Circular Letter CVM/SNC/GNA 01/22: Clarifications on the Role of the Independent Auditor in the Securities Market

COMISSÃO DE VALORES MOBILIÁRIOS
Rua Sete de Setembro, 111/2-5º e 23-34º Andares, Centro, Rio de Janeiro/RJ – CEP: 20050-901 – Brasil - Tel.:
(21) 3554-8686
Rua Cincinato Braga, 340/2º, 3º e 4º Andares, Bela Vista, São Paulo/ SP – CEP: 01333-010 – Brasil - Tel.: (11) 2146-2000 SCN Q.02 – Bl. A – Ed. Corporate Financial Center, S.404/4º Andar, Brasília/DF – CEP: 70712-900 – Brasil -Tel.:
(61) 3327-2030/2031 www.cvm.gov.br
Circular Letter No. 1/2022-CVM/SNC/GNA
Rio de Janeiro, April 5, 2022.
Subject: Clarifications related to the performance of the independent accountant auditor within the securities market.
Dear Independent Auditor,
As a direct result of the supervision and inspection actions regarding the auditing activity within the securities market, we list below some points related to registration with the CVM, performance in the securities market, and the application of professional standards for independent accounting auditing in the execution of work, for which we request special attention from the independent auditor registered with this Commission.
Index:

Introduction
SECTION I – NEW TOPICS (NOT ADDRESSED IN CIRCULAR LETTERS FROM PREVIOUS YEARS)
Auditing Technical Communication - CTA 30
Summarized financial statements published in printed newspapers
Immaterial distortions with significant potential to become material in the future
Circumstances of impediment and incompatibility (Art. 22 to 24 - CVM Resolution No. 23/2021)
Transparency in the audit report
Main issues pointed out in recent years by IFIAR
Circular Letter 1 (1474792) SEI 19957.002839/2022-25 / pg. 1

SECTION II – RECURRENT TOPICS STILL RELEVANT – UPDATED
8. Registration as Independent Auditor (Art. 1st to 6th-A – CVM Resolution No. 23/2021)
9. Proof of auditing activity (Art. 7th - CVM Resolution No. 23/2021)
10. Periodic Information (Art. 16 – CVM Resolution No. 23/2021)
11. Registration Update and Electronic Declaration of Conformity (art. 2nd, items I and II of CVM Resolution No. 51/21)
12. Communications regarding art. 24 of CVM Resolution No. 50/21
13. External Quality Review Program (Art. 33 – CVM Resolution No. 23/2021)
14. Continuing Professional Education Program (Art. 34 – CVM Resolution No. 23/2021)
15. Auditor Rotation (Art. 31 – CVM Resolution No. 23/2021)
16. Issuance of Circumstantial Report (art. 25, item II, CVM Resolution No. 23/2021)
17. Audit Report and Key Audit Matters
18. Technical Qualification Examination - specific CVM test (art. 30, CVM Resolution No. 23/2021)
19. Composition of audit teams (art. 25, item VII, CVM Resolution No. 23/2021)
20. Single Registry (art. 11, sole paragraph, CVM Resolution No. 23/2021)
21. Auditing of financial statements of Investment Funds in Credit Rights - FIDC, Real Estate Receivables Certificates - CRI and Agricultural Business Receivables Certificates - CRA
22. Auditing of accounting estimates and related disclosures - NBC TA 540 (R2)
23. Preparation of audit reports – modification of opinion
24. Independent Auditor – Legal Entity: corporate types and liability of partners
25. Recognition of tax credits and their possible effects on the audit report
26. Relevant aspects to be observed in the review of Explanatory Notes and in the evaluation of other information contained in the Financial Statements in initial registration requests for open companies
27. Digital Protocol

Introduction
On April 1, 2021, CVM Resolution No. 23 entered into force. The aforementioned standard revoked CVM Instruction No. 308/99 and updated the regulation of the independent auditing activity within the securities market. However, it is important to emphasize that the foundations guiding the regulatory activity of the Securities and Exchange Commission of Brazil (CVM) on the subject remain valid and up to date. They are:
the importance of an independent auditing system as an indispensable support for the regulatory body; the figure of the independent auditor as an essential element for market credibility and as an instrument of inestimable value in investor protection, insofar as its function is to ensure the Circular Letter 1 (1474792) SEI 19957.002839/2022-25 / pg. 2

fidelity and reliability of the audited entity's financial statements; the accuracy and clarity of the financial statements, including the disclosure in explanatory notes of information indispensable for viewing the asset and financial situation and the results of the audited entity, also depend on an effective auditing system and, fundamentally, on the auditor's awareness of their true role within this context; and the need for the market to have highly qualified independent auditors who, at the same time, enjoy a high degree of independence in the exercise of their activity. It is important to note that CVM Resolution No. 23 established the possibility for auditing firms registered with the CVM to use other corporate forms, previously restricted to the format of a pure simple partnership. Regarding this topic, item 24 (below) provides more information.
SECTION I – NEW TOPICS (NOT ADDRESSED IN CIRCULAR LETTERS FROM PREVIOUS YEARS)
2. Auditing Technical Communication - CTA 30
Since 2019, the supervision actions of the SNC have been detecting audit reports that do not comply with independent auditing professional standards regarding financial statements of companies under criminal investigation, including those of their directors and managers. These reports presented generic reservations without specifying the relevant impacts on the statements or without clearly indicating the factors that led the auditors to conclude on their use. After the issuance of several alert letters by the SNC, and concomitant interaction with Ibracon, the Federal Council of Accounting (CFC) published, on July 1, 2021, the Auditing Technical Communication (CTA) 30, which standardizes and guides independent auditors on the impacts on auditing, measurement, and evaluation arising from these situations. The Technical Communication also guides on the possible reflections in the opinion contained in the audit reports of the financial statements of entities involved in matters related to non-compliance with laws and regulations, illegal acts, or fraud.
3. Summarized financial statements published in printed newspapers
Guidance Opinion 39 published by the CVM on December 20, 2021, deals with the requirements to be observed in the publication of summarized financial statements, according to the new wording of art. 289, I and II, of Law 6.404/76:
https://www.gov.br/cvm/pt-br/assuntos/noticias/cvm-divulga-parecer-deorientacao-sobre-demonstracoes-financeiras-resumidas.
We emphasize that the summarized report of the independent auditor, when published, must be prepared from the complete independent auditor's report, which must be duly disclosed in an electronic address clearly referenced in the summarized publication.
In our monitoring activities, it has already been possible to observe that some important information recorded in the audit report is being omitted in the final summarized form (“extract of the relevant information from the report”). We remind you that item 4 of CVM Guidance Opinion No. 39 defines the minimum content that the summarized independent auditor's report must contain.
However, this minimum content does not limit its application, nor does it exclude the need to disclose other relevant information existing in the audit report. Thus, it is the understanding of this SNC that, if when recording emphasis paragraphs in their report, the auditor considers it necessary to draw the users' attention to a subject presented or disclosed in the financial statements that, in their judgment, is of such importance that it is fundamental for the users' understanding of the financial statements, it is not acceptable for such information to be excluded from the summarized audit report. This understanding applies to any emphasis paragraph contained in the auditor's report and, in an even more substantial way, to those related to the going concern risk of the audited entity. We therefore reaffirm that it is the responsibility of the independent auditor to verify if the information published in condensed form is in consonance with the complete audited financial statements and with the report issued by the independent auditor on these complete financial statements, in line with the provisions of article 25, I of CVM Resolution 23/2021. We also clarify, as also disclosed in Circular Letter No. 01/2022 issued by Ibracon, that the publication of summarized financial statements cannot be accompanied by the publication of the auditor's report on the complete financial statements, issued under NBC TA 700. The publication of an “extract of the relevant information from the report” is not confused with the publication of parts of the report nor does it constitute an opinion on the aforementioned summarized financial statements.
4. Immaterial distortions with significant potential to become material in the future
As a basis for the auditor's opinion, the NBCs TA require that they obtain reasonable assurance that the financial statements as a whole are free from material misstatement, regardless of whether caused by fraud or error.
Thus, the concept of materiality is applied by the auditor in the planning and execution of the audit, as well as in the evaluation of the effect of identified distortions on the financial statements. In general, distortions, including omissions, are considered material if it is reasonable to expect that, individually or jointly, they influence the economic decisions of users made based on the financial statements.
Judgments about materiality are established taking into account the circumstances involved and are affected by the perception the auditor has of the needs of the users of the financial statements and by the size or nature of a distortion, or by a combination of both.
In this sense, we emphasize that, when evaluating the “size” of the identified distortions, the auditor must, among other things, consider their potential for growth in the long term, that is, their potential to become material in the future.
5. Circumstances of impediment and incompatibility (Art. 22 to 24 - CVM Resolution No. 23/2021)
The SNC understands that independence is perhaps the greatest factor, if not the only one, that differentiates the accounting professional who works within the company from that who provides independent auditing services. Technical competence, responsibility, integrity, objectivity, and ethics are elements common to both. The great differentiator is the degree of independence to which both are subject. Moreover, the most relevant aspect of independence is not the fact that the auditor is independent, but rather if, in addition, they appear to be independent, that is, if the people who are supposed to benefit from their work see the auditor as an independent person or firm. This is fundamental for maintaining confidence in the system. Considering mainly this last aspect, CVM Resolution No. 23/2021 prohibits the provision of certain consulting services to audit client companies, such as: corporate restructuring, business valuation, asset revaluation, determination of the values of technical provisions or provisions for contingencies, tax planning, and remodeling of accounting, information, and internal control systems. Furthermore, CVM Resolution No. 23/2021 prohibits the independent auditor and persons linked to them from acquiring or maintaining securities or financial instruments of the audited entity. Persons linked to the independent auditor are those with whom they maintain a bond, relationship, participation, or have an interest, as defined by the Federal Council of Accounting (CFC) in professional independence standards and which prevents them from performing auditing services.
6. Transparency in the audit report
It is essential for fulfilling the role of the independent auditor that their opinion is expressed clearly through a written report, which involves, among other information, transparency in communicating key audit matters, and, when applicable, in preparing emphasis paragraphs, and in describing the subject(s) that gave rise to the modification of the opinion.
These items in the report require the auditor's additional attention, with a view to the needs of the users of the financial statements, and must be written in a way that allows these users to fully understand the information that must be transmitted.
As described in NBC TA 701, the communication of key audit matters aims to make the audit report more informative, by providing greater transparency about the audit performed, providing additional information to the intended users of the financial statements, to help them understand the matters that, in the auditor's professional judgment, were the most important in the audit of the financial statements of the current period, potentially helping them also understand the entity and areas that involved significant management judgment. With regard to this, for sensitive topics, identified during audit work, that have been the subject of professional judgment, both by preparers of financial statements and by independent auditors, the technical areas of the CVM recommend adopting the following steps, extracted from a conceptual framework for professional judgment, also reported in Circular Letter CVM/SNC/SEP 01/22:

Elucidate the problem and the informational objectives to be achieved;
Consider the alternatives and available choices;
Gather and evaluate the necessary information;
Reach a conclusion; and
Articulate and document the rationale for the decision.
As stated in the aforementioned Circular Letter, we emphasize that it is important that in this process of professional judgment, “mental traps” are avoided, which originate from informational restrictions, influences, preconceived ideas, and biases.
We highlight that teams of experienced professionals in the subject, involved in the professional judgment process, help mitigate the risks arising from “mental traps”; however, they do not exempt the auditor from their responsibility for their independent opinion, and for the application of the requirements contained in the applicable professional standards.
The auditor must remain attentive, among other things, to signs of management bias, without failing to also observe what is described in item 22 of this Circular Letter.
We also emphasize that, to achieve the intended degree of transparency, such communications must not be standardized; they must be drafted specifically for the subject and for the entity to which they refer.
Circular Letter 1 (1474792) SEI 19957.002839/2022-25 / pg. 5
Main issues pointed out in recent years by IFIAR
We list below the topics of the main findings in auditor inspections in recent years, pointed out by regulators associated with IFIAR, and consistent with those also verified in our supervision work and inspections.
Accounting estimates, including fair value measurement:

reasonableness of assumptions – when testing an accounting estimate, failure to assess the reasonableness of assumptions, including consideration of contradictory or inconsistent evidence;
failure in the sufficiency of tests of data accuracy;
failure to perform sufficient risk assessment procedures;
failure to adequately consider indicators of bias;
failure to consider relevant variables;
failure to assess how management considered alternative assumptions.
Internal control tests:
failure to obtain sufficient persuasive evidence to support confidence in manual internal controls;
failure to sufficiently test controls over, or the accuracy and completeness of, data or reports produced by management;
failure to sufficiently test general information technology controls;
failure to sufficiently assess the severity of control deficiencies;
failure to adequately adjust tests as a result of ineffective controls;
failure to adequately assess the appropriateness of reliance on the work of others.
Revenue Recognition:
failure to sufficiently understand the terms and conditions of complex agreements and the impact on accounting;
failure in procedures to determine if revenue was recognized in the correct period;
failure to assess and respond appropriately to fraud risks in revenue recognition.
Adequacy of presentation and disclosure in financial statements:
failure to sufficiently consider the adequacy of disclosures in footnotes (excluding segment information)
failure to identify or assess the adequacy of classifications and presentations of financial statements, including Cash Flow Statements;
failure to evaluate and test segment information
Audit Sampling:
insufficient sample to reduce sampling risk to an acceptable low level;
sample selected for testing is biased and/or not representative of the population;
failure to identify the nature and cause of any deviation and to project errors to the population;
failure to design appropriate procedures to achieve the test objective and/or to perform adequate alternative procedures when necessary.
Group Audit:
Circular Letter 1 (1474792) SEI 19957.002839/2022-25 / pg. 6
failure to sufficiently consider the nature, timing, and extent of involvement with the work of component auditors, including evidence of reviews performed;
failure to develop a group audit plan and/or appropriately communicate instructions to the component auditor;
failure to appropriately calculate materiality for the group and for related audit components;
failure to appropriately resolve points identified by the component auditor.
SECTION II – RECURRENT TOPICS STILL RELEVANT – UPDATED

Registration as Independent Auditor (Art. 1st to 6th-A – CVM Resolution No. 23/2021)
Initially, it is worth clarifying that registration with the CVM does not constitute a new professional category, nor does it mean restriction of the exercise of the professional activity. On the contrary, the independent auditing activity is a prerogative of the legally qualified accountant registered with the Regional Accounting Council. This activity can be exercised individually or in partnership, whose partners must all be accountants, consequently, there are no incompatibilities between these norms and the disciplinary regime of the accountant professional category. The new resolution maintains the two existing forms of registration, namely: Independent Auditor – Natural Person (AIPN), granted to the legally qualified accountant who meets the requirements established in arts. 3rd, 5th, and 7th, and Independent Auditor – Legal Entity (AIPJ), granted to the firm integrated exclusively by accountants, registered with the Regional Accounting Council and who meets the requirements established in arts. 4th, 6th, and 7th. For partners or other accountants who maintain a professional bond of any nature with the auditing firm registered with the CVM (AIPJ) to issue and sign audit or review reports on behalf of the firm, it is mandatory to be registered as the technical responsible for said firm with the CVM. Resolution No. 23/2021 maintains the requirement that at least half of the partners of the auditing firm (AIPJ) be registered as the technical responsible for the firm with the CVM to exercise the auditing activity within the securities market, on behalf of the firm (end of item II of art. 4th). If, after obtaining the firm's registration, there is a change in the partnership, whether by exclusion or admission of partners, it is imperative that this relationship be maintained, under penalty of suspension or even cancellation of the respective registration until the situation is normalized (item II of art. 15). Among the other conditions for obtaining registration, it is fundamental that the exercise of the auditing activity be proven for a minimum period of 05 (five) years, consecutive or not. It should be clarified that this period is counted from the interested party's registration with the Regional Accounting Council (CRC), in the accountant category. The exercise of auditing activity prior to their registration in said category at the CRC constitutes non-compliance with professional standards. The interested party must present a copy of their accountant identity card, in the accountant category or, at their discretion, a registration certificate issued by the CRC. In this regard, it is recommended that the interested party verify if their professional identity card contains the date of effective registration at the CRC in the accountant category. Otherwise, it becomes necessary to send, in addition to the copy of the accountant's professional identity card, a certificate issued by the Regional Accounting Council, which must necessarily
contain the date of effective registration as an accountant. Absent the aforementioned date, for the purpose of determining the initial term for counting the time of exercise of the auditing activity at the Circular Letter 1 (1474792) SEI 19957.002839/2022-25 / pg. 7

the form of art. 7, the date of issuance of the professional identity card of the accountant presented will be considered. Also as guidance, even if for compliance with item III of art. 6-A of CVM Resolution No. 23/2021 it is possible to deliver only the "equivalent certificate, issued by the Regional Council of Accounting", we recommend that the audit firm, or the independent professional, opt for the delivery of the "copy of the professional identity card of the accountant", since most certificates do not contain the date of the professional's registration, hindering the verification of compliance with § 2 of art. 7 of the same resolution. In some cases, where there is a new issuance of the document, we recommend that copies of the previous documents also be sent, proving the effective date of registration in the professional category.

Regarding the proof of a legal office in the professional's own name, the License for Location and Operation or an equivalent competent document issued by the City Hall of the municipality where the professional exercises their activity must be sent. In the case of registration as AIPN, a document issued in the name of any partnership of which the interested party is a member will not be accepted.

Resolution No. 23/2021 maintains the requirements that all partners of audit firms registered with the CVM be accountants (initial part of item II of art. 4) and that the corporate purpose of these firms be exclusively focused on the provision of professional audit services and other services inherent to the accounting profession. Thus, in light of the sole paragraph of art. 966 of the Civil Code (CC), the simple - non-business - nature of these single-profession accounting partnerships is configured. Consequently, according to the final part of art. 1.150 of the CC, the Civil Registry of Legal Entities (RCPJ) is the competent registry for the constitutive acts and subsequent contractual amendments of these simple single-profession partnerships, even if they adopt one of the corporate types provided for business partnerships, as granted by the final part of art. 983 of the CC.

On this subject, it is also important to consider the clarifications established in Statement No. 57 – approved at the I Civil Law Day held by the Center for Judicial Studies of the Council of Justice of the Federal Court (CEJ/CJF). According to the aforementioned statement, "the option for the business type does not remove the simple nature of the partnership". Additionally, as clarified by Statement No. 382 – approved at the IV Civil Law Day (CEJ/CJF), the registration of partnerships observes the nature of their respective activities (business or non-business – art. 966); the remaining issues follow the norms pertinent to the adopted corporate type (art. 983).

As a condition for approval of registration requests (AIPN or AIPJ) or for the registration of the technical manager of an AIPJ with the CVM, items VI of art. 5, XII of art. 6 and V of art. 6-A of CVM Resolution No. 23/2021 also establish that copies of the certificates of approval of the respective accountants in the technical qualification exam – specific CVM test, instituted by item 3, letter "b" of NBC PA 13 (R2) of 08/21/2015, must be presented. It is worth highlighting that the copy of the Professional Registration Certificate in the National Registry of Independent Auditors (CNAI), by itself, does not constitute a competent document to meet the aforementioned requirements.

We emphasize that, from 01.01.2022, in order for the request for registration as an independent auditor with the CVM to be analyzed, it is also necessary to present proof of payment of the supervision fee instituted by Provisional Measure 1072/21, and incorporated by Law 14.317, of March 29, 2022, in the following terms:

Art. 4
...................................................................................................................
III - annually and paid in full with respect to the entire year to which it refers, according to the values expressed in reais and established in Annexes I, II and III of this Law, pro rata payment not admitted;

Circular Letter 1 (1474792) SEI 19957.002839/2022-25 / pg. 8

IV - upon the realization of a public offering of securities, subject to registration or exempt from registration by the CVM, with incidence on the value of the operation, as established in Annex IV of this Law; and

V - upon the request for initial registration as a participant in the securities market, as provided in this Law, or of the issuance of an equivalent authorizing act, in the case provided for in Annex V of this Law, pro rata payment not admitted and with full payment of the Tax regardless of the date of the request.

More information regarding the supervision fee can be obtained at https://www.gov.br/cvm/pt-br/assuntos/regulados/taxa-de-fiscalizacao .

For cancellation of registration as Natural Person Independent Auditor or as Legal Entity Independent Auditor, as well as for exclusion of technical managers, it is sufficient that a letter signed by the auditor's representative before the CVM be filed, requesting the aforementioned cancellation or exclusion.

Proof of audit activity (Art. 7 - CVM Resolution No. 23/2021)

To obtain registration as Independent Auditor - Natural Person (AIPN) or to integrate the registry of Technical Managers authorized to issue and sign audit and review reports in the name of an AIPJ registered with the CVM, the accountant must prove that they have exercised the activity of auditing financial statements for a period of no less than 05 (five) years, consecutive or not, from the date of their effective registration, in the accountant category, with the respective CRC. This proof must be met in the following way:

a) by presenting audit reports issued and signed by the interested accountant, published in a newspaper or specialized magazine or made available on the worldwide computer network, one publication being sufficient for each year. The published audit reports, to be accepted, must be in accordance with the norms of the Federal Council of Accounting (CFC) that are applicable. The publication must include, in addition to the audit report, the set of financial statements and their respective explanatory notes. In these cases, it is important that the name of the newspaper or magazine; the address of the worldwide computer network site and the date of publication are not omitted;

b) by proving that the interested accountant exercised the audit activity as an employee of an audit firm registered with the CVM. This proof will also only be counted from the date of the professional's registration in the accountant category, whether this registration is provisional or definitive. In cases of registration request as Independent Auditor - Natural Person, the interested accountant must also prove that they are no longer part of the employee staff of the employing audit firm, in compliance with the provisions of art. 11 of CVM Resolution No. 23/2021.

To prove the exercise of the audit activity in the manner indicated in item "b" above, the following must be presented: i) copy of the individual employee registration of the accountant in the employing audit firm, containing all information required by specific regulation and ii) copy of the work and social security card (CTPS) of the interested accountant, comprising the pages containing: the number and series of the CTPS; the qualification of the holder; the annotations regarding employment contracts and changes in salaries, vacations, positions or functions performed. Copies of the CTPS pages that are blank, i.e., in which no annotations have been recorded, do not need to be presented. Also, a declaration signed by a partner representative of the employing audit firm will be admitted in place of the copy of the individual employee registration, in which the qualification of the accountant; the dates of admission and departure from employment (if applicable); the position or function in which they were admitted and the dates on which changes in positions or functions occurred must necessarily appear.

Circular Letter 1 (1474792) SEI 19957.002839/2022-25 / pg. 9

Also as guidance, even if for compliance with item III of art. 6-A of CVM Resolution No. 23/2021 it is possible to deliver only the "equivalent certificate, issued by the Regional Council of Accounting", we recommend that the audit firm opt for the delivery of the "copy of the professional identity card of the accountant", since most certificates do not contain the date of the professional's registration, hindering the verification of compliance with § 2 of art. 7 of the same resolution.

An important fact to be considered is that, in the case of proof of the exercise of the audit activity in the manner indicated in item "b" above, the interested party must also prove that they exercised, for 05 (five) years, positions of direction, management or supervision in the area of auditing financial statements.

On this subject, it is important to mention that the understanding is consolidated, within the scope of the CVM's Superintendence of Accounting and Audit Standards (SNC), that the possibility of proof by partial periods, established in § 3 of art. 7 of CVM Resolution No. 23/2021, enables the counting of periods in the exercise of positions of direction, management and supervision for a period of less than 05 (five) years, in addition to the other forms of proof of experience provided for in the same article.

The CVM may also, at its exclusive discretion, accept that the proof of the exercise of the audit activity is made through the presentation of audit work performed that has not been published (§ 1 of art. 7 of CVM Resolution No. 23/2021). In this case, the interested party must present as proof of each work performed: the respective audit report, the corresponding detailed report (final report, encompassing the entire audited period) and the respective audited financial statements. In order to protect professional secrecy and guarantee its authenticity, it is indispensable that all these documents be authenticated by the audited entity, and must also contain authorization from the aforementioned entity for them to be presented to the CVM for the exclusive purpose of proving the exercise of the audit activity by the interested accountant. The mentioned authentication of documents must be met by the entry, on each page of the respective documents, of the signature of the legal representative of the audited entity along with the indication (stamped, handwritten or printed) that the copy matches the original. It is important to highlight that this mode of proof will also be subject to the evaluation of the quality of the work performed and may also include the availability of the respective working papers for CVM inspection.

As guidance, we clarify that the detailed report must contain, at a minimum, the following information: the name or denomination of the audited entity; the period covered by the examination; description of the deficiencies and inefficacy of the internal controls and accounting procedures adopted by the audited entity followed by recommendations for the required corrections; and the date of issuance, the identification and signature of the responsible auditor.

Periodic Information (Art. 16 – CVM Resolution No. 23/2021)

Independent auditors must send information related to their performance in the securities market to the CVM, until the last business day of April of each year, according to Annex D to CVM Resolution No. 23/2021. This information is important support for the CVM to evaluate the auditors' ability to adequately serve their clients.

This information must be sent via the internet, on the CVM page. The submission must be made through the option "REGULATED (https://www.gov.br/cvm/pt-br/assuntos/regulados)", selecting next the option "DOCUMENT SUBMISSION – CVMWEB (https://cvmweb.cvm.gov.br/swb/default.asp?sg_sistema=scw)" and then the option "DOCUMENT SUBMISSION".

We inform you that a change in the procedure for presenting such information was implemented since 2020. Now, when accessing the CVMWEB system to present the Annual Periodic Information provided for in art. 16 of CVM Resolution No. 23/2021, the auditor will be automatically directed to the verification of their registration data. After validation of the registration data, or its update, the auditor must, mandatorily, issue the Electronic Conformity Declaration. Only after this procedure will the independent auditor be redirected to the presentation of the Annual Periodic Information.

At this stage, there are two options for sending information: i) Document submission via form and ii) Document upload. Finally, the option "Annual Report of Independent Auditor" must be selected. The "document upload" option should only be used by those auditors who have more than 10 (ten) clients that are open companies (or part of the securities market or incentive companies), since in this case, it is necessary to create a file (XML standard) to send the required information.

Additionally, we remind you that from the effectiveness of CVM Resolution No. 23/2021, Annex D of the aforementioned Resolution presents in item 4.A the request for presentation of the financial statements of the audit firm (only legal entity) referring to the social exercise that serves as the basis for the annual information being presented, if the period prescribed by law for its elaboration has already elapsed; or to the penultimate closed social exercise, in other cases. The file containing the aforementioned financial statements must be in "PDF" format and must be sent together with the Annual Information through the document upload option provided.

We also alert that there is no longer a need to inform about courses and training carried out in the year of competence of the report, since this information is sent directly by the Federal Council of Accounting – CFC, to the CVM.

The presentation of this information late subjects auditors to a coercive fine, as provided in art. 18 of CVM Resolution No. 23/2021. We remind you that non-observance of the deadline for sending the information treated in this topic entails the collection of a daily coercive fine of R$ 200.00 (two hundred reais), according to CVM Resolution No. 47/21.

Registration Update and Electronic Conformity Declaration (art. 2, items I and II of CVM Resolution No. 51/21)

Regardless of the presentation of the periodic information required by CVM Resolution No. 23/2021, it is also necessary for independent auditors to keep their registration updated, observing a deadline of up to 07 (seven) business days from the event that caused the alteration. For this, it is necessary for independent auditors to access their registration data on the CVM page, proceeding with the appropriate update. In addition to the required update, annually and until the last business day of April (according to item II, art. 2 of CVM Resolution No. 51/21), the Independent Auditor must confirm that their registration data remains valid, by issuing the Electronic Conformity Declaration. The Electronic Conformity Declaration must be issued by accessing the option "REGULATED (https://www.gov.br/cvm/pt-br/assuntos/regulados)", selecting next the option "SERVICES TO PARTICIPANT CVM" and then the option "PARTICIPANT REGISTRATION UPDATE", then "ELECTRONIC CONFORMITY DECLARATION", on the CVM page. It is important to stress that, even in cases where there are no changes in the data on the site, the Electronic Conformity Declaration must be issued.

In order to facilitate the presentation of the Electronic Conformity Declaration, avoiding delays or non-presentation, a new functionality was made available on the CVM internet page. Since 2020, when accessing the CVMWEB system for the transmission of the Annual Periodic Information provided for in art. 16 of CVM Resolution No. 23/2021 (item 10 above), and which has the same presentation deadline, the auditor will be automatically directed to the verification of their registration data and updates that may be necessary. After confirmation of the registration data, or its update, the auditor will be directed

Circular Letter 1 (1474792) SEI 19957.002839/2022-25 / pg. 11 to the issuance of the Electronic Conformity Declaration. After the Electronic Conformity Declaration is issued, the auditor will be redirected to the presentation of the Annual Periodic Information.

For the issuance of the Electronic Conformity Declaration, the independent auditor must be selected (click on the box located before the auditor's name), confirming the registration data, or changing them if necessary, and then activating the option "SEND FORM". After sending the Electronic Conformity Declaration, the following information will appear: Form already sent? YES.

Finally, we emphasize that the non-presentation of the Electronic Conformity Declaration, or its presentation late, subjects the participant to a daily coercive fine, provided for in art. 6 of CVM Resolution No. 51/21, in the amount of R$ 200.00 (two hundred reais) for the legal entity participant and R$ 100.00 (one hundred reais) for the natural person participant.

Incidentally, considering that all communications from the CVM with independent auditors are carried out through electronic messages (e-mail), we reinforce the need for such addresses to be updated. Also on this subject, we remind you that the e-mail informed as the link of communication with the CVM is not protected by message barriers (anti-spam), as such functionality prevents the reception of forwarded messages. Unfortunately, we have received several message returns due to this tool. We highlight that such addresses are freely updated by independent auditors, characterizing the primary source of communication with the CVM. Thus, the existence of these control tools is the sole responsibility of the independent auditors, who assume the risk of their maintenance.

Communications related to art. 24 of CVM Resolution No. 50/21

With a view to faithful compliance with CVM Resolution No. 50/21, in particular, to the provisions of article 24, we reiterate that for the purposes of the provisions of item I of art. 11, of Law No. 9.613, of 1998, independent auditors must carry out monitoring, analysis and communication related to considering, at a minimum, the application of the procedures provided for in specific regulation issued by the CFC.

Due to a convention signed with the Federal Council of Accounting - CFC, the negative declaration (if applicable) must be made in the CFC environment of SISCOAF. Nothing prevents the auditor registered with the CVM from spontaneously, and on a supplementary basis, also sending suspicious communications or negative declaration to the CVM segment of SISCOAF.

External Quality Review Program (Art. 33 – CVM Resolution No. 23/2021)

We remind you that independent auditors must submit to external quality review to be carried out by another auditor registered with the CVM, with a view to also evaluating compliance with technical and professional standards, in accordance with a specific norm issued by the CFC. Currently, NBC PA 11 regulates the matter, to be observed by independent auditors.

Specifically regarding the performance of the reviewing auditor, we have observed several problems in the execution of review work. Such problems are, for the most part, related to the depth of the examinations carried out, as well as to the obtaining of appropriate and sufficient audit evidence, in order to support the opinion issued at the end of the work. It is important to stress that, from the sample of reviewing auditors selected for inspections in compliance with the Risk-Based Supervision Program (SBR) adopted by the CVM in recent years, we identified a high recurrence of problems in the execution of review work by reviewing auditors, leading to the adoption of complementary administrative procedures, by this Autarchy, including, the instigation of sanctioning administrative processes (Term of Accusation). In this sense, we remind you that the auditor

Circular Letter 1 (1474792) SEI 19957.002839/2022-25 / pg. 12

The reviewer must pay special attention to verifying compliance with the Professional Education Program (NBCPG 12 R3) and the procedures to be observed by professionals and accounting organizations to fulfill the obligations set forth in Law No. 9,613/1998 (CFC Resolution 1530/2017), by the audited auditor, in addition to those already listed in the external quality review questionnaire.

We remind you that non-compliance with the Program instituted by the CFC by the audited auditor also entails the application of administrative sanctions. In this sense, we remind you that §4 of art. 33 of CVM Resolution No. 23/2021 establishes:

§4 Non-compliance with the provisions of the caput in at least 2 (two) of the last 5 (five) years will result in the immediate suspension of the registration of the Independent Auditor – Natural Person, or the Independent Auditor – Legal Entity, until a new review of its quality control is presented, according to the guidelines of the Federal Council of Accounting, with a report issued without reservations, duly approved by the Management Committee of the External Quality Review Program, or equivalent, instituted by the Federal Council of Accounting – CFC.

It is important to emphasize that, since 2018, auditors who again failed to comply with the External Quality Review Program, as provided for in §4 above, had their registrations suspended at CVM. In such cases, and in those that are identified in the future, the auditor who wishes to reactivate their registration must, by their own act and without prior indication by the External Quality Review Committee – CRE, indicate their auditor-reviewer to the CRE, submitting themselves to an external quality review, within the deadlines and procedures defined by the standard governing the Program. At the end of the review, its results, conclusions, and recommendations must be presented to the CRE, so that the Committee can analyze the review performed by the auditor-reviewer, approving or not.

Unfortunately, we have observed movements in the direction of attempting to infringe compliance with the External Quality Review Program, notably in two ways:

Independent auditors indicated by the CFC to participate in the External Quality Review Program cancel their registration with CVM. Still within that fiscal year, or in the following year, they request new registration. In this case, as defined in the normative instruments of CVM and CFC, the auditor must submit to the Program in the next fiscal year (starting from the new registration). However, we have verified that some auditors do not submit to the Program upon their return. It is the understanding of this Superintendence of Accounting Standards and Auditing – SNC that these auditors, with this attitude, incur the situation described in §4 of art. 33 cited above. Thus, in already identified cases, as well as new ones, the SNC will adopt the suspension provided for in the standard.

Some independent auditors, despite submitting to the External Quality Review Program when indicated annually by the CFC, present recurrent problems in their reviews, which prevents the approval of the review by the CRE-CFC, being automatically indicated for the following year. We understand that the recurrence of this practice, year after year, constitutes an attempt to circumvent compliance with the external quality review. Therefore, we remind you that such auditors are subject to suspension of registration, in the manner of §4, of art. 33 of CVM Resolution No. 23/2021, in addition to the adoption of other administrative measures applicable to the case.

It should be emphasized that, once the suspension of registration for non-compliance with the External Quality Review Program is applied, provided for in §4 of article 33 of CVM Resolution No. 23/2021, the reactivation of the registration of the independent auditor (audited) with CVM will only occur if the external quality review process is approved by the CRE/CFC and provided that the external quality review report does not contain any reservations (report of quality system review adequate1). Reports of review issued with reservations (report of quality system review with deficiencies), abstention of opinion (report of quality system review with scope limitation to the reviewer's work), or adverse (report of inadequate quality system review), even if they meet the requirements provided for in the standard and are approved by the CRE/CFC, will not be considered valid for the reactivation of the independent auditor's registration. It should also be noted that the submission to the External Quality Review Program for these suspended auditors will be voluntary, at the request of the auditor themselves, since only auditors active in the CVM registry, and indicated by the CRE/CFC, are obliged to participate in said Program.

Continuing Professional Education Program (Art. 34 – CVM Resolution No. 23/2021)

Aiming to maintain a high standard of technical qualification and constant updating regarding professional standards, accounting and auditing procedures, and standards related to the exercise of their activity in the securities market, independent auditors registered with CVM must maintain, for themselves and their technical staff, a continuing education program in accordance with the guidelines approved by the CFC, contained in NBC PG 12 (R3).

In this regard, we remind you that non-compliance with the Continuing Professional Education Program by independent auditors – natural persons and independent auditors – legal entities, as well as their partners and/or technical managers, entails the application of administrative sanctions. On this subject, we bring §§ 1 and 2 of art. 34 of CVM Resolution No. 23/2021, which establish:

§ 1 The provisions of the caput apply to Independent Auditors – Natural Persons and partners, whether or not they exercise the activity of auditing, technical managers, directors, supervisors, and managers of Independent Auditors – Legal Entities.

§ 2 Non-compliance with the provisions of the caput in at least 2 (two) of the last 5 (five) years will result in the immediate suspension of the registration of the Independent Auditor – Natural Person, or the registration as technical manager of Independent Auditor – Legal Entity, until a new certificate of approval in the Technical Qualification Exam, provided for in art. 30 of this Resolution, is presented, regardless of the adoption of other administrative measures applicable.

It is worth clarifying that, due to the joint action of this Autarchy with the Continuing Professional Education Commission – CEPC, instituted by the CFC for management and monitoring of the Program, it is not necessary to present the annual activity report related to Continuing Education to CVM. Said report must be delivered annually to the respective Regional Council of Accounting – CRC, as defined in NBC PG 12 (R3). Proof of compliance with the Continuing Professional Education Program is homologated by the CFC/CRCs system.

We remind you that, regardless of participation in external courses and activities, independent auditors must have mechanisms for timely monitoring of changes in independent auditing professional standards issued by the CFC and, when applicable, by the Institute of Independent Auditors of Brazil - IBRACON, and standards that regulate the activity of independent auditing within the securities market.

At the request of the CFC, we also inform that, considering the control of the covid-19 pandemic and the resumption of in-person activities, the minimum score required for professionals obliged to comply with the Program returns, starting from 2022, to its normative condition, that is, 40 (forty) points – with at least 8 (eight) points to be fulfilled with knowledge acquisition activities, contained in Table I of Annex II – as provided for in item 7 of NBC PG 12 (R3).

In the tables contained in NBC PG 12 (R3), the maximum and minimum limits established are informed, as follows:

Table I – Knowledge acquisition: minimum of 8 points
Table II – Teaching: limited to 20 points per year
Table III – Participation as a participant: limited to 20 points per year
Table IV – Intellectual Production: limited to 20 points per year

Auditor Rotation (Art. 31 – CVM Resolution No. 23/2021)

We remind you that the Independent Auditor - Natural Person and the Independent Auditor - Legal Entity cannot provide services to the same client for a period longer than five consecutive fiscal years, requiring a minimum interval of three fiscal years for their re-hiring, regardless of the period in which the auditor provided services to the audited entity.

For its part, we highlight that the only exception permitted is that in which the audited company has a Statutory Audit Committee – CAE, installed and fully functioning, until the date of closing of the third fiscal year starting from the hiring of the independent auditor, and remain in operation after said date and while using the aforementioned prerogative; and that this auditor is a legal entity, as provided for in art. 31-A of the same Resolution, conditioning, furthermore, to the observation of the requirements contained in arts. 31-B to 31-F, all of the same Resolution. It must be emphasized that the primary responsibility of the auditor is to meet the rotation requirement, renouncing the client when the occurrence of a situation characterizing non-compliance with the standard is verified, notwithstanding the responsibility of the administrators of the audited entity for the eventual hiring and maintenance of independent auditors who do not meet the conditions provided for in the Resolution (art. 27 – CVM Resolution No. 23/2021).

We also alert that rotation cannot be carried out with another audit firm with which the replaced auditor has common interests, nor that they use the same physical and operational structure as the previous auditors. Below, we cite some examples of situations that may characterize non-observance of the auditor rotation rule, in addition to others of the same nature:

a) use of the same address (headquarters and offices, if any); b) direct kinship relationship between partners and technical managers of audit firms (replaced and current); or c) creation of "new" audit firms for service provision, with the existence of partners and/or technical managers previously linked to the replaced auditor.

Additionally, we draw attention to the eventual re-hiring of the replaced auditor. Regardless of whether or not the period defined in the standard for consecutive audit services for the same client is reached (five fiscal years, in normal situations; up to ten fiscal years for cases where there is a CAE, in operation and in adherence to the requirements of Resolution 23/2021), their re-hiring can only occur after a period of 03 (three) fiscal years. For example, if AUDITOR "A", after 02 (two) fiscal years of providing services to the audited, was replaced by AUDITOR "B", AUDITOR "A" can only return to provide audit services after 03 (three) fiscal years of their replacement, in any hypothesis.

In other words, we clarify that the rule of mandatory rotation of independent auditors is composed by the conjugation of the maximum linkage periods and the minimum interval of withdrawal, both necessary to achieve the objective sought by the normative activity in establishing said rule. As highlighted above, art. 31-A of CVM Resolution No. 23/2021 established an express hypothesis that exempts the maximum linkage period, allowing its extension to up to 10 (ten) years, if the audited entity has a Statutory Audit Committee (CAE) in permanent operation and the hired independent auditor is a legal entity. However, there is no hypothesis provided for in the same resolution that contemplates an exception, reducing the minimum interval established. As can be seen, there is no proportionality relationship between the linkage period and the minimum withdrawal period. Thus, for any duration of the linkage period of the independent auditor with the audited entity, the minimum interval of 3 (three) fiscal years, before the start of a new linkage period, must equally be respected.

Regarding the re-election of members of the Statutory Audit Committee (CAE) by re-election, without interregnum between mandates, it is understood that it is possible to re-elect those members. We emphasize, however, that in the occurrence of any gap between mandates, the explicit in § 4o of Art. 31-C of CVM Resolution No. 23/21 must be applied. Furthermore, in any hypothesis, the maximum period of 10 (ten) years provided for in the caput of Art. 31-C must be observed.

Issuance of Detailed Report (art. 25, item II, CVM Resolution No. 23/2021)

Art. 25, item II, of CVM Resolution No. 23/2021 provides that the independent auditor must "prepare and send to the administration and the Fiscal Council, a detailed report containing their observations regarding the internal controls and accounting procedures of the audited entity, describing, furthermore, any deficiencies or inefficiencies identified during the course of the work".

In this sense, ratifying the provisions in the cited normative text, we clarify that the issuance of said detailed report at the end of the work is expressly mandatory in any hypothesis, regardless of whether deficiencies or inefficiencies were identified or not in the examined environment. That is, although the independent auditing professional standard dealing with the subject (NBC TA 265) determines the mention in the report only of significant deficiencies, if any, the detailed report required by CVM Resolution No. 23/2021 is more comprehensive, requiring the issuance of the report at the end of each work.

As already cited in item 3 supra, we reinforce that the detailed report must contain, at minimum, among other information, the description of the deficiencies and inefficiencies of the internal controls and accounting procedures adopted by the audited entity accompanied by the recommendations of the independent auditors for the corrections that may be necessary. As can be seen, such points integrate the minimum set of information that the detailed report must contain. However, they do not exhaust the content of said report.

Furthermore, it is important to emphasize that said report, in consonance with the cited professional standard, must segregate significant deficiencies from non-significant ones. In those extremely rare situations, in which the independent auditor concludes by the non-identification of internal control deficiencies (significant or not), the report to be issued will be affirmative, that is, it must affirm the non-identification of internal control deficiencies, whether significant or not, during the performance of the work.

Such procedure allows minimal proof that the independent auditor executed the evaluation of internal controls and accounting procedures provided for in the standard issued by CVM and by the independent auditing professional standards. It is always important to remember that it is the responsibility of the administration of the audited entity to ensure the adequacy of the internal controls that it determined as necessary to allow the preparation of financial statements free from material misstatement, and to the auditor, to consider internal control to plan audit procedures that are appropriate under the circumstances; but not for the purpose of expressing an opinion on the effectiveness of internal control.

In this context, we reinforce that the auditor must, furthermore, during the course of audit work in subsequent years, establish specific monitoring of those deficiencies pointed out in the previous report, as well as their outcome in relation to the administration's actions, to determine whether such deficiencies should continue to be communicated in the detailed report, or if those initially considered "non-significant" have changed their status due to their recurrence, without actions by the administration of the audited entity over the examined periods.

It is important to remember, furthermore, about said report, that in NBC TA 265 – Communication of Internal Control Deficiencies, the deadline for issuing written communication is detailed in item A13, as follows:

When determining when to issue written communication, the auditor may consider whether the receipt of this communication would be an important factor to allow those charged with governance to perform their general supervision responsibilities. Furthermore, for entities listed on stock exchanges in certain jurisdictions, those charged with governance may have to receive written communication from the auditor before the date of approval of the financial statements to perform specific responsibilities regarding internal control, for regulatory purposes or to meet other purposes. For other entities, the auditor may issue written communication at a later date. However, in the latter case, considering that the auditor's written communication about significant deficiencies is part of the final audit file, the written communication is subject to the requirement of item 14 of NBC TA 230, which requires the auditor to timely assemble the final audit file.

NBC TA 230 establishes that the appropriate time limit for the completion of the assembly of the final audit file is normally no more than 60 days after the date of the independent auditor's report (NBC TA 230, item A21). (our emphasis)

Therefore, the independent auditor must make efforts to receive the administration's comments within a period of up to 60 (sixty) days after the date of the respective audit report. In cases where there is no response from the administration, the fact must be recorded in that final audit file, together with the discussion version sent, being considered "final" from that moment.

Audit Report and Key Audit Matters

As is widely known, in 2016, the audit report was altered in its form and content. There was, in the first year of application of the standard, doubt and discussion regarding the scope of the new section, given that the standard treated as mandatory the inclusion of key audit matters for listed companies. In response to a consultation from IBRACON regarding the scope of this term, the CVM Collegiate decided:

After discussion of the subject, the Collegiate deliberated, unanimously, to partially defer the IBRACON appeal in order to fix the understanding that, within the scope of the market regulated by CVM and for the purposes of NBC TA 701, the concept of listed entities encompasses entities authorized by a market administrator to negotiate their securities in an organized market. Notwithstanding, in line with the understanding of the SNC, the Collegiate recognized the importance and convenience that the innovations brought by that auditing standard be observed by all entities registered with CVM. Thus, the Collegiate deliberated to return the theme to the SNC to prioritize a normative alteration process in order to expressly provide for the disclosure of KAMs for all entities registered with CVM already in relation to

to the exercises to be closed from 31.12.2017.
Following the recommendation of the collegial board, from 2017, the inclusion of Key Audit Matters (KAMs) was established for all entities regulated or supervised by the CVM, including investment funds, as determined by item VIII, of Art. 25 of CVM Resolution No. 23/2021:

VIII – communicate the key audit matters in the audit reports of financial statements of all entities regulated or supervised by the CVM, in accordance with the professional standards of independent auditing approved by the Federal Council of Accounting - CFC.

In turn, in connection with international discussions on the subject, the Institute of Independent Auditors of Brazil – IBRACON, issued circular no. 07/2017 – DN, which strongly recommends the explicit inclusion of the results of audit procedures in the KAMs and provides some examples of their presentation, making it clear that these are merely illustrative examples and without the purpose of suggesting any standardized wording, which would be incompatible with the main objectives of the new report, which, in the end, are to make it more informative and transparent to its users.

It is relevant to emphasize that, in order to achieve such objectives, it is essential that the description of the procedures carried out by the auditor and the results achieved present informationally relevant content for users, not restricting themselves to generic presentations of what was done and vague assertions regarding the adequacy of the subject as a whole to the financial statements.

Regarding the content, it is reasonable to conclude that various users expect that the following items, among others possible, be described in the Key Audit Matters section, even if not fully required by NBC TA 701, which we understand as improvements applicable by the auditor when preparing their audit report:

specific audit procedures for the risk under discussion;
information on the use of the work of experts and/or internal auditors;
specific audit procedures related to applicable internal controls and whether, as a result of the application of the procedures carried out by the auditor, possible deficiencies in their effectiveness were detected;
any difficulties in applying planned procedures;
changes in the planning of procedures executed, in the scope or depth of audit tests;
whether, during the execution of audit procedures, adjustments were identified, recorded or not by the entity's management, even if they are not considered material by the auditor.

Additionally, considering the dynamics of the economic and business environment, as well as the diversity of activities, processes, and systems of the audited entities, it is expected that audit reports be effectively individualized, not being mere repetitions of the key audit matters of the previous exercise, nor composed of standardized KAMs, established internally by the audit firm, for the firm as a whole or by sector of activity of the audited entities.

In this sense, given the provisions of items I, II, and III, art. 25-A of CVM Instruction No. 480/09, added by CVM Instruction No. 600/18 (regarding the financial statements of separate assets) and the provision in item VIII, art. 25, of CVM Resolution No. 23/2021, which deals with Key Audit Matters, we remind you that each separate asset is considered an entity that reports information for the purpose of preparing individual financial statements. Therefore, the professional standards of independent auditing must be observed when issuing the respective audit report, including NBC TA 701 which deals with the subject.

Technical Qualification Examination - specific CVM exam (art. 30, CVM Resolution No. 23/2021)

On 21.08.2015, NBCPA 13 (R2) was approved, which deals with the Technical Qualification Examination, instituted by the Federal Council of Accounting – CFC.

Thus, considering that the aforementioned NBCPA 13 (R2) altered the functioning model of said Examination, creating a specific exam for acting in entities regulated by this Autarchy, it is worth recalling the provision in article 30, of CVM Resolution No. 23/2021, which determines that the Technical Qualification Examination will be carried out with a view to qualifying the independent auditor for the exercise of the activity of auditing accounting statements for all entities comprising the securities market.

NBCPA 13 (R2), in its item 3, letter “b”, instituted the specific exam for acting in entities regulated by the Securities and Exchange Commission (CVM).

That is, from the entry into force of NBCPA 13 (R2), the Technical Qualification Examination – “CVM” became the necessary technical qualification exam for registration with this Autarchy.

Additionally, it is worth clarifying that approval in a specific technical qualification exam “CVM” is, only, one of the necessary requirements for registration at the CVM. The fact of being active in the National Registry of Independent Auditors (CNAI), maintained by the Federal Council of Accounting, does not guarantee, by itself, compliance with this requirement, given that many professionals included in the CNAI were not approved in the Technical Qualification Examination, but migrated from the CVM registry when it was created. We clarify that accountants already registered at the CVM as technical managers or Natural Person Independent Auditor - AIPN and who wish to change category or transfer to the registry of another Independent Auditor Legal Entity - AIPJ do not need to present the certificate of approval in the technical qualification exam if the change occurs concomitantly, that is, without discontinuity of the professional's registration with the CVM. Thus, professionals who were previously registered at the CVM as technical managers of an audit society are subject to proof of approval in said exam if the request for inclusion in another auditor, or in an audit society of which they were previously the technical manager, occurs after the cancellation of their registration as technical manager in the previous auditor or in that audit society where they exercised that function.

In turn, with the adoption of the specific “CVM” technical qualification exam, we highlight that, after being approved in that exam, and until their registration or record at the CVM, the professional interested in obtaining such prerogative must remain up to date with the requirements of the Continuing Professional Education Program, proving their regularity through a specific certificate issued by the Federal Council of Accounting (items VII of art. 5º; XIII of art. 6º and VI of art. 6º-A of CVM Resolution No. 23/2021). If the aforementioned proof is not possible, the requesting professional must submit again to the specific technical qualification exam for the CVM and obtain the respective approval.

We also clarify that all members of audit teams who perform managerial functions must also have been approved in said exam, as detailed in item 13 below.

Composition of audit teams (art. 25, item VII, CVM Resolution No. 23/2021)

One of the novelties presented in the alteration of ICVM 308/99 that occurred in 2017 concerns the composition of the teams that carry out audit activities. Item VII, art. 25, of CVM Resolution No. 23/2021 (which replaced ICVM 308/99) determines that the auditor must:

VII – ensure that all partners, directors, managers, supervisors or any other members, with a management function, in the team destined to the exercise of the audit activity in entities regulated by the CVM, have been approved in the Specific Technical Qualification Examination for the CVM.

Thus, when planning audit teams, auditors must pay attention to the fact that all those components who perform a management function, such as, partners, directors, managers or supervisors, among other possible positions, have been approved in the Specific Technical Qualification Examination for the CVM.

It is important to emphasize that item VII of art. 25, combined with the provision in the caput and in §1º of art. 34, all of the aforementioned CVM Resolution No. 23/2021, ratifies the obligation that such professionals pay attention to the annual compliance with the Continuing Professional Education Program, after their approval in said exam. Non-compliance with the guidelines imposed by the Federal Council of Accounting regarding the Continuing Professional Education Program by the aforementioned professionals may lead to the adoption of administrative measures against the independent auditors linked to them, as stated in item 05 of this circular.

Regarding specifically the accountants already registered as technical managers authorized to issue and sign audit reports on behalf of each audit society, within the scope of the securities market, it should be noted that, upon their requests for inclusion in the registry of technical managers, they complied with all the requirements that allowed them to have their registration requests approved by the CVM.

Thus, it is settled understanding in the SNC that technical managers, as such already registered with this Autarchy and while maintaining their current active registration, do not need to be approved in the Specific Technical Qualification Examination for the CVM, even though the voluntary realization of said exam is a technically recommendable condition as it is addressed to the indispensable and continuous technical improvement of professionals who act in the securities market.

Single Registry (art. 11, sole paragraph, CVM Resolution No. 23/2021)

The sole paragraph of art. 11 of CVM Resolution No. 23/2021 seeks to establish a relationship of equity between the treatment given to the independent auditor – natural person and the independent auditor – legal entity and their technical managers. As stated in the norm, it is not allowed to register, in the category of Independent Auditor - Natural Person, an accountant who is a partner, director, or technical manager or who has a professional link of any nature with Independent Auditor - Legal Entity. However, for the partner, or technical manager, of an independent auditor – legal entity registered at the CVM, there was no impediment to participation, also as a partner and/or technical manager, in another audit society registered at the CVM.

We therefore had an asymmetric situation that benefited one participant to the detriment of another.

It is worth mentioning that the limitation of participation of a partner to only one audit society registered at the CVM does not characterize non-observance of the constitutional right of free association. In truth, there is no impediment to the free association of the professional; they may have as many associations and participations as they wish, even within the same economic group.

However, participation in an independent auditor – legal entity registered at the CVM, whether as a partner or as a technical manager, will be limited to only 01 (one) audit society. Therefore, requests for new registrations of audit societies or inclusion of technical managers that are out of compliance with this determination will be promptly denied.

Audit of financial statements of Investment Funds in Credit Rights - FIDC, Real Estate Receivables Certificates - CRI and Agribusiness Receivables Certificates - CRA

The OFFICIAL LETTER/CVM/SIN/SNC/ No. 01/2012, guides independent auditors who act in “FIDC” funds regarding certain procedures that they must execute regarding the credit rights held by the funds, including the verification of existence and adequate pricing, considering, furthermore, issues related to provisions for losses on these rights, which is dealt with in CVM Instruction No. 489/11.

In this context, we reinforce that the aforementioned OFFICIAL LETTER also applies to the audit procedures to be carried out for the financial statements of the separate assets of CRI and CRA, required by art. 25-A of CVM Instruction No. 480/09, in order to complement the guidelines of OFFICIAL LETTER No. 2/2019/CVM/SIN/SNC, through which we highlighted that the functioning dynamics of CRI and CRA are similar to those of FIDC, making the application of CVM Instruction No. 489/11 appropriate.

Audit of accounting estimates and related disclosures - NBC TA 540 (R2)

We have verified, in recent years, recurrent failures of auditors in meeting the requirements of NBC TA 540 (R1) / NBC TA 540 (R2), in the audit of accounting estimates, including, but not limited to, the audit of impairment tests, fair value, and related disclosures.

Thus, follow our considerations on the main non-compliances verified:

as part of the validation of the calculation methodology used, it is expected that the auditor, among other procedures, verifies the comparison of historically calculated estimates with what was actually realized, analyzing the reasons for the discrepancies found, and also if the methodology needs any adjustment to be used again in the audited period;
when planning the use of independent calculations (including sensitivity analyses), the auditor must establish an expectation, formalizing in their working papers the acceptable limits of difference in relation to management's calculations and what their objective is with that work;
it is essential that the auditor validates the premises and data (including historical data) used to calculate the estimate;
it is part of the auditor's responsibility to verify if the required disclosures are being made, requesting management to make any necessary adjustments;
evaluate possible impacts on their audit report or the inclusion of the subject in the detailed report, when applicable; and
the value of the estimate reflected in the financial statements (appraisal reports, mainly) having been calculated by independent experts hired by the audit client does not exempt the auditor from the procedures described above, nor from the other requirements of auditing standards, including the verification and review of the reasonableness of premises and projections used, and
management's judgment must present neutrality and the auditor must evaluate possible biases of management.

Preparation of audit reports – modification of opinion

Since 2019 we have detected the issuance of some audit reports of annual and interim financial statements that, in our judgment, were out of compliance with the professional standards of independent auditing. Such reports were related to companies undergoing criminal investigation processes, including those of their directors and managers.

Although we understand that this is a complex theme, of extreme relevance and involving professional judgment, we have verified that some auditors are opting to issue their opinion in a way not consistent with the guidelines contained in the professional standards of auditing, more precisely, NBC TA 700, NBC TA 705 and NBC TA 706. In this sense, we remind you that the auditor must modify the opinion in their report when:

(a) they conclude, based on the audit evidence obtained, that the financial statements as a whole present material misstatements; or (b) they are unable to obtain appropriate and sufficient audit evidence to conclude that the financial statements, as a whole, do not present material misstatements.

We opportunistically highlight that NBC TA 705, the professional standard that deals with the modification of opinion, is clear in defining the situations in which modifications are required:

Qualified Opinion

The auditor must express a “Qualified Opinion” when:
(a) they, having obtained appropriate and sufficient audit evidence, conclude that the misstatements, individually or in aggregate, are material, but not pervasive in the financial statements; or (b) it is not possible for them to obtain appropriate and sufficient audit evidence to substantiate their opinion, but they conclude that the possible effects of undetected misstatements on the financial statements, if any, could be material, but not pervasive.

Adverse Opinion

The auditor must express an “Adverse Opinion” when, having obtained appropriate and sufficient audit evidence, they conclude that the misstatements, individually or in aggregate, are material and pervasive to the financial statements.

Disclaimer of Opinion

The auditor must refrain from expressing an opinion when they are unable to obtain appropriate and sufficient audit evidence to substantiate their opinion and they conclude that the possible effects of undetected misstatements on the financial statements, if any, could be material and pervasive.
The auditor must refrain from expressing an opinion when, in extremely rare circumstances involving various uncertainties, they conclude that, regardless of having obtained appropriate and sufficient audit evidence on each of the uncertainties, it is not possible to express an opinion on the financial statements due to the possible interaction of the uncertainties and their possible cumulative effect on these financial statements.

Similarly, we have observed that, in these cases, the “Basis for Opinion” section does not correspond to the opinion issued at the end, considering the guidelines of the professional standards of independent auditing. In this sense, we remind you that the “Basis for Opinion” section is responsible for contextualizing the opinion issued, whether modified or not, and must therefore present all the necessary information for the user of that report to have the basis used by the auditor in their professional judgment, provided that the professional standards of independent auditing are respected.

Still on the theme, it is necessary to remember that CVM Resolution No. 23/2021, in its article 25, item IV, clearly defines the need to measure the impact on the audited financial statements when issuing the respective audit report, in cases of modification of opinion (qualified or adverse), as follows:

art.
25...............................................................................................
IV - indicate clearly, and by how much, the accounts or subgroups of assets, liabilities, results and equity that are affected by the adoption of accounting procedures conflicting with the Fundamental Principles of Accounting, as well as the effects on mandatory dividends and profit or loss per share, as the case may be, whenever issuing a report on the review of interim information or an adverse or qualified audit report.

Independent Auditor – Legal Entity: corporate types and partners' liability

With the entry into force of CVM Resolution No. 23/2021, relevant alterations were made to the corporate types that can be used by audit societies registered with the CVM, as well, the requirement of joint and unlimited liability among partners was eliminated. Thus, there is no longer an obligation for the audit society registered with the CVM to be constituted under the form of a pure simple society. Similarly, CVM Resolution No. 23/2021 eliminated the obligation to include in their respective articles of association clauses that required joint and unlimited liability among partners.

In this sense, it is relevant to highlight that the aforementioned normative alterations do not entail any need for audit societies to move to adapt their articles of association to the provision of CVM Resolution No. 23/2021. On the contrary, the contracts in force remain perfectly valid and apt for the maintenance of the society's registration with the CVM. Any contractual alterations that reflect the partners' desire to adopt the possibilities introduced with these normative alterations can be made at any time, according to the will of its partners, and subsequently sent to the CVM for the update of their registry data, as provided in art. 17 of the aforementioned Resolution.

Recognition of tax credits and their possible effects on the audit report

During the supervision and inspection activity of the audit activity within the scope of the securities market, it is normal for us to identify situations that demonstrate potential problems, with direct impacts on the users of accounting information. Currently, an item with this characteristic is the recognition of tax credits and their possible effects on the financial statements and, finally, the respective audit report. Situations such as the Expansion of the Concept of Input – PIS and COFINS and the exclusion of ICMS from the calculation base of PIS and COFINS have drawn the attention of this Superintendency, mainly regarding the positioning of some independent auditors in blatant non-observance of basic concepts of the conceptual structure of accounting currently in force worldwide.

Regarding the theme, we reinforce that Official Letter/CVM/SNC/SEP 01/21 deals with the subject comprehensively, and should be considered when deciding on the recognition of such values by the companies or in issuing an opinion in the audit report by their auditors.

Relevant aspects to be observed in the review of the Explanatory Notes and in the evaluation of the other information contained in the Financial Statements in initial registration requests of open companies

As informed by the Superintendency of Corporate Relations - SEP, in the result of its actions related to the registration requests of open companies, several requirements related to the disclosure of financial information were identified

From the requirements carried out to conclude the cited analyses, it was possible to identify that the 5 (five) most frequent requirements are related to

a) deficient disclosure of accounting policies applied to the Company, particularly when it is verified that the Company mostly transcribed or paraphrased accounting standards, thus without compliance with OCPC 07; b) deficient disclosure of information on Related Parties, without compliance with CPC 05 (R1), particularly regarding the disclosure of interest rates and terms of loans between related parties; c) absence of disclosure of information on the Relationship with Independent Auditors in the Management Report, without observing article 2, items I to IV, combined with the same article 2, §1, item I, of CVM Instruction 381/2003; d) failures in the disclosure of the reconciliation of non-accounting information (LAJIDA/EBTIDA or LAJIDA/EBTIDA adjusted) with accounting information, thus without compliance with CVM Instruction No. 527/12; and e) deficient disclosure of assumptions in impairment tests, thus without compliance with CPC 01 (R1), mainly regarding the disclosure of discount rates and growth rates and assumptions.

If on the one hand, such information is under the primary responsibility of the companies' management, with these being responsible for dedicating special attention to the standards related to the preparation of Financial Statements and Interim Statements related to the above-mentioned themes, as well as to the guidelines contained in Circular Letter No. 01/2021/CVM/SNC/SEP (and circular letters from previous years); on the other hand, it is up to the independent auditor to make efforts in analyzing the content of that information presented together with the respective audited financial statements, recommending necessary adjustments and improvements, in order to allow a better understanding by the various users and, mainly, their adequacy to the applicable financial reporting framework.

Still in this sense, depending on the type, the relevance of the inadequately disclosed information and its possible effects on the degree of understanding by its users of those financial statements, it is up to the auditor to evaluate, in light of the provisions of independent auditing professional standards, the need to cite the fact in their audit report, considering, including, the possibility of issuing a modified opinion.

Finally, it is worth noting that in initial registration requests for open companies, the auditor will be held responsible for the opinion issued in the respective audit report and for the conduct of the audit work and procedures that served as the basis for their opinion, if there are deviations related to the applicable financial reporting structure and its disclosures.

Digital Protocol

The objective of the Digital Protocol system is to allow the complete automation of the flow of receipt, distribution, and processing of documents received by the Authority, making this service more agile and efficient. In this new version, it is possible to track the progress of requests during all stages.

Without intermediaries, independent auditors can perform the protocol directly with the Audit Standards Management, which may redirect the demand in case of errors. Among the benefits of automating this service are the reduction in document delivery time and the increase in transparency in this processing, as the auditor can track it from the beginning to the end of their request. We highlight that documents must be preceded by an introductory letter signed by the representative of the audit firm, describing the objective of the documented protocol.

Documents delivered in person or received via Mail Circular Letter 1 (1474792) SEI 19957.002839/2022-25 / pg. 24

will continue to be treated by the area responsible for receiving these documents, which will perform the registration and digitization in the new Digital Protocol.

Specifically regarding requests for the inclusion of technical responsible persons and the sending of contractual changes, due to user security and the need for internal control, we inform that an individual SEI process is generated for each request.

Thus, when there is the presentation of several requests, for the inclusion of technical responsible persons and the delivery of several contractual changes, in batches (several documents in a single PROTOCOL), the system generates a single process with the quantity of professionals indicated and changes forwarded.

These occurrences generate a need for manual individualization of the processes, which negatively impacts the analysis time of the inclusion of technical responsible persons and the treatment of other related changes, since the entire corporate chain must be verified for the inclusion/exclusion/changes to be processed.

Therefore, the following guidelines follow for the protocol of these requests:
a) requests for the inclusion/exclusion of technical responsible persons must be carried out individually (one digital protocol for each professional); and b) avoid, as much as possible, that several contractual changes are "accumulated" to be registered (RCPJ) in a single batch.

We remind you that, according to article 17 of Resolution 23, contractual changes must be presented within 30 days of their occurrence (considered the date of registration in the RCPJ, due to the characteristic of public recognition) and, considering that the cost for registration in the respective instances is the same (for each registered change), there is no logical reason for such registrations to be made in batches. Therefore, we strongly recommend that firms carry out the respective registrations as contractual changes are signed, promoting greater speed in this process for CVM and, consequently, in the registration update.

It is unnecessary to remind that the Digital Protocol does not exclude the other CVM service channels, such as, for example, Hearings for Individuals, Process Review, CVMWEB, among others. On the CVM portal, on the SERVICE page, the auditor can consult which channel is most appropriate for their request. However, presentation of documents, requests for information, and queries of any kind will no longer be accepted via email.

We reinforce that to use the new Digital Protocol, access the Federal Government Services Portal (https://www.gov.br/pt-br/servicos/protocolardocumentos-junto-a-cvm) and register. For more information, go to the CVM portal (https://www.gov.br/cvm/pt-br; on the left menu, select the "Services" option and access the item "CVM Digital Protocol (CVM Protocol)". In case of doubt, contact the Information Management Division (DINF/SOI) via email dinf@cvm.gov.br or by phone (21) 3554-8411.

Finally, we highlight the relevance of the guidelines contained in the last Joint Circular Letters, issued by the Superintendence of Accounting and Audit Standards – SNC and by the Superintendence of Corporate Relations - SEP, all available on our internet page (http://www.cvm.gov.br/legislacao/index.html? buscado=true&contCategoriasCheck=1&vimDaCategoria=/legislacao/oficioscirculares/snc-sep/):
CIRCULAR LETTER/CVM/SNC/SEP No. 01/2021, which provides guidance on relevant aspects to be observed in the preparation of Financial Statements for the social year ended on 12/31/2020, and CIRCULAR LETTER/CVM/SNC/SEP No. 02/2020, which deals with the possible impacts Circular Letter 1 (1474792) SEI 19957.002839/2022-25 / pg. 25

of the Coronavirus pandemic on the Financial Statements of entities under the supervision of this Authority and the expected performance by independent auditors.

We inform that doubts related to registration and performance in the securities market can be resolved via email: gna@cvm.gov.br, or through the phones (21) 3554-8397 or 3554-8615, as soon as the restrictions imposed by the COVID-19 pandemic allow.

Sincerely,
MADSON DE GUSMÃO
VASCONCELOS
PAULO ROBERTO GONÇALVES FERREIRA
Manager of Audit Standards Superintendent of Accounting and Audit Standards

Document electronically signed by Madson Vasconcelos, Manager, on 05/04/2022, at 12:12, based on art. 6 of Decree No. 8.539, of October 8, 2015.
Document electronically signed by Paulo Roberto Gonçalves Ferreira, Superintendent, on 05/04/2022, at 12:27, based on art. 6 of Decree No. 8.539, of October 8, 2015.
The authenticity of the document can be checked on the site https://sei.cvm.gov.br/conferir_autenticidade, informing the code verifier 1474792 and the CRC code 70B60EF3.
This document's authenticity can be verified by accessing https://sei.cvm.gov.br/conferir_autenticidade, and typing the "Código Verificador" 1474792 and the "Código CRC" 70B60EF3.
Reference: Process No. 19957.002839/2022-25 SEI Document No. 1474792 Circular Letter 1 (1474792) SEI 19957.002839/2022-25 / pg. 26

Circular Letter CVM/SNC/GNA 01/22: Clarifications on the Role of the Independent Auditor in the Securities Market

Lineage: In force