Czech National Bank expects the notification of selection to include: a) the business name, the ID numbers of persons, and the registered address of the notifier, or another mailing address, b) the name(s), surname and date of birth or the business name, registered office and ID number of the auditor, c) information about the duration and content of previous activities of the auditor in the area of accounting of banks, credit unions or other financial institutions, so that the suitability of activities and experience can be assessed, d) a description of previous activities in the area of auditing of banks, credit unions or other financial institutions, e) the information referred to in (b) to (d) for the person responsible in the audit company for performing audit activities (Article 22(1) of the Act on Banks or Article 8b(1) of the Credit Unions Act), f) disciplinary action taken by the Chamber of Auditors of the Czech Republic or a similar institution abroad against the auditor or the person responsible in the audit company for the performance of activities under Article 22(1) of the Act on Banks or Article 8b(1) of the Credit Unions Act, g) a declaration that the auditor has no special relation to the bank or credit union, h) a declaration that the auditor has no conflict of interest in relation to the bank or credit union, and, where relevant, a statement giving facts from which a conflict of interest might be inferred and the reasons why no such conflict of interest actually exists, 7

CNB Bulletin No. 17/2011 of 30 December 2011 8 i) information on whether the selected auditor, or the auditor submitted for approval to the general meeting, conforms to the recommendation of the audit committee and, if it does not, a statement giving relevant reasons for this deviation from the recommendation by the audit committee. IV. Final provision This Official Information shall apply from 1 January 2012. Official Information of the Czech National Bank No. 6/2003 CNB Journal of 19 March 2003, regarding the provisions of Article 22(3) of Act No. 21/1992 Coll., as amended by Act No. 126/2002 Coll., shall be repealed on 31 December 2011. Vice-Governor Prof. PhDr. Ing. Vladimír Tomšík, Ph.D. signed Financial Market Regulation and International Co-operation Department Responsible employee: Mr. Tyraj, tel. 00420 224 413 899