Circular Letter CVM/SNC/GNA 01/24

SECURITIES AND EXCHANGE COMMISSION OF BRAZIL
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/ SP – CEP: 01333-010 – Brazil - Tel.: (11) 2146- 2000 SCN Q.02 – Bl. A – Ed. Corporate Financial Center, S.404/4th Floor, Brasília/DF – CEP: 70712-900 – Brazil - Tel.: (61) 3327-2030/2031 www.cvm.gov.br Circular Letter No. 1/2024/CVM/SNC/GNA Rio de Janeiro, May 24, 2024. To Independent Auditors and their respective Technical Managers Subject: Clarifications related to the performance of the independent accounting auditor within the securities market. Gentlemen Auditors, As a direct result of the supervision and inspection of the auditing activity within the securities market, we list below some points related to registration with the CVM, performance in the securities market, and the application of independent accounting audit professional standards in the execution of work, for which we request special attention from the independent auditor registered with this Commission. Index:

Introduction
SECTION I – NEW TOPICS (NOT ADDRESSED IN CIRCULAR LETTERS FROM PREVIOUS YEARS)
Evaluation of qualification as an investment entity (Investment Funds - FIPs)
Evaluation of the classification of financial assets
Criteria for sample selection in auditing
Circular Letter 1 (2045101) SEI 19957.004309/2024-83 / pg. 1
Auditor rotation in 10 years - prerogative provided in the caput of
art. 31-A of CVM Resolution No. 23/2021 - Auditors' responsibility in documentation
Internal Quality Control - implementation of NBC PA 01 – Quality
Management for Firms (Legal and Natural Persons) of Independent Auditors (corresponding to International Standard on Quality Management – ISQM 1)
CVM Resolution No. 193/2023: Provides for the preparation and disclosure
of the report on financial information related to sustainability, based on the international standard issued by the International Sustainability Standards Board - ISSB.
SECTION II – RECURRENT TOPICS STILL RELEVANT –
UPDATED
Registration as an Independent Auditor (Art. 1st to 6th-A – CVM Resolution No.
23/2021)
Proof of auditing activity (Art. 7th - CVM Resolution No.
23/2021)
Periodic Information (Art. 16 – CVM Resolution No. 23/2021)
Registration Update and Electronic Declaration of Compliance (Art.
2nd, items I and II of CVM Resolution No. 51/2021)
Communications regarding art. 24 of CVM Resolution No. 50/2021
External Quality Review Program (Art. 33 – CVM Resolution
No. 23/2021)
Continuing Professional Education Program (Art. 34 – CVM Resolution
No. 23/2021)
Auditor Rotation (Art. 31 – CVM Resolution No. 23/2021)
Issuance of Detailed Report (Art. 25, item II, CVM Resolution
No. 23/2021)
Audit Report and Key Audit Matters
Technical Qualification Examination - specific CVM test (Art. 30,
CVM Resolution No. 23/2021)
Composition of audit teams (Art. 25, item VII, CVM Resolution
No. 23/2021)
Single Registry (Art. 11, sole paragraph, CVM Resolution No. 23/2021)
Auditing of financial statements of Credit Rights Investment Funds - FIDC, Real Estate Receivables Certificates -
CRI and Agricultural Business Receivables Certificates – CRA
Auditing of accounting estimates and related disclosures - NBC
TA 540 (R2)
Preparation of audit reports – modification of opinion
Independent Auditor – Legal Entity: corporate types and
liability of partners
Recognition of tax credits and their possible effects on
the audit report
Circular Letter 1 (2045101) SEI 19957.004309/2024-83 / pg. 2
Relevant aspects to be observed in the review of the Notes
to the Financial Statements and in the evaluation of other information contained in the Financial Statements in initial registration requests of open companies
Summarized statements published in printed newspapers
Immaterial distortions with significant potential to become
relevant in the future
Hypotheses of impediment and incompatibility (Art. 22 to 24 -
CVM Resolution No. 23/2021)
Professional judgment and transparency in the audit report
Main issues pointed out in recent years by IFIAR
Digital Protocol
Circular Letter 1 (2045101) SEI 19957.004309/2024-83 / pg. 3
Introduction
We highlight the foundations that guide the regulatory activity of the Securities and Exchange Commission of Brazil (CVM) regarding independent auditing within the securities market:

the importance of an independent auditing system as an indispensable support for the regulatory body;
the figure of the independent auditor as an essential element for market credibility and as an instrument of inestimable value in investor protection, insofar as its function is to ensure the fidelity and reliability of the accounting statements of the audited entity;
the accuracy and clarity of the accounting statements, including disclosure in explanatory notes of information indispensable to viewing the patrimonial and financial situation and the results of the audited entity, also depend on an effective auditing system and, fundamentally, on the auditor's awareness of their true role within this context; and
the need for the market to have highly qualified independent auditors who, at the same time, enjoy a high degree of independence in the exercise of their activity.
SECTION I – NEW TOPICS (NOT ADDRESSED IN CIRCULAR LETTERS FROM PREVIOUS YEARS)

Evaluation of qualification as an investment entity – Investment Funds in Participations (FIPs)
It is part of the auditor's obligations to confirm that the audited entity that reports as an investment entity actually qualifies as such, in accordance with applicable accounting standards.
However, auditing work on investment funds in participations (FIPs) was verified throughout 2022 and 2023, where the auditor did not perform auditing procedures to confirm the qualification of the audited fund as an investment entity, as established in articles 4th and 5th of CVM Instruction No. 579/2016.
It is important to clarify that said article 4th brings four conditions for the qualification of a FIP as an investment entity, which must be met cumulatively.
In this regard, we draw attention to its item III, which requires that the fund substantially measure and evaluate the performance of its investments, for management model purposes, based on fair value. We also remind, in line with what is described in item B85-F of CPC 36 (R3), that, for qualification as an investment entity, the entity/fund must not hold its investments indefinitely. It is necessary for the investment entity to have clearly defined an exit strategy, documenting how it plans to realize the capital appreciation of all its investments, including a concrete deadline to divest said assets.
Evaluation of the classification of financial assets (REITs - FIIs and FIP-EI)
Similarly to the previous item, we emphasize that it is part of the auditor's obligations to confirm that the classification of the audited entity's financial assets is in accordance with applicable accounting standards.
In this sense, auditing work on investment funds was identified where the auditor did not perform auditing procedures to confirm the correct classification of the audited fund's financial assets, as established in Technical Pronouncement CPC 48.
Obviously, without review and evaluation by auditors of the classification of these financial assets, it is not possible to obtain comfort regarding the reasonableness of the measurement and recognition of those assets recorded by the fund administrators and reflected in their respective financial statements, nor their adequacy regarding specific CVM standards that deal with the subject, as the case may be. In this regard, it is important to remember that, for the correct evaluation of the classification of financial assets, it is necessary to evaluate and understand the entity's business model for managing financial assets, as well as the contractual cash flow characteristics of these assets.
Criteria for sample selection in auditing
NBC TA 500 (R1) – “Audit Evidence” deals with the auditor's responsibility in defining and executing auditing procedures to obtain appropriate and sufficient audit evidence to reach reasonable conclusions that support their audit opinion, providing guidance on the means available for the auditor to select items for testing, with audit sampling being one of them.
The aforementioned standard establishes that “when defining control tests and detail tests, the auditor must determine means to select items to be tested that are effective for fulfilling auditing procedures”.
In this sense, its item A63 clarifies:
An effective test provides appropriate audit evidence insofar as, considered with other audit evidence obtained or to be obtained, it will be sufficient for the auditor's purposes. When selecting items to be tested, item 7 requires that the auditor determine the relevance and reliability of the information to be used as audit evidence; another aspect of effectiveness (sufficiency) is an important consideration in the selection of items to be tested. The means available to the auditor for the selection of items to be tested are:
(a) selection of all items (examination of 100%); (b) selection of specific items; and (c) audit sampling.
The application of any of these means or a combination thereof may be appropriate depending on specific circumstances, for example, the risks of material misstatement related to the assertion being tested, and the practicality and efficiency of the different means.
In this regard, we consider it relevant to emphasize that the test performed on a selection of specific items does not provide audit evidence regarding the rest of the population. Thus, the audit conclusion obtained with said test is limited to the selected items, which generates a need for additional auditing procedures for the rest of the population.
At this opportunity, it is important to remember that item A12 of NBC TA 530 – “Sampling in Auditing” advises that, as the purpose of sampling is to provide a reasonable basis for the auditor to conclude regarding the population from which the sample is selected, it is important that the auditor selects a representative sample, in order to avoid bias through the choice of sample items that have characteristics typical of the population.
According to NBC TA 530, “the auditor must determine a sample size sufficient to reduce sampling risk to an acceptably low level”, further clarifying that items must be selected “in such a way that each sampling unit of the population has the same chance of being selected”.
In this line, despite the fact that the professional standard does not define the sample size for this purpose, it is inadmissible that, based solely on the auditor's personal professional judgment, the sample be considered representative of the analyzed population, due to the quantitative insufficiency of selected items or the irrelevance of the items analyzed in that context, due to disregard for statistical procedures, common sense, or professional skepticism. Thus, we reaffirm that the entire process of selection and composition of samples must be documented with a detailed description of the criteria and grounds that justify its structure. Generic citations do not meet the requirements of professional standards.
Auditor rotation in 10 years - prerogative provided in the caput of
art. 31-A of CVM Resolution No. 23/2021
According to art. 31 of CVM Resolution No. 23/2021, the Independent Auditor – Natural Person and the Independent Auditor – Legal Entity cannot provide services to the same client for a period longer than five consecutive fiscal years, requiring a minimum interval of three fiscal years for their re-hiring.
However, art. 31-A of CVM Resolution No. 23/2021 brings an exception by allowing the service provision period established in art. 31 of the same resolution to be up to 10 (ten) consecutive fiscal years, provided that the audited company has a Statutory Audit Committee - SAC in permanent operation and the auditor is a legal entity, as well as meeting §§1st and 2nd of said article.
Furthermore, in the case of using the prerogative provided in the caput of art. 31-A of CVM Resolution No. 23/2021, the independent auditor must evaluate and document in their work papers the compliance with the installation, composition, and functioning requirements of the Statutory Audit Committee – SAC provided for in arts. 31-A, 31-B, and 31-C, according to item IX of art. 25 of said resolution.
In 2022 and 2023, regarding the composition and functioning requirements of the SAC, some analyses presented by audit firms were verified that only reproduce what is established in the audited company's Bylaws and/or the SAC's Internal Regulations, without presenting the auditor's evaluation and the respective evidence that such regulations are being put into practice, as well as presenting conclusions without the respective documents that supported the auditor's conclusion on that point. It is worth noting that, according to the definition of NBC TA 230 (R1), audit documentation is the record of auditing procedures performed, relevant audit evidence obtained, and conclusions reached by the auditor. That is, it comprises documents and notes prepared during the course of work or obtained from any other source, which record the evidence of the work performed by the auditor and support their opinion and comments, and not just copies of documents. We remind that the auditor must prepare audit documentation that is sufficiently complete and detailed to allow an experienced auditor, with no prior involvement with the audit, to understand the work performed, as audit evidence is fundamental, since it comprises the information used by the auditor to reach the conclusions on which their opinion stated in the respective audit report is based, as defined by NBC TA 500 (R1). By logic, the same reasoning must be considered when preparing their audit evidence that is subject to supervision or inspection processes by the CVM, as provided for in item IX, art. 25 of CVM Resolution No. 23/21. Thus, it is our understanding that the mere attachment of meeting minutes, internal regulations, or the mere citation regarding the evaluation of the personal condition of a SAC member, without an objective and highlighted analysis of the content of discussions, functioning, determinations, and requirements to meet the standard's requirements, do not meet such objectives. Similarly, analyses performed without any formal document proving subjective conclusions incur in the same deficiency.
Internal Quality Control - implementation of NBC PA 01 - Quality
Management for Firms (Legal and Natural Persons) of Independent Auditors (corresponding to International Standard on Quality Management – ISQM 1) In 2021, the Federal Council of Accounting (CFC) altered the standard dealing with the quality control process of audit firms (NBC PA 01), previously denominated Quality Control for Firms (Legal and Natural Persons) of Independent Auditors (corresponding to International Standards on Quality Control – ISQC 1), giving new wording to the standard which became denominated NBC PA 01 – Quality Management for Firms (Legal and Natural Persons) of Independent Auditors (corresponding to International Standard on Quality Management – ISQM 1). As is known to all, NBC PA 01 (ISQM 1) deals with the responsibilities of the audit firm for the development (design), implementation, and operation of a quality management system for audits and for review of financial statements, as well as other assurance work and related services, because, just like its predecessor, NBC PA 01 (ISQM 1) applies to auditing and review work of financial statements, other assurance work Circular Letter 1 (2045101) SEI 19957.004309/2024-83 / pg. 6

assurance and related services, performed in accordance with NBC TA, NBC TR, NBC TO, and NBC TSC standards.
NBC PA 01 establishes that the adoption of the quality management system shall be done in two stages. The first, which should have been concluded by the end of 2022, with the planning and implementation of quality management systems; and the second with the evaluation of the quality management system – which should be carried out within a period of one year from December 31, 2022, that is, by December 31, 2023.
In this sense, we highlight that the execution of the activities proposed in the standard, as well as the observance of its schedule by auditors registered with the CVM is mandatory, with each stage subject to specific procedures by this autarchy to verify its compliance. It is important to remember that non-compliance with said standard, in those terms, may lead to the adoption of administrative sanctions by this Superintendency regarding auditors who incur in irregularity, given the provisions of articles 20 and 32 (§§ 1st, 2nd, and 3rd) of CVM Resolution No. 23/21. Still on the subject, it is important to establish that the quality reviewer of auditing work on financial statements, review of interim information, or other applicable assurance work, whether they are an individual internal to the audit firm or an external professional hired by it (NBC PA 02), as well as the person responsible for these work and signatory of the respective reports, must be registered with the CVM as a technical manager authorized to issue and sign audit and review reports, on behalf of the respective audit firm, within the securities market.
7. CVM RESOLUTION NO. 193, OF OCTOBER 20, 2023 - preparation and
disclosure of the report on financial information related to sustainability, based on the international standard issued by the International Sustainability Standards Board - ISSB.
Recently, on October 11, 2023, the CVM approved CVM Resolution No. 193/23, which deals with the preparation and disclosure of the report on financial information related to sustainability, based on the international standard issued by the International Sustainability Standards Board - ISSB.
With said regulation, the option for preparation and disclosure of a report on financial information related to sustainability, by open companies, investment funds, and securitization companies, based on the international standard issued by the ISSB, was established on a voluntary basis, starting from fiscal years beginning on or after January 1, 2024.
If the entity opts for voluntary adoption as established in the standard, it must use the financial information disclosure standards related to sustainability, as issued in English by the ISSB, until the process of internalization of said standards in the Brazilian jurisdiction is concluded. The open company must declare the option, indicating the fiscal year of the start of voluntary adoption, preferably by May 31, 2024, this option or its revision limited until December 31, 2024, through a communication to the market. Investment funds and securitization companies may declare the option, or its revision, as provided in the caput, until the end of the fiscal year prior to the first preparation and disclosure of the report on financial information related to sustainability, through a communication to the market. Circular Letter 1 (2045101) SEI 19957.004309/2024-83 / pg. 7

The first preparation and disclosure of a sustainability-related financial information report implies its continuity throughout all periods of voluntary adoption.

We also highlight the obligation to prepare and disclose sustainability-related financial information reports, based on ISSB standards, for open companies, starting from fiscal years beginning on or after January 1, 2026.

CVM Resolution No. 193/23 further determines that entities must archive the sustainability-related financial information report through an electronic system available on the CVM website on the World Wide Web.

The sustainability-related financial information report must be subject to assurance by an independent auditor registered with the CVM, in accordance with standards issued by the Federal Council of Accounting – CFC, noting that those issued for information related up to the fiscal year of 2025 must receive limited assurance; and for those issued for information related to fiscal years beginning on or after January 1, 2026, reasonable assurance must be issued.

SECTION II – RECURRENT TOPICS STILL RELEVANT – UPDATED

Registration as Independent Auditor (Art. 1 to 6-A – CVM Resolution No. 23/2021)

Initially, it is worth clarifying that registration with the CVM does not constitute a new professional category, nor does it mean restriction of the exercise of the professional activity. On the contrary, the activity of independent audit is a prerogative of the legally qualified accountant registered with the Regional Council of Accounting. This activity can be exercised individually or in partnership, where the partners are all accountants, consequently, there are no incompatibilities between these norms and the disciplinary regime of the accountant professional category.

CVM Resolution No. 23/2021 maintains the two existing forms of registration, namely: Independent Auditor – Natural Person (AIPN), granted to the legally qualified accountant who meets the requirements established in arts. 3, 5, and 7, and Independent Auditor – Legal Entity (AIPJ), granted to the society integrated exclusively by accountants, registered with the Regional Council of Accounting and who meets the requirements established in arts. 4, 6, and 7. For the partners or other accountants who maintain a professional link of any nature with the audit society registered with the CVM (AIPJ) to issue and sign audit or review reports on behalf of the society, it is mandatory to be registered as the technical manager of said society with the CVM.

It is important to note that the corporate purpose of audit societies registered with the CVM or applying for registration must be exclusively focused on the provision of professional audit services and other services inherent to the accounting profession, as established in item I of art. 4 of CVM Resolution No. 23/2021, which does not include participation/investment in other entities and sale of training and preparatory courses, among others.

CVM Resolution No. 23/2021 also maintains the requirement that at least half of the partners of the audit society (AIPJ) be registered as the technical manager of the society at the CVM to exercise the audit activity within the scope of the securities market, on behalf of the society (final part of item II of art. 4). If, after obtaining the society's registration, there is a change in the partnership, whether by exclusion or admission of partners, it is imperative that this relationship be maintained, under penalty of suspension or even cancellation of the respective registration until the situation is normalized (item II of art. 15).

Among the other conditions for obtaining registration, it is fundamental that the exercise of the audit activity for a minimum period of 05 (five) years, consecutive or not, exclusively in the forms provided for in art. 7 of CVM Resolution No. 23/2021 and detailed in the following item of this circular letter, be proven. It should be clarified that this period is counted from the registration of the interested party with the Regional Council of Accounting (CRC), in the accountant category. The exercise of audit activity prior to their registration in said category at the CRC constitutes non-compliance with professional norms.

The interested party must present a copy of the accountant identity card, in the accountant category, or, at their discretion, an equivalent registration certificate issued by the CRC. In this regard, it is recommended that the interested party verify if their professional identity card contains the date of effective registration at the CRC in the accountant category. Otherwise, it becomes necessary to send, in addition to the copy of the accountant professional identity card, a certificate issued by the Regional Council of Accounting, which must necessarily contain the date of effective registration as an accountant. Absent said date, for the purpose of the initial term of counting the time of exercise of the audit activity in the form of art. 7, the date of issuance of the accountant professional identity card presented will be considered. In some cases, where there is a new issuance of a physical professional identity card, we recommend that previous copies of said document also be sent, so that the earliest issuance date can be considered as the initial term for counting the time of exercise of audit activity.

Still as guidance, even if for compliance with items II of art. 5, IX of art. 6, and III of art. 6-A of CVM Resolution No. 23/2021 it is possible to deliver only the “equivalent certificate, issued by the Regional Council of Accounting”, we recommend that the audit society, or the independent professional, opt for delivering also the digital file of the professional identity card generated from the CRCDigital application (Professional Card – Options – Download Card in PDF) or the printout of the data query (including registration date data in the category and current status) of the accounting professional in the registry of the respective Regional Council of Accounting, since most physical professional identity cards and professional qualification certificates do not bring the registration date of the professional, hindering the verification of compliance with art. 7 of the same resolution.

Regarding proof of a legalized office in one's own name, the Location and Operation License or an equivalent competent document issued by the City Hall of the municipality where the professional exercises their activity must be sent. In the case of registration as AIPN, a document issued in the name of any society of which the interested party is a member will not be accepted. In the case of AIPJ, a document issued in the name of a natural person, even if they are part of the partnership of the requesting audit society, nor a document issued in the name of another society, will not be accepted.

In the event that the activity exercised by the AIPN or AIPJ is exempted or waived from a location and operation license by the City Hall of the municipality where said activity is exercised, the equivalent document must be sent, as well as the respective reference indicating the municipal regulation that supports said waiver or exemption. Among other documents, the municipal taxpayer registration form or the AIPN or AIPJ data registration form at the respective city hall; the specific query for waiver or exemption of AIPN or AIPN license on the respective city hall website on the World Wide Web; the specific declaration of waiver or exemption of AIPN or AIPJ license issued by the respective city hall; if provided for in the municipality's regulation, the self-declaration presented by the AIPN or AIPJ to the respective city hall of their classification in a scenario of waiver or exemption of location and operation license.

CVM Resolution No. 23/2021 maintains the requirements that all partners of audit societies registered with the CVM be accountants (initial part of item II of art. 4) and that the corporate purpose of said societies be exclusively focused on the provision of professional audit services and other services inherent to the accounting profession. Thus, in light of the sole paragraph of art. 966 of the Civil Code (CC), the nature of these single-profession accountant societies is configured as simple – non-business. Consequently, according to the final part of art. 1.150 of the CC, the Civil Registry of Legal Entities (RCPJ) is the competent registry for the constitutive acts and subsequent contractual amendments of said simple single-profession societies, even if they were to adopt one of the corporate types provided for business societies, as allowed by the final part of art. 983 of the CC.

On this topic, it is also important to consider the clarifications established in Statement No. 57 – approved at the I Civil Law Day held by the Judicial Studies Center of the Council of Justice of the Federal Council (CEJ/CJF). According to said statement, “the option for the business type does not remove the simple nature of the society”. Additionally, as clarified by Statement No. 382 – approved at the IV Civil Law Day (CEJ/CJF), the registration of societies observes the nature of their respective activities (business or not – art. 966); the other issues follow the norms pertinent to the adopted corporate type (art. 983).

As a condition for approval of registration requests (AIPN or AIPJ) or for registration of AIPJ technical manager with the CVM, items VI of art. 5, XII of art. 6, and V of art. 6-A of CVM Resolution No. 23/2021 further establish that copies of the approval certificates of the respective accountants in the technical qualification exam – specific CVM test, instituted by item 3, letter “b” of NBC PA 13 (R2) of 08/21/2015, must be presented. It is worth highlighting that the copy of the Professional Registration Certificate in the National Registry of Independent Auditors (CNAI), by itself, does not constitute a competent document to meet the requirements mentioned. Still on the topic, it is appropriate to highlight that the copy of the approval certificate in the technical qualification exam – specific CVM test can be obtained, by the accountant themselves, on the website of the Federal Council of Accounting (CFC) on the World Wide Web (https://cfc.org.br/desenvolvimento-profissional-e-institucional/exames/certificados/).

We emphasize that, from 01.01.2022, in order for the registration request as an independent auditor with the CVM to be analyzed, it is necessary to present proof of payment of the supervision fee instituted by Provisional Measure 1072/21, and incorporated by Law 14.317, of March 29, 2022, in the following terms:

Art. 4 The Fee is due:
...
III - annually and paid in full with respect to the entire year to which it refers, according to the values expressed in reais and established in Annexes I, II, and III of this Law, pro rata payment not admitted; ...
V - upon the initial registration request as a participant in the securities market, as provided in this Law, or of the issuance of an equivalent authorizing act, in the scenario provided for in Annex V of this Law, pro rata payment not admitted and with full payment of the Fee regardless of the date of the request.

More information regarding the supervision fee can be obtained at https://www.gov.br/cvm/pt-br/assuntos/regulados/taxa-de-fiscalizacao.

For cancellation of registration as Independent Auditor Natural Person (AIPN) or as Independent Auditor Legal Entity (AIPJ), as well as for exclusion of technical managers, it is sufficient that a letter signed by the auditor's representative before the Securities and Exchange Commission (CVM) be filed, requesting said cancellation or exclusion.

In cases of request for exclusion of technical managers; for exclusion of partners who are also technical managers and for cancellation of registration as Independent Auditor Legal Entity (AIPJ), said letter must also contain the awareness of the respective professionals that they are being excluded from the registry of technical managers authorized to issue and sign audit and review reports on behalf of an AIPJ registered with the CVM and that, if they do not maintain their registrations active with the CVM, they must comply with all requirements of CVM Resolution No. 23/2021, including approval in the Technical Qualification Exam – CVM, upon subsequent request for registration as AIPN; inclusion as a technical manager in another AIPJ; or even new inclusion as a technical manager in the audit society from which they are being excluded.

At this opportunity, it is important to remember that the updated list with the technical managers who integrate the aforementioned registry, authorized to issue and sign audit and review reports on behalf of each AIPJ, can be consulted directly on the CVM website on the World Wide Web (https://www.gov.br/cvm/pt-br), by accessing the link http://sistemas.cvm.gov.br/?CadGeral and typing the corporate name or CNPJ number of the respective audit society.

Still regarding registration with the CVM and the respective Registry, we inform that the new Auditor Registry system is in the homologation and testing phase. Said system, when in production, will allow auditors themselves to submit requests for registry changes, request inclusion or exclusion of professionals, send documents or issue registration confirmation certificates, among other facilities, with direct (online) access to the independent auditor Registry. The initial prediction is that by the end of the first semester of 2024 this system will be available to all auditors.

Proof of Audit Activity (Art. 7 – CVM Resolution No. 23/2021)

To obtain registration as Independent Auditor – Natural Person (AIPN) or to integrate the registry of Technical Managers authorized to issue and sign audit and review reports on behalf of an AIPJ registered with the CVM, the accountant must prove having exercised the activity of auditing financial statements for a period of no less than 05 (five) years, consecutive or not, from the date of their effective registration, in the accountant category, with the respective CRC. Said proof must be met, exclusively, in the following manner:

a) by presenting audit reports issued and signed by the interested accountant, published in a specialized newspaper or magazine or made available on the World Wide Web, one publication being sufficient for each year. The published audit reports, to be accepted, must be in consonance with the standards of the Federal Council of Accounting (CFC) that are applicable. The publication must include, in addition to the audit report, the set of financial statements and their respective explanatory notes. In these cases, it is important that the name of the newspaper or magazine; the address of the World Wide Web site; and the date of publication are not omitted; or

b) by proving that the interested accountant exercised the audit activity as an employee of an audit society registered with the CVM. This proof will also only be counted from the date of the professional's registration in the accountant category, whether this registration is provisional or definitive. In cases of registration request as Independent Auditor – Natural Person, the interested accountant must also prove that they are no longer part of the employee roster of the employing audit society, in compliance with the provisions of art. 11 of CVM Resolution No. 23/2021.

To prove the exercise of the audit activity in the manner indicated in item “b” above, the following must be presented: i) copy of the individual employee registration of the accountant at the employing audit society, containing all information required by specific regulation and ii) copy of the Work and Social Security Card (CTPS) of the interested accountant, comprising the pages that contain: the number and series of the CTPS; the holder's qualification; the annotations regarding employment contracts and changes in salaries, vacations, positions or functions exercised. Copies of the CTPS pages that are blank, i.e., where no annotations have been recorded, do not need to be presented. Also admitted, in place of the copy of the individual employee registration, is a declaration signed by a partner representative of the employing audit society, in which the accountant's qualification; the dates of admission and departure from employment (if applicable); the position or function in which they were admitted and the dates when changes in positions or functions exercised occurred must necessarily appear.

An important fact to consider is that, in the event of proof of the exercise of the audit activity in the manner indicated in item “b” above, the interested party must also prove that they exercised, for 05 (five) years, positions of direction, management, or supervision in the area of auditing financial statements. On this topic, it is important to mention that it is consolidated understanding, within the scope of the CVM's Superintendence of Accounting and Audit Standards (SNC), that the possibility of proof by partial periods, established in § 3 of art. 7 of CVM Resolution No. 23/2021, enables the counting of periods in the exercise of positions of direction, management, and supervision for a period of less than 05 (five) years, in addition to the other forms of proof of experience provided for in the same article.

The CVM may also, at its exclusive discretion, accept that the proof of the exercise of the audit activity be made by presenting audit work that has not been published (§1 of art. 7 of CVM Resolution No. 23/2021). In this case, the interested party must present as proof of each work performed: the respective audit report, the corresponding detailed report (final report, encompassing the entire audited period) and the respective audited financial statements. Aiming to protect professional secrecy and guarantee its authenticity, it is indispensable that all these documents be authenticated by the audited entity, and must also contain authorization from said entity for them to be presented to the CVM for the exclusive purpose of proving the exercise of the audit activity by the interested accountant. Said authentication of documents must be met by the entry, on each page of the respective documents, of the signature of the legal representative of the audited entity along with the indication (stamped, handwritten, or printed) that said copy matches the original. It is important to note that this mode of proof will also be subject to the evaluation of the quality of the work performed and may also include the availability of the respective working papers for CVM inspection.

As guidance, we clarify that the detailed report must contain, at a minimum, the following information: the name or denomination of the audited entity; the period covered by the examination; description of deficiencies and inefficacy of internal controls and accounting procedures adopted by the audited entity followed by recommendations for required corrections; and the date of issuance, identification, and signature of the responsible auditor.

Annual Periodic Information (Art. 16 – CVM Resolution No. 23/2021)

Independent auditors must send to the CVM, by the last business day of April of each year, information related to their performance in the securities market, according to Annex D to CVM Resolution No. 23/2021. This information is important for the CVM to assess the auditors' capacity to adequately serve their clients.

Such information must be sent via the internet, on the CVM website. The submission must be made through the option “REGULATED (https://www.gov.br/cvm/pt-br/assuntos/regulados)”, selecting next the option “DOCUMENT SUBMISSION – CVMWEB (https://cvmweb.cvm.gov.br/swb/default.asp?sg_sistema=scw)” and then the option “DOCUMENT SUBMISSION”.

We inform that a change in the procedure for presenting such information was implemented since 2020. Now, when accessing the CVMWEB system to present the Annual Periodic Information provided for in art. 16 of CVM Resolution No. 23/2021, the auditor will be automatically directed to the verification of their registry data. After validation of the registry data, or their update, the auditor must issue, mandatorily, the Electronic Declaration of Conformity. Only after this procedure will the independent auditor be redirected to the presentation of the Annual Periodic Information.

At this stage, there are two options for sending information: i) Document submission via form and ii) Document upload. Finally, the option “Independent Auditor Annual Report” must be selected. The “document upload” option should only be used by those auditors who have more than 10 (ten) clients that are open companies (or part of the securities market or incentivized companies), as in this case, it is necessary to create a file (XML standard) for sending the required information.

Additionally, we remind you that from the effectiveness of CVM Resolution No. 23/2021, Annex D of said Resolution presents in item 4.A the request for presentation of the financial statements of the audit society (only legal entity) Ofício-Circular 1 (2045101) SEI 19957.004309/2024-83 / pg. 13

regarding the fiscal year serving as the basis for the annual information being presented, if the period provided by law for its preparation has already elapsed; or to the penultimate closed fiscal year, in other cases. The file containing the aforementioned accounting statements must be in "PDF" format and must be sent together with the Annual Information via the document upload option provided.

Submitting this information late subjects the auditors to a coercive fine, as provided in Article 18 of CVM Resolution No. 23/2021.

We remind you that failure to observe the deadline for sending the information covered in this topic results in the imposition of a daily coercive fine of R$ 200.00 (two hundred reais), in accordance with CVM Resolution No. 47/2021.

We also alert that there is no longer a need to report the courses and training conducted in the year of competence of the report, as this information is sent directly by the Federal Council of Accounting – CFC, to the CVM.

Registration Update and Electronic Declaration of Conformity (Article 2, items I and II of CVM Resolution No. 51/2021)

Regardless of the submission of the periodic information required by CVM Resolution No. 23/2021, it is also necessary for independent auditors to keep their registration updated, observing a deadline of up to 07 (seven) business days from the event that caused the alteration. To do so, independent auditors must access their registration data on the CVM website, proceeding with the appropriate update. In addition to the required update, annually and until the 30th day of April (according to item II, Article 2 of CVM Resolution No. 51/2021), the Independent Auditor must confirm that their registration data remains valid, by issuing the Electronic Declaration of Conformity. The Electronic Declaration of Conformity must be issued by accessing the option "REGULATED (https://www.gov.br/cvm/pt-br/assuntos/regulados)", selecting next the option "SERVICES TO CVM PARTICIPANT" and then the option "REGISTRATION UPDATE OF PARTICIPANTS", followed by "ELECTRONIC DECLARATION OF CONFORMITY", on the CVM website. It is important to emphasize that, even in cases where there are no changes in the data on the site, the Electronic Declaration of Conformity must be issued.

With the aim of facilitating the submission of the Electronic Declaration of Conformity, avoiding delays or non-submission, a new functionality has been made available on the CVM website. Since 2020, when accessing the CVMWEB system for the transmission of Annual Periodic Information provided for in Article 16 of CVM Resolution No. 23/2021 (item 09 above), the auditor will be automatically directed to the verification of their registration data and updates that may be necessary. After confirming the registration data, or updating it, the auditor will be directed to the issuance of the Electronic Declaration of Conformity. Once the Electronic Declaration of Conformity is issued, the auditor will be redirected to the submission of the Annual Periodic Information.

For the issuance of the Electronic Declaration of Conformity, the independent auditor must be selected (click on the box located before the auditor's name), confirming the registration data, or altering it if necessary, and then activating the option "SEND FORM". After sending the Electronic Declaration of Conformity, the following information will appear: Form already sent? YES.

Finally, we emphasize that the non-submission of the Electronic Declaration of Conformity, or its submission late, subjects the participant to a daily coercive fine, provided for in Article 6 of CVM Resolution No. 51/2021, in the amount of R$ 200.00 (two hundred reais) for the participant legal entity and R$ 100.00 (one hundred reais) for the participant natural person.

Opportune, considering that all communications from the CVM with independent auditors are carried out via electronic messages (e-mail), we reinforce the need for such addresses to be updated. Also on this topic, we remind you that the e-mail informed as the link of communication with the CVM is not protected by message barriers (anti-spam), as such functionality prevents the reception of forwarded messages.

Unfortunately, we have received several message returns due to this tool. We highlight that such addresses are freely updatable by independent auditors, characterizing the primary source of communication with the CVM. Thus, the existence of these control tools is the sole responsibility of the independent auditors, who assume the risk of their maintenance.

Communications regarding Article 24 of CVM Resolution No. 50/2021

With a view to the faithful compliance with CVM Resolution No. 50/2021, particularly regarding the provisions of Article 24, we reiterate that, for the purposes of the provision of item I of Article 11 of Law No. 9.613 of 1998, independent auditors must carry out monitoring, analysis, and communication considering, at minimum, the application of procedures provided for in specific regulation issued by the CFC.

Due to an agreement signed with the Federal Council of Accounting - CFC, the negative declaration (if applicable) must be made in the CFC environment of SISCOAF. Nothing prevents the auditor registered with the CVM from spontaneously, and in a supplementary manner, also sending suspicious communications or a negative declaration to the CVM segment of SISCOAF.

External Quality Review Program (Article 33 – CVM Resolution No. 23/2021)

We remind you that independent auditors must submit to an external quality review to be carried out by another auditor registered with the CVM, with a view to also evaluating compliance with technical and professional standards, in accordance with a specific standard issued by the CFC. Currently, NBC PA 11 regulates the matter, to be observed by independent auditors.

As provided for in Article 33 of CVM Resolution No. 23/2021, the external quality review must be carried out by another independent auditor also registered with the CVM and who possesses a structure compatible with the work to be developed. In this sense, even for the external quality review of Independent Auditor - Natural Person (AIPN) or Independent Auditor - Legal Entity (AIPJ), constituted as a Single-Person Limited Liability Company (SLU), a reviewer auditor registered with the CVM and equally qualified to perform the quality review must be hired. On this topic, it is also important to establish that the external review report of quality control must be signed by a technical manager registered with the CVM or AIPN registered with this agency, as applicable.

Specifically regarding the performance of the reviewer auditor, we have observed some problems in the execution of review work. Such problems are, for the most part, related to the depth of the examinations carried out, as well as to the obtaining of appropriate and sufficient audit evidence, in order to support the opinion issued at the end of the work. It is important to emphasize that, from the sample of reviewer auditors selected for inspections in compliance with the Risk-Based Supervision Program (SBR) adopted by the CVM in recent years, we identified a high recurrence of problems in the execution of review work by reviewer auditors, leading to the adoption of complementary administrative procedures by this Agency, including the initiation of administrative sanctioning processes (Accusation Term). In this sense, we remind you that the reviewer auditor must pay special attention to verifying compliance with the Professional Education Program (NBC PG 12 R4) and the procedures to be observed by accounting professionals and organizations to comply with the obligations provided for in Law No. 9.613/1998 (CFC Resolution 1530/2017), by the audited auditor, in addition to those already listed in the external quality review questionnaire.

We remind you that non-compliance with the Program instituted by the CFC by the audited auditor also entails the application of administrative sanctions. In this sense, we remind you that §4 of Article 33 of CVM Resolution No. 23/2021 establishes:

§4 Non-compliance with the provisions of the caput in at least 2 (two) of the last 5 (five) years entails the immediate suspension of the registration of the Independent Auditor – Natural Person, or of the Independent Auditor – Legal Entity, until a new review of their quality control is presented, according to the guidelines of the Federal Council of Accounting, with a report issued without reservations, duly approved by the Management Committee of the External Quality Review Program, or equivalent, instituted by the Federal Council of Accounting – CFC.

It is important to emphasize that, since 2018, auditors who again incurred non-compliance with the External Quality Review Program, in the manner provided for in §4 above, had their registrations suspended at the CVM. In such cases, and in those that are identified in the future, the auditor who wishes to reactivate their registration must, by their own act and without the need for prior indication by the External Quality Review Committee – CRE, indicate their reviewer auditor to the CRE, submitting themselves to the external quality review, within the deadlines and procedures defined by the standard governing the Program. At the end of the review, its result, conclusions, and recommendations must be presented to the CRE, so that the Committee can analyze the review performed by the reviewer auditor, approving or not.

Unfortunately, we have observed movements in the direction of attempting to infringe compliance with the External Quality Review Program, notably in two ways:

A. Independent auditors indicated by the CFC to participate in the External Quality Review Program cancel their registration with the CVM. Still within that fiscal year, or in the following year, they request new registration. In this case, as defined in the norms of the CVM and CFC, the auditor must submit to the Program in the next fiscal year (starting from the new registration). However, we have verified that some auditors do not submit to the Program upon their return. It is the understanding of this Superintendence of Accounting and Audit Standards – SNC, that these auditors, with this attitude, incur in the situation described in §4 of Article 33 cited above. Thus, in cases already identified, as well as new ones, the SNC will adopt the suspension provided for in the norm.

B. Some independent auditors, despite submitting to the External Quality Review Program when indicated annually by the CFC, present recurrent problems in their reviews, which makes the approval of the review by the CRE-CFC impossible, being automatically indicated for the following year. We understand that the recurrence of this practice, year after year, characterizes an attempt to circumvent compliance with the external quality review. In this way, we remind you that such auditors are subject to suspension of registration, in the manner of §4 of Article 33 of CVM Resolution No. 23/2021, in addition to the adoption of other administrative measures applicable to the case.

It should be emphasized that, once the suspension of registration for non-compliance with the External Quality Review Program is applied, provided for in §4 of Article 33 of CVM Resolution No. 23/2021, the reactivation of the independent auditor's (audited) registration with the CVM will only occur if the external quality review process is approved by the CRE/CFC and provided that the external quality review report does not contain any reservations (report of review of adequate quality system1). A review report issued with reservations (review report of quality system with deficiencies), abstention of opinion (review report of the quality system with limitation of scope to the reviewer's work) or adverse (review report of inadequate quality system), even if they meet the requirements provided for in the standard and are approved by the CRE/CFC, will not be considered valid for the reactivation of independent auditor registration at the CVM. It is also worth noting that, as already stated previously, the submission to the External Quality Review Program for these suspended auditors will be voluntary, at the request of the auditor themselves, since only auditors active in the CVM register and indicated by the CRE/CFC are obliged to participate in the said Program.

Continuing Professional Education Program (Article 34 – CVM Resolution No. 23/2021)

Aiming to maintain a high standard of technical qualification and constant update regarding professional standards, accounting and audit procedures, and standards related to the exercise of their activity in the securities market, independent auditors registered with the CVM must maintain, for themselves and their technical staff, a continuing education program in accordance with the guidelines approved by the CFC, contained in NBC PG 12 (R4).

In this regard, we remind you that non-compliance with the Continuing Professional Education Program by independent auditors – natural person and independent auditors – legal entity, as well as their partners and/or technical managers, entails the application of administrative sanctions. On this topic, we bring §§ 1 and 2 of Article 34 of CVM Resolution No. 23/2021, which establish:

§ 1 The provisions of the caput apply to Independent Auditors – Natural Person and to partners, who exercise, or not, the activity of auditing, technical managers, directors, supervisors and managers of Independent Auditors - Legal Entity.

§ 2 Non-compliance with the provisions of the caput in at least 2 (two) of the last 5 (five) years entails the immediate suspension of the registration of the Independent Auditor – Natural Person, or the registration as technical manager of Independent Auditor – Legal Entity, until a new certificate of approval in the Technical Qualification Exam, provided for in Article 30 of this Resolution, is presented, regardless of the adoption of other administrative measures applicable.

It is worth clarifying that, due to the joint action of this Agency with the Continuing Professional Education Commission – CEPC, instituted by the CFC for the management and monitoring of the Program, it is not necessary to submit the annual activity report related to Continuing Education to the CVM. This report must be delivered annually to the respective Regional Council of Accounting – CRC, as defined in NBC PG 12 (R4). The proof of compliance with the Continuing Professional Education Program is homologated by the CFC/CRCs system.

We remind you that, regardless of participation in external courses and activities, independent auditors must have mechanisms for timely monitoring of changes in independent audit professional standards issued by the CFC and, when applicable, by the Institute of Independent Auditors of Brazil - IBRACON, and the standards that regulate the independent audit activity within the securities market.

At the request of the CFC, we also inform that, considering the control of the covid-19 pandemic and the resumption of in-person activities, the minimum score required for professionals obliged to comply with the Program returned, starting from 2022, to its normative condition, that is, 40 (forty) points – with at least 12 (twelve) points to be fulfilled with knowledge acquisition activities, contained in Table I of Annex II – as provided for in item 7 of NBC PG 12 (R4).

Auditor Rotation (Article 31 – CVM Resolution No. 23/2021)

We remind you that the Independent Auditor - Natural Person and the Independent Auditor - Legal Entity cannot provide services for the same client for a period exceeding five consecutive fiscal years, requiring a minimum interval of three fiscal years for their re-hiring, regardless of the period in which the auditor provided services to the audited entity.

For its part, we highlight that the only exception permitted is that in which the audited company has a Statutory Audit Committee – CAE, installed and fully functioning, until the date of closure of the third fiscal year counting from the hiring of the independent auditor, and remain in functioning after said date and while using the aforementioned prerogative; and that this auditor is a legal entity, as provided for in Article 31-A of the same Resolution, conditioning, furthermore, to the observation of the requirements contained in Articles 31-B to 31-F, all of the same Resolution. It must be emphasized that the primary responsibility of the auditor is to meet the rotation requirement, renouncing the client when a situation characterizing non-compliance with the standard is verified, notwithstanding the responsibility of the administrators of the audited entity for the eventual hiring and maintenance of independent auditors who do not meet the conditions provided for in the Resolution (Article 27 – CVM Resolution No. 23/2021).

We also alert that rotation cannot be carried out with another audit firm with which the replaced auditor has common interests, nor that they use the same physical and operational structure as the previous auditors. Below, we cite some examples of situations that may characterize non-observance of the auditor rotation rule, in addition to others of the same nature:

a) use of the same address (headquarters and offices, if any);

b) direct kinship relationship between partners and technical managers of audit firms (replaced and current); or

c) creation of "new" audit firms for service provision, with the existence of partners and/or technical managers previously linked to the replaced auditor.

Additionally, we draw attention to the eventual re-hiring of the replaced auditor. Regardless of whether or not the period defined in the standard for consecutive audit services to the same client is reached (five fiscal years, in normal situations; up to ten fiscal years for cases where there is a CAE, functioning and in adherence to the requirements of Resolution 23/2021), its re-hiring can only occur after a period of 03 (three) fiscal years. For example, if AUDITOR "A", after 02 (two) fiscal years of providing services to the audited, was replaced by AUDITOR "B", AUDITOR "A" can only return to provide audit services after 03 (three) fiscal years of their replacement, in any case.

In other words, we clarify that the rule of mandatory rotation of independent auditors is composed by the conjugation of the maximum linkage periods and the minimum withdrawal interval, both necessary to achieve the objective sought by the normative activity in establishing the aforementioned rule. As highlighted above, Article 31-A of CVM Resolution No. 23/2021 established an express hypothesis that exceptions the maximum linkage period, allowing its extension to up to 10 (ten) years, if the audited entity has a Statutory Audit Committee (CAE) permanently functioning and the hired independent auditor is a legal entity. However, there is no hypothesis provided for in the same resolution that contemplates an exception, reducing the minimum interval established.

As can be seen, there is no proportionality relationship between the linkage period and the minimum interval of withdrawal. Thus, for any duration of the linkage period of the independent auditor with the audited entity, the minimum interval of 3 (three) fiscal years, before the start of a new linkage period, must equally be respected.

Regarding the re-election of members of the Statutory Audit Committee (CAE) by re-election, without interregnum between mandates, it is understood that it is possible to re-elect those members. We emphasize, however, that in the occurrence of any gap between mandates, the explicit in § 4 of Art. 31-C of CVM Resolution No. 23/21 must be applied. In addition, in any hypothesis, the maximum period of 10 (ten) years provided for in the caput of Art. 31-C must be observed.

Issuance of Detailed Report (Article 25, item II, CVM Resolution No. 23/2021)

Article 25, item II, of CVM Resolution No. 23/2021 provides that the independent auditor must "prepare and send to the administration and the Fiscal Council, a detailed report containing their observations regarding the internal controls and the accounting procedures of the audited entity, describing, furthermore, any deficiencies or inefficiencies identified during the work".

In this sense, ratifying the provisions of the cited normative text, we clarify that the issuance of said detailed report is expressly mandatory at the end of the work, in any hypothesis, regardless of whether deficiencies or inefficiencies have been, or not, identified in the examined environment. That is, despite the independent audit professional standard that

Circular-Official 1 (2045101) SEI 19957.004309/2024-83 / pg. 19

determines the mention in the report only of significant deficiencies, if any, the detailed report required by CVM Resolution No. 23/2021 is more comprehensive, requiring the issuance of the report at the end of each work.

We reinforce that the detailed report must contain, at a minimum, among other information, the description of the deficiencies and ineffectiveness of the internal controls and accounting procedures adopted by the audited entity, accompanied by the recommendations of the independent auditors for the corrections that may be necessary. As can be seen, such points constitute the minimum set of information that the detailed report must contain. However, they do not exhaust the content of said report.

Furthermore, it is important to emphasize that said report, in consonance with the cited professional standard, must segregate significant deficiencies from those that are not significant. In those extremely rare situations, in which the independent auditor concludes that no internal control deficiencies (significant or not) were identified, the report to be issued will be affirmative, that is, it must state the non-identification of internal control deficiencies, whether significant or not, during the performance of the work.

Such procedure enables minimal proof that the independent auditor executed the evaluation of internal controls and accounting procedures provided for in the standard issued by the CVM and by the independent auditing professional standards. It is always important to remember that it is the responsibility of the audited entity's management to ensure the adequacy of the internal controls it determined as necessary to allow the preparation of financial statements free from material misstatement, and for the auditor, to consider internal control to plan audit procedures that are appropriate in the circumstances; but not for the purpose of expressing an opinion on the effectiveness of internal control.

In this context, we reinforce that the auditor must, furthermore, during the subsequent year audit work, establish specific monitoring of those deficiencies pointed out in the previous report, as well as their outcome in light of management's actions, to determine whether such deficiencies should continue to be communicated in the detailed report, or whether those initially considered "non-significant" have altered their status due to their recurrence, without actions by the management of the audited entity over the periods examined.

It is also important to remember regarding said report that in NBC TA 265 – Communication of Internal Control Deficiencies, the deadline for issuing written communication is detailed in item A13, as follows:

When determining when to issue written communication, the auditor may consider whether the receipt of this communication would be an important factor to allow those responsible for governance to perform their general supervision responsibilities. Furthermore, for entities registered in stock exchanges in certain jurisdictions, those responsible for governance may have to receive the auditor's written communication before the date of approval of the financial statements to perform specific responsibilities regarding internal control, for regulatory purposes or to meet other purposes. For other entities, the auditor may issue the written communication at a later date.

However, in the latter case, considering that the auditor's written communication on significant deficiencies is part of the final audit file, the written communication is subject to the requirement of item 14 of NBC TA 230, which requires the auditor to promptly assemble the final audit file. NBC TA 230 establishes that the appropriate time limit for completing the assembly of the final audit file is normally no more than 60 days after the date of the independent auditor's report (NBC TA 230, item A21). (our highlights)

Therefore, the independent auditor must make efforts to receive management's comments within 60 (sixty) days after the date of the respective audit report. In cases where there is no response from management, the fact must be recorded in that final audit file, along with the version for discussion sent, being considered "final" from that moment.

Audit Report and Key Audit Matters

After several years of adaptation to the determinations contained in standard NBC TA 701, we understand that its informational objectives have been achieved. However, it is relevant to highlight that, in order to achieve such objectives, it is essential that the description of the procedures performed by the auditor and the results achieved present relevant informational content for users, not restricting themselves to generic presentations of what was done and vague statements regarding the adequacy of the subject as a whole to the financial statements.

Regarding the content, various users expect that the following items, among others possible, be described in the Key Audit Matters section, even if not fully required by NBC TA 701, which we understand as improvements applicable by the auditor when preparing their audit report:

specific audit procedures for the risk under discussion;
information on the use of the work of specialists and/or internal auditors;
specific audit procedures related to applicable internal controls and whether, as a result of the application of the procedures performed by the auditor, possible deficiencies in their effectiveness were detected;
possible difficulties in applying the planned procedures;
changes in the planning of procedures executed, in scope or depth of audit tests;
whether, during the execution of audit procedures, adjustments were identified, recorded or not by the entity's management, even if they are not considered material by the auditor.

Additionally, considering the dynamics of the economic and business environment, as well as the diversity of activities, processes, and systems of the audited entities, it is expected that audit reports are effectively individualized, not being mere repetitions of the key audit matters from the previous year, nor composed of standardized (PAAs) subjects, established internally by the audit firm, for the firm as a whole or by sector of activity of the audited entities.

In this sense, regarding the financial statements of separate funds and the provisions of item VIII, art. 25, of CVM Resolution No. 23/2021, which deals with Key Audit Matters, we remind you that each separate fund is considered an entity that reports information for the purpose of preparing individual financial statements. Therefore, independent auditing professional standards must be observed when issuing the respective audit report, including NBC TA 701, which deals with the subject.

Technical Qualification Examination - specific CVM exam (art. 30, CVM Resolution No. 23/2021)

In 2015, NBC PA 13 (R2), now NBC PA 13 (R3), was approved, which deals with the Technical Qualification Examination, instituted by the Federal Council of Accounting – CFC. Thus, considering that the cited NBC PA 13 (R2) altered the operating model of said Examination, creating a specific exam for acting in entities regulated by this Agency, we recall the provisions of article 30, of CVM Resolution No. 23/2021, which determines that the Technical Qualification Examination will be carried out with a view to qualifying the independent auditor for the exercise of the activity of auditing financial statements for all entities included in the securities market.

NBC PA 13 (R2), in its item 3, letter "b", instituted the specific exam for acting in entities regulated by the Securities and Exchange Commission (CVM). That is, from the entry into force of NBC PA 13 (R2), the Technical Qualification Examination – "CVM" became the necessary technical qualification exam for registration with this Agency.

Additionally, it is worth clarifying that approval in a specific technical qualification exam "CVM" is, only, one of the necessary requirements for registration at the CVM. The fact of being active in the National Registry of Independent Auditors (CNAI), maintained by the Federal Council of Accounting, does not guarantee, by itself, compliance with this requirement, since many professionals included in the CNAI were not approved in the Technical Qualification Examination - CVM, but migrated from the CVM's registry when it was created. We clarify that accountants already registered at the CVM as technical managers or Independent Natural Person Auditor - AIPN and who wish to change category or transfer to the registry of another Independent Legal Person Auditor - AIPJ do not need to present the certificate of approval in the technical qualification exam if the change occurs simultaneously, that is, without discontinuity of the professional's registration with the CVM.

Thus, professionals who have already been registered at the CVM as technical managers of an audit firm are subject to proof of approval in said exam (Technical Qualification - CVM) if the request for inclusion in another auditor, or in an audit firm of which they were previously technical manager, occurs after the cancellation of their registry as technical manager in the previous auditor or in that audit firm where they exercised this function.

For its part, with the adoption of the specific technical qualification exam "CVM", we highlight that, after approval in said exam, and until their registry or registration at the CVM, the professional interested in obtaining such prerogative must remain up to date with the requirements of the Continuing Professional Education Program, proving their regularity through a specific certificate issued by the Federal Council of Accounting (items VII of art. 5º; XIII of art. 6º and VI of art. 6º-A of CVM Resolution No. 23/2021). If the aforementioned proof is not possible, the requesting professional must submit again to the specific technical qualification exam for the CVM and obtain the respective approval.

We also clarify that all members of audit teams who exercise managerial functions must also have been approved in said exam, as will be detailed further in item 19 below.

Still on the subject, it is important to alert that, in the event that the audit report issued within the securities market contains signatures of other accountants, in addition to the signature of the accountant registered at the CVM as the technical manager (RT) authorized to issue and sign audit reports on behalf of the audit firm, the other signatories of said report, even if not registered at the CVM as technical managers, must have been previously approved in a specific technical qualification exam "CVM", under penalty of the respective audit firm and its technical manager (RT), registered with this Agency and also signatory of the audit report, infringing item VII of art. 25 of CVM Resolution No. 23/2021.

Composition of audit teams (art. 25, item VII, CVM Resolution No. 23/2021)

Item VII, art. 25, of CVM Resolution No. 23/2021 determines that the auditor must:

VII – ensure that all partners, directors, managers, supervisors, or any other members, with management functions, in the team designated to exercise the activity of auditing entities regulated by the CVM, have been approved in the Specific Technical Qualification Examination for the CVM.

Thus, when planning audit teams, auditors must pay attention to the fact that all those components who exercise management functions, such as partners, directors, managers, or supervisors, among other possible positions, have been approved in the Specific Technical Qualification Examination for the CVM.

It is important to emphasize that item VII of art. 25, combined with the provisions of the caput and §1 of art. 34, all of the cited CVM Resolution No. 23/2021, ratifies the obligation that such professionals pay attention to the annual compliance with the Continuing Professional Education Program, after their approval in said exam. Non-compliance with the guidelines imposed by the Federal Council of Accounting regarding the Continuing Professional Education Program by the aforementioned professionals may lead to the adoption of administrative measures against the independent auditors linked to them.

Regarding specifically the accountants already registered as technical managers authorized to issue and sign audit reports on behalf of each audit firm, within the securities market, it should be noted that, upon their requests for inclusion in the registry of technical managers, these complied with all the requirements that enabled them to have their registration requests approved by the CVM. Thus, it is settled understanding in the SNC that technical managers, as such already registered with this Agency and while maintaining their current active registry, do not need to be approved in the Specific Technical Qualification Examination for the CVM, even if the voluntary performance of said exam is a technically recommended condition as it is addressed to the indispensable and continuous technical improvement of professionals who operate in the securities market.

Unique registry (art. 11, sole paragraph, CVM Resolution No. 23/2021)

The sole paragraph of art. 11 of CVM Resolution No. 23/2021 seeks to establish a relationship of equity between the treatment given to the independent auditor – natural person and the independent auditor – legal person and their technical managers.

As stated in the standard, it is not permitted the registration, in the category of Independent Auditor - Natural Person, of an accountant who is a partner, director, or technical manager or who has a professional link of any nature with Independent Auditor - Legal Person. However, for the partner, or technical manager, of an independent auditor – legal person registered at the CVM, there was no impediment to participation, also as a partner and/or technical manager, in another audit firm registered at the CVM. We therefore had an asymmetric situation that benefited one participant to the detriment of another.

It is worth mentioning that the limitation of a partner's participation to only one audit firm registered at the CVM does not characterize non-compliance with the constitutional right of free association. In truth, there is no impediment to the free association of the professional; they may have as many associations and participations as they wish, even within the same economic group. However, participation in independent auditor – legal person registered at the CVM, whether as a partner or as a technical manager, will be limited to only 01 (one) audit firm. Therefore, requests for new registrations of audit firms or inclusion of technical managers that are in disagreement with this determination will be promptly denied.

Audit of financial statements of Investment Funds in Credit Rights - FIDC, Real Estate Receivables Certificates - CRI and Agricultural Business Receivables Certificates - CRA

OFFICE-CIRCULAR/CVM/SIN/SNC/ No. 01/2012, guides independent auditors who act in "FIDC" funds regarding certain procedures that they should execute regarding the credit rights held by the funds, including the verification of existence and adequate pricing, considering, furthermore, issues related to provisions for losses on these rights, which are dealt with by CVM Instruction No. 489/11.

In this context, we reinforce that said OFFICE-CIRCULAR also applies to the audit procedures to be executed for the financial statements of CRI and CRA separate funds, in order to complement the guidelines of OFFICE-CIRCULAR No. 2/2019/CVM/SIN/SNC, through which we highlighted that the operating dynamics of CRI and CRA are similar to those of FIDC.

Audit of accounting estimates and related disclosures - NBC TA 540 (R2)

We have verified, in recent years, recurrent failures by auditors in meeting the requirements of NBC TA 540 (R1) / NBC TA 540 (R2), in the audit of accounting estimates, including, but not limited to, the audit of impairment tests, fair value, and related disclosures.

Thus, follow our considerations on the main non-compliances verified:

as part of the validation of the calculation methodology used, it is expected that the auditor, among other procedures, verifies the comparison of historically calculated estimates with what was actually realized, analyzing the reasons for the discrepancies verified, and whether the methodology needs any adjustment to be used again in the audited period;
when planning the use of independent calculations (including sensitivity analyses), the auditor must establish an expectation, formalizing in their working papers the acceptable limits of difference in relation to management's calculations and what is their objective with that work;
it is essential that the auditor validates the premises and data (including historical data) used to calculate the estimate;
it is part of the auditor's responsibility to verify if the required disclosures are being made, requesting any necessary adjustments from management;
evaluate possible impacts on their audit report or the inclusion of the subject in the detailed report, when applicable; and
the value of the estimate reflected in the financial statements (appraisal reports, mainly) having been calculated by independent specialists hired by the audited client does not exempt the auditor from the procedures described above, nor from the other requirements of auditing standards, including the verification and review of the reasonableness of premises and projections used and
management's judgment must be neutral, and the auditor must evaluate possible biases of management.

Preparation of audit reports – modification of opinion

It is common to detect the issuance of some audit (or review) reports of annual financial statements and interim financial statements that, in our opinion, were in disagreement with independent auditing professional standards. Such reports were related to companies undergoing criminal investigation processes, including those of their directors and managers.

Although we understand that this is a complex theme, of extreme relevance and involving professional judgment, we have verified that some auditors opt to issue their opinion in a manner inconsistent with the guidelines contained in the professional standards, specifically, NBC TA 700, NBC TA 705, and NBC TA 706. In this sense, we remind you that the auditor must modify the opinion in their report when:

(a) they conclude, based on the audit evidence obtained, that the financial statements as a whole present material misstatements; or (b) they are unable to obtain appropriate and sufficient audit evidence to conclude that the financial statements, as a whole, do not present material misstatements.

We opportunistically emphasize that NBC TA 705, the professional standard dealing with the modification of opinion, is clear in defining the situations in which modifications are required:

Qualified Opinion

The auditor must express a "Qualified Opinion" when:
(a) he, having obtained appropriate and sufficient audit evidence, concludes that the misstatements, individually or in aggregate, are material, but not pervasive in the financial statements; or (b) it is not possible for him to obtain appropriate and sufficient audit evidence to support his opinion, but he concludes that the possible effects of undetected misstatements on the financial statements, if any, could be material, but not pervasive.

Adverse Opinion

The auditor must express an "Adverse Opinion" when, having obtained appropriate and sufficient audit evidence, they conclude that the misstatements, individually or in aggregate, are material and pervasive to the financial statements.

Disclaimer of Opinion

The auditor must refrain from expressing an opinion when they are unable to obtain appropriate and sufficient audit evidence to support their opinion and they conclude that the possible effects of undetected misstatements on the financial statements, if any, could be material and pervasive.
The auditor must refrain from expressing an opinion when, in extremely rare circumstances involving various uncertainties, they conclude that, regardless of having obtained appropriate and sufficient audit evidence on each of the uncertainties, it is not possible to express an opinion on the financial statements due to the possible interaction of the uncertainties and their possible cumulative effect on these financial statements.

Still on the subject, it is necessary to remember that CVM Resolution No. 23/2021, in its article 25, item IV, clearly defines the need to measure the impact on the audited financial statements when issuing the respective audit report, in cases of modification of opinion (qualified or adverse), as follows:

Art. 25. In the exercise of their activities within the securities market, the independent auditor must, additionally:

...

IV - clearly indicate, and by how much, the accounts or subgroups of assets, liabilities, results, and equity that are affected by the adoption of accounting procedures conflicting with the Fundamental Accounting Principles, as well as the effects on mandatory dividends and earnings or loss per share, as the case may be, whenever issuing a review report of interim information or an adverse or qualified audit report.

Still on the subject, we remind you that after the issuance of several alert letters by the SNC, and concomitant interaction with Ibracon, the Federal Council of Accounting (CFC) published, in 2021, the Audit Technical Communication (CTA) 30, which standardizes and guides independent auditors on the impacts in the audit, measurement, and evaluation arising from these situations. The Technical Communication also guides on the possible reflections in the opinion contained in the audit reports of the financial statements of entities involved in matters related to non-compliance with laws and regulations, illegal acts, or fraud, and therefore must be consulted in the

occurrence of such situations.

Independent Auditor – Legal Entity: Corporate Types and Liability of Partners
With the entry into force of CVM Resolution No. 23/2021, significant changes were implemented in the corporate types eligible for use by audit firms registered with the CVM, and the requirement for joint and unlimited liability among partners was eliminated. Thus, there is no longer an obligation for an audit firm registered with the CVM to be constituted as a pure simple society. Similarly, CVM Resolution No. 23/2021 eliminated the mandatory inclusion in their articles of association of clauses requiring joint and unlimited liability among partners.

In this regard, it is relevant to highlight that these regulatory changes do not create any need for audit firms to move to adapt their articles of association to the provisions of CVM Resolution No. 23/2021. On the contrary, existing contracts remain perfectly valid and suitable for maintaining the firm's registration with the CVM. Any contractual changes that reflect the partners' desire to adopt the possibilities introduced by these regulatory changes can be made at any time, according to the will of its partners, and subsequently submitted to the CVM for the update of its registration data, as provided for in Article 17 of the aforementioned Resolution.

Still on the subject, it is opportune to highlight that the Specialized Federal Prosecutor's Office attached to the Securities and Exchange Commission (PFE) expressed the understanding that "no legal or regulatory foundation is seen to prohibit audit firms from adopting the single-member limited liability company (SLU) as a corporate type, provided for in §1 of Article 1.052 of the Civil Code [...] If the independent auditor adopts the form of a single-member society, it must register in the category of independent auditor legal entity."

Recognition of tax credits and their possible reflections in the audit report
During the supervision and inspection activities of the audit activity within the securities market, it is common to identify situations that demonstrate potential problems, with direct impacts on users of accounting information. Currently, an item with this characteristic is the recognition of tax credits and their possible reflections in the financial statements and, ultimately, the respective audit report. Situations such as the Expansion of the Concept of Input – PIS and COFINS and the exclusion of ICMS from the PIS and COFINS calculation base have drawn the attention of this Superintendency, mainly regarding the position of some independent auditors in blatant disregard for basic concepts of the accounting conceptual framework currently in force worldwide.

Regarding the subject, we reiterate that Circular-Office/CVM/SNC/SEP 01/21 addresses the subject comprehensively and should be considered when deciding on the recognition of such values by companies or in issuing an opinion in the audit report by their auditors.

Relevant aspects to be observed in the review of the Notes to the Financial Statements and in the evaluation of other information contained in the

Circular-Office 1 (2045101) SEI 19957.004309/2024-83 / pg. 27

Audited Financial Statements
As informed by the Superintendency of Corporate Relations - SEP, in the results of its actions related to registration requests for public companies, several requirements related to the disclosure of financial information were identified.

From the requirements carried out to conclude the cited analyses, it was possible to identify that the 5 (five) most frequent requirements are related to:
a) deficient disclosure of accounting policies applied to the Company, notably when it is verified that the Company mostly devoted itself to transcribing or paraphrasing accounting standards, thus without compliance with OCPC 07 (R1); b) deficient disclosure of information on Related Parties, without compliance with CPC 05 (R1), notably regarding the disclosure of rates and terms of loans between related parties; c) absence of disclosure of information on the Relationship with Independent Auditors, contrary to CVM Resolution No. 80/2022 (Annex C – Item 9); d) failures in the disclosure of the reconciliation of non-accounting information (LAJIDA/EBTIDA or LAJIDA/EBTIDA adjusted) with accounting information, thus without compliance with CVM Resolution No. 156/2022; and e) deficient disclosure of premises in impairment tests, thus without compliance with CPC 01 (R1), mainly regarding the disclosure of discount rates and growth rates and premises.

If on the one hand, such information is under the primary responsibility of the management of the companies, with these being responsible for paying special attention to the standards related to the preparation of the Financial Statements and the Interim Statements related to the aforementioned themes, as well as to the guidelines contained in CIRCULAR-OFFICE/CVM/SNC/SEP No. 01/2023 (and circular-offices of previous years); on the other hand, it is the responsibility of the independent auditor to make efforts in the analysis of the content of that information presented together with the respective audited accounting statements, recommending necessary adjustments and improvements, in order to allow a better understanding by the various users and, mainly, their adequacy to the applicable financial reporting structure.

Still in this sense, depending on the type, the relevance of the inadequately disclosed information and its possible effects on the degree of understanding by its users of those accounting statements, it is up to the auditor to evaluate, in light of the provisions of the independent audit professional standards, the need to cite the fact in its audit report, considering, including, the possibility of issuing a modified opinion.

Finally, it is worth noting that in initial registration requests for public companies, the auditor will be held responsible for the opinion issued in the respective audit report and for the conduct of the audit work and procedures that served as the basis for its opinion, if there are deviations related to the applicable financial reporting structure and its related disclosures.

Published summarized statements (in printed newspaper)

Circular-Office 1 (2045101) SEI 19957.004309/2024-83 / pg. 28

Guidance Opinion 39 published by the CVM on December 20, 2021, deals with the requirements to be observed in the publication of summarized accounting statements, according to the new wording of Article 289, I and II, of Law 6.404/76:
https://www.gov.br/cvm/pt-br/assuntos/noticias/cvm-divulga-parecer-de-orientacaosobre-demonstracoes-financeiras-resumidas.

We emphasize that the summarized independent auditor's report, when published, must be prepared from the complete independent auditor's report, which must be duly disclosed in an electronic address clearly referenced in the summarized publication.

In our monitoring activities, it has already been possible to observe that some important information recorded in the audit report is being omitted in the final summarized form (“excerpt of the relevant information from the report”). We remind you that item 4 of CVM Guidance Opinion No. 39 defines the minimum content that the summarized independent auditor's report must contain. However, this minimum content does not limit its application, nor does it exclude the need to disclose other relevant information existing in the audit report. Thus, it is the understanding of this SNC that, if when recording emphasis paragraphs in its report, the auditor considers it necessary to draw users' attention to a subject presented or disclosed in the financial statements that, in his judgment, is of such importance that it is fundamental for the understanding by users of the financial statements, it is not acceptable that such information be excluded from the summarized audit report. This understanding applies to any emphasis paragraph contained in the auditor's report and, in an even more substantial way, to those related to the risk of continuity of the audited entity.

We therefore reaffirm that it is the responsibility of the independent auditor to verify if the information published in a condensed manner is in consonance with the complete audited financial statements and with the report issued by the independent auditor on these complete financial statements, in line with the provisions of Article 25, I of CVM Resolution 23/2021.

We also clarify, as also disclosed in Circular No. 01/2022 issued by Ibracon, that the publication of summarized accounting statements cannot be accompanied by the publication of the auditor's report on the integral accounting statements, issued within the scope of NBC TA 700. The publication of an “excerpt of the relevant information from the report” does not confuse with the publication of parts of the report nor does it consist of an opinion on the referenced summarized financial statements.

Immaterial distortions with significant potential to become relevant in the future
As a basis for the auditor's opinion, the NBC TA require that he obtain reasonable assurance that the financial statements as a whole are free from material misstatement, regardless of whether caused by fraud or error.

Thus, the concept of materiality is applied by the auditor in the planning and execution of the audit, as well as in the evaluation of the effect of identified distortions on the financial statements. In general, distortions, including omissions, are considered material if it is reasonable to expect that, individually or collectively, they influence the economic decisions of users taken based on the financial statements.

Judgments on materiality are established taking into account the circumstances involved and are affected by the perception that the auditor has of the needs of the users of the financial statements and by the size or nature of a distortion, or by a combination of both.

In this sense, we emphasize that, when evaluating the “size” of the identified distortions, the auditor must, including, consider their potential for growth in the long term, that is, their potential to become relevant in the future.

Hypotheses of impediment and incompatibility (Art. 22 to 24 - CVM Resolution No. 23/2021)
The SNC understands that independence is perhaps the greatest factor, if not the only one, that differentiates the accounting professional who works within the company from that who provides independent audit services. Technical competence, responsibility, integrity, objectivity, and ethics are elements common to both. The great differentiator is the degree of independence to which both are subject. Moreover, the most relevant aspect of independence is not the fact that the auditor is independent, but rather if he, in addition, appears to be independent, that is, if the people who supposedly should benefit from his work see the auditor as an independent person or society. This is fundamental for the maintenance of confidence in the system.

Considering mainly this last aspect, CVM Resolution No. 23/2021 prohibits the provision of certain consulting services to audit client companies, such as: corporate restructuring, company valuation, asset revaluation, determination of the values of provisions or technical reserves and provisions for contingencies, tax planning, and remodeling of accounting, information, and internal control systems.

At this opportunity, it is worth clarifying that the restriction imposed by item II of Article 23 of CVM Resolution No. 23/2021 does not constitute an obstacle to the exercise of the professional activity, since it does not establish an absolute prohibition on the provision of the audit service nor of the consulting service, but merely prevents both services from being provided, simultaneously, by the same independent auditor to the same client, within the scope of the securities market.

Additionally, CVM Resolution No. 23/2021 prohibits the independent auditor and persons linked to him from acquiring or maintaining securities or financial instruments of the audited entity.

Persons linked to the independent auditor are those with whom he maintains a bond, relationship, participation, or has an interest, as defined by the Federal Council of Accounting (CFC) in the professional independence standards and which prevent him from executing audit services.

Professional judgment and transparency in the audit report
It is essential for the fulfillment of the role of the independent auditor that his opinion be clearly expressed through a written report, which involves, in addition to various other information, transparency in the communication of the main audit matters, and, when applicable, in the preparation of emphasis paragraphs, and in the description of the subject(s) that gave rise to the modification of the opinion.

These items in the report require the auditor to pay additional attention, with a look at the needs of the users of the financial statements, and must be written in a way to allow these users to be able to fully understand the

Circular-Office 1 (2045101) SEI 19957.004309/2024-83 / pg. 30

information that must be transmitted.

As described in NBC TA 701, the communication of the main audit matters aims to make the audit report more informative, by giving greater transparency about the audit performed, providing additional information to the intended users of the financial statements, to help them understand the matters that, according to the auditor's professional judgment, were of greatest importance in the audit of the financial statements of the current period, and may also help them understand the entity and areas that involved significant judgment by management.

With regard to sensitive themes, identified during audit work, which have been the subject of professional judgment, both by preparers of financial statements and by independent auditors, the technical areas of the CVM recommend adopting the following steps, extracted from a conceptual framework for professional judgment, also reported in Circular-Office CVM/SNC/SEP 01/23:

Elucidate the problem and the informational objectives to be achieved;
Consider the alternatives and available choices;
Gather and evaluate the necessary information;
Reach a conclusion; and
Articulate and document the rationale for the decision.

As stated in the aforementioned Circular-Office, we emphasize that it is important that in this process of professional judgment, “mental traps” are avoided, which originate from informational restrictions, influences, preconceived ideas, and biases.

We highlight that teams of experienced professionals on the subject, involved in the process of professional judgment, help mitigate the risks arising from “mental traps”, however, they do not exempt the auditor from his responsibility for his independent opinion, and for the application of the requirements contained in the applicable professional standards.

The auditor must remain attentive, among other things, to signs of management bias, without failing to also observe what is described in item 22 of this Circular-Office.

We also emphasize that, to achieve the degree of transparency intended, such communications should not be standardized, but must be drafted specifically for the subject and for the entity to which they refer.

Finally, it is opportune to remember that item A30 of NBC TA 200 (R1) warns that professional judgment must be adequately documented and should not be used as justification for decisions that, otherwise, are not supported by the facts and circumstances of the work nor by appropriate and sufficient audit evidence.

Main issues pointed out in recent years by IFIAR
We list below the themes of the main findings in auditor inspections in recent years, pointed out by regulators associated with IFIAR, and consistent with those also verified in our supervision and inspection work, for which we recommend attention on the part of auditors:

Circular-Office 1 (2045101) SEI 19957.004309/2024-83 / pg. 31

Accounting estimates, including fair value measurement:

reasonableness of premises – when testing an accounting estimate, failure to evaluate the reasonableness of the premises, including consideration of contradictory or inconsistent evidence;
failure in the sufficiency of tests of data accuracy;
failure to perform sufficient risk assessment procedures;
failure in the adequate consideration of indicators of bias;
failure to consider relevant variables;
failure to evaluate how management considered alternative premises.

Internal control tests:

failure to obtain sufficient persuasive evidence to support confidence in manual internal controls;
failure to sufficiently test controls over, or the accuracy and completeness of, data or reports produced by management;
failure to sufficiently test general information technology controls;
failure to sufficiently evaluate the severity of control deficiencies;
failure to adequately adjust tests as a result of ineffective controls;
failure to adequately assess the adequacy of confidence in the work of others.

Revenue Recognition:

failure to sufficiently understand the terms and conditions of complex agreements and the impact on accounting;
failure in procedures to determine if revenue was recognized in the correct period;
failure to assess and respond appropriately to fraud risks in revenue recognition.

Adequacy of presentation and disclosure in financial statements:

failure to sufficiently consider the adequacy of disclosures in footnotes (excluding segment information)
failure to identify or assess the adequacy of classifications and presentations of financial statements, including Cash Flow Statements;
failure to evaluate and test segment information

Circular-Office 1 (2045101) SEI 19957.004309/2024-83 / pg. 32

Audit Sampling:

insufficient sample to reduce sampling risk to an acceptable low level;
selected sample for test is biased and/or not representative of the population;
failure to identify the nature and cause of any deviation and to project errors to the population;
failure to design appropriate procedures to achieve the test objective and/or to perform adequate alternative procedures when necessary.

Group Audit:

failure to sufficiently consider the nature, timing, and extent of involvement with the work of component auditors, including evidence of reviews performed;
failure to develop a group audit plan and/or appropriately communicate instructions to the component auditor;
failure to appropriately calculate materiality for the group and for related audit components;
failure to appropriately resolve points identified by the component auditor.

Digital Protocol
The objective of the Digital Protocol system is to allow complete automation of the flow of receipt, distribution, and processing of documents received by the Autarchy, making this service more agile and efficient.

Without intermediaries, independent auditors can perform the protocol directly to the Audit Standards Management, which can redirect the demand in case of errors. Among the benefits of automating this service are the reduction in document delivery time and the increase in transparency in this processing, since the auditor can follow it from start to finish of his demand. We highlight that documents must be preceded by an introductory letter signed by the representative of the audit firm, describing the purpose of the documented protocol.

Documents delivered in person or received via Post Office will continue to be treated by the area responsible for receiving these documents, which will perform the registration and digitization in the new Digital Protocol.

Specifically regarding requests for the inclusion of technical managers and the sending of contractual changes, for reasons of user security and the need for internal control, we inform that an individualized SEI process is generated for each request.

Thus, when there is the presentation of several requests, for the inclusion of technical managers and the delivery of several contractual changes, in batches (several documents in a single PROTOCOL), the system generates a single process with the quantity of professionals indicated and changes forwarded.

Circular-Office 1 (2045101) SEI 19957.004309/2024-83 / pg. 33

These occurrences generate a need for manual individualization of processes, which negatively impacts the analysis time for the inclusion of technical responsible persons and the treatment of other related changes, since the entire corporate chain must be verified for the inclusion/exclusion/changes to be processed.

Accordingly, the following guidelines follow for the protocol of these requests:
a) requests for the inclusion/exclusion of technical responsible persons must be made individually (one digital protocol for each professional); and b) avoid, as much as possible, having multiple contractual amendments "accumulated" to be taken to registration (RCPJ) in a single batch.

We remind you that, according to Article 17 of CVM Resolution No. 23/2021, contractual changes must be presented within 30 days of their occurrence (considered the date of registration at the RCPJ, due to the characteristic of public recognition) and, considering that the cost for registration at the respective instances is the same (per each registered change), there is no logical reason for such registrations to be made in batches. Thus, we strongly recommend that companies carry out the respective registrations as the contractual amendments are signed, promoting greater speed in this procedure for CVM and, consequently, in the updating of the registry.

It is unnecessary to remind you that the Digital Protocol does not exclude the other CVM service channels, such as, for example, Hearings for Individuals, File Review, CVMWEB, among others. On the CVM portal, on the SERVICE page, the auditor can consult which channel is most appropriate for their demand. However, the presentation of documents, requests for information, and inquiries of any kind will no longer be accepted via email or telephone.

We reinforce that to use the new Digital Protocol, access the Federal Government Services Portal (https://www.gov.br/pt-br/servicos/protocolar-documentos-junto-acvm) and register. For more information, access (https://www.gov.br/cvm/ptbr/canais_atendimento/protocolo-digital) In case of doubt, contact the Information Management Division (DINF/SAD) via email at dinf@cvm.gov.br or by phone at (21) 3554-8677.

Furthermore, we inform you that, likely still in the first half of 2024, we will have the implementation of the INFOAUDI system (Auditors Registry) which will allow more agile communication of auditors with this SNC, for those documents and information related to the society's registry (registration, inclusion/exclusion of technical responsible person, contractual changes, updates of general registry data, etc.) without the need for use of the digital protocol, by direct access of the independent auditors themselves, via login to the system on our internet page.

Finally, we emphasize the relevance of the guidelines contained in the latest Joint Circular Letters, issued by the Superintendency of Accounting Standards and Audit – SNC and by the Superintendency of Corporate Relations - SEP, all available on our internet page (http://www.cvm.gov.br/legislacao/index.html? buscado=true&contCategoriasCheck=1&vimDaCategoria=/legislacao/oficioscirculares/snc-sep/).
Circular Letter 1 (2045101) SEI 19957.004309/2024-83 / pg. 34

Sincerely,
Document electronically signed by Madson Vasconcelos, Manager, on 05/24/2024, at 15:54, based on art. 6 of Decree No. 8.539, of October 8, 2015.
Document electronically signed by Paulo Roberto Gonçalves Ferreira, Superintendent, on 05/24/2024, at 17:19, based on art. 6 of Decree No. 8.539, of October 8, 2015.
The authenticity of the document can be checked on the site https://sei.cvm.gov.br/conferir_autenticidade, informing the verification code 2045101 and the CRC code 09D1E367.
The authenticity of this document can be verified by accessing https://sei.cvm.gov.br/conferir_autenticidade, and typing the "Verification Code" 2045101 and the "CRC Code" 09D1E367.
Reference: Process No. 19957.004309/2024-83 SEI Document No. 2045101 Circular Letter 1 (2045101) SEI 19957.004309/2024-83 / pg. 35

Circular Letter CVM/SNC/GNA 01/24

Lineage: In force