Circular Letter CVM/SNC/GNA 01/2020

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Seven of September Street, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP Code: 20050-901 – Brazil - Tel.: (21) 3554-8686 CIRCULAR LETTER No. 01/2020 CVM/SNC/GNA Rio de Janeiro, April 9, 2020.
Subject: Clarifications related to the performance of the independent accounting auditor within the securities market

Dear Independent Auditor,

As a direct result of the supervision and inspection actions regarding the auditing activity within the securities market, we list below some points related to registration with the CVM, performance in the securities market, and the application of independent accounting auditing professional standards in the execution of work, for which we request special attention from the independent auditor registered with this Commission.

1. Periodic Information (Art. 16 – CVM Instruction No. 308/99)

Independent auditors must send information related to their performance in the securities market to the CVM by the last business day of April each year, according to Annex VI to CVM Instruction No. 308/99. This information is important for the CVM to assess the auditors' capacity to adequately serve their clients. However, this year, due to the Coronavirus pandemic, this deadline is suspended for 03 (three) months, as per the terms of CVM Deliberation No. 848, of March 25, 2020.

Such information must be sent via the internet, on the CVM website. The submission must be made through the option “CENTRAL DE SISTEMAS” (Systems Central), selecting next the option “SISTEMA CVMWEB” (CVMWEB SYSTEM) and then the option “ENVIO DE DOCUMENTOS” (DOCUMENT SUBMISSION).

We inform you that a change has been implemented in the procedure for presenting such information. Now, when accessing the CVMWEB system to present the Annual Periodic Information provided for in Art. 16 of CVM Instruction No. 308/99, the auditor will be automatically directed to verify their registration data. After validation of the registration data, or their update, the auditor must, mandatorily, issue the Electronic Conformity Declaration. Only after this procedure will the independent auditor be redirected to the presentation of the Annual Periodic Information.

At this stage, there are two options for submitting information: i) Submission of documents via form and ii) Upload of documents. Finally, the option “Informe Anual de Auditor Independente” (Annual Independent Auditor Report) must be selected. The “upload of documents” option should be used only by those auditors who have more than 10 (ten) clients that are public companies (or part of the securities market or incentivized companies), as in this case, it is necessary to create a file (XML standard) to forward the required information.

The late presentation of this information subjects the auditors to a penalty fine, as provided in Art. 18 of CVM Instruction No. 308/99.

We also alert that Annex VI to CVM Instruction No. 308/99 was amended by CVM Instruction No. 591/17, with the elimination of item 8 (Continuing Education). Thus, whether via form submission or document upload, there is no longer a need to inform about courses and training completed in the reference year of the report.

Additionally, we remind you that failure to observe the deadline for sending the information treated in this topic results in the collection of a daily penalty fine of R$ 200.00 (two hundred reais), according to the amendment introduced by CVM Instruction No. 608/19.

2. Registration Update and Electronic Conformity Declaration (Art. 1, item II of CVM Instruction No. 510/11, with amendments from CVM Instruction No. 604/18)

Regardless of the presentation of the periodic information required by CVM Instruction No. 308/99, it is also necessary for independent auditors to keep their registration updated, observing a deadline of up to 07 (seven) business days from the event that caused the alteration. For this, independent auditors must access their registration data on the CVM website, proceeding with the appropriate update. In addition to the required update, annually and until the last business day of April (according to the new wording of item II, Art. 1 of CVM Instruction No. 510/11, amended by CVM Instruction No. 604/18), the Independent Auditor must confirm that their registration data remains valid, by issuing the Electronic Conformity Declaration, established by CVM Instruction No. 510/11. However, this year, due to the Coronavirus pandemic, this deadline is suspended for 03 (three) months, as per the terms of CVM Deliberation No. 848, of March 25, 2020.

The Electronic Conformity Declaration must be issued by accessing the option “CENTRAL DE SISTEMAS” (Systems Central), selecting next the option “SISTEMA CVMWEB” (CVMWEB SYSTEM) and then the option “ATUALIZAÇÃO CADASTRAL” (REGISTRATION UPDATE), followed by “DECLARAÇÃO ELETRÔNICA DE CONFORMIDADE” (ELECTRONIC CONFORMITY DECLARATION), on the CVM website. It is important to emphasize that, even in cases where there are no alterations in the data on the website, the Electronic Conformity Declaration must be issued.

With the aim of facilitating the presentation of the Electronic Conformity Declaration, avoiding delays or non-presentation, a new functionality has been made available on the CVM website. Now, when accessing the CVMWEB system for the transmission of the Annual Periodic Information provided for in Art. 16 of CVM Instruction No. 308/99 (item 01 above), which has the same presentation deadline, the auditor will be automatically directed to verify their registration data and updates that are necessary. After confirmation of the registration data, or their update, the auditor will be directed to the issuance of the Electronic Conformity Declaration.

After issuing the Electronic Conformity Declaration, the auditor will be redirected to the presentation of the Annual Periodic Information.

For the issuance of the Electronic Conformity Declaration, the independent auditor must be selected (click on the box located before the auditor's name), confirming the registration data, or altering them if necessary, and then activating the option “ENVIAR FORMULÁRIO” (SEND FORM). After sending the Electronic Conformity Declaration, the information will appear: Form already sent? YES.

Finally, we emphasize that the non-presentation of the Electronic Conformity Declaration, or its late presentation, subjects the participant to a daily penalty fine, provided for in Art. 5 of CVM Instruction No. 510/11.

3. Communications regarding Arts. 7 and 7-A of CVM Instruction No. 301/99.

With a view to the faithful compliance with CVM Instruction No. 301/99, particularly regarding the provisions of Articles 7 and 7-A, we reiterate that in the event that no communication referred to in the caput of said Art. 7 of the mentioned Instruction has been made to the Financial Activities Control Council – COAF, the independent auditor must communicate by the last business day of January, the non-occurrence in the previous calendar year of transactions or proposals for transactions subject to communication, as per Art. 7-A (“negative declaration”), through the SISCOAF system.

Due to an agreement signed with the Federal Council of Accounting – CFC, the negative declaration (if applicable) must be made in the CFC environment of SISCOAF. Nothing prevents the auditor registered with the CVM from spontaneously, and in a supplementary manner, also sending suspicious communications or negative declarations to the CVM segment of SISCOAF.

4. External Quality Review Program (Art. 33 – CVM Instruction No. 308/99)

We remind you that independent auditors must submit to an external quality review to be carried out by another auditor registered with the CVM, with a view to also assessing compliance with technical and professional standards, in accordance with a specific standard issued by the CFC.

Currently, NBC PA 11 regulates the matter, and it must be observed by independent auditors.

Specifically regarding the performance of the reviewing auditor, we have observed various problems in the execution of review work. Such problems are, for the most part, related to the depth of examinations performed, as well as to obtaining appropriate and sufficient audit evidence, in order to support the opinion issued at the end of the work. It is important to emphasize that, from the sample of reviewing auditors selected for inspections in compliance with the Risk-Based Supervision Program (SBR) adopted by the CVM in recent years, we identified a high recurrence of problems in the execution of review work by reviewing auditors, leading to the adoption of complementary administrative procedures by this Autarchy, including the initiation of administrative sanctioning processes (Accusation Term).

Non-compliance with the Program instituted by the CFC by the reviewed auditor also entails the application of administrative sanctions. In this sense, we remind you that §5 of Art. 33 of ICVM 308/99, included by ICVM 591/17, establishes:

“§5 Non-compliance with the provisions of the caput in at least 2 (two) of the last 5 (five) years will result in the immediate suspension of the registration of the Independent Auditor – Natural Person, or the Independent Auditor – Legal Entity, until a new review of their quality control is presented, according to the guidelines of the Federal Council of Accounting, with a report issued without reservations, duly approved by the Management Committee of the External Quality Review Program, or equivalent, instituted by the Federal Council of Accounting – CFC.”

It is important to emphasize that, from 2018, auditors who again failed to comply with the External Quality Review Program, as provided in §5 above, had their registrations suspended at the CVM. In such cases, and in those that are identified in the future, the auditor who wishes to reactivate their registration must, by their own act and without prior indication by the External Quality Review Committee – CRE, indicate their reviewing auditor to the CRE, submitting themselves to the external quality review, within the deadlines and procedures defined by the standard governing the Program. At the end of the review, its result, conclusions, and recommendations must be presented to the CRE, so that the Committee can analyze the review performed by the reviewing auditor, approving or not.

Unfortunately, we have observed movements in the direction of attempting to infringe compliance with the External Quality Review Program, notably in two ways:
a. Independent auditors indicated by the CFC to participate in the External Quality Review Program cancel their registration with the CVM. Still within that exercise, or in the following exercise, they request new registration. In this case, as defined in the norms of the CVM and CFC, the auditor must submit to the Program in the next exercise (counting from the new registration). However, we have verified that some auditors do not submit to the Program upon their return. It is the understanding of this SNC that these auditors, with this attitude, incur in the situation described in §5 of Art. 33 cited above. Thus, in cases already identified, the SNC adopted the suspension provided for in the norm. b. Some independent auditors, despite submitting to the External Quality Review Program when indicated annually by the CFC, present recurrent problems in their reviews, which makes the approval of the review by the CRE-CFC impossible, being automatically indicated for the following year. We understand that the recurrence of this practice, year after year, characterizes an attempt to circumvent compliance with the external quality review. Thus, we remind you that such auditors are subject to suspension of registration, in the mold of §5, of Art. 33 of ICVM 308/99, in addition to the adoption of other administrative measures applicable to the case.

It should be remembered that, once the suspension of registration for non-compliance with the External Quality Review Program is applied, provided for in §5 of Article 33 of ICVM 309/99, the reactivation of the independent auditor's (reviewed) registration with the CVM will only occur if the external quality review process is approved by the CRE/CFC and provided that the external quality review report does not contain any reservations (report of review of an adequate quality control system [1]). A report issued with reservations (report of review of a quality control system with deficiencies), with abstention of opinion (report of review of the quality control system with scope limitation to the reviewer's work) or adverse (report of review of an inadequate quality control system), even if they meet the requirements provided for in the standard and are approved by the CRE/CFC, will not be considered valid for the reactivation of the independent auditor's registration. It should also be noted that the submission to the External Quality Review Program for these suspended auditors will be voluntary, at the request of the auditor themselves, since only auditors active in the CVM registration and indicated by the CRE/CFC are obliged to participate in the said Program.

5. Continuing Professional Education Program (Art. 34 – CVM Instruction No. 308/99)

With the aim of maintaining a high standard of technical qualification and constant updating regarding professional standards, accounting and auditing procedures, and standards related to the exercise of their activity in the securities market, independent auditors registered with the CVM must maintain, for themselves and for their technical staff, a continuing education program in accordance with the guidelines approved by the CFC, contained in NBC PG 12 (R3).

In this regard, we remind you that non-compliance with the Continuing Professional Education Program by independent auditors – natural persons and independent auditors – legal entities, as well as their partners and/or technical managers, entails the application of administrative sanctions. On the subject, we bring §§ 1 and 2 of Art. 34 of ICVM 308/99, included by ICVM 591/17, which establish:

Ҥ 1 The provisions of the caput apply to Independent Auditors РNatural Persons and to partners, whether or not they exercise the auditing activity, technical managers, directors, supervisors, and managers of Independent Auditors РLegal Entities.

§ 2 Non-compliance with the provisions of the caput in at least 2 (two) of the last 5 (five) years will result in the immediate suspension of the registration of the Independent Auditor – Natural Person, or the registration as technical manager of Independent Auditor – Legal Entity, until a new certificate of approval in the Technical Qualification Exam, provided for in Art. 30 of this Instruction, is presented, regardless of the adoption of other administrative measures applicable.”

It is worth clarifying that, due to the joint action of this Autarchy with the Continuing Professional Education Commission – CEPC, instituted by the CFC for management and monitoring of the Program, it is not necessary to present the annual activity report related to Continuing Education to the CVM. This report must be delivered annually to the respective Regional Council of Accounting – CRC, as defined in NBC PG 12 (R3). Proof of compliance with the Continuing Professional Education Program is homologated by the CFC/CRCs system.

We emphasize that, regardless of participation in external courses and activities, independent auditors must have mechanisms for timely monitoring of changes in independent auditing professional standards issued by the CFC and, when applicable, by the Institute of Independent Auditors of Brazil - IBRACON, and standards that regulate the independent auditing activity within the securities market.

At this opportunity, we inform independent auditors who promote internal courses for points in the Continuing Professional Education Program that such courses may be subject to “in loco” inspection by the CVM. The inspection may occur without prior notice and aims to verify their effective realization, the existence of satisfactory attendance controls, the effective participation of instructors indicated when the course was homologated, and also the effective application of the curricular content approved by the CFC/CRCs system.

6. Auditor Rotation (Art. 31 – CVM Instruction No. 308/99)

We remind you that the Independent Auditor – Natural Person and the Independent Auditor – Legal Entity cannot provide services to the same client for a period longer than five consecutive years, requiring a minimum interval of three years for their re-hiring, regardless of the period in which the auditor provided services to the audited entity.

For its part, we highlight that the only permitted exception is that in which the audited company has a Statutory Audit Committee – CAE, installed and fully functioning, until the closing date of the third fiscal year counting from the hiring of the independent auditor, and remaining in functioning after said date and while using the aforementioned prerogative (amendment introduced by CVM Instruction No. 611, of August 15, 2019); and that this auditor is a legal entity, as provided for in Art. 31-A of the same Instruction, conditioning, furthermore, to the observation of the requirements contained in Arts. 31-B to 31-F, all of the same Instruction. It must be emphasized that the primary responsibility of the auditor is to meet the rotation requirement, renouncing the client when the occurrence of a situation characterizing non-compliance with the norm is verified, notwithstanding the responsibility of the audited entity's administrators for the eventual hiring and maintenance of independent auditors who do not meet the conditions provided for in the Instruction (Art. 27 – CVM Instruction No. 308/99).

We also alert that rotation cannot be carried out with another audit firm with which the replaced auditor has common interests, nor that they use the same physical and operational structure as the previous auditors. Below, we cite some examples of situations that may characterize non-observance of the auditor rotation rule, in addition to others of the same nature:
a) use of the same address (headquarters and offices, if any); b) direct kinship relationship between partners and technical managers of the audit firms (replaced and current); or c) creation of “new” audit firms for service provision, with the existence of partners and/or technical managers previously linked to the replaced auditor.

Additionally, we draw attention to the eventual re-hiring of the replaced auditor. Regardless of whether or not the period defined in the norm for the provision of consecutive audit services to the same client is reached (five years, in normal situations; up to ten years for cases where there is a CAE, functioning and in adherence to the requirements of ICVM 308/99), their re-hiring can only occur after a period of 03 (three) years. For example, if AUDITOR “A”, after 02 (two) years of providing services to the audited, was replaced by AUDITOR “B”, AUDITOR “A” can only return to provide audit services after 03 (three) years of their replacement, in any hypothesis.

7. Issuance of Detailed Report (Art. 25, item II, CVM Instruction No. 308/99)

Art. 25, item II, of ICVM 308/99, with wording given by ICVM 591/17, provides that the independent auditor must “prepare and send to the administration and the Fiscal Council, a detailed report containing their observations regarding the internal controls and accounting procedures of the audited entity, describing, furthermore, any deficiencies or inefficiencies identified during the work.”

In this sense, ratifying the provisions in the cited normative text, we clarify that the issuance of said detailed report at the end of the work is expressly mandatory in any hypothesis, regardless of whether deficiencies or inefficiencies were identified in the examined environment. That is, although the independent auditing professional standard dealing with the subject (NBC TA 265) determines the mention in the report only of significant deficiencies, if any, the detailed report required by ICVM 308/99 is more comprehensive, requiring the issuance of the report at the end of each work.

Furthermore, it is important to emphasize that said report, in consonance with the cited professional standard, must segregate significant deficiencies from non-significant ones. In those extremely rare situations where the independent auditor concludes by the non-identification of internal control deficiencies (significant or not), the report to be issued will be affirmative, that is, it must affirm the non-identification of internal control deficiencies, whether significant or not, during the execution of the work.

Such procedure enables minimal proof that the independent auditor executed the evaluation of internal controls and accounting procedures provided for in the standard issued by the CVM and by independent auditing professional standards. It is always important to remember that it is the responsibility of the audited entity's administration to ensure the adequacy of the internal controls they determined as necessary to allow the preparation of financial statements free from material misstatement, and for the auditor to consider internal control to plan audit procedures that are appropriate in the circumstances; but not for the purpose of expressing an opinion on the effectiveness of internal control.

In this context, we reinforce that the auditor must, furthermore, during the execution of audit work in subsequent years, establish specific monitoring of those deficiencies pointed out in the previous report, as well as their outcome regarding the administration's actions, to determine if such deficiencies should continue to be communicated in the detailed report, or if those initially considered “non-significant” have altered their status due to their recurrence, without actions by the administration of the audited entity over the examined periods.

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Seven of September Street, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686

It is also important to remember, regarding the aforementioned report, that in NBC TA 265 – Communication of Internal Control Deficiencies, the deadline for issuing written communication is detailed in item A13, as follows:

“When determining when to issue written communication, the auditor may consider whether the receipt of this communication would be an important factor to allow those charged with governance to perform their overall supervision responsibilities. Furthermore, for entities listed on a stock exchange in certain jurisdictions, those charged with governance may be required to receive the auditor’s written communication before the date of approval of the financial statements to perform specific responsibilities regarding internal control, for regulatory purposes, or to meet other purposes. For other entities, the auditor may issue the written communication at a later date. However, in the latter case, considering that the auditor’s written communication regarding significant deficiencies is part of the final audit file, the written communication is subject to the requirement of item 14 of NBC TA 230, which requires the auditor to complete the final audit file in a timely manner. NBC TA 230 establishes that the appropriate time limit for completing the final audit file is normally no more than 60 days after the date of the independent auditor’s report (NBC TA 230, item A21)”. (our emphasis)

Therefore, the independent auditor must make efforts to receive management comments within a period of up to 60 (sixty) days after the date of the respective audit report. In cases where there is no response from management, the fact must be included in that final audit file, along with the version sent for discussion, being considered “final” from that moment.

8. New Audit Report and Key Audit Matters

As is widely known, in 2016, the audit report was altered in its form and content. There was, in this first year of application of the standard, doubt and discussion regarding the scope of the new section, given that the standard treated as mandatory the inclusion of key audit matters for listed companies. In response to a consultation from IBRACON regarding the scope of this term, the Collegiate Body of the CVM decided:

“After discussion of the subject, the Collegiate Body unanimously deliberated to partially grant the appeal of IBRACON in order to fix the understanding that, within the scope of the market regulated by the CVM and for the purposes of NBC TA 701, the concept of listed entities encompasses entities authorized by a market administrator for the trading of their securities in an organized market. Notwithstanding, in line with the understanding of the SNC, the Collegiate Body recognized the importance and convenience that the innovations brought by that audit standard be observed by all entities registered with the CVM. Thus, the Collegiate Body deliberated to return the theme to the SNC to prioritize a normative alteration process in order to expressly provide for the disclosure of KAMs for all entities registered with the CVM already in relation to fiscal years to be closed from 31.12.2017”.

Following the recommendation of the collegiate board, ICVM 308/99 was revisited and, after a public hearing process, altered by the issuance of CVM Instruction 591, which provided, from 2017, the inclusion of Key Audit Matters (KAMs) for all entities regulated or supervised by the CVM, including investment funds, as determined by item VIII, of Art. 25 of CVM Instruction 308:

“VIII – communicate the key audit matters in the audit reports of financial statements of all entities regulated or supervised by the CVM, in accordance with the independent audit professional standards approved by the Federal Council of Accounting - CFC. ”

In turn, in connection with international discussions on the subject, the Institute of Independent Auditors of Brazil – IBRACON, issued circular no. 07 /2017 – DN, in which it strongly recommends the explicit inclusion of the results of audit procedures in KAMs and brings some examples of their presentation, making it clear that these are merely illustrative examples and without the purpose of suggesting any standardized wording, which would be incompatible with the main objectives of the new report, which, in the end, are to make it more informative and transparent to its users.

It is relevant to emphasize that, in order to achieve such objectives, it is essential that the description of the procedures carried out by the auditor and the results achieved present relevant informational content for users, not restricting themselves to generic presentations of what was done and vague statements regarding the adequacy of the subject as a whole to the financial statements.

Regarding the content, it is reasonable to conclude that various users expect that the following items, among others possible, be described in the Key Audit Matters section, even if not fully required by NBC TA 701, which we understand as improvements applicable by the auditor when preparing their audit report:

• specific audit procedures for the risk under discussion;

• information on the use of the work of specialists and/or internal auditors;

• specific audit procedures related to applicable internal controls and whether, as a result of the application of the procedures carried out by the auditor, possible deficiencies in their effectiveness were detected;

• any difficulties in the application of planned procedures;

• changes in the planning of procedures executed, in the scope or in the depth of audit tests;

• if during the execution of audit procedures adjustments were identified, recorded or not by the entity's management, even if they are not considered material by the auditor.

Additionally, considering the dynamics of the economic and business environment, as well as the diversity of activities, processes, and systems of the audited entities, it is expected that audit reports be effectively individualized, not being mere repetitions of the key audit matters of the previous year, nor composed of standardized KAMs, established internally by the audit firm, for the firm as a whole or by the sector of activity of the audited entities.

In this sense, having in view the provisions of items I, II and III, art. 25-A of CVM Instruction no. 480/09, added by CVM Instruction no. 600/18 (regarding the financial statements of separate estates) and the provision in item VIII, art. 25, of ICVM 308/99, which deals with Key Audit Matters, we remind you that each separate estate is considered an entity that reports information for the purpose of preparing individual financial statements. Therefore, independent audit professional standards must be observed when issuing the respective audit report, including NBC TA 701, which deals with the subject.

9. Technical Qualification Examination (art. 30, CVM Instruction no. 308/99)

On 08.21.2015, NBCPA 13 (R2) was approved, which deals with the Technical Qualification Examination, instituted by the Federal Council of Accounting – CFC. Thus, considering that the aforementioned NBCPA 13 (R2) altered the functioning model of said Examination, creating a specific test for acting in entities regulated by this Autarchy, it is worth remembering the provision in article 30, of ICVM 308/99, which determines that the Technical Qualification Examination will be carried out with a view to qualifying the independent auditor for the exercise of the activity of auditing financial statements for all entities comprising the securities market.

NBCPA 13 (R2), in its item 3, letter “b”, instituted the specific test for acting in entities regulated by the Securities and Exchange Commission (CVM). That is, from the entry into force of NBCPA 13 (R2), the Technical Qualification Examination – “CVM” became the necessary technical qualification examination for registration with this Autarchy.

Additionally, it is worth clarifying that approval in a specific technical qualification examination “CVM” is, only, one of the necessary requirements for registration with the CVM. The fact of being active in the National Registry of Independent Auditors (CNAI), maintained by the Federal Council of Accounting, does not guarantee, by itself, compliance with this requirement, given that many professionals included in the CNAI were not approved in the Technical Qualification Examination, but migrated from the CVM registry when it was created. Thus, professionals who were already registered with the CVM as technical responsible persons of an audit firm are subject to proof of approval in said examination if the request for inclusion in another auditor occurs after the cancellation of their registration in the previous auditor.

In turn, with the adoption of the specific “CVM” technical qualification examination, we highlight that, after being approved in that exam, and until their registration or record with the CVM, the professional interested in obtaining such prerogative must remain up to date with the requirements of the Continuing Professional Education Program, proving their regularity through a specific certificate issued by the Federal Council of Accounting.

We also clarify that all members of audit teams who perform managerial functions must also have been approved in said exam, as detailed further in item 10 below.

10. Composition of audit teams (art. 25, item VII, CVM Instruction no. 308/99)

One of the novelties presented in the alteration of ICVM 308/99 that occurred in 2017 concerns the composition of the teams that carry out audit activities. Item VII, art. 25 of ICVM 308/99 determines that the auditor must:

“
VII – ensure that all partners, directors, managers, supervisors or any other members, with a management function, in the team destined for the exercise of the audit activity in entities regulated by the CVM, have been approved in a Specific Technical Qualification Examination for the CVM.
”

Thus, when planning audit teams, auditors must pay attention to the fact that all those components who exercise a management function, such as partners, directors, managers or supervisors, among other possible positions, have been approved in a Specific Technical Qualification Examination for the CVM.

It is important to highlight that item VII of art. 25, combined with the provisions of the caput and §1 of art. 34, all of the aforementioned ICVM 308/99, ratifies the obligation that such professionals pay attention to the annual compliance with the Continuing Professional Education Program, after their approval in said exam. Non-compliance with the guidelines imposed by the Federal Council of Accounting regarding the Continuing Professional Education Program by the aforementioned professionals may lead to the adoption of administrative measures against the independent auditors linked to them, in the terms contained in item 05 of this circular.

11. Single Registry (art. 11, sole paragraph, CVM Instruction no. 308/99)

The alteration introduced in art. 11, sole paragraph, of ICVM 308/99 sought to establish a relationship of equity between the treatment given to the independent auditor – natural person and the independent auditor – legal entity and their technical responsible persons. As stated in the standard, it is not permitted the registration, in the category of Independent Auditor - Natural Person, of an accountant who is a partner, director or technical responsible person or who has an employment link with Independent Auditor - Legal Entity. However, for the partner, or technical responsible person, of an independent auditor – legal entity registered with the CVM, this impediment did not apply. We therefore had an asymmetric situation that benefited one participant to the detriment of another.

It is worth mentioning that the limitation of participation of a partner in only one audit society registered with the CVM does not characterize non-observance of the constitutional right to free association. In truth, there is no impediment to the free association of the professional; they may have as many associations and participations as they wish, even within the same economic group. However, participation in an independent auditor – legal entity registered with the CVM, whether as a partner or as a technical responsible person, will be limited to only 01 (one) audit society.

Therefore, requests for new registrations of audit societies or inclusion of technical responsible persons that are out of compliance with this determination will be promptly denied.

12. Audit of financial statements of Investment Funds in Credit Rights - FIDC, Certificates of Real Estate Receivables - CRI and Certificates of Receivables of the Agribusiness - CRA.

THE CIRCULAR LETTER/CVM/SIN/SNC/ No. 01/2012, guides independent auditors who act in “FIDC” funds regarding certain procedures that they must execute regarding the credit rights held by the funds, including the verification of existence and adequate pricing, considering, furthermore, issues related to provisions for losses on these rights, which are dealt with in CVM Instruction no. 489/11.

In this context, we reinforce that the aforementioned CIRCULAR LETTER also applies to the audit procedures to be carried out for the financial statements of the separate estates of CRI and CRA, required by art. 25-A of CVM Instruction no. 480/09, in order to complement the guidelines of CIRCULAR LETTER no. 2/2019/CVM/SIN/SNC, through which we highlighted that the operational dynamics of CRI and CRA is similar to that of FIDCs, making the application of CVM Instruction no. 489/11 appropriate.

13. Audit of accounting estimates and related disclosures (NBC TA 540 (R1) / NBC TA 540 (R2)

We have verified, in recent years, recurrent failures of auditors in meeting the requirements of NBC TA 540 (R1), in the audit of accounting estimates, including, but not limited to, the audit of impairment tests and related disclosures.

Thus, follow our considerations on the main non-compliances verified:
a) as part of the validation of the calculation methodology used, it is expected that the auditor, among other procedures, verify the comparison of historically calculated estimates with what was actually realized, analyzing the reasons for the discrepancies found, and also if the methodology needs any adjustment to be used again in the audited period;

b) when planning the use of independent calculations (including sensitivity analyses), the auditor must establish an expectation formalizing in their working papers the acceptable limits of difference in relation to management's calculations and what their objective is with that work; c) it is essential that the auditor validate the premises and data (including historical data) used for the calculation of the estimate; d) it is part of the auditor's responsibility to verify if the required disclosures are being made, requesting from management any adjustments that are necessary, and e) evaluate possible impacts on their audit report or the inclusion of the subject in the detailed report, when applicable.

14. Preparation of audit reports – modification of opinion

In the last year, we detected the issuance of some audit reports of annual financial statements and interim financial statements that, in our judgment, were out of compliance with independent audit professional standards. Such reports were related to companies undergoing criminal investigation processes, including those of their directors and managers.

Although we understand that this is a complex theme, of extreme relevance and involving professional judgment, we verified that some auditors are opting to issue their opinion in a manner not consistent with the guidelines contained in independent audit professional standards, more precisely, NBC TA 700, NBC TA 705 and NBC TA 706. In this sense, we remind you that the auditor must modify the opinion in their report when:
(a) concludes, based on the audit evidence obtained, that the financial statements as a whole present material misstatements; or (b) is unable to obtain appropriate and sufficient audit evidence to conclude that the financial statements as a whole do not present material misstatements.

Timely, we emphasize that NBC TA 705, the professional standard that deals with the modification of opinion, is clear in defining the situations in which modifications are required:

“Qualified Opinion
7. The auditor must express a “Qualified Opinion” when:
(a) he, having obtained appropriate and sufficient audit evidence, concludes that the misstatements, individually or in aggregate, are material, but not pervasive in the financial statements; or (b) it is not possible for him to obtain appropriate and sufficient audit evidence to support his opinion, but he concludes that the possible effects of undetected misstatements on the financial statements, if any, could be material, but not pervasive.
Adverse Opinion
8. The auditor must express an “Adverse Opinion” when, having obtained appropriate and sufficient audit evidence, he concludes that the misstatements, individually or in aggregate, are material and pervasive to the financial statements.
Disclaimer of Opinion
9. The auditor must refrain from expressing an opinion when he is unable to obtain appropriate and sufficient audit evidence to support his opinion and he concludes that the possible effects of undetected misstatements on the financial statements, if any, could be material and pervasive.
10. The auditor must refrain from expressing an opinion when, in extremely rare circumstances involving multiple uncertainties, he concludes that, regardless of having obtained appropriate and sufficient audit evidence on each of the uncertainties, it is not possible to express an opinion on the financial statements due to the possible interaction of the uncertainties and their possible cumulative effect on these financial statements.”

In the same way, we have observed that, in these cases, the “Basis for Opinion” section does not match the opinion issued at the end, considering the guidelines of independent audit professional standards. In this sense, we remind you that the “Basis for Opinion” section is responsible for contextualizing the opinion issued, whether modified or not, and must therefore present all the necessary information for the user of that report to have the basis used by the auditor in their professional judgment, provided that independent audit professional standards are respected.

Still on the subject, it is necessary to remember that CVM Instruction no. 308/99, in its article 25, item IV, clearly defines the need to measure the impact on the audited financial statements when issuing the respective audit report, in cases of modification of opinion (qualified or adverse), as follows:

“art. 25 - ...
IV - clearly indicate, and by how much, the accounts or subgroups of accounts of assets, liabilities, results and equity that are affected by the adoption of accounting procedures conflicting with the Fundamental Principles of Accounting, as well as the effects on mandatory dividend and profit or loss per share, as the case may be, whenever issuing a review report of interim information or an adverse or qualified audit report.”

15. New Digital Protocol

Since 2019, the new CVM Digital Protocol system has been available. The objective of the new system is to allow complete automation of the flow of receipt, distribution, and routing of documents received by the Autarchy, making this service more agile and efficient. In this new version, it is possible to track the progress of requests during all stages.

Without intermediaries, independent auditors can file directly with the Audit Standards Management, which can redirect the demand in case of errors. Among the benefits of automating this service are the reduction in document delivery time and the increase in transparency in this routing, as the auditor can track it from start to finish of their request. Documents delivered in person or received via Post Office will continue to be treated by the area responsible for receiving these documents, which will register and digitize them in the new Digital Protocol.

The Digital Protocol does not exclude other CVM service channels, such as, for example, Hearings for Individuals, Process Review, CVMWEB, among others. On the CVM portal, on the SERVICE page, the auditor can consult which channel is most appropriate for their request.

However, presentation of documents, requests for information, and inquiries of any kind via email will no longer be accepted.

To use the new Digital Protocol, access the Federal Government Service Portal (https://scp.brasilcidadao.gov.br/scp/login) and register. For more information, go to the CVM portal (www.cvm.gov.br) in the Digital Protocol item. In case of doubt, contact the Information Management Division (DINF/SOI) via email dinf@cvm.gov.br or by phone (21) 3554-8411.

We emphasize the relevance of the guidelines contained in the last Joint Circular Letters, issued by the Superintendence of Accounting and Audit Standards – SNC and the Superintendence of Corporate Relations - SEP, all available on our internet page (http://www.cvm.gov.br/legislacao/index.html?buscado=true&contCategoriasCheck=1&vimDaCate goria=/legislacao/oficios-circulares/snc-sep/):

• CIRCULAR LETTER/CVM/SNC/SEP/No. 02/2019: guidance on relevant aspects of CPC 06 (R2) - IFRS 16 to be observed in the preparation of Financial Statements of lessee companies, for the fiscal year ending on 31/12/2019; and

SECURITIES AND EXCHANGE COMMISSION OF BRAZIL
Seven of September Street, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP Code: 20050-901 – Brazil - Tel.: (21) 3554-8686

CIRCULAR LETTER/CVM/SNC/SEP No. 01/2020: guidance on relevant aspects to be observed in the preparation of Financial Statements for the fiscal year ended on 12/31/2019.

Finally, considering the current moment of the COVID-19 pandemic and its potential impacts on the accounting statements of entities and on the performance of independent auditors, we recommend special attention to CIRCULAR LETTER/CVM/SNC/SEP No. 02/2020, which deals with the possible impacts of the Coronavirus pandemic on the Financial Statements of entities under the supervision of this Autarchy and the expected performance by independent auditors, also available on our website.

We inform you that doubts related to registration and performance within the scope of the securities market can be resolved through the phones (21) 3554-8397 or 3554-8615, or by email: gna@cvm.gov.br.

[1] - The review reports cited in parentheses reflect the types of reports contained in the review of NBC PA 11, approved on December 8, 2017, with effects from 01.01.2019.

Sincerely,

Signed original by
MADSON DE GUSMÃO VASCONCELOS
Audit Standards Manager

Signed original by
PAULO ROBERTO GONÇALVES FERREIRA
Superintendent of Accounting Standards and Audit