Circular Letter CVM/SNC/GNA 01/21

COMISSÃO DE VALORES MOBILIÁRIOS
Rua Sete de Setembro, 111/2-5º e 23-34º Andares, Centro, Rio de Janeiro/RJ – CEP: 20050-901 – Brasil - Tel.:
(21) 3554-8686
Rua Cincinato Braga, 340/2º, 3º e 4º Andares, Bela Vista, São Paulo/ SP – CEP: 01333-010 – Brasil - Tel.: (11) 2146-2000 SCN Q.02 – Bl. A – Ed. Corporate Financial Center, S.404/4º Andar, Brasília/DF – CEP: 70712-900 – Brasil -Tel.:
(61) 3327-2030/2031 www.cvm.gov.br
Circular Letter No. 1/2021-CVM/SNC/GNA
Rio de Janeiro, May 7, 2021.
To Independent Auditors
Subject: Clarifications regarding the performance of the independent accounting auditor within the securities market

Dear Independent Auditor,

As a direct result of the supervision and inspection actions regarding the audit activity within the securities market, we list below some points related to registration with the CVM, performance in the securities market, and the application of professional standards for independent accounting audit in the execution of work, for which we request special attention from the independent auditor registered with this Commission.

Index:

1. Introduction;
2. Registration as an Independent Auditor (Art. 1 to 6-A – CVM Resolution No. 23/2021);
3. Proof of audit activity (Art. 7 - CVM Resolution No. 23/2021);
4. Periodic Information (Art. 16 – CVM Resolution No. 23/2021);
5. Registration Update and Electronic Declaration of Conformity (art. 1, items I and II of CVM Instruction No. 510/11, with changes from CVM Instruction No. 604/18);
6. Communications regarding art. 24 of CVM Instruction No. 617/19;
7. External Quality Review Program (Art. 33 – CVM Resolution No. 23/2021);
8. Continuing Professional Education Program (Art. 34 – CVM Resolution No. 23/2021);
9. Auditor Rotation (Art. 31 – CVM Resolution No. 23/2021);
10. Issuance of Circumstantial Report (art. 25, item II, CVM Resolution No. 23/2021);

Circular Letter 1 (1257149) SEI 19957.003867/2021-89 / pg. 1

11. Audit Report and Key Audit Matters;

12. Technical Qualification Examination - specific CVM exam (art. 30, CVM Resolution No. 23/2021);

13. Composition of audit teams (art. 25, item VII, CVM Resolution No. 23/2021);

14. Single Registry (art. 11, sole paragraph, CVM Resolution No. 23/2021);

15. Audit of financial statements of Investment Funds in Credit Rights - FIDC, Real Estate Receivables Certificates - CRI and Agricultural Business Receivables Certificates - CRA;

16. Audit of accounting estimates and related disclosures (NBC TA 540 (R2));

17. Preparation of audit reports – modification of opinion;

18. Independent Auditor – Legal Entity: corporate types and liability of partners;

19. Recognition of tax credits and their possible effects on the audit report;

20. Relevant aspects to be observed in the review of Explanatory Notes and in the evaluation of other information contained in the Financial Statements in initial registration requests of open companies;

21. New Digital Protocol.

22. Introduction

On April 1, 2021, CVM Resolution No. 23 entered into force. The aforementioned standard revoked CVM Instruction No. 308/99 and updated the regulation of the independent audit activity within the securities market. However, it is important to emphasize that the foundations that guide the regulatory activity of the Securities and Exchange Commission (CVM) on the subject remain valid and updated. They are:

• the importance of an independent audit system as an indispensable support for the regulatory body;
• the figure of the independent auditor as an essential element for market credibility and as an instrument of inestimable value in the protection of investors, insofar as its function is to ensure the fidelity and reliability of the audited entity's financial statements;
• the accuracy and clarity of the financial statements, including the disclosure in explanatory notes of information indispensable to viewing the patrimonial and financial situation and the results of the audited entity, also depend on an effective audit system and, fundamentally, on the auditor's awareness of their true role within this context; and
• the need for the market to have highly qualified independent auditors who, at the same time, enjoy a high degree of independence in the exercise of their activity.

It is important to note that CVM Resolution No. 23 established the possibility for audit societies registered with the CVM to use other corporate forms, previously restricted to the format of a pure simple society.
Regarding this topic, item 18 (below) provides more information.

2. Registration as an Independent Auditor (Art. 1 to 6-A – CVM Resolution No. 23/2021)

Initially, it is worth clarifying that registration with the CVM does not constitute a new professional category, nor does it mean restriction of the professional activity. On the contrary, the independent audit activity is a prerogative of the accountant legally qualified and registered with the Regional Council of Accounting (CRC). This activity can be exercised individually or in partnership, whose partners are all accountants, consequently, there are no incompatibilities between these norms and the disciplinary regime of the accountant professional category.

The new resolution maintains the two existing forms of registration, namely: Independent Auditor – Natural Person (AIPN), granted to the accountant legally qualified and who meets the requirements established in arts. 3, 5, and 7, and Independent Auditor – Legal Entity (AIPJ), granted to the society integrated exclusively by accountants, registered with the Regional Council of Accounting and who meets the requirements established in arts. 4, 6, and 7.

For partners or other accountants who maintain a professional link of any nature with the audit society registered with the CVM (AIPJ) to issue and sign audit or review reports on behalf of the society, it is mandatory to be registered as the technical responsible for said society with the CVM.

Resolution No. 23/2021 maintains the requirement that at least half of the partners of the audit society (AIPJ) be registered as the technical responsible for the society at the CVM to exercise the audit activity within the securities market, on behalf of the society (end of item II of art. 4). If, after obtaining the society's registration, there is a change in the partnership, whether by exclusion or admission of partners, it is imperative that this relationship be maintained, under penalty of suspension or even cancellation of the respective registration until the situation is normalized (item II of art. 15).

Among the other conditions for obtaining registration, it is fundamental that the exercise of the audit activity for a minimum period of 05 (five) years, consecutive or not, be proven. It should be clarified that this period is counted from the date of the interested party's registration with the Regional Council of Accounting (CRC), in the accountant category. The exercise of audit activity prior to their registration in said category at the CRC constitutes non-compliance with professional standards.

The interested party must present a copy of the accountant identity card, in the accountant category, or, at their discretion, a registration certificate issued by the CRC. In this regard, it is recommended that the interested party verify if their professional identity card contains the date of effective registration at the CRC in the accountant category. Otherwise, it becomes necessary to send, in addition to the copy of the accountant professional identity card, a certificate issued by the Regional Council of Accounting, which must necessarily contain the date of effective registration as an accountant. Absent the aforementioned date, for the purpose of the initial term for counting the time of exercise of the audit activity in the form of art. 7, the date of issuance of the accountant professional identity card presented will be considered.

Regarding the proof of a legalized office in one's own name, the License for Location and Operation or an equivalent competent document issued by the City Hall of the municipality where the professional exercises their activity must be sent. In the case of registration as AIPN, a document issued in the name of any society of which the interested party is a member will not be accepted.

Resolution No. 23/2021 maintains the requirements that all partners of the audit societies registered with the CVM be accountants (beginning of item II of art. 4) and that the corporate object of said societies be exclusively directed towards the provision of professional audit services and other services inherent to the accountant profession. Thus, in light of the sole paragraph of art. 966 of the Civil Code (CC), the simple - non-business - nature of these single-profession accountant societies is configured. Consequently, according to the final part of art. 1.150 of the CC, the Civil Registry of Legal Entities (RCPJ) is the competent registry for the constitutive acts and subsequent contractual alterations of these simple single-profession societies, even if they adopt one of the corporate types provided for business societies, as granted by the final part of art. 983 of the CC.

Regarding this topic, it is also important to consider the clarifications codified in Statement No. 57 – approved at the I Civil Law Day held by the Judicial Studies Center of the Council of Justice of the Federal Court (CEJ/CJF). According to the aforementioned statement, "the choice for the business type does not remove the simple nature of the society." Additionally, as clarified by Statement No. 382 – approved at the IV Civil Law Day (CEJ/CJF), the registration of societies observes the nature of their respective activities (business or not – art. 966); the other issues follow the norms pertinent to the adopted corporate type (art. 983).

As a condition for granting registration requests (AIPN or AIPJ) or for registering the technical responsible of AIPJ with the CVM, items VI of art. 5, XII of art. 6, and V of art. 6-A of CVM Resolution No. 23/2021 also establish that copies of the approval certificates of the respective accountants in the technical qualification exam – specific CVM exam, instituted by item 3, letter "b" of NBC PA 13 (R2) of 08/21/2015, must be presented. It is worth highlighting that the copy of the Registration Certificate of the professional in the National Registry of Independent Auditors (CNAI), by itself, does not constitute a competent document to meet the aforementioned requirements.

3. Proof of Audit Activity (Art. 7 - CVM Resolution No. 23/2021)

To obtain registration as Independent Auditor - Natural Person (AIPN) or to integrate the registry of Technical Responsibles authorized to issue and sign audit and review reports on behalf of an AIPJ registered with the CVM, the accountant must prove having exercised the activity of auditing financial statements for a period of no less than 05 (five) years, consecutive or not, from the date of their effective registration, in the accountant category, with the respective CRC. This proof must be met as follows:

a) by presenting audit reports issued and signed by the interested accountant, published in a newspaper or specialized magazine or made available on the worldwide computer network, one publication being sufficient for each year. The published audit reports, to be accepted, must be in consonance with the standards of the Federal Council of Accounting (CFC) that are applicable. The publication must include, in addition to the audit report, the set of financial statements and their respective explanatory notes. In these cases, it is important that the name of the newspaper or magazine; the address of the worldwide computer network site; and the date of publication are not omitted;

b) by proving that the interested accountant exercised the audit activity as an employee of an audit society registered with the CVM. This proof will also only be counted from the date of the professional's registration in the accountant category, whether this registration is provisional or definitive. In the case of registration requests as Independent Auditor - Natural Person, the interested accountant must also prove that they are no longer part of the employee roster of the employing audit society, in compliance with the provisions of art. 11 of CVM Resolution No. 23/2021.

To prove the exercise of the audit activity in the manner indicated in item "b" above, the following must be presented: i) copy of the individual employee registration of the accountant at the employing audit society, containing all information required by specific regulation and ii) copy of the work and social security card (CTPS) of the interested accountant, comprising the pages containing: the number and series of the CTPS; the holder's qualification; the annotations regarding employment contracts and changes in salaries, vacations, positions, or functions performed. Copies of the CTPS pages that are blank, i.e., in which no annotations have been recorded, do not need to be presented. Also, a declaration signed by a partner representative of the employing audit society will be admitted in place of the copy of the individual employee registration, which must necessarily contain the accountant's qualification; the dates of admission and departure from employment (if applicable); the position or function in which they were admitted and the dates when changes in positions or functions performed occurred.

An important fact to consider is that, in the case of proof of the exercise of the audit activity in the manner indicated in item "b" above, the interested party must also prove that they exercised, for 05 (five) years, positions of direction, management, or supervision in the area of auditing financial statements.

Regarding this topic, it is important to mention that it is consolidated understanding, within the Superintendence of Accounting Standards and Audit of the CVM (SNC), that the possibility of proof by partial periods, codified in § 3 of art. 7 of CVM Resolution No. 23/2021, enables the counting of periods in the exercise of positions of direction, management, and supervision for a period of less than 05 (five) years, in addition to the other forms of proof of experience provided for in the same article.

The CVM may also, at its exclusive discretion, accept that the proof of the exercise of the audit activity be made by presenting audit work that has not been published (§1 of art. 7 of CVM Resolution No. 23/2021). In this case, the interested party must present as proof of each work performed: the respective audit report, the corresponding circumstantial report, and the respective audited financial statements. Aiming to protect professional secrecy and guarantee its authenticity, it is indispensable that all these documents be authenticated by the audited entity, and must also contain authorization from said entity for them to be presented to the CVM for the exclusive purpose of proving the exercise of the audit activity by the interested accountant. The aforementioned authentication of documents must be met by placing, on each page of the respective documents, the signature of the legal representative of the audited entity along with the indication (stamped, handwritten, or printed) that the copy matches the original. It is important to note that this mode of proof will also be subject to the evaluation of the quality of the work performed and may also include the availability of the respective working papers for CVM inspection.

As a guideline, we clarify that the circumstantial report must contain, at a minimum, the following information: the name or denomination of the audited entity; the period covered by the examination; description of deficiencies and ineffectiveness of internal controls and accounting procedures adopted by the audited entity followed by recommendations for the required corrections; and the date of issuance, identification, and signature of the responsible auditor.

Circular Letter 1 (1257149) SEI 19957.003867/2021-89 / pg. 5

4. Periodic Information (Art. 16 – CVM Resolution No. 23/2021)

Independent auditors must send to the CVM, by the last business day of April of each year, information related to their performance in the securities market, as per Annex D to CVM Resolution No. 23/2021.
These information are important subsidies for the CVM to evaluate the auditors' capacity to adequately serve their clients.

Such information must be sent via the internet, on the CVM page. The submission must be made through the option “REGULATED (https://www.gov.br/cvm/pt-br/assuntos/regulados)”, selecting next the option “DOCUMENT SUBMISSION – CVMWEB (https://cvmweb.cvm.gov.br/swb/default.asp?sg_sistema=scw)” and then the option “DOCUMENT SUBMISSION”.

We inform that a change in the procedure for presenting such information was implemented since 2020. Now, when accessing the CVMWEB system to present the Annual Periodic Information provided for in art. 16 of CVM Resolution No. 23/2021, the auditor will be automatically directed to the verification of their registration data. After validation of the registration data, or their update, the auditor must issue, mandatorily, the Electronic Declaration of Conformity. Only after this procedure will the independent auditor be redirected to the presentation of the Annual Periodic Information.

At this stage, there are two options for sending information: i) Document submission via form and ii) Document upload.
Finally, the option “Annual Report of Independent Auditor” must be selected. The “document upload” option should only be used by those auditors who have more than 10 (ten) clients that are open companies (or part of the securities market or incentivized companies), as in this case, it is necessary to create a file (XML standard) to send the required information.

Additionally, we remind you that from the effectiveness of CVM Resolution No. 23/2021, Annex D of the aforementioned Resolution presents in item 4.A the request for presentation of the financial statements of the audit society (legal entity only) referring to the fiscal year that serves as the basis for the annual information being presented, if the period prescribed by law for its elaboration has already elapsed; or to the penultimate closed fiscal year, in other cases. The file containing the aforementioned financial statements must be in “PDF” format and must be sent together with the Annual Information through the document upload option made available.

We also alert that there is no longer a need to inform about courses and training carried out in the competency year of the report, as this information is sent directly by the Federal Council of Accounting – CFC, to the CVM.

The late presentation of this information subjects auditors to a penalty fine, as provided in art. 18 of CVM Resolution No. 23/2021. We remind you that non-observance of the deadline for sending the information treated in this topic entails the collection of a daily penalty fine of R$ 200.00 (two hundred reais), according to the change introduced by CVM Instruction No. 608/19.

5. Registration Update and Electronic Declaration of Conformity (art. 1, items I and II of CVM Instruction No. 510/11, with

Circular Letter 1 (1257149) SEI 19957.003867/2021-89 / pg. 6

changes to CVM Instruction No. 604/18)
Regardless of the submission of the periodic information required by CVM Resolution No. 23/2021, it is also necessary for independent auditors to keep their registration updated, observing a deadline of up to 07 (seven) business days from the event that caused the change. To this end, it is necessary for independent auditors to access their registration data on the CVM website, proceeding with the appropriate update. In addition to the required update, annually and until the last business day of April (according to the new wording of item II, art. 1 of CVM Instruction No. 510/11, amended by CVM Instruction No. 604/18), the Independent Auditor must confirm that their registration data remains valid, by issuing the Electronic Conformity Declaration, established by CVM Instruction No. 510/11. The Electronic Conformity Declaration must be issued by accessing the option “REGULATED (https://www.gov.br/cvm/ptbr/assuntos/regulados)”, then selecting the option “SERVICES FOR CVM PARTICIPANT” and then the option “REGISTRATION UPDATE FOR PARTICIPANTS”, followed by “ELECTRONIC CONFORMITY DECLARATION”, on the CVM website. It is important to emphasize that, even in cases where there are no changes in the data on the website, the Electronic Conformity Declaration must be issued.

With the aim of facilitating the submission of the Electronic Conformity Declaration, avoiding delays or non-submission, a new functionality has been made available on the CVM website. Since 2020, when accessing the CVMWEB system for the transmission of Annual Periodic Information provided for in art. 16 of CVM Resolution No. 23/2021 (item 01 above), which has the same submission deadline, the auditor will be automatically directed to the verification of their registration data and any necessary updates. After confirming the registration data, or updating it, the auditor will be directed to the issuance of the Electronic Conformity Declaration. Once the Electronic Conformity Declaration is issued, the auditor will be redirected to the submission of the Annual Periodic Information.

For the issuance of the Electronic Conformity Declaration, the independent auditor must be selected (click on the box located before the auditor's name), confirming the registration data, or altering it if necessary, and then activating the option “SEND FORM”. After sending the Electronic Conformity Declaration, the following information will appear: Form already sent? YES.

Finally, we emphasize that the non-submission of the Electronic Conformity Declaration, or its submission late, subjects the participant to a daily penalty, provided for in art. 5 of CVM Instruction No. 510/11, in the amount of R$ 200.00 (two hundred reais) for the participant legal entity and R$ 100.00 (one hundred reais) for the participant natural person.

Opportunistically, considering that all communications from the CVM to independent auditors are carried out through electronic messages (e-mail), we reinforce the need for such addresses to be updated. Still on this topic, we remind you that the e-mail informed as the link of communication with the CVM is not protected by message barriers (anti-spam), as this functionality prevents the reception of forwarded messages. Unfortunately, we have received several message returns due to this tool. We highlight that such addresses are freely updated by independent auditors, characterizing the primary source of communication with the CVM. Thus, the existence of these control tools is the sole responsibility of the independent auditors, who assume the risk of their maintenance. Circular Letter 1 (1257149) SEI 19957.003867/2021-89 / pg. 7

6. Communications related to art. 24 of CVM Instruction No. 617/19.
   With a view to the faithful compliance with CVM Instruction No. 617/19, in particular, to the provisions of article 24, we reiterate that for the purposes of the provisions of item I of art. 11, of Law No. 9.613, of 1998, independent auditors must carry out monitoring, analysis and communication related to this, considering, at minimum, the application of the procedures provided for in specific regulation issued by the CFC.

Due to a convention signed with the Federal Council of Accounting - CFC, the negative declaration (if applicable) must be made in the CFC environment of SISCOAF. Nothing prevents the auditor registered with the CVM from spontaneously, and in a supplementary manner, also sending suspicious communications or negative declaration to the CVM segment of SISCOAF.

7. External Quality Review Program (Art. 33 – CVM Resolution No. 23/2021)
   We remind you that independent auditors must submit to an external quality review to be carried out by another auditor registered with the CVM, with a view to also assessing compliance with technical and professional standards, in accordance with a specific standard issued by the CFC. Currently, NBC PA 11 regulates the matter, to be observed by independent auditors.

Specifically regarding the performance of the reviewing auditor, we have observed several problems in the execution of review work. Such problems are, for the most part, related to the depth of the examinations carried out, as well as to the obtaining of appropriate and sufficient audit evidence, in order to support the opinion issued at the end of the work. It is important to emphasize that, from the sample of reviewing auditors selected for inspections in compliance with the Risk-Based Supervision Program (SBR) adopted by the CVM in recent years, we identified a high recurrence of problems in the execution of review work by reviewing auditors, leading to the adoption of complementary administrative procedures by this Autarchy, including the instigation of administrative sanctioning processes (Statement of Accusation). In this sense, we remind you that the reviewing auditor must pay special attention to verifying compliance with the Professional Education Program (NBCPG 12 R3) and the procedures to be observed by accounting professionals and organizations to comply with the obligations provided for in Law No. 9.613/1998 (CFC Resolution 1530/2017), by the audited auditor, in addition to those already listed in the external quality review questionnaire.

We remind you that non-compliance with the Program instituted by the CFC by the audited auditor also entails the application of administrative sanctions. In this sense, we remind you that §4 of art. 33 of CVM Resolution No. 23/2021, establishes:

“§4 Non-compliance with the provisions of the caput in at least 2 (two) of the 5 (five) last years will result in the immediate suspension of the registration of the Independent Auditor – Natural Person, or of the Independent Auditor – Legal Entity, until a new review of their quality control is presented, according to the guidelines of the Federal Council of Accounting, with a report issued without reservations, duly approved by the Management Committee of the External Quality Review Program, or equivalent, instituted by the Federal Council of Accounting – CFC.” Circular Letter 1 (1257149) SEI 19957.003867/2021-89 / pg. 8

It is important to emphasize that, from 2018, auditors who again incurred non-compliance with the External Quality Review Program, in the manner provided for in §4 above, had their registrations suspended at the CVM. In such cases, and in those that are identified in the future, the auditor who wishes to reactivate their registration must, by their own act and without prior indication by the External Quality Review Committee – CRE, indicate their reviewing auditor to the CRE, submitting themselves to the external quality review, within the deadlines and procedures defined by the standard governing the Program. At the end of the review, its result, conclusions and recommendations must be presented to the CRE, so that the Committee can analyze the review carried out by the reviewing auditor, approving or not.

Unfortunately, we have observed movements in the direction of attempting to infringe compliance with the External Quality Review Program, notably in two ways:
a) Independent auditors indicated by the CFC to participate in the External Quality Review Program cancel their registration with the CVM. Still within that exercise, or in the following exercise, they request new registration. In this case, as defined in the norms of the CVM and the CFC, the auditor must submit to the Program in the next exercise (starting from the new registration). However, we have verified that some auditors do not submit to the Program upon their return. It is the understanding of this Superintendence of Accounting Standards and Auditing – SNC, that these auditors, with this attitude, incur the situation described in §4 of art. 33 cited above. Thus, in the cases already identified, as well as the new ones, the SNC will adopt the suspension provided for in the norm. b) Some independent auditors, despite submitting to the External Quality Review Program when indicated annually by the CFC, present recurrent problems in their reviews, which makes the approval of the review by the CRE-CFC impossible, being automatically indicated for the following year. We understand that the recurrence of this practice, year after year, constitutes an attempt to circumvent compliance with the external quality review. In this way, we remind you that such auditors are subject to suspension of registration, in the mold of §4, of art. 33 of CVM Resolution No. 23/2021, in addition to the adoption of other administrative measures applicable to the case.

It should be emphasized that, once the suspension of registration for non-compliance with the External Quality Review Program is applied, provided for in §4 of article 33 of CVM Resolution No. 23/2021, the reactivation of the registration of the independent auditor (audited) with the CVM will only occur if the external quality review process is approved by the CRE/CFC and provided that the external quality review report does not contain any reservations (report of review of an adequate quality system1). Report of review issued with reservations (report of review of quality system with deficiencies), with abstention of opinion (report of review of the quality system with limitation of scope to the reviewer's work) or adverse (report of review of inadequate quality system), even if they meet the requirements provided for in the standard and are approved by the CRE/CFC, will not be considered valid for the reactivation of the registration of independent auditor. It should also be noted that the submission to the External Quality Review Program for these suspended auditors will be voluntary, at the request of the auditor themselves, since only auditors active in the CVM registry, and indicated by the CRE/CFC, are obliged to participate in the aforementioned Program.

8. Continuing Professional Education Program (Art. 34 – CVM Resolution No. 23/2021)
   With the objective of maintaining a high standard of technical training and constant updating regarding professional standards, accounting and audit procedures and standards related to the exercise of their activity in the securities market, independent auditors registered with the CVM must maintain, for themselves and for their technical staff, a continuing education program in accordance with the guidelines approved by the CFC, contained in NBC PG 12 (R3).

In this regard, we remind you that non-compliance with the Continuing Professional Education Program by independent auditors – natural person and independent auditors – legal entity, as well as their partners and/or technical managers, entails the application of administrative sanctions. On the subject, we bring the §§ 1 and 2 of art. 34 of CVM Resolution No. 23/2021, which establish:

Ҥ 1 The provisions of the caput apply to Independent Auditors РNatural Person and to partners, who exercise, or not, the activity of auditing, technical managers, directors, supervisors and managers of Independent Auditors - Legal Entity.

§ 2 Non-compliance with the provisions of the caput in at least 2 (two) of the 5 (five) last years will result in the immediate suspension of the registration of the Independent Auditor – Natural Person, or of the registration as technical manager of Independent Auditor – Legal Entity, until a new certificate of approval in the Technical Qualification Exam, provided for in art. 30 of this Resolution, is presented, regardless of the adoption of other administrative measures applicable.”

It is worth clarifying that, due to the joint action of this Autarchy with the Continuing Professional Education Commission – CEPC, instituted by the CFC for the management and monitoring of the Program, it is not necessary to present the annual activity report related to Continuing Education to the CVM. This report must be delivered annually to the respective Regional Council of Accounting – CRC, as defined in NBC PG 12 (R3). Proof of compliance with the Continuing Professional Education Program is homologated by the CFC/CRCs system.

We remind you that, regardless of participation in external courses and activities, independent auditors must have mechanisms for timely monitoring of changes in independent audit professional standards emanating from the CFC and, when applicable, from the Institute of Independent Auditors of Brazil - IBRACON, and standards that regulate the independent audit activity within the securities market.

9. Auditor Rotation (Art. 31 – CVM Resolution No. 23/2021)
   We remind you that the Independent Auditor - Natural Person and the Independent Auditor - Legal Entity cannot provide services to the same client for a period longer than five consecutive fiscal years, requiring a minimum interval of three fiscal years for their re-hiring, regardless of the period in which the auditor provided services to the audited entity.

For its part, we highlight that the only exception permitted is that in which the audited company has a Statutory Audit Committee – CAE, installed and fully functioning, until the date of closing of the third fiscal year from the hiring of the independent auditor, and remain in operation after that date and while using the aforementioned prerogative; and that this auditor is a legal entity, as provided for in art. 31-A of the same Resolution, conditioning, furthermore, to the observation of the requirements contained in arts. 31-B to 31-F, all of the same Resolution. It must be emphasized the primary responsibility of the auditor to meet the rotation requirement, renouncing the client when a situation characterizing non-compliance with the standard is verified, notwithstanding the responsibility of the administrators of the audited entity for the eventual hiring and maintenance of independent auditors who do not meet the conditions provided for in the Resolution (art. 27 – CVM Resolution No. 23/2021).

We also alert that rotation cannot be carried out with another audit firm with which the replaced auditor has common interests, nor that they use the same physical and operational structure as the previous auditors. Below, we cite some examples of situations that may characterize non-observance of the auditor rotation rule, in addition to others of the same nature:
a) use of the same address (headquarters and offices, if any); b) direct kinship relationship between partners and technical managers of audit firms (replaced and current); or c) creation of “new” audit firms for the provision of services, with the existence of partners and/or technical managers previously linked to the replaced auditor.

Additionally, we draw attention to the eventual re-hiring of the replaced auditor. Regardless of whether or not the period defined in the standard for the provision of consecutive audit services to the same client is reached (five fiscal years, in normal situations; up to ten fiscal years for cases where there is a CAE, in operation and in adherence to the requirements of Resolution 23/2021), its re-hiring can only occur after a period of 03 (three) fiscal years. For example, we have that, if AUDITOR “A”, after 02 (two) fiscal years of providing services to the audited, was replaced by AUDITOR “B”, AUDITOR “A” can only return to provide audit services after 03 (three) fiscal years of their replacement, in any hypothesis.

In other words, we clarify that the rule of mandatory rotation of independent auditors is composed by the conjugation of the maximum linkage periods and the minimum interval of withdrawal, both necessary for the objective sought by the normative activity in establishing the aforementioned rule. As highlighted above, art. 31-A of CVM Resolution No. 23/2021 established an express hypothesis that exempts the maximum linkage period, allowing its extension to up to 10 (ten) years, if the audited entity has a Statutory Audit Committee (CAE) in permanent operation and the hired independent auditor is a legal entity. However, there is no hypothesis provided for in the same instruction that contemplates an exception, reducing the minimum interval established. As can be seen, there is no proportionality relationship between the linkage period and the minimum withdrawal period. Thus, for any duration of the linkage period of the independent auditor with the audited entity, the minimum interval of 3 (three) fiscal years, before the start of a new linkage period, must equally be respected.

10. Issuance of Circumstantial Report (art. 25, item II, CVM Resolution No. 23/2021)
    Art. 25, item II, of CVM Resolution No. 23/2021 provides that the independent auditor must “prepare and send to the administration and the Fiscal Council, a circumstantial report containing their observations regarding the internal controls and accounting procedures of the audited entity, describing, furthermore, any deficiencies or inefficiencies identified during the work.”

In this sense, ratifying the provisions of the cited normative text, we clarify that the issuance of the aforementioned circumstantial report at the end of the work is expressly mandatory, in any hypothesis, regardless of whether deficiencies or inefficiencies have been identified or not in the examined environment. That is, although the independent audit professional standard that deals with the subject (NBC TA 265) determines the mention in the report only of significant deficiencies, if any, the circumstantial report required by CVM Resolution No. 23/2021 is more comprehensive, requiring the issuance of the report at the end of each work.

As already cited in item 3 above, we reinforce that the circumstantial report must contain, at minimum, among other information, the description of the deficiencies and inefficiencies of the internal controls and accounting procedures adopted by the audited entity accompanied by the recommendations of the independent auditors for the corrections that may be necessary. As can be seen, such points integrate the minimum set of information that the circumstantial report must contain. However, they do not exhaust the content of the aforementioned report.

Furthermore, it is important to emphasize that the aforementioned report, in consonance with the cited professional standard, must segregate significant deficiencies from non-significant ones. In those extremely rare situations, in which the independent auditor concludes by the non-identification of internal control deficiencies (significant or not), the report to be issued will be affirmative, that is, it must affirm the non-identification of internal control deficiencies, whether significant or not, during the performance of the work.

Such procedure allows minimal proof that the independent auditor executed the evaluation of internal controls and accounting procedures provided for in the standard issued by the CVM and by the independent audit professional standards. It is always important to remember that it is the responsibility of the administration of the audited entity to ensure the adequacy of the internal controls that it determined as necessary to allow the preparation of financial statements free from material misstatement and, to the auditor, to consider internal control to plan audit procedures that are appropriate in the circumstances; but not for the purpose of expressing an opinion on the effectiveness of internal control.

In this context, we reinforce that the auditor must, furthermore, during the performance of audit work in subsequent years, establish specific monitoring of those deficiencies pointed out in the previous report, as well as their outcome in relation to the administration's actions, to determine whether such deficiencies should continue to be communicated in the circumstantial report or, still, if those initially considered as “non-significant” have altered their status due to their recurrence, without actions by the administration of the audited entity over the periods examined.

It is important to remember, still on the aforementioned report, that in NBC TA 265 – Communication of Internal Control Deficiencies, the deadline for issuing the written communication is detailed in item A13, as follows:

“When determining when to issue the written communication, the auditor may consider whether the receipt of this communication would be an important factor to allow those responsible for governance to perform their general supervision responsibilities. Furthermore, for entities registered on stock exchanges in certain jurisdictions, those responsible for governance may have to receive the written communication from the auditor before the date of approval of the financial statements to perform specific responsibilities regarding internal control Circular Letter 1 (1257149) SEI 19957.003867/2021-89 / pg. 12

internally, for regulatory purposes or to meet other purposes. For other entities, the auditor may issue the written communication at a later date. However, in the latter case, considering that the auditor's written communication regarding significant deficiencies is part of the final audit file, the written communication is subject to the requirement of item 14 of NBC TA 230, which requires the auditor to timely assemble the final audit file. NBC TA 230 establishes that the appropriate time limit for completing the assembly of the final audit file is normally no more than 60 days after the date of the independent auditor's report (NBC TA 230, item A21)”. (our emphasis)

Therefore, the independent auditor must make efforts to receive management's comments within a period of up to 60 (sixty) days after the date of the respective audit report. In cases where there is no response from management, the fact must be recorded in that final audit file, along with the version sent for discussion, being considered “final” from that moment.

11. Audit Report and Key Audit Matters

As is widely known, in 2016, the audit report was altered in its form and content. There was doubt and discussion in the first year of application of the standard regarding the scope of the new section, given that the standard treated as mandatory the inclusion of key audit matters for listed companies. In response to a consultation from IBRACON regarding the scope of this term, the Collegiate Body of the CVM decided:

“After discussion of the subject, the Collegiate Body deliberated, unanimously, to partially grant the appeal of IBRACON in order to establish the understanding that, within the scope of the market regulated by the CVM and for the purposes of NBC TA 701, the concept of listed entities encompasses entities authorized by a market administrator for the trading of their securities in an organized market. Notwithstanding, in line with the understanding of the SNC, the Collegiate Body recognized the importance and convenience that the innovations brought by that audit standard be observed by all entities registered with the CVM. Thus, the Collegiate Body deliberated to return the topic to the SNC so that it prioritizes a normative alteration process to expressly provide for the disclosure of KAMs for all entities registered with the CVM already in relation to fiscal years to be closed from 31.12.2017”.

Following the recommendation of the collegiate board, from 2017 onwards, the inclusion of Key Audit Matters (KAMs) was established for all entities regulated or supervised by the CVM, including investment funds, as determined by item VIII, of Art. 25 of CVM Resolution n.º 23/2021:

“VIII – communicate the key audit matters in the audit reports of financial statements of all entities regulated or supervised by the CVM, in accordance with the professional standards of independent auditing approved by the Federal Council of Accounting - CFC.”

In turn, in connection with international discussions on the subject, the Institute of Independent Auditors of Brazil – IBRACON, issued circular nº 07 /2017 – DN, in which it strongly recommends the explicit inclusion of the results of audit procedures in the KAMs and brings some examples of their presentation, making it clear that these are merely illustrative examples and without the purpose of suggesting any standardized wording, which would be incompatible with the main objectives of the new report, which ultimately are to make it more informative and transparent to its users.

It is relevant to emphasize that, in order to achieve such objectives, it is indispensable that the description of the procedures carried out by the auditor and the results achieved present informationally relevant content for users, not restricting themselves to generic presentations of what was done and vague assertions regarding the adequacy of the subject as a whole to the financial statements.

Regarding the content, it is reasonable to conclude that various users expect that the following items be described in the Key Audit Matters section, even if not fully required by NBC TA 701, among other possible ones, which we understand as improvements applicable by the auditor when preparing their audit report:

• specific audit procedures for the risk in discussion;
• information on the use of the work of specialists and/or internal auditors;
• specific audit procedures related to applicable internal controls and whether as a result of the application of the procedures carried out by the auditor possible deficiencies in their effectiveness were detected;
• any difficulties in the application of planned procedures;
• changes in the planning of procedures executed, in the scope or in the depth of audit tests;
• whether during the execution of audit procedures adjustments were identified, recorded or not by the entity's management, even if they are not considered material by the auditor.

Additionally, considering the dynamics of the economic and business environment, as well as the diversity of activities, processes, and systems of the audited entities, it is expected that audit reports be effectively individualized, not being mere repetitions of the key audit matters of the previous fiscal year, nor composed of standardized KAMs, established internally by the audit firm, for the firm as a whole or by sector of activity of the audited entities.

In this sense, having in view the provisions of items I, II and III, art. 25-A of CVM Instruction nº 480/09, added by CVM Instruction nº 600/18 (regarding the financial statements of separate assets) and the provision in item VIII, art. 25, of CVM Resolution n.º 23/2021, which deals with Key Audit Matters, we remind you that each separate asset is considered an entity that reports information for the purpose of preparing individual financial statements. Therefore, the professional standards of independent auditing must be observed when issuing the respective audit report, including NBC TA 701 which deals with the subject.

12. Technical Qualification Examination - specific CVM exam (art. 30, CVM Resolution n.º 23/2021)

On 21.08.2015, NBCPA 13 (R2) was approved, which deals with the Technical Qualification Examination, instituted by the Federal Council of Accounting – CFC. Thus, considering that the aforementioned NBCPA 13 (R2) altered the operational model of said Examination, creating a specific exam for acting in entities regulated by this Autarchy, it is worth remembering the provision in article 30, of CVM Resolution n.º 23/2021, which determines that the Technical Qualification Examination will be carried out with a view to qualifying the independent auditor for the exercise of the activity of auditing accounting statements for all entities comprising the securities market.

NBCPA 13 (R2), in its item 3, letter “b”, instituted the specific exam for acting in entities regulated by the Securities and Exchange Commission (CVM). That is, from the entry into force of NBCPA 13 (R2), the Technical Qualification Examination – “CVM” became the necessary technical qualification exam for registration with this Autarchy.

Additionally, it is worth clarifying that approval in a specific technical qualification exam “CVM” is, only, one of the necessary requirements for registration with the CVM. The fact of being active in the National Registry of Independent Auditors (CNAI), maintained by the Federal Council of Accounting, does not guarantee, by itself, compliance with this requirement, given that many professionals included in the CNAI were not approved in the Technical Qualification Examination, but migrated from the CVM registry when it was created. Thus, professionals who were already registered with the CVM as technical managers of an audit firm are subject to proof of approval in said exam if the request for inclusion in another auditor occurs after the cancellation of their registration with the previous auditor.

In turn, with the adoption of the specific technical qualification exam “CVM”, we highlight that, after being approved in that exam, and until their registration or record with the CVM, the professional interested in obtaining such prerogative must remain up to date with the requirements of the Continuing Professional Education Program, proving their regularity through a specific certificate issued by the Federal Council of Accounting (items VII of art. 5º; XIII of art. 6º and VI of art. 6º-A of CVM Resolution n. 23/2021). If the aforementioned proof is not possible, the requesting professional must undergo the specific technical qualification exam for the CVM again and obtain the respective approval.

We also clarify that all members of audit teams who perform managerial functions must also have been approved in said exam, as detailed further in item 13 below.

13. Composition of audit teams (art. 25, item VII, CVM Resolution n.º 23/2021)

One of the novelties presented in the alteration of ICVM 308/99 that occurred in 2017 concerns the composition of the teams that carry out audit activities. Item VII, art. 25, of CVM Resolution n.º 23/2021 (which replaces ICVM 308/99) determines that the auditor must:

“VII – ensure that all partners, directors, managers, supervisors or any other members, with a management function, in the team destined to the exercise of the activity of auditing entities regulated by the CVM, have been approved in the Specific Technical Qualification Examination for the CVM.”

Thus, when planning audit teams, auditors must pay attention to the fact that all those components who perform a management function, such as partners, directors, managers or supervisors, among other possible positions, have been approved in the Specific Technical Qualification Examination for the CVM.

It is important to emphasize that item VII of art. 25, combined with the provision in the caput and in §1º of art. 34, all of the aforementioned CVM Resolution n.º 23/2021, ratifies the obligation that such professionals pay attention to the annual compliance with the Continuing Professional Education Program, after their approval in said exam. Non-compliance with the guidelines imposed by the Federal Council of Accounting regarding the Continuing Professional Education Program by the aforementioned professionals may lead to the adoption of administrative measures against the independent auditors linked to them, as stated in item 05 of this circular.

Regarding specifically the accountants already registered as technical managers authorized to issue and sign audit reports on behalf of each audit firm, within the securities market, it should be noted that, upon their requests for inclusion in the registry of technical managers, they complied with all the requirements that allowed them to have their registration requests approved by the CVM. Thus, it is settled understanding in the SNC that technical managers, as such already registered with this Autarchy and while maintaining their current active registration, do not need to be approved in the Specific Technical Qualification Examination for the CVM, even though the voluntary performance of said exam is a technically recommendable condition as it is addressed to the indispensable and continuous technical improvement of professionals acting in the securities market.

14. Single Registry (art. 11, sole paragraph, CVM Resolution n.º 23/2021)

The sole paragraph of art. 11 of CVM Resolution n.º 23/2021 seeks to establish a relationship of equity between the treatment given to the independent auditor – natural person and the independent auditor – legal entity and their technical managers. As stated in the standard, it is not permitted to register, in the category of Independent Auditor - Natural Person, an accountant who is a partner, director or technical manager or who has a professional link of any nature with Independent Auditor - Legal Entity. However, for the partner, or technical manager, of an independent auditor – legal entity registered with the CVM, there was no impediment to participation, also as a partner and/or technical manager, in another audit firm registered with the CVM.

We therefore had an asymmetric situation that benefited one participant to the detriment of another.

It is worth mentioning that the limitation of participation of a partner in only one audit firm registered with the CVM does not characterize non-observance of the constitutional right to free association. In truth, there is no impediment to the free association of the professional; they may have as many associations and participations as they wish, even within the same economic group.

However, participation in an independent auditor – legal entity registered with the CVM, whether as a partner or as a technical manager, will be limited to only 01 (one) audit firm. Therefore, requests for new registrations of audit firms or inclusion of technical managers that are out of compliance with this determination will be promptly denied.

15. Audit of financial statements of Investment Funds in Credit Rights - FIDC, Certificates of Real Estate Receivables - CRI and Certificates of Agricultural Receivables - CRA.

OFFICE-CIRCULAR/CVM/SIN/SNC/ Nº 01/2012, guides independent auditors acting in “FIDC” funds regarding certain procedures that they must execute regarding the credit rights held by the funds, including the verification of existence and adequate pricing, considering, still, issues related to provisions for losses on these rights, which are dealt with in CVM Instruction nº 489/11.

In this context, we reinforce that the aforementioned OFFICE-CIRCULAR also applies to the audit procedures to be carried out for the financial statements of the separate assets of CRI and CRA, required by art. 25-A of CVM Instruction nº 480/09, in order to complement the guidelines of OFFICE-CIRCULAR nº 2/2019/CVM/SIN/SNC, through which we highlighted that the operational dynamics of CRI and CRA is similar to that of FIDC, making the application of CVM Instruction nº 489/11 appropriate.

16. Audit of accounting estimates and related disclosures (NBC TA 540 (R2)

We have verified, in recent years, recurrent failures of auditors in complying with the requirements of NBC TA 540 (R1) / NBC TA 540 (R2), in the audit of accounting estimates, including, but not limited to, the audit of impairment tests, fair value, and related disclosures.

Thus, follow our considerations on the main non-compliances verified:

a) as part of the validation of the calculation methodology used, it is expected that the auditor, among other procedures, verifies the comparison of historically calculated estimates with what was actually realized, analyzing the reasons for the discrepancies found, and also whether the methodology needs any adjustment to be used again in the audited period;

b) when planning the use of independent calculations (including sensitivity analyses), the auditor must establish an expectation by formalizing in their working papers the acceptable limits of difference in relation to management's calculations and what their objective is with that work;

c) it is essential that the auditor validates the premises and data (including historical data) used to calculate the estimate;

d) it is part of the auditor's responsibility to verify if the required disclosures are being made, requesting management to make any necessary adjustments;

e) evaluate possible impacts on their audit report or the inclusion of the subject in the detailed report, when applicable; and

f) the value of the estimate reflected in the financial statements (appraisal reports, mainly) having been calculated by independent specialists hired by the audit client does not exempt the auditor from the procedures described above, nor from the other requirements of auditing standards, including the verification and review of the reasonableness of premises and projections used, and

g) the management's judgment must present neutrality and the auditor must evaluate possible biases of management.

17. Preparation of audit reports – modification of opinion

Since 2019 we have detected the issuance of some audit reports of annual financial statements and interim financial statements that, in our judgment, were out of compliance with the professional standards of independent auditing. Such reports were related to companies undergoing criminal investigation processes, including those of their executives and managers.

Although we understand that this is a complex theme, of extreme relevance and involving professional judgment, we have verified that some auditors are opting to issue their opinion in a manner inconsistent with the guidelines contained in the professional auditing standards, more precisely, NBC TA 700, NBC TA 705 and NBC TA 706. In this sense, we remind you that the auditor must modify the opinion in their report when:

(a) they conclude, based on the audit evidence obtained, that the financial statements as a whole present material misstatements; or

(b) they are unable to obtain appropriate and sufficient audit evidence to conclude that the financial statements, as a whole, do not present material misstatements.

We opportunistically highlight that NBC TA 705, the professional standard dealing with the modification of opinion, is clear in defining the situations in which modifications are required:

“Qualified Opinion

7. The auditor must express a “Qualified Opinion” when:

(a) they, having obtained appropriate and sufficient audit evidence, conclude that the misstatements, individually or in aggregate, are material, but not pervasive in the financial statements; or

(b) it is not possible for them to obtain appropriate and sufficient audit evidence to support their opinion, but they conclude that the possible effects of undetected misstatements on the financial statements, if any, could be material, but not pervasive.

Adverse Opinion

8. The auditor must express an “Adverse Opinion” when, having obtained appropriate and sufficient audit evidence, they conclude that the misstatements, individually or in aggregate, are material and pervasive to the financial statements.

Disclaimer of Opinion

9. The auditor must disclaim an opinion when they are unable to obtain appropriate and sufficient audit evidence to support their opinion and they conclude that the possible effects of undetected misstatements on the financial statements, if any, could be material and pervasive.

10. The auditor must disclaim an opinion when, in extremely rare circumstances involving multiple uncertainties, they conclude that, regardless of having obtained appropriate and sufficient audit evidence on each of the uncertainties, it is not possible to express an opinion on the financial statements due to the possible interaction of the uncertainties and their possible cumulative effect on these financial statements.”

Similarly, we have observed that, in these cases, the “Basis for Opinion” section does not correspond to the opinion issued at the end, considering the guidelines of the professional standards of independent auditing. In this sense, we remind you that the “Basis for Opinion” section is responsible for contextualizing the opinion issued, whether modified or not, and must therefore present all the necessary information for the user of that report to have the

Ofício-Circular 1 (1257149) SEI 19957.003867/2021-89 / pg. 18

basis used by the auditor in their professional judgment, provided that the professional standards for independent audit are respected.

Regarding the topic, it is necessary to remember that Resolution CVM No. 23/2021, in its Article 25, item IV, clearly defines the need to measure the impact on audited financial statements when issuing the respective audit report, in cases of modified opinion (qualified or adverse), as follows:

“Art. 25 - ...
IV - clearly indicate, and by how much, the accounts or subgroups of accounts of assets, liabilities, results, and equity that are affected by the adoption of procedures co Accounting, as well as the effects on mandatory dividends and earnings or loss per share, as applicable, whenever issuing a review report on interim information or an adverse or qualified audit report”.

18. Independent Auditor – Legal Entity: Corporate Types and Liability of Partners

With the entry into force of Resolution CVM No. 23/2021, relevant changes were implemented in the corporate types eligible for use by audit firms registered with the CVM, as well as the requirement for joint and unlimited liability among partners was eliminated. Thus, there is no longer an obligation for the audit firm registered with the CVM to be constituted as a pure simple society. Similarly, Resolution CVM No. 23/2021 eliminated the requirement to include clauses in the respective articles of association that required joint and unlimited liability among partners.

In this sense, it is relevant to highlight that these regulatory changes do not entail any need for audit firms to move to adapt their articles of association to the provisions of Resolution CVM No. 23/2021. On the contrary, existing contracts remain perfectly valid and suitable for maintaining the firm's registration with the CVM. Any contractual changes that reflect the partners' desire to adopt the possibilities introduced by these regulatory changes can be made at any time, according to the will of its partners, and subsequently sent to the CVM for the update of their registration data, as provided for in Art. 17 of the aforementioned Resolution.

19. Recognition of Tax Credits and Their Possible Reflections in the Audit Report

During the supervision and inspection activity of the audit activity within the securities market, it is common to identify situations that demonstrate potential problems, with direct impacts on users of accounting information. Currently, an item with this characteristic is the recognition of tax credits and their possible reflections in the financial statements and, ultimately, the respective audit report. Situations such as the Expansion of the Concept of Input – PIS and COFINS and the exclusion of ICMS from the PIS and COFINS calculation base have drawn the attention of this Superintendency, especially regarding the position of some independent auditors in blatant disregard for basic concepts of the conceptual framework for accounting in force worldwide.

Circular Letter 1 (1257149) SEI 19957.003867/2021-89 / pg. 19

Regarding the topic, we reinforce that Circular Letter/CVM/SNC/SEP 01/21 addresses the subject comprehensively, and should be considered when deciding on the recognition of such values by companies or in issuing an opinion in the audit report by their auditors.

20. Relevant Aspects to Be Observed in the Review of Explanatory Notes and in the Evaluation of Other Information in the Financial Statements in Initial Registration Requests for Open Companies

As informed by the Superintendency of Corporate Relations - SEP, in the results of its actions related to registration requests for open companies, various requirements related to the disclosure of financial information were identified.

From the requirements carried out to conclude the cited analyses, it was possible to identify that the 5 (five) most frequent requirements are related to:

a) deficient disclosure of accounting policies applied to the Company, notably when it is verified that the Company mostly focused on transcribing or paraphrasing accounting standards, thus without compliance with OCPC 07;

b) deficient disclosure of information on Related Parties, without compliance with CPC 05 (R1), notably regarding the disclosure of rates and terms of loans between related parties;

c) absence of disclosure of information on the Relationship with Independent Auditors in the Management Report, without observing Article 2, items I to IV, c/c the same Article 2, §1, item I, of CVM Instruction 381/2003;

d) failures in the disclosure of the reconciliation of non-accounting information (LAJIDA/EBTIDA or LAJIDA/EBTIDA adjusted) with accounting information, thus without compliance with CVM Instruction No. 527/12; and

e) deficient disclosure of premises in impairment tests, thus without compliance with CPC 01 (R1), mainly regarding the disclosure of discount rates and growth rates and premises.

If on one hand, such information is under the primary responsibility of the companies' management, falling to them to dedicate special attention to the standards related to the preparation of the Financial Statements and Interim Statements related to the above-mentioned topics, as well as to the guidelines contained in Circular Letter No. 01/2021/CVM/SNC/SEP (and circular letters from previous years); on the other hand, it is up to the independent auditor to make efforts in analyzing the content of that information presented together with the respective audited financial statements, recommending necessary adjustments and improvements, in order to allow better understanding by the various users and, mainly, their adequacy to the applicable financial reporting framework.

Still in this sense, depending on the type, the relevance of the inadequately disclosed information and its possible effects on the degree of understanding by its users of those financial statements, it is up to the auditor to evaluate, in light of the provisions of the professional standards for independent audit, the need to cite the fact in their audit report, considering, including, the possibility of issuing a modified opinion.

Circular Letter 1 (1257149) SEI 19957.003867/2021-89 / pg. 20

Finally, it is worth noting that in initial registration requests for open companies, the auditor will be held responsible for the opinion issued in the respective audit report and for the conduct of the audit work and procedures that served as the basis for their opinion, if there are deviations related to the applicable financial reporting framework and its disclosures.

21. New Digital Protocol

Since 2019, the new CVM Digital Protocol system has been available. The objective of the new system is to allow complete automation of the flow of receipt, distribution, and processing of documents received by the Autarchy, making this service more agile and efficient. In this new version, it is possible to track the progress of requests during all stages.

Without intermediaries, independent auditors can file directly with the Audit Standards Management, which may redirect the demand in case of errors. Among the benefits of automating this service are the reduction in document delivery time and the increase in transparency in this processing, as the auditor can track it from start to finish of their demand. Documents delivered in person or received via mail will continue to be handled by the area responsible for the receipt of these documents, which will register and digitize them in the new Digital Protocol. We remind you that, due to the COVID pandemic, the CVM is not receiving physical documents, until in-person work resumes.

The Digital Protocol does not exclude other CVM service channels, such as, for example, Hearings for Individuals, Process Review, CVMWEB, among others. On the CVM portal, on the SERVICE page, the auditor can consult which channel is most appropriate for their demand. However, presentation of documents, requests for information, and queries of any kind will no longer be accepted via email.

To use the new Digital Protocol, access the Federal Government Service Portal ( https://www.gov.br/pt-br/servicos/protocolar-documentos-juntoa-cvm) and register. For more information, go to the CVM portal (https://www.gov.br/cvm/pt-br; on the left menu, select the “Services” option and access the “CVM Digital Protocol (CVM Protocol)” item. In case of doubt, contact the Information Management Division (DINF/SOI) by email dinf@cvm.gov.br or by phone (21) 3554-8411.

Finally, we emphasize the relevance of the guidelines contained in the latest Joint Circular Letters, issued by the Superintendency of Accounting and Audit Standards – SNC and by the Superintendency of Corporate Relations - SEP, all available on our internet page (http://www.cvm.gov.br/legislacao/index.html? buscado=true&contCategoriasCheck=1&vimDaCategoria=/legislacao/oficioscirculares/snc-sep/):

• CIRCULAR LETTER/CVM/SNC/SEP No. 01/2021, which provides guidance on relevant aspects to be observed in the preparation of Financial Statements for the social year ending on 12/31/2020, and

• CIRCULAR LETTER/CVM/SNC/SEP No. 02/2020, which deals with the possible impacts of the Coronavirus pandemic on the Financial Statements of entities under the supervision of this Autarchy and the expected performance on the part of independent auditors.

Circular Letter 1 (1257149) SEI 19957.003867/2021-89 / pg. 21

We inform that questions related to registration and performance within the securities market can be resolved by email: gna@cvm.gov.br, or through the phones (21) 3554-8397 or 3554-8615, as soon as the restrictions imposed by the COVID-19 pandemic allow.

---

1 - The review reports cited in parentheses reflect the types of reports contained in the review of NBC PA 11, approved on December 8, 2017, with effects from 01.01.2019.

Sincerely,

Document electronically signed by Madson Vasconcelos, Manager, on 05/07/2021, at 12:36, based on Art. 6 of Decree No. 8.539, of October 8, 2015.

Document electronically signed by Paulo Roberto Gonçalves Ferreira, Superintendent, on 05/07/2021, at 12:38, based on Art. 6 of Decree No. 8.539, of October 8, 2015.

The authenticity of the document can be checked on the site https://sei.cvm.gov.br/conferir_autenticidade, informing the code verifier 1257149 and the CRC code 0533B071.

This document's authenticity can be verified by accessing https://sei.cvm.gov.br/conferir_autenticidade, and typing the "Código Verificador" 1257149 and the "Código CRC" 0533B071.

Reference: Process No. 19957.003867/2021-89 SEI Document No. 1257149 Circular Letter 1 (1257149) SEI 19957.003867/2021-89 / pg. 22