Circular CSSF 19/717 Update of the General Presentation of the Law of 23 July 2016 and Audit Profession Regulations

Circular CSSF 19/717 as amended by Circular CSSF 22/794 and CSSF 24/852 page 1/29 In case of discrepancies between the French and the English text, the French text shall prevail. Luxembourg, 26 April 2019 To all entities subject to the public oversight of the audit profession by the CSSF Re: Update of the general presentation of the Law of 23 July 2016 and regulations relating to the audit profession Ladies and Gentlemen, This circular presents the updates of the legal and regulatory framework concerning the audit profession following the entry into force of several new regulatory texts. The Law of 23 July 2016 concerning the audit profession (hereinafter, the “Law”), which repealed and replaced the Law of 18 December 2009, confers on the CSSF the public oversight of the audit profession. The Law transposes Directive 2014/56/EU of the European Parliament and of the Council of 16 April 2014 amending Directive 2006/43/EC on statutory audits of annual accounts and consolidated accounts (hereinafter, the “Directive”) and implements Regulation (EU) No 537/2014 on specific requirements regarding statutory audit of public-interest entities (hereinafter, the “EU Regulation”). It is supplemented by regulations that are implementing measures of the Law or specifications of certain provisions of the Law. This circular aims at providing further information on the following laws and regulations:  Law of 23 July 2016 concerning the audit profession, published in Mémorial A - No 141 of 28 July 2016;  Grand-ducal Regulation of 14 December 2018 determining the requirements for the professional qualification of réviseurs d'entreprises (statutory auditors) and réviseurs d’entreprises agréés (approved statutory auditors), as amended (hereinafter, the “GDR access to the profession”), published in Mémorial A - No 1148 of 18 December 2018;  Grand-ducal Regulation of 18 December 2009 determining the conditions for the recognition of service providers from other Member States in order to carry out any duties CIRCULAR CSSF 19/717 as amended by Circulars CSSF 22/794 and CSSF 24/852

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 2/29 exclusively entrusted to réviseurs d’entreprises (statutory auditors) by way of free provision of services, as amended (hereinafter, the “GDR LPS”);  CSSF Regulation No 16-10 organising continuing education of réviseurs d'entreprises (statutory auditors) and réviseurs d'entreprises agréés (approved statutory auditors) pursuant to Article 10 of the Law (hereinafter, the “RCSSF continuing education”);  CSSF Regulation No 19-03 relating to the establishment of a consultative commission for the access to the audit profession (hereinafter, the “RCSSF consultative commission”);  CSSF Regulation No 19-02 relating to 1) the adoption of audit standards in the field of statutory audit under the Law, 2) the adoption of standards on professional ethics and internal quality control under the Law (hereinafter, the “RCSSF standards”);  CSSF Regulation No 19-04 relating to 1) the establishment of a list of Master’s degrees or diplomas corresponding to equivalent training which satisfy the requirements referred to in Article 2(1) and (2) of the GDR access to the profession, 2) the establishment of a list of approvals referred to in Article 1, Section D of the GDR access to the profession (hereinafter, the “RCSSF list of diplomas and approvals”);  CSSF Regulation No 16-13 relating to the reporting of infringements of the Law of 23 July 2016 concerning the audit profession and Regulation (EU) No 537/2014 on specific requirements regarding statutory audit of public-interest entities (hereinafter, the “RCSSF whistleblowing”);  CSSF Regulation No 16-07 relating to out-of-court complaint resolution (hereinafter, the “RCSSF complaints”). This circular repeals and replaces Circular CSSF 17/662 of 27 July 2017, effective as from 26 April 2019. It includes in particular • the main amendments introduced by the GDR access to the profession as regards the candidates for the training and the trainees: o The conditions of the theoretical qualification have been adapted to reflect the evolution of the complementary training certificate and to avoid any redundancy with the structure of the Master’s degree or equivalent education; o The reintroduction of mandatory attendance at the complementary training certificate courses; o The introduction of a modular formula for the examination of professional competence allowing candidates to take the written and oral tests in the order of their choice. • the amendments to be made to the Luxembourg complements to the parts “Application and Other Explanatory Material” and “Appendix” of the auditing standards for statutory audit following the entry into force of the RCSSF standards of 2019. The whole documentation relating to the information mentioned in this circular is available on the CSSF website: https://www.cssf.lu/en/public-oversight-of-the-audit-profession/.

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 3/29 Table of contents

1. General provisions and scope.........................................................................................................5 1.1. The main provisions of the EU Regulation...................................................................................5 1.2. The different players governed by the Law..................................................................................5 1.3. Statutory audit activity...................................................................................................................6 1.4. Activities that réviseurs d’entreprises may carry out ...................................................................6 1.5. Record-keeping of failures to comply with the Law or the EU Regulation (Article 25(3))......6 1.6. Complaints (Article 36(4))..............................................................................................................7 1.7. Reporting of breaches to the CSSF (Article 36(7)) ......................................................................7 1.8. Specific requirements applicable to public interest entities........................................................8 1.9. Requests for extension of the maximum duration of an audit mission ......................................9 1.10. Requests for exemption from limitation of non-audit fees (Article 49)....................................10
2. Access to the audit profession ......................................................................................................11 2.1. Admission to and conduct of professional training....................................................................11 2.2. Consultative commission..............................................................................................................12 2.3. Complementary training certificate ............................................................................................12 2.4. Examination of professional competence....................................................................................13 2.5. Access to the profession in Luxembourg for auditors of other Member States and third countries (outside the EU)........................................................................................................................13
3. Procedure to obtain the title Réviseur d'entreprises or Cabinet de révision and approval procedure...................................................................................................................................................14 3.1. Procedure to obtain the title (Article 3 of the Law)...................................................................14 3.2. Approval procedure (Article 5 of the Law) ................................................................................14 3.3. Update of administrative data .....................................................................................................14
4. Restitution of the title or of the approval....................................................................................15
5. Registration of audit firms (Article 6 of the Law) and of third-country auditors and audit entities (Article 57 of the Law).................................................................................................................15
6. Public register................................................................................................................................16

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 4/29 7. Continuing education of réviseurs d'entreprises and réviseurs d'entreprises agréés (Article 10 of the Law).................................................................................................................................................16 8. Audit standards and other standards (Article 33 and Article 36(3), letter (b)).......................17 9. Quality assurance reviews (Article 39 of the Law) ....................................................................19 ANNEX………………………………………………………………………………………………… 21

Circular CSSF 19/717 as amended by Circular CSSF 22/794 and CSSF 24/852 page 5/29

1. General provisions and scope 1.1. The main provisions of the EU Regulation The main provisions of the EU Regulation applicable to public-interest entities concern: • mandatory rotation of audit firms; • limitation in the provision of non-audit services; • extended audit report; • additional report to the audit committee; • creation of the Committee of European Auditing Oversight Bodies (hereinafter, the “CEAOB”). 1.2. The different players governed by the Law

• “réviseur d’entreprises” (statutory auditor) (point (33) of Article 1) and “réviseur d'entreprises agréé” (approved statutory auditor) (point (34) of Article 1) mean the natural persons established in Luxembourg and members of the IRE;
• “statutory auditor” (point (9) of Article 1) means a natural person approved by the competent authorities of another EU Member State;
• “third-country auditor” (point (7) of Article 1) means a natural person who is not a statutory auditor in an EU Member State;
• “key audit partner” (point (1) of Article 1) means the person responsible for the audit engagement, the law specifying that only a réviseur d'entreprises agréé may sign an audit report (including where an audit engagement is carried out by an audit firm);
• “cabinet de révision” (audit firm) (point (4) of Article 1) and “cabinet de révision agréé” (approved audit firm) (point (5) of Article 1) mean the legal persons established in Luxembourg and members of the IRE;
• “audit firm” (point (3) of Article 1) means a legal person approved by the competent authorities of another EU Member State;
• “third-country audit entity” (point (19) of Article 1) means a legal person that is not an audit firm in an EU Member State.

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 6/29 1.3. Statutory audit activity The Law (point (6) of Article 1) defines statutory audit as the audit of annual financial statements or consolidated financial statements in so far as required by law or by directly applicable Union law. In Luxembourg, Article 5(1) of the Law reserves the exercise of statutory audit to réviseurs d’entreprises agréés. However, Article 6 introduces a derogation from this principle by allowing an audit firm which is approved in another Member State to perform statutory audits in Luxembourg, provided that the key audit partner who carries out the statutory audit on behalf of the audit firm is a réviseur d’entreprises agréé. Thus, in exercising its activity in Luxembourg, the audit firm is required to comply with the Law in the same way as the cabinets de révision agréés and the réviseurs d’entreprises agréés and will be subject to the public oversight of the audit profession for statutory audits carried out in Luxembourg. These audit firms will be registered by the CSSF and listed as such in the public register. 1.4. Activities that réviseurs d’entreprises may carry out Réviseurs d’entreprises are authorised to carry out all the duties exclusively entrusted by the law to réviseurs d’entreprises except for statutory audits. Réviseurs d'entreprises may carry out other activities than those reserved to them, such as domiciliation, contractual audit, tax advice, organisation and bookkeeping and analysis, using accounting techniques, of the situation and functioning of undertakings from their various economic, legal and financial aspects, in compliance with the independence rules laid down in Articles 18 to 23 of the Law and in the RCSSF standards. Réviseurs d'entreprises are free to exercise their professional activities, provided that they meet certain requirements and in particular that they are subject to different provisions of the Law, such as continuing education, ethical rules and supervision by the Institut des Réviseurs d'Entreprises (hereinafter, the “IRE”) in order to ensure the quality of the audit profession. Réviseurs d'entreprises do not fall within the scope of the public oversight of the CSSF. 1.5. Record-keeping of breaches of the Law or the EU Regulation (Article 25(3)) The Law lays down that réviseurs d’entreprises agréés and cabinets de révision agréés shall keep records of the breaches of the provisions of the Law or of the EU Regulation, of their consequences, including the measures taken to address such breaches and to change their internal quality control system, where applicable.

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 7/29 For the CSSF, this notion of breaches is to be interpreted at three levels:

• Where the breach concerns the internal organisation of réviseurs d’entreprises agréés or cabinets de révision agréés, reference should be made to Article 24(1) of the Law. We refer to the International Standard on Quality Control (ISQC1) as adopted through the RCSSF standards, to assess the obligation to keep record of such breach;
• Breaches concerning professional ethics and independence must be recorded without exception;
• In connection with audit engagements, the need to record the breach must be assessed in the light of the materiality level and/or its possible impact on the audit report. 1.6. Complaints (Article 36(4)) The CSSF is competent as per the Law to receive third-party complaints in the field of statutory audit but does not, however, act as mediator. Third party means any natural or legal person, including the entity itself, that needs to file a complaint relating to the statutory audit of the entity. The RCSSF complaints and the CSSF circular specifying the implementation of this RCSSF deal with the procedures governing third-party complaints filed with the CSSF as regards statutory audits. In this regard, the notion of professional referred to in Article 1 includes any natural or legal person subject to the public oversight of the audit profession. The provisions of Section 2 of the RCSSF complaints apply to CRA and REA. In addition, the third indent of Article 4 does not exclude the product or service of statutory audit. In accordance with the RCSSF complaints, a complaint means a “complaint filed with a professional to recognise a right or to redress a harm”. Thus, simple requests for information or clarification cannot be considered as complaints. Complaints without any link whatsoever with statutory audit must not be mentioned in the table. CRAs must therefore designate a person responsible within the management in charge of the implementation and the efficient operation of the internal procedure for complaint handling. Likewise, the person responsible must communicate to the CSSF, on an annual basis, a table with the number of complaints registered by the CRA (cf. point 3.3. below), by type of complaint, as well as a summary report of the complaints and the measures taken to address them. This summary report is not supposed to be a compilation of complaint summaries, but must present the recurring issues that the professional faced, and must contain, where applicable, an account of the measures taken to handle these complaints. 1.7. Reporting of breaches to the CSSF (Article 36(7)) In order to allow the CSSF to detect certain irregularities, including fraud, information concerning breaches of the Law or the EU Regulation may be transmitted to it.

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 8/29 The RCSSF whistleblowing defines the mechanisms to report presumed or real breaches as well as their follow-up. The CSSF has made available a communication tool on its website in the form of an electronic form and a dedicated email address (whistleblowing@cssf.lu) allowing any person to report any breaches of the Law or the EU Regulation to the CSSF in a confidential and secured manner. 1.8. Specific requirements applicable to public-interest entities Pursuant to the Law, “public-interest entities” are:  entities governed by Luxembourg law whose transferable securities are admitted to trading on a regulated market of a Member State;  credit institutions incorporated under Luxembourg law;  insurance and reinsurance undertakings incorporated under Luxembourg law, except for captive insurance and reinsurance undertakings. Henceforth, the EU Regulation centralises all the requirements that apply to the public-interest entities, in particular concerning audit fees, principles of independence (prohibition of the provision of non-audit services), appointment and role of the person responsible for carrying out the engagement’s quality control review before signing the audit report, the content of the audit report as well as the additional report to the audit committee and the transparency report, and also the duration of the audit engagement. The Law only sets out the optional provisions (Articles 49 to 51) provided for by the EU Regulation. Thus, derogations have been put in place as regards audit fees (cap of 70%) for a maximum duration of two years upon motivated request of the cabinet de révision agréé (cf. 1.10 below), the provision of tax and valuation services under certain conditions and the maximum duration of the audit engagement which can be extended to 20 years where a public tendering process is conducted (cf. 1.9 below). Each public-interest entity must have an audit committee, unless otherwise provided (Article 52(5)). In the absence of concrete cases, the CSSF has not, to date, laid down conditions under which public-interest entities that have a body fulfilling functions that are equivalent to those of an audit committee may derogate from the obligation to set up an audit committee. From now on, the audit committee has a more active role, the majority of its members must be independent from the audited entity, competent in the entity's area of activity and at least one member must be competent in accounting and/or audit. The audit committee, besides the missions entrusted on it historically, i.e. ensuring the follow-up of the financial reporting process, the efficiency of the internal control and risk management systems and, where applicable, internal audit, the statutory audits and the independence of the réviseur d'entreprises agréé or cabinet de révision agréé must henceforth also report on the results of the statutory audit to the administrative or supervisory body and provide a statement on the

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 9/29 actions it has taken in this process in order to ensure the integrity of the financial information. Moreover, it must assess the quality of the additional report issued for it by the réviseur d'entreprises agréé. Independence being a pillar of these new European texts, every year, the réviseurs d'entreprises agréés and cabinets de révision agréés now have to confirm in writing their independence to the audit committee and discuss the risks to their independence as well as the safeguards applied to mitigate these risks. This is valid, in particular, for service provisions to the audited entity other than audit services. In addition, the audit committee must submit its recommendation to the administrative or supervisory body of the audited entity in the framework of the process of selection of the réviseur d'entreprises agréé or cabinet de révision agréé. Except when renewing the statutory auditor, this recommendation will have to be justified and include at least two possible choices among the candidates and it will have to indicate the duly motivated preference of the audit committee for one of these two. In other words, it will have to further accompany and supervise the réviseur d'entreprises agréé and cabinet de révision agréé. The CSSF will have to assess the work of these audit committees and report it to the European Commission. The ability to sanction the less diligent audit committees was entrusted to the regulator. 1.9. Requests to extend the maximum duration of an audit engagement The second subparagraph of Article 17(1) of the EU Regulation sets a maximum duration of 10 years for an audit engagement of a public-interest entity. Article 51 of the Audit Law allows extending this maximum duration up to a maximum duration of 20 years where a public tendering process is conducted. Article 17(6) specifies that after expiry of the maximum duration and on the condition that a public tendering process is conducted, the public-interest entity may, on an exceptional basis, request that the competent authority (the CSSF) grant an extension under the terms of which it can appoint the same cabinet de révision agréé for another engagement which may not exceed two years. The CSSF specifies that this request must be addressed in writing by the public-interest entity, within a reasonable period, to the department “Public oversight of the audit profession”, and must include at least the following information: • The number of consecutive years of the audit engagement; • An explanation regarding the need for this extension and the exceptional character of the request, including the consequences and/or alternatives in case of a refusal of the extension; • The duration of the requested extension.

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 10/29 The CSSF analyses the information provided and may request additional information if so needed. The decision regarding the extension will be communicated to the public-interest entity within one month as from the reception of the request. The CSSF does not grant an extension if the criteria “on an exceptional basis” is not demonstrated. Likewise, if the CSSF grants an extension, it will be of a minimum duration it sees fit given the circumstances. The requesting entities may file an appeal against the decision of the CSSF not to grant an extension within 15 days following notification of the decision. 1.10. Requests for exemption from limitation of non-audit fees (Article 49) Article 4(2) of the EU Regulation provides that the competent authority (the CSSF) may, upon a request by the cabinet de révision agréé and on an exceptional basis, grant an exemption from the 70% limitation to fees for non-audit services for a period not exceeding two financial years. These requests must be addressed in writing, within a reasonable period, to the department “Public oversight of the audit profession”. They must include the following information: • Details of all the audit and non-audit services that the cabinet de révision agréé provided to the audited entity (and, where applicable, to its affiliated undertakings: parent and controlled companies) during the last three financial years, with supporting documents (where available); • The fees received by the cabinet de révision agréé for the statutory and consolidated audit of the last three consecutive financial years of the audited entity (and, where applicable, of its affiliated undertakings: parent and controlled companies); • The fees received by the cabinet de révision agréé during the last consecutive financial years for non-audit services provided to the entity. These exemption requests must also specify: • The duration of the requested exemption (one year or two consecutive years) and its justification; • An estimation of the fees for non-audit services to be provided during the period for which the exemption is requested (in euros and as a percentage of the average of the audit fees of the last three financial years) and the reason for which they would exceed the 70% limitation; • Whether the exemption request results from a one-time or recurrent service provision; • The level of urgency, as well as the reasons for which this request is necessary and exceptional, including the incidence on the audited entity if the cabinet de révision agréé could not carry out the requested work;

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 11/29 • The envisaged alternatives to the exemption request; • The measures taken by the cabinet de révision agréé to ensure that the non-audit service provisions, beyond those that gave rise to the exemption request, will be limited as far as possible; • The safeguards applied by the cabinet de révision agréé to mitigate any threats to its independence as regards its audit engagement if the exemption was granted. The CSSF analyses the information provided and may request additional information if so needed. The decision regarding the exemption request will be communicated to the cabinet de révision agréé within one month as from the reception of the request. If the CSSF grants an exemption, it will be of a minimum duration it sees fit given the circumstances. The requesting entities may file an appeal against the decision of the CSSF not to grant an extension within 15 days following notification of the decision. 2. Access to the audit profession There are three types of candidates for the audit profession in Luxembourg: • the candidates exercising a professional activity in Luxembourg as referred to in point (1) of Article 1 of the GDR access to the profession (cf. points 2.1. to 2.5. below); • the candidates who are approved as statutory auditors or who satisfy the requirement of approval in other Member States as referred to in point (2) of Article 1 of the GDR access to the profession (cf. point 2.6. below); • the candidates who are holders of an approval considered as equivalent in third countries ensuring reciprocity in Luxembourg as referred to in point (3) of Article 1 of the GDR access to the profession (cf. point 2.6. below); 2.1. Admission to and conduct of professional training The practical details regarding the admission to training and the training itself are available on the CSSF website: https://www.cssf.lu/en/access-audit-profession/. The CSSF provides a personal identification number, which is unique and permanent, to every candidate. The practical details regarding the update of administrative data of the candidates are provided on the CSSF website: https://www.cssf.lu/en/public-register-data-update-annual-declarations￾monitoring-of-continuing-education/.

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 12/29 2.2. Consultative commission The CSSF set up, by way of the RCSSF consultative commission, a consultative commission for the access to the audit profession, whose purpose is, among others, to verify the theoretical and professional qualification of the candidates to access the audit profession in Luxembourg, of the providers that are nationals from other Member States wishing to provide these services by way of free provision of services, as well as of providers wishing to freely provide services in Luxembourg (Article 8 of the Law). The consultative commission gives its opinion about the creation of a list of Masters or diplomas corresponding to an equivalent qualification, as set forth in point (1) of Article 1 of the GDR access to the profession, complying fully or partially with the conditions required under Article 2(1) and (2). The list of Masters or diplomas corresponding to an equivalent qualification will be regularly reviewed by the consultative commission and updated whenever required. The consultative commission gives its opinion about the creation and update of a list of the approvals meeting the conditions required under point (3) of Article 1 of the GDR access to the profession. The CSSF publishes the aforementioned lists by means of a CSSF regulation and on its website (RCSSF list of diplomas and approvals). Subsequently, these lists are submitted to the consultative commission, on a yearly basis, for suggestions on amendments and/or complements. 2.3. Complementary training certificate The candidates to the access to the profession must present a complementary training certificate on the legislation applicable in Luxembourg in various subjects. However, a difference is made between the candidates referred to in point (1) of Article 1 of the GDR access to the profession and the candidates referred to in points (2) and (3) of Article 1.  The candidates that fulfil the criteria of point (1) of Article 1 of the GDR access to the profession (including the candidates that benefitted from the derogation referred to in letter (b) of Article 9(3) of the Law (seven years)) shall sit all the exams in the seven fields defined1 in the said GDR to obtain the complementary training certificate.  The candidates meeting the requirements of points (2) and (3) shall only sit tests in three fields defined2 in the GDR access to the profession in order to obtain the complementary training certificate. The University of Luxembourg organises preparation courses to these exams, based on an agreement between the State, the CSSF and the Université du Luxembourg. 1 GDR access to the profession, letter (b) of point (1) of Article 1 2 GDR access to the profession, letter (b) of point (2) and letter (b) of point (3) of Article 1

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 13/29 For further information on these courses, please refer to the following website: http://wwwen.uni.lu/formations/fdef/formation_complementaire_des_candidats_reviseurs_d_entr eprises_et_experts_comptables. The CSSF authorises the registrations for the exams based on the lists of candidates registered at the Université du Luxembourg by ensuring that the candidates are indeed registered at the CSSF and that they demonstrate an attendance rate of at least 66.67% in the courses of the exam concerned. 2.4. Examination of professional competence The GDR access to the profession of 2018 modified the arrangements for the examination of professional competence that had been in force until then. Henceforth, this examination will be held in one session between 1 September and 30 November each year. It will be in modular form with a written and an oral test which are independent from each other and which can be taken during the same session or in two different sessions. The candidate must obtain at least 40% of the marks to validate a test. S/he may retain the benefit of this passing of the exam for six years or decide to re-take it, in which case s/he loses the benefit of the previous mark received. The number of attempts for each test is limited to four. After four failures to the same test, the candidate is definitely excluded from the examination. In order to pass the examination, the candidate must have obtained at least 40% of the marks in each test and 50% of the marks combined. It must be noted that the candidates that had already taken and failed the examination in its former version may take it again in its new form. Their previous results will not be taken into account. The practical arrangements relating to the examination of professional competence (opening and closing dates of the ordinary session, registration deadline, dispatch of documents, attachments to the registration applications and processing of registration applications) are published on the CSSF website every year in June. Registration to each session of the examination is authorised upon decision of the CSSF after the candidate has submitted a written registration request to the CSSF and signed according to the procedure provided on the CSSF website. 2.5. Access to the profession in Luxembourg for auditors of other Member States and third countries (outside the EU) The persons referred to in points (2) and (3) of the GDR access to the profession can submit an application to the CSSF in order to obtain the title réviseur d'entreprises (statutory auditor). The practical details are available on the CSSF website under https://www.cssf.lu/en/access-audit￾profession/#exemptions.

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 14/29 3. Procedure to obtain the title Réviseur d'entreprises or Cabinet de révision and approval procedure 3.1. Procedure to obtain the title (Article 3 of the Law) Upon written application, the CSSF grants the title Réviseur d'entreprises to:  candidates who have passed the examination of professional competence;  candidates referred to in points (2) and (3) of Article 1 of the GDR access to the profession who have been authorised by the CSSF and who have completed the complementary training certificate. Likewise, the CSSF grants the title Cabinet de révision, upon written request, to the legal persons that fulfil the conditions laid down by the Law. The practical details to obtain the title Réviseur d'entreprises or Cabinet de révision are available on the CSSF website: https://www.cssf.lu/en/business-authorisation-audit-profession/#procedure￾to-obtain-the-title. The personal ID number allocated by the CSSF is a unique and permanent number. 3.2. Approval procedure (Article 5 of the Law) In order to be able to carry out the statutory audit activities, the réviseurs d'entreprises and cabinets de révision must submit a request for approval by the CSSF. The approval procedure is explained on the CSSF website: https://www.cssf.lu/en/business￾authorisation-audit-profession/#cssf-approval-as-reviseur-dentreprises-agree-and-cabinet-de￾revision-agree. The written application must indicate the personal ID number allocated by the CSSF. Applications which do not include this number will not be processed. 3.3. Update of administrative data Réviseurs d'entreprises and cabinets de révision are required to inform the CSSF of any change to their administrative data within eight business days. Moreover, every year in January, the CSSF requests all cabinets de révision and réviseurs d'entreprises to confirm or to update their personal data by means of interactive forms by adding the required supporting documents. The practical details regarding the update of data are available on the CSSF website:

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 15/29 https://www.cssf.lu/en/public-register-data-update-annual-declarations-monitoring-of￾continuing-education/. Cabinets de révision agréés and réviseurs d’entreprises agréés are also required to fill in the Annual Appendix which collects the statistical data concerning the population of the firm (réviseurs, réviseurs agréés, candidates), the number of missions and the annual declaration of the number of hours of continuing education. The Annual Appendix must be transmitted irrespective of the update of the data by all cabinets de révision agréés and réviseurs d'entreprises agréés via the portal Guichet.lu (two separate dispatches). The following must be appended to this Annual Appendix: the table of complaints referred to in point 1.6 and, for firms that audit public-interest entities, the list of audited public￾interest entities (the forms are available on the CSSF website). The deadline to receive all the forms and required supporting evidence is set on 31 January every year. 4. Restitution of the title or of the approval When cabinets de révision agréés return the approval, they are required to confirm in writing that they do not carry out statutory audits anymore and to amend their corporate purpose in the articles of incorporation of the firm so as to remove any reference to statutory audit. The original copy of the firm’s approval must be returned to the CSSF. Likewise, prior to the restitution of the title of cabinet de révision, the latter must modify its article of incorporation so that the corporate purpose no longer refers to the audit profession. 5. Registration of audit firms (Article 6 of the Law) and of third-country auditors and audit entities (Article 57 of the Law)

1. The practical arrangements for the registration and update of administrative data of audit firms (cf. point 1.3 above) are identical to those of “cabinets de révision agréés” and are described in detail on the CSSF website: https://www.cssf.lu/en/business-authorisation-audit￾profession/#recognition-of-audit-firms-approved-in-another-member-state.
2. Entities - natural or legal persons - approved in a third country, outside the European Union, which provide an audit report concerning the accounts of companies whose transferable securities are admitted to trading on a regulated market in Luxembourg must register with the CSSF and are subject to the CSSF’s systems of public oversight, quality assurance, investigations and sanctions for these missions. An exemption from certain requirements may however be granted, subject to reciprocity, provided that the entity carrying out the audit is subject to “equivalent” systems of public oversight, quality assurance, investigations and sanctions in the third country where it has its registered office.

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 16/29 The assessment process of this equivalence is carried out by the European Commission, in close cooperation with the Member States. At the end of this process, the European Commission decides either on the equivalence or absence of equivalence. The practical arrangements for the registration of third-country auditors and audit entities are described in detail on the CSSF website: https://www.cssf.lu/en/registration-third-country￾audit-entities-cooperation-agreements/. The practical details regarding the update of administrative data of the candidates are also available on the CSSF website: https://www.cssf.lu/en/public-register-data-update-annual￾declarations-monitoring-of-continuing-education/#annual-declarations. 6. Public register Réviseurs d'entreprises agréés and cabinets de révision agréés, third-country auditors and audit entities are registered in a public register maintained by the CSSF. Each of them is identified by its personal ID number allocated by the CSSF. The information required in accordance with the Law is stored in electronic form and available electronically to the public through a link on the CSSF website: https://www.cssf.lu/en/public￾register-data-update-annual-declarations-monitoring-of-continuing-education/#public-register. It must be borne in mind that all the entities registered in the public register must notify to the CSSF any change regarding their data in the public register within eight business days as from the change. 7. Continuing education of réviseurs d'entreprises and réviseurs d'entreprises agréés (Article 10 of the Law) Pursuant to the Law and the RCSSF continuing education, réviseurs d'entreprises and réviseurs d'entreprises agréés must participate in appropriate programmes of continuing education in order to maintain their theoretical knowledge, their professional skills and their values at a sufficiently high level. The CSSF is responsible for monitoring the continuing education activities of the réviseurs d'entreprises agréés3 :

• within the context of the annual update of the administrative data. The réviseurs d'entreprises agréés are thus required to indicate in the Annual Appendix, every year in January, the hourly volume of training attended during the previous calendar year.
• at the end of the three-year reference period either in the context of the quality assurance reviews or through a specific verification. 3 The IRE is responsible for monitoring the continuing education activities of the réviseurs d'entreprises.

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 17/29 When monitoring the continuing education, the following principles are applied:  In general and for the purposes of simplifying the administrative procedures, where the title réviseur/approval is granted during the first half of the calendar year, the training requirement starts on 1 January of this calendar year. However, where the title/approval is granted during the second half, the training requirement starts on 1 January of the following calendar year. As the reference periods are fixed, (the current period runs from 1 January 2019 to 31 December 2021), an annual prorata temporis must be applied: thus, for example, a réviseur having received his/her title between July 2019 and June 2020 will have a minimum training requirement of 80 hours (120 x 2 / 3) and a réviseur having received his/her title between July 2020 and June 2021 will have a minimum training requirement of 40 hours.  For part-time réviseurs d'entreprises, the regulation must be complied with without applying a prorata.  Where the réviseur d'entreprises agréé benefits from a leave provided for in the Labour Code, and the duration of this leave is shorter than the calendar year, s/he may be offered a six-month period upon request to get back into his/her programme of continuing education. In such a case, s/he must justify to the CSSF the duration of his/her leave provided for in the Labour Code and the six-month period will be notified to him/her by post. Where the réviseur d'entreprises agréé benefits from a leave provided for in the Labour Code and the duration of this leave is longer than a calendar year, the three-year reference period is interrupted; s/he must contact the CSSF at the return from leave in order to determine the period granted to get back into the programme. 8. Auditing standards and other standards (Article 36(3), letters (d) and (e)) The CSSF assumes responsibility for:  the adoption of auditing standards in the field of statutory audit for matters not covered by the auditing standards as adopted by the European Commission;  the adoption of standards on professional ethics and internal quality control by the cabinets de révision agréés; Pending the adoption by the European Commission of the international standards on auditing through an EU regulation4 , and in order to ensure the continuity of the standard framework applicable to the statutory audit activity in Luxembourg, the CSSF has adopted, by means of the RCSSF standards, the sections “Introduction”, “Objective”, “Definitions” and “Requirements” of the International Standards on Auditing as established by the International Auditing and Assurance Standards Board (IAASB) in their clarified version and published in the Handbook of International Quality Control, Auditing, Review, Other Assurance, and Related Services Pronouncements - 2022 Edition of the International Federation of Accountants (IFAC). 4 EU regulations are directly applicable in national law. No transposition is required.

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 18/29 These standards have been supplemented by the provisions introduced by the directive and the EU regulation and by the provisions applicable to entities subject to the provisions of Commission Delegated Regulation (EU) 2019/815 on the European Single Electronic Format (ESEF) in order to have a standard framework comprising all the applicable rules in Luxembourg. In this same perspective, the CSSF has adopted through the RCSSF standards:  the international standard on quality control or the international standards on quality management, respectively, as established by the International Auditing and Assurance Standards Board (IAASB) in its versions published in the Handbook of International Quality Control, Auditing, Review, Other Assurance, and Related Services Pronouncements - 2022 Edition by the International Federation of Accountants (IFAC), as well as the Luxembourg annex to this standard relating to the retention of working papers of réviseurs d’entreprises agréés and;  the Code of Ethics for the audit profession which corresponds to the Code of Ethics issued by the International Ethics Standards Board for Accountants (IESBA) in its version published in the Handbook of the International Code of Ethics for Professional Accountants – 2023 Edition by the International Federation of Accountants (IFAC). In the same way as the international standards on auditing, these standards have been supplemented by the provisions introduced by the directive and the EU regulation in order to have a standard framework comprising all the applicable rules in Luxembourg. Concomitantly with the RCSSF standards, the CSSF has adopted:  the parts “Application and Other Explanatory Material” of the international standards on auditing referred to in Chapter 1 of the RCSSF standards and of the international standard on quality control or the international standards on quality management, respectively, referred to in Chapter 2 of said regulation which provide supplementary specifications and/or explanations to these standards;  the “Appendices” to the international standards on auditing referred to in Chapter 1 of the RCSSF standards which provide examples and illustrations essential for the compliance with these standards. These “Application and Other Explanatory Material” and “Appendices” have also been supplemented by the provisions introduced by the directive and the EU regulation. These supplements are presented in Annex 1 to this circular. Annex 2 presents supplementary information regarding the Luxembourg standard on the auditors’ involvement on financial statements in ESEF (European Single Electronic Format) Consequently, réviseurs d’entreprises agréés and cabinets de révision agréés have the duty to take into consideration these implementing procedures and other explanatory information as well as the annexes for the audit engagements.

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 19/29 9. Quality assurance reviews (Article 39 of the Law) Among the missions which are conferred on the CSSF, the Law provides that it is in charge of implementing a quality assurance system. This quality assurance system applies to all réviseurs d’entreprises agréés and cabinets de révision agréés for the audit engagements performed in Luxembourg. The quality assurance review includes an assessment of the firm’s internal quality control system and an adequate testing of selected audit files. It comprises:  an assessment of compliance of the audit files with applicable international standards on auditing;  an assessment of compliance with the principles of professional ethics and independence;  an assessment of the quantity and quality of the resources spent as well as of the audit fees charged in the context of duties. In addition, the CSSF periodically performs thematic inspections focussing on specific audit aspects through the revision of a selection of files from a sample of cabinets de révision agréés. The quality assurance review takes place at least every six years. The quality assurance review of réviseurs d'entreprises agréés and cabinets de révision agréés which audit public-interest entities is carried out at least every three years. The CSSF follows a “global” approach of control which considers the audit firm as the entry point for the periodical quality assurance review. The global control of the audit firm consists in:  appraising the existence within the audit firm, of an organisation, of policies and procedures aimed to ensure the quality of the audit engagements and the fact that it is designed and operating effectively, and the independence of the réviseur d'entreprises agréé/cabinet de révision agréé in accordance with Articles 18 to 30 of the Law and with the International Standard on Quality Control ISQC 1 (including the Luxembourg supplements);  verifying, based on a sample of audit files, the proper execution of certain duties by the audit partners (réviseurs d'entreprises agréés) to ensure, on the basis of this selection, the existence and efficiency of the procedures and internal quality control system;  assessing the content of the transparency report for cabinets de révision agréés that are required to draw up such a report; and  assessing, where applicable, the actions implemented by the réviseur d’entreprises agréé/cabinet de révision agréé in order to address deficiencies noted during the previous reviews.

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 20/29 Quality assurance reviews are made according to a common inspection methodology at European level and are proportionate in view of the scale and complexity of the activity of the reviewed réviseur d'entreprises agréé or cabinet de révision agréé. Pursuant to Articles 37 and 39(3) of the Law, the CSSF may require any information useful to fulfil its missions and has the right to access any document in any form whatsoever and receive a copy thereof. In order to facilitate the process of the quality assurance review, the CSSF agents must have unrestricted access to the data necessary to accomplish their mission. In addition, the audit firm shall appoint a contact person as intermediary between the CSSF agents and the audit firm. The duties of this contact person include centralising all the CSSF's requests, gathering the CSSF's observations and ensuring they are being followed up within the deadlines. The contradictory process regarding the CSSF's observations will be in writing and will take place via the contact person appointed by the audit firm. After the quality assurance review, the CSSF issues a report which includes in particular:

• the preventive measures (Article 42) imposed on réviseurs d'entreprises agréés acting as signing partners for the audit files which present significant deficiencies in relation to the legal and regulatory framework in force in Luxembourg; these measures may be training plans, an engagement quality control review by another partner before issuing the opinion, a specific follow-up or joint signature of all audit reports by another réviseur d'entreprises agréé who participated in carrying out the engagement accompanied by a specific follow-up;
• a summary for the firm which includes the main deficiencies relating to its internal organisation for which the CSSF requires that corrective measures be taken.
• the action plan drawn up by the cabinet de révision agréé with a view to implementing the actions addressing the identified deficiencies and allowing improving the quality of the audits. The CSSF periodically monitors that the firms and/or réviseurs concerned have taken appropriate corrective measures to address the deficiencies previously noted. Where the deficiencies are not considered as being material, the corrective measures taken by the audit firms will be followed up during the next periodic quality assurance review scheduled within the legal deadlines. In case of material deficiencies, a specific follow-up will be programmed within 12 months from the date of issue of the report.

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 21/29 A specific follow-up may be programmed for the cabinet de révision agréé and/or for a réviseur d'entreprises agréé of the cabinet de révision agréé. Yours faithfully,

COMMISSION de SURVEILLANCE du SECTEUR FINANCIER Marco ZWICK Jean-Pierre FABER Françoise KAUTHEN Claude MARX Director General ANNEXE 1 : Compléments luxembourgeois aux parties « Application and Other Explanatory Material » et « Appendix » des normes d’audit dans le domaine du contrôle légal des comptes en vertu de l’article 33, paragraphe 2, de la loi du 23 juillet 2016 relative à la profession de l’audit.

1. LUXEMBOURG SUPPLEMENT TO INTERNATIONAL STANDARD ON AUDITING 220 (REVISED) QUALITY CONTROL FOR AN AUDIT OF FINANCIAL STATEMENTS Application and Other Explanatory Material Documentation A120-1. In documenting the significant threats to the firm’s independence and any mitigating safeguards, the auditor refers to the documentation required by ISQM15 .
2. LUXEMBOURG SUPPLEMENT TO INTERNATIONAL STANDARD ON AUDITING 240 THE AUDITOR’S RESPONSIBILITIES RELATING TO FRAUD IN AN AUDIT OF FINANCIAL STATEMENTS Application and Other Explanatory Material Communications to Management and with Those Charged With Governance Communications with Those Charged With Governance 5 ISQM1. Paragraph 58D-1 (b) (ii)

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 22/29 A63-1. For statutory audits of financial statements of public-interest entities, ISA 260 (Revised)6 requires the auditor to communicate in the additional report to the audit committee any significant matters involving actual or suspected non-compliance with laws and regulations, including from fraud or suspected fraud, which were identified in the course of the audit. [AR/Article 11.2(k)] Communications to Authorities of Public-Interest Entities (Ref: Para. 43R-1) A65-1. The disclosure in good faith to the authorities responsible for investigating such irregularities, by the auditor, of any irregularities referred to in paragraph 43R-1 shall not constitute a breach of any contractual or legal restriction on disclosure of information in accordance with the Audit Regulation. [AR/Article 7] 3. LUXEMBOURG SUPPLEMENT TO INTERNATIONAL STANDARD ON AUDITING 250 (REVISED) CONSIDERATION OF LAWS AND REGULATIONS IN AN AUDIT OF FINANCIAL STATEMENTS Application and Other Explanatory Material Communicating and reporting Identified or Suspected Non-Compliance Communicating Identified or Suspected Non-Compliance with Those Charged with Governance A25-1. For statutory audits of financial statements of public-interest entities, ISA 260 (Revised)2 requires the auditor to communicate in the additional report to the audit committee any significant matters involving actual or suspected non-compliance with laws and regulations or article of association, including from fraud or suspected fraud, which were identified in the course of the audit. [AR/Article 11.2.(k)] Reporting of Identified or Suspected Non-Compliance to an Appropriate Authority outside the entity A33-1. The disclosure in good faith to the authorities responsible for investigating such irregularities, by the auditor, of any irregularities referred to in paragraph 29R-2 shall not constitute a breach of any contractual or legal restriction on disclosure of information in accordance with the Audit Regulation. [AR/Article 7] 4. LUXEMBOURG SUPPLEMENT TO INTERNATIONAL STANDARD ON AUDITING 330 THE AUDITOR’S RESPONSES TO ASSESSED RISKS Application and Other Explanatory Material Valuation Methods (Ref: Para. 19R-1) 6 ISA 260 (Revised), “Communication with Those Charged with Governance”, paragraph 16R-1(k).

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 23/29 A51-1. For audits of financial statements of public interest entities, the Luxembourg supplement to ISA 260 (Revised)7 requires the auditor to communicate in the additional report to the audit committee the auditor’s assessment of the valuation methods applied to the various items in the annual or consolidated financial statements including any impact of changes of such methods. 5. LUXEMBOURG SUPPLEMENT TO INTERNATIONAL STANDARD ON AUDITING 600 SPECIAL CONSIDERATIONS—AUDITS OF GROUP FINANCIAL STATEMENTS (INCLUDING THE WORK OF COMPONENT AUDITORS) (effective for audits of financial statements for periods beginning before December 15, 2023) Appendix Appendix 5 Required and Additional Matters Included in the Group Engagement Team’s Letter of Instruction Matters required by this ISA to be communicated to the component auditor are shown in italicized text. Matters that are relevant to the planning of the work of the component auditor: • The ethical requirements that are relevant to the group audit and, in particular, the independence requirements, for example, where the group auditor is prohibited by law or regulation from using internal auditors to provide direct assistance, it is relevant for the group auditor to consider whether the prohibition also extends to component auditors and, if so, to address this in the communication to the component auditors.8 [...] 6. LUXEMBOURG SUPPLEMENT TO INTERNATIONAL STANDARD ON AUDITING 610 (REVISED 2013) – USING THE WORK OF INTERNAL AUDITORS (effective for audits of financial statements for periods beginning on or after December 15, 2023) Application and Other Explanatory Material 7 ISA 260 (Revised), Communication with Those Charged With Governance, paragraph 16R-1(l). 8 ISA 610 (Revised June 2013), Using the Work of Internal Auditors, paragraph A31. The use of internal auditors to provide direct assistance is prohibited in a statutory audit of financial statements conducted in accordance with ISAs. For a group audit this prohibition extends to the work of any component auditor which is relied upon by the group auditor, including for overseas components – see the Luxembourg supplement to ISA 610 (Revised June 2013), paragraph 5-1.

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 24/29 Determining Whether, in Which Areas and to What Extent Internal Auditors Can Be Used to Provide Direct Assistance Determining Whether Internal Auditors Can Be Used to Provide Direct Assistance for Purposes of the Audit (Ref: Para. 5, 26–28) A31. In jurisdictions where the external auditor is prohibited by law or regulation from using internal auditors to provide direct assistance, it is relevant in the circumstances of a group audit, for the group auditor to consider whether the prohibition also extends to component auditors and, if so, to address this in the communication to the component auditors.9 7. LUXEMBOURG SUPPLEMENT TO INTERNATIONAL STANDARD ON AUDITING 620 USING THE WORK OF AN AUDITOR’S EXPERT Appendix (Ref: Para. A25) Considerations for Agreement between the Auditor and an Auditor’s External Expert […] • The auditor’s external expert’s consent to the auditor’s intended use of that expert’s report, including any reference to it, or disclosure of it, to others, for example reference to it in the basis for a modified opinion in the auditor’s report, if necessary, or disclosure of it to management or an audit committee10. 8. LUXEMBOURG SUPPLEMENT TO INTERNATIONAL STANDARD ON AUDITING 700 (REVISED) FORMING AN OPINION AND REPORTING ON FINANCIAL STATEMENTS Application and Other Explanatory Material Auditor’s Responsibilities for the Audit of the Financial Statements (Ref: Para. 37-40) 6 ISA 610 (Revised June 2013), Using the Work of Internal Auditors, paragraph A31. The use of internal auditors to provide direct assistance is prohibited in a statutory audit of financial statements conducted in accordance with ISAs. For a group audit this prohibition extends to the work of any component auditor which is relied upon by the group auditor, including for overseas components – see the Luxembourg supplement to ISA 610 (Revised June 2013), paragraph 5-1. 10 Auditors of public-interest entities are required by paragraph 16R-1(c) of the supplement to ISA 260 (Revised) to communicate matters relating to the use of the work of the auditor’s external expert in the additional report to the audit committee.

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 25/29 A52-1. ISA 700 paragraph 40R-1 requires the auditor to provide a declaration in their audit report that they have not breached non-audit services requirements. Where those requirements have been breached, but where the auditor believes that an ‘objective, reasonable and informed third party’ would not conclude that the auditor’s independence had been compromised (perhaps because the breach was minor in nature), then the auditor should issue the auditor’s report, disclosing within it: (i) the nature of the breach; (ii) confirming the auditor’s assessment that their independence had not been compromised; and (iii) stating what had been done to address any risks arising impacting on the independence of the auditor. Before the auditor’s report is signed, this should be discussed and agreed with the audit committee of the entity concerned. Auditor’s Report Prescribed by Law or Regulation (Ref: Para. 50) A65-1. Auditor’s reports prepared in compliance with the requirements of this Luxembourg supplement to ISA 700 (Revised) shall comply with ISA 700 (Revised) “Forming an Opinion and Reporting on Financial Statements” issued by the IAASB, including the minimum elements of an auditor’s report required by paragraph 50(a)-(o) of ISA 700 (Revised). Therefore, it does not preclude the auditor from being able to assert compliance with International Standards on Auditing issued by the IAASB. Auditor’s Report for Audits Conducted in Accordance with Both Auditing Standards of a Specific Jurisdiction and International Standards on Auditing (Ref: Para. 51) A72-1. The requirements of the Luxembourg supplement to ISAs do not conflict with the requirements in ISAs. An audit conducted in accordance with ISAs and their Luxembourg supplements does not therefore preclude the auditor from being able to assert compliance with International Standards on Auditing issued by the IAASB. 9. LUXEMBOURG SUPPLEMENT TO INTERNATIONAL STANDARD ON AUDITING 701 COMMUNICATING KEY AUDIT MATTERS IN THE INDEPENDENT AUDITOR’S REPORT Application and Other Explanatory Material Definitions Key Audit Matters A8-1. In Luxembourg, those matters of the current period that were of most significance in the statutory audits of the financial statements of public-interest entities include the most significant assessed risks of material misstatement (whether or not due to fraud) identified by the auditor. [AR/Article 10.2(c)] Communicating Key Audit Matters

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 26/29 Communicating Key Audit Matters for Group and Parent Company Financial Statements (Ref: Para 13.) A33-1. An auditor’s report for a group may include the auditor’s report with respect to both the group and the parent company financial statements. This is typically the case where both sets of financial statements are presented in accordance with IFRSs as adopted in the EU. However, where the financial statements of the group and the parent company are presented in accordance with different financial reporting frameworks, the financial statements might be presented separately within the Annual Report and in such circumstances separate auditor’s reports in respect of the group and the parent company financial statements might be provided within the Annual Report. A33-2. Most of the key audit matters communicated in the audit of the parent company would likely also be key audit matters relating to risks of material misstatement in the audit of the group financial statements, subject to any differences in quantitative materiality considerations that may apply in those audits. However, there may be key audit matters that only arise in relation to the audit of the parent company financial statements (such as risks relating to investments in subsidiaries that could, for example, have implications for distributable reserves). A33-3. An understanding of such key audit matters may be of interest to readers of auditor’s reports. Readers may find such key audit matters to be of particular interest when their implications are relevant in the context of the parent company’s reported distributable reserves. However, readers of the auditor’s report(s) on the group and parent company financial statements will be assisted by avoiding unnecessary duplication or disaggregation of key audit matters arising from these audits in such report(s). Application where there is a single auditor’s report A33-4. Where the auditor’s reports on both the group and parent company financial statements are combined within a single report, it may be appropriate for any relevant key audit matters and other information required by ISA 701 that are unique to the parent company audit to be separately identified but integrated within the disclosures in that report of corresponding matters arising from the audit of the group financial statements. Application where the auditor reports separately on the group and parent company financial statements A33-5. Where the auditor provides separate auditor’s reports on the group and parent company financial statements, it may also be appropriate for any relevant key audit matters and other information required by ISA 701 that are unique to the parent company audit to be separately identified but integrated within the disclosures within the group auditor’s report of corresponding matters arising from the group audit. Except where such matters are required by law or regulation to be included in the auditor’s report, the parent company

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 27/29 auditor’s report, the auditor could make reference in the other matter paragraph that refers to the separate auditor’s report on the group financial statements to the fact that the key audit matters that relate to the parent company audit have been included in the group auditor’s report, rather than repeating the information. 10. LUXEMBOURG SUPPLEMENT TO INTERNATIONAL STANDARD ON AUDITING 720 (REVISED) THE AUDITOR’S RESPONSIBILITIES RELATING TO OTHER INFORMATION Application and Other Explanatory Material Reading and Considering the Other Information Identifying whether the other information has been prepared in accordance with the applicable reporting framework (Ref: Para. 14D-1) A36-1. As explained in paragraph 12(b), a misstatement of the other information also exists when the other information has not been prepared in accordance with the applicable legal and regulatory requirements. A36-2. In considering whether the other information has been prepared in accordance with the applicable legal and regulatory requirements, the auditor identifies whether information that is required by law or regulation to be included in the other information has been omitted. This includes situations where the required information is presented separately from the other information without appropriate cross reference. A36-3. If the auditor concludes that the other information has not been prepared in accordance with the applicable legal and regulatory requirements, the auditor determines whether non￾compliance with the applicable legal or regulatory requirement has a material effect on the financial statements.11 A36-4. For statutory audits of financial statements of public-interest entities, the auditor considers whether to communicate any non-compliance with the applicable legal and regulatory requirement in the additional report to the audit committee.12 11 ISA250 (Revised), “Consideration of Laws and Regulations in an Audit of Financial Statements.” 12 ISA 260 (Revised), “Communication with Those Charged with Governance”, paragraph 16R-1(k).

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 28/29 ANNEXE 2: Additional information regarding the Luxembourg guidelines on the auditors’ involvement on financial statements in European Single Electronic Format (ESEF)

1. “Relevant statutory requirements” The relevant statutory requirements are set out in the Question 2.2 of the Commission Interpretative Communication on the preparation, audit and publication of the financial statements included in the annual financial reports drawn up in accordance with Commission Delegated Regulation (EU) 2019/815 on the European Single Electronic Format (ESEF) (Communication 2020/C379/01). In order to provide an audit opinion on whether the financial statements comply with the ‘relevant statutory requirements’ laid down therein, statutory auditors shall check the compliance of the issuers’ financial statements with the provisions of the ESEF Delegated Regulation that are applicable to the financial statements. The ‘relevant statutory requirements’ are the following: i) All the financial statements that are included in the annual financial report shall be prepared in a valid XHTML format; ii) For all consolidated financial statements that are drawn up in accordance with IFRS as endorsed by the EU or with IFRS as adopted by the IASB;13

• The disclosures specified in Annex II of the ESEF Delegated Regulation shall be marked-up, where those disclosures are present in those consolidated financial statements;
• All mark-ups, including the voluntary mark-ups of disclosures other than those specified in Annex II of the ESEF Delegated Regulation, shall meet the following requirements: o the XBRL mark-up language shall be used; o the elements of the core taxonomy specified in Annex VI of the ESEF Delegated Regulation with the closest accounting meaning shall be used, unless an extension taxonomy element is created in compliance with Annex IV of the ESEF Delegated Regulation; o the mark-ups shall comply with the common rules on mark-ups.14 iii) For financial statements other than the IFRS consolidated financial statements.15
• All mark-ups included by the issuer on a voluntary basis or in compliance with national law shall meet the following requirements: o the XBRL mark-up language shall be used; o a specific taxonomy provided by the Member State in which the issuer is incorporated shall be used; 13 See Article 4 of the ESEF Delegated Regulation 14 See Article 6 of the ESEF Delegated Regulation 15 See Article 5 of the ESEF Delegated Regulation. These rules apply to issuers incorporated in EU Member States

Circular CSSF 19/717 as amended by Circular CSSF 22/794 page 29/29 o the mark-ups shall comply with the common rules on mark-ups.16 2. Risks attached to the marked-up information Risks attached to the marked-up information may encompass, for example, the following areas: Completeness

• Not all figures disclosed in the primary financial statements17 of the IFRS consolidated financial statements are marked-up;
• Not all the disclosures in the IFRS consolidated financial statements, are marked-up as specified in Annex II of the ESEF Delegated Regulation;
• Required mark-ups relating to the identification of the entity are omitted. Accuracy
• The marked-up information does not correspond with the human-readable layer of the financial statements;
• Numbers disclosed in the primary statements of the IFRS consolidated financial statements have been marked-up with an inaccurate context (e.g., year or year-end, currency; debit/credit; scaling (i.e., millions/thousands);
• Inappropriate elements from the core taxonomy have been selected;
• A misrepresentation of the accounting meaning of the number or disclosure being marked￾up arising from selecting an inappropriate element from the core taxonomy;
• An extension taxonomy element created to mark-up a number in the primary statements is not anchored to the core taxonomy element having the closest wider accounting meaning and/or scope to that extension taxonomy element of the issuer;
• Where an extension taxonomy element combines a number of core taxonomy elements, the issuer has not anchored that extension taxonomy element to each of those core taxonomy elements. 16 See Article 6 of the ESEF Delegated Regulation 17 Primary (financial) statements encompass the statement of financial position, the statement of profit or loss and other comprehensive income, the statement of changes in equity and the statement of cash flows.