BCTL Instruction No. 19/2022 On Requirements For External Auditor, Publication Of Auditor's Opinion And Annual Report Of Insurance Companies And Insurance Intermediaries

[Logo of Banco Central de Timor-Leste]

INSTRUCTION NO. 19/2022¹
ON REQUIREMENTS FOR EXTERNAL AUDITOR, PUBLICATION OF AUDITOR'S OPINION AND ANNUAL REPORT OF INSURANCE COMPANIES AND INSURANCE INTERMEDIARIES

Considering that the Banco Central de Timor-Leste (BCTL) has, in accordance with article 5, paragraph j) of Law no. 5/2011, of 14 June (BCTL Organic Law), the responsibility of regulating and supervising financial institutions.

Considering that, in accordance with article 33, number 1, paragraph (h) of Law no. 6/2005, of 7 July, on the Regime for the Licensing, Supervision and Regulation of Insurance Companies and Insurance Intermediaries ("Insurance Law") that requires any replacement of auditors and actuaries by an insurance company or insurance intermediary to be subject to the written approval of BCTL.

Considering Article 36 of the Insurance Law, that regulates the external auditing of insurance companies and insurance intermediaries.

The Banco Central de Timor-Leste places reliance on quality Audit services to complement its supervision of insurance companies and insurance intermediaries to foster the safety and soundness of these entities. Therefore, it is of paramount importance the quality of the external Audit performed on the financial statements of the licensed insurance companies and insurance intermediaries.

The main objective of an external Audit is to verify that the accounting records for a company provide a true and accurate picture of the organisation's finances and that statements are prepared in accordance with the set laws and accounting standards.

External audits also add value by identifying areas where efficiency in the business can be improved and where controls and processes may be made more effective.

The Governing Board of Banco Central de Timor-Leste, pursuant to the authority granted in Article 31 paragraph 1 of Law no. 5/2011 of 15 June, in Article 3 and Article 4 of the Insurance Law, hereby resolves to approve the following Instruction:

Article 1
Objectives and Scope

1. The objective of this instruction is to establish requirements and rules for external auditors, publication of the Audit Report and annual report of insurance companies and insurance intermediaries in Timor-Leste.
2. This Instruction shall apply to all insurance companies and insurance intermediaries including branches of foreign entities licensed to operate in Timor-Leste.

Article 2
Definitions

In this Instruction the terms below shall have the following meaning:

a) "Audit" means a process conducted according to pre-established generally accepted auditing standards for objectively obtaining and evaluating evidence regarding assertions about economic

¹¹ Please refer to the Portuguese version for official use. This English version is prepared to facilitate the availability of information for the financial institutions.

actions and events, financial statements, financial systems, records, transactions, and operations, performed by professional accountants for the purpose of providing assurance of accountability, giving credibility to the financial statements and other management reports, identifying weaknesses in internal controls and financial systems, and making appropriate recommendations for improvement;

b) "BCTL" means the Banco Central de Timor-Leste, established under Law No.05/2011, of June 15;

c) "Engagement Letter" means a document addressed by the auditor to the insurance company or insurance intermediary confirming acceptance of the appointment, stating the objective and scope of the Audit, the extent of the auditor's responsibilities to the client, and the forms of any reports. This includes any special reports to be addressed to the supervisory authorities and, when applicable, any use and source of specialized accounting principles imposed by national laws and regulations applicable to insurance companies and insurance intermediaries;

d) "Management Letter" means a letter to the insurance company's or the insurance intermediary's Board of Directors (in addition to the basic opinion contained in the Audit Report) wherein the auditor addresses weaknesses and other limitations found in the insurance company's or the insurance intermediary's internal control structure and operating procedures. The Management Letter shall meet the following minimum requirements;

i. provide comments and observations on the accounting records, operating systems and internal controls that were examined during the course of the Audit;

ii. identify specific deficiencies and areas of weakness in operating systems and internal controls, and make recommendations for their improvement;

iii. communicate matters that have come to the auditor's attention during the Audit which might have a significant impact on the operations of the insurance company or insurance intermediary, including:

• any fraudulent act by any administrator, employee, or agent of the insurance company or insurance intermediary; or
• any irregularity or deficiency in the administration or operations that should be expected to result in a material loss for the insurance company or insurance intermediary.

iv. bring to the attention of the Board of Directors any other matters that the auditor deems to be pertinent.

e) "Professional Scepticism" means an attitude characterized by critical spirit, attentive to conditions that may indicate possible distortions due to error or fraud, and a critical appraisal of the Audit and conclusions resulting therefrom.

f) "Board of Directors" means the panel of individuals elected by the shareholders to represent them in the management of the insurance company or insurance intermediary;

g) "Audit Committee" means to the panel of individuals elected by the shareholders to undertake supervisory functions over the management of the insurance company or insurance intermediary;

h) "Management" means to the individuals or body responsible for managing the business on a day-to-day basis in accordance with strategies, policies and procedures set out by the Board of Directors;

i) "Financial Statements" means the balance sheet, comprehensive income statement, cash flow statement, statement of changes in equity, notes and other statements and explanatory material which are identified as being part of the Financial Statements;

j) "International Financial Reporting Standards (IFRS)" means the formal standards that specify how certain types of transactions or events are to be recorded in the financial statements and what disclosures should be made in the notes to Financial Statements, as published by the International Accounting Standard Board;

k) "International Standards on Auditing" means the formal standards on auditing which are issued by the International Auditing and Assurance Standards Board;

l) "Audit Opinion" means a formal report on an Audit which gives the auditor's conclusion, and which clearly sets forth a judgment upon the reasonability with which the Financial Statements present the

insurance company's or the insurance intermediary's financial position and results of operation and are presented in accordance with International Accounting Standards. This Audit Opinion may be (1) unqualified; (2) qualified; (3) adverse; or (4) disclaimer of opinion;

m) "Audit Report" means the expression of opinion rendered by the auditor in writing on the insurance company's or the insurance intermediary's financial information. The Audit Report must contain (1) title; (2) addressee; (3) identification of financial information audited; (4) reference to the auditing standards followed; (5) expression or disclaimer of opinion on the financial information; (6) signature; (7) auditor's address; and (8) date of report.

Article 3
Designation of External Auditors

1. The designation or change of the auditing firm by an insurance company or insurance intermediary is subject to written approval by BCTL.
2. The insurance companies and insurance intermediaries shall submit to BCTL not later than the first day of financial year any new or replacement of appointment of the auditing firm for approval by BCTL.
3. For the purpose of the previous paragraph, the following information are required to be included:
   a) proof of compliance by the auditor of all requirements foreseen in article 5 of this Instruction; b) the Audit period; c) identification of the independent external auditor responsible mentioning: name, address, telephone/mobile phone number, name of the partner in charge of the Audit; d) a copy of the Engagement Letter; and e) certified excerpts from the minutes of the meeting of Audit Committee and of the Board of Directors of the insurance company or insurance intermediary approving the appointment of the independent external auditor.

Article 4
Publication of Annual Financial Statements

1. Within four months of the end of each financial year, every Insurance companies and insurance intermediaries shall publish in at least a national newspaper a summary of its annual balance sheet, Audit Opinion and income statement for the previous year.
2. Branches of foreign insurance companies and insurance intermediaries shall publish their balance sheets and income statements on both an individual and consolidated basis.
3. Within four months of the end of each financial year, every insurance company and insurance intermediary shall publish on its website the annual report, Audit Opinion and audited annual Financial Statements for the proceeding of financial year.
4. The published annual balance sheet and income statement, accompanied by a certification from director(s)/manager(s) designated by the Board of Directors shall be submitted to BCTL within four months of the end of each financial year.

Article 5
Criteria for the Appointment of an External Auditor

The qualifications criteria of an external auditor are as follows:

a) have the necessary skills, knowledge, and appropriate experience to perform the audits of insurance companies or insurance intermediaries with professional competence, due care and diligence in accordance with the auditing standards and applicable regulatory and legal requirements. b) should not have any relation with, or interests in, including an interest in shares of the insurance company or insurance intermediary or any of its related entities that are likely to impair its objectivity or independence, and which cannot be reduced to an acceptable level through the application of appropriate safeguards. c) has specialized knowledge and competence in auditing insurance companies or insurance intermediaries. Knowledge and competence are particularly important in an external auditor's ability to exercise professional judgment and carry out key aspects of the Audit, such as identifying and assessing

the risks of material misstatement and designing and implementing appropriate responses to those risks. d) should not have any record of disciplinary actions taken against him/her for unprofessional conduct by the relevant professional association.

Article 6
Duties of the Board of Directors

1. The Board of Directors of the insurance companies and insurance intermediaries must apply robust processes for monitoring and assessing the independence of the external auditor and to ensure that the appointed external auditor has the necessary knowledge, skills, expertise, integrity and resources to conduct the Audit and meet any additional regulatory requirements
2. The Board and Management of the insurance companies and insurance intermediaries are responsible for ensuring that Financial Statements are prepared in accordance with the International Financial Reporting Standards (IFRS), as determined by the applicable regulatory instruments issued by BCTL.
3. The Board and Management of the insurance companies and insurance intermediaries are responsible for ensuring that the Financial Statements issued annually to the public bear an independent external auditor's opinion as a result of an Audit conducted in accordance with internationally accepted auditing practices and standards.
4. The Board of Directors of insurance companies and insurance intermediaries should ensure that members of the Audit engagement team meet the qualification criteria set out in the preceding Article.
5. Where non- Audit services are provided to an insurance company or insurance intermediary by an external auditor, the Board of Directors should ensure that the provision of such service does not impair, either in fact or appearance, the external auditor's objectivity, judgement or independence.

Article 7
Terms of an External Audit Engagement

1. The duration of appointment of an external auditor shall not exceed for cumulative period five (5) years consecutively for the same insurance company or insurance intermediary
2. The Board of Directors of the insurance company or insurance intermediary should review the terms of an external Audit engagement prior to confirming an engagement. For that, the agreed terms should be documented in an external Audit Engagement Letter.
3. The terms of an external Audit engagement should at minimum cover the following:
   a) objective of the Audit; b) scope of an external Audit engagement; c) agreement on the external Audit plan; d) responsibilities of the engagement and concurring partners; e) reports to be prepared by the external auditor, including the Auditor's Report and recommendations for improving internal controls; f) timing of the external Audit and the respective Audit fees; g) use of experts in certain aspects of the external Audit; h) other significant arrangements in relation to the external Audit, including responsibilities of the external auditor with regard to any change to members of the engagement team during the Audit; i) certified excerpts from the meeting minutes of the Board of Directors and Audit Committee of the insurance company or insurance intermediary approving the appointment of the independent external auditor.
4. The Audit contract between the insurance company or insurance intermediary and the independent external auditor, or Engagement Letter, must stipulate that the auditor shall:
   a) fulfil the requirements of Article 36.5, Article 36.7, and Article 37 of the Insurance Law and applicable regulatory instruments issued by BCTL;

b) prepare the annual Audit Report, auditor's opinion, and Management Letter in accordance with International Standards on Auditing; c) submit the annual Audit Report, auditor's opinion, and Management Letter simultaneously to the insurance company or insurance intermediary four months from the end of its Financial Year to enable the insurance company or insurance intermediary to meet the publishing deadlines as stipulated in Article 4; and d) prepare all documents in the official languages of Timor-Leste and English.
5. For the reappointment of an external auditor, the existing terms of the Audit engagement should be confirmed for each reporting period and appropriate modifications made as necessary to reflect any material changes in the insurance company or insurance intermediary which has a bearing on the external Audit engagement, and
6. An external auditor who has been rotated off the Audit of an insurance company or insurance intermediary may resume the role as engagement partner only after a lapse of five years consecutively from the last Audit engagement with that insurance company or insurance intermediary.

Article 8
Scope of an Audit Engagement

1. The scope of the Audit engagement should be determined having regard to all activities of an insurance company or insurance intermediary where the financial reporting risks are material.
2. An insurance company and insurance intermediary should consider any significant changes during the reporting period which may contribute to an increased risk inherent to the insurance company's and insurance intermediary's internal controls over financial reporting processes, the accuracy of its recording of transactions, and ability to comply with financial reporting standards.
3. Changes that are relevant to determination under the preceding paragraph may include business combinations, significant changes in operating structures, processes or key Management personnel, the implementation of new reporting standards or regulatory requirements and major systems changes or upgrades.
4. The scope of the Audit engagement should also include recommendations to the Management for improving internal controls to ensure fair presentation of the Financial Statements.
5. The detailed Audit program and Audit plan must, at least, include specific procedures to test the insurance company's and insurance intermediary's internal controls.
6. In areas identified as being of high risk or concern in any particular financial year(s) having regard to matters covered in paragraphs 1 and 2, the Audit program and plan should address any additional and specific procedures needed to address these areas.
7. The main duty of the external auditor is to form and provide an objective and written opinion on whether:
   a) he/she has obtained all the necessary information and explanation for the Audit of books of accounts and have applied International Standards of Auditing; b) proper books of accounts have been kept and maintained by the institution; c) the Financial Statements are in agreement with the books of account and are in conformity with applicable International Financial Reporting Standards (IFRS); d) the Financial Statements derived from the books of accounts give a "true and fair view" of the financial status of the institution in accordance with International Financial Reporting Standards (IFRS).
8. The external auditor must verify whether transactions between financial institutions have value addition for the insurance company or insurance intermediary and are at arm's length.

Article 9
Obligations of an External Auditor

1. An external auditor shall have full compliance with these obligations to achieve the duties and meet its responsibilities:

a) ensure that the audited insurance companies or insurance intermediaries prepare Financial Statements in accordance with International Financial Reporting Standards (IFRS) and that those Financial Statements are supported by the financial institution's data systems, in accordance with the relevant laws and regulations; b) determine that the insurance company or insurance intermediary has used valuation practices consistent with International Financial Reporting Standards (IFRS) and that the framework, structure and processes for fair value estimation are subject to independent verification and validation; c) document and disclose any significant differences between the valuations used for financial reporting purposes and for regulatory purposes in the Management Letter; d) ensure that the disclosure of the Financial Statements of insurance companies and insurance intermediaries complies with the International Financial Reporting Standards (IFRS) and relevant provisions of laws and regulatory instruments issued by BCTL; e) disclose violations of laws and regulatory instruments issued by BCTL in the Management Letter; f) ensure that Financial Statements, including the explanatory notes, are audited in accordance with International Standards on Auditing issued by the International Auditing and Assurance Standards Board (IAASB); g) maintain Professional Scepticism throughout the Audit process, recognising the possibility of material misstatements due to facts or behaviour indicating irregularities, including fraud or error.
2. In addition to the above obligations, the external auditor shall promptly inform BCTL about:
a) any information or occurrence relating to the affairs of the institution that, in his or her opinion, could jeopardize the interest of the institution or policyholders, or information that the insurance company or insurance intermediary is insolvent or is likely to be unable to meet its obligations; b) any criminal offence that has been or is being committed by the institution or in connection with the institution's business; c) transactions leading to suspicion of money laundering and financing terrorism; d) fraudulent act(s) committed by an employee of the insurance company or insurance intermediary or any of its subsidiaries or any administrative or operational irregularities or deficiencies that are likely to result in material losses to the entity or its claims arising from insurance policies; e) the suppression, non-attendance or undue influence on the conclusions of the Audit Report by members of the management, supervisory or advisory bodies of the insurance company or insurance intermediary; f) any breach or non-compliance with relevant laws or regulatory instruments issued by BCTL; and g) any significant weaknesses in the insurance company's and insurance intermediary's internal control procedures which may render it vulnerable to significant risks or any exposures that may potentially jeopardize its financial viability.

Article 10
Responsibilities of the Engagement and Concurring Partners

1. An engagement partner and concurring partners should be identified for each Audit engagement.
2. The auditor is responsible for the carrying out the Audit and drafting Audit Report.
3. Before the conclusion of the Audit Report, the concurring partner is responsible for objectively evaluating, the significant judgements made by the engagement team and conclusions reached in formulating the report.
4. The terms of the Audit engagement should state the responsibilities of the engagement partner to:
   a) direct, supervise and perform the Audit in compliance with the relevant auditing standards and the Audit firm's internal quality control procedures throughout the Audit engagement; b) ensure that the engagement team collectively has the appropriate capabilities, competence and time to devote to the Audit of the insurance company or insurance intermediary. This should include relevant Audit experience of the team in the insurance industry; and

c) ensure that the auditor's report, including any opinions expressed and emphasis of matter, is reliable based on sufficient Audit evidence and is not misleading in any material respect.
5. The terms of the Audit engagement should also establish that it is the responsibility of the concurring partner to form an objective assessment, based on an appropriate review of selected Audit working papers, of:
a) significant risks identified by the engagement team during the Audit and the appropriateness of the team's responses to those risks; b) whether the Audit evidence obtained is sufficient to support the significant judgements made and conclusions reached by the engagement team; c) whether differences of opinion with the Management or other contentious matters were appropriately dealt with; and d) matters which should be communicate to Management and, where applicable, to BCTL.
6. The Board of Directors should take appropriate steps to satisfy itself that the concurring partner can reasonably commit the necessary time to carry out the required review of Audit documentation to support the assessment required under the preceding paragraph.
7. Where the external auditor expects or intends to use the work of an expert to obtain sufficient Audit evidence to support the Audit, the terms of the Audit engagement should provide that the use of experts does not diminish the auditor's responsibility for the Audit reports issued and opinions expressed.

Article 11
Reliance and Accountability for the Audit Report

1. An insurance company or an insurance intermediary should inform the auditor that BCTL may rely on the auditor's review and report as input to BCTL's supervisory plans under the risk-based approach to supervision, and its ongoing assessments of the safety and soundness of the insurance company or insurance intermediary.
2. An insurance company or an insurance intermediary should not accept any terms of an Audit engagement under which this institution agrees to indemnify the external auditor against claims made by third parties, release the auditor from liability for claims or potential claims that might be brought by the insurance company or insurance intermediary against the external auditor, or limit the remedies available to the insurance company or insurance intermediary for professional misconduct of the external auditor.

Article 12
Annual Audited Reports

The Audit Report of the external auditor of the insurance company or insurance intermediary shall include:
a) a Statement of Financial Position; b) a Statement of Comprehensive Income; c) a Statement of Changes in Equity; d) a Statement of Cash Flows; e) notes, comprising a summary of the significant accounting policies; f) an opinion on the Financial Statements; g) a copy of the external auditor's letter to the Management on their Audit findings and concerns; and h) any other comments on the institution's risk profile and control environment.

Article 13
Additional Report to BCTL

In addition to the obligations above provided for, the external auditor is required to report promptly to BCTL any of the information concerning the following matters:
a) matters of serious conflict within the decision-making bodies; b) intention of the auditor to resign or any threat of removal of the auditor from office;

c) material adverse changes in current or potential risks in the institution's business; d) serious irregularities or significant losses which may jeopardize the interests of policyholders or other creditors of the institution; e) information that indicate a material breach of the insurance company's or insurance intermediary's own policies, articles of association and memorandum of association.

Article 14
Audit Fees

The Board of Directors should ensure that Audit fees are commensurate with the scope of the Audit and accountability assumed by an external auditor, taking into account the required skills, knowledge and allocation of time and resources needed to complete the Audit assignment in accordance with the requirements set out in this Instruction.

Article 15
Procedures for Submitting the Authorization Request

1. Without prejudice of article 3 of this Instruction, the proposed external auditor should complete and send to the insurance company or insurance intermediary a statutory statement, confirming, at least, that the external auditor:
   a) is not disqualified under the applicable legislation from being appointed as an external auditor for the insurance company or insurance intermediary in question; b) is not convicted of an offence under the applicable legislation to the insurance sectors of Timor-Leste, or any offence crime related to fraud, dishonesty, bankruptcy, money laundering or terrorism financing or any other relevant crime; c) has no relations with, or interests in, including an interest in shares of the insurance company or insurance intermediary in question or any of its related entities that are likely to impair his/her objectivity or independence, and which cannot be reduced to an acceptable level through the application of appropriate safeguards; and d) has no record of disciplinary actions taken against him/her for unprofessional conduct by the relevant professional association.
2. Together with the statement mentioned in the previous number, the external auditor shall also send to the insurance company or insurance intermediary the documentation attesting the veracity of the statement mentioned in the previous number.

Article 16
Quality Assurance Enforcement

1. External auditors should follow International Standards on Quality Control (ISQC) of the IAASB and ensure that they maintain appropriate internal quality control processes for their external audits and to minimize Audit quality deficiencies.
2. BCTL continuously monitors the quality of Audit of insurance companies and insurance intermediaries and may investigate failures or weaknesses of the external auditor in the Audit.
3. BCTL has the power to access external auditors' working papers, where necessary.
4. BCTL may, where it is not satisfied with the external Audit Report, disqualify the auditor and appoint another auditor to carry out additional Audit or investigation as may be deemed necessary and submit a report on the matter concerned.
5. The audited insurance company or insurance intermediary will be responsible for remunerating that auditor for the additional duties referred on above paragraph 4.

Article 17
Cancellation of External Auditor Appointment

1. When BCTL determines that the external auditor failed to meet his/her obligations in accordance with relevant laws and regulations, or no longer fulfils the requirements to operate as an external auditor as

per the provisions of this Instruction, BCTL shall revoke the external auditor's appointment and inform in writing of such a decision to the insurance company or insurance intermediary with request to appoint a new auditor.
2. BCTL shall give the insurance company or insurance intermediary a notice to immediately revoke the external auditor's appointment.
3. The insurance company or insurance intermediary should ensure that the contract with an external auditor should have the provisions that allow BCTL to apply the cancellation of the appointment of external auditor.

Article 18
Meeting with an External Auditor

1. BCTL may organize a meeting with an external auditor to discuss the scope of the work and to exchange information on the audited insurance company or insurance intermediary.
2. Where necessary or convenient, BCTL may invite the Management of the audited insurance company or insurance intermediary.

Article 19
Entry Into Force

This Instruction shall enter into force on the day of its publication in the Jornal da República.

Approved on 21 July 2022

The Governor,
[Signature]
Abraão de Vasconcelos