Circular Letter CVM/SNC/GNA 01/25: Clarifications Regarding the Role of the Independent Auditor in the Securities Market

COMMISSION OF SECURITIES AND EXCHANGE (CVM)
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/SP – ZIP: 01333-010 – Brazil - Tel.: (11) 2146- SCN Q.02 – Bl. A – Ed. Corporate Financial Center, 4th Floor, S.404, Brasília/DF – ZIP: 70712-900 – Brazil - Tel.: (61) 3327-2030/2031

Circular Letter No. 01/2025/CVM/SNC/GNA
Rio de Janeiro, May 5, 2025.

To Independent Auditors and their respective Technical Managers

Subject: Clarifications related to the performance of the independent accounting auditor within the securities market.

Dear Auditors,

As a direct result of the supervision and inspection actions regarding the auditing activity within the securities market, we list below some points related to registration with the CVM, performance in the securities market, and the application of professional standards for independent accounting auditing in the execution of work, for which we request special attention from the independent auditor registered with this Commission.

In this sense, it is important to recall the foundations that guide the actions of the Securities and Exchange Commission (CVM) regarding independent auditing within the securities market:

the importance of an independent auditing system as an indispensable support for the regulatory body;
the figure of the independent auditor as an essential element for market credibility and as an instrument of inestimable value in investor protection, insofar as its function is to ensure the fidelity and reliability of the audited entity's financial statements;
the accuracy and clarity of the financial statements, including the disclosure in explanatory notes of information essential for viewing the patrimonial and financial situation and the results of the audited entity, also depend on an effective auditing system and, fundamentally, on the auditor's awareness of their true role within this context; and
the need for the market to have highly qualified independent auditors who, at the same time, enjoy a high degree of independence in the exercise of their activity.

Sincerely,

Paulo Roberto Gonçalves Ferreira
Superintendent of Accounting and Auditing Standards - SNC

Madson de Gusmão Vasconcelos
Manager of Auditing Standards – GNA

Document electronically signed by Madson Vasconcelos, Manager, on 05/05/2025, at 10:48, based on art. 6 of Decree No. 8.539, of October 8, 2015.

Document electronically signed by Paulo Roberto Gonçalves Ferreira, Superintendent, on 05/05/2025, at 11:17, based on art. 6 of Decree No. 8.539, of October 8, 2015.

The authenticity of the document can be verified on the site https://sei.cvm.gov.br/conferir_autenticidade, by informing the verifier code 2302544 and the CRC code 8E2D1610.

This document's authenticity can be verified by accessing https://sei.cvm.gov.br/conferir_autenticidade, and typing the "Verifier Code" 2302544 and the "CRC Code" 8E2D1610.

Reference: Process No. 19957.003477/2025-32 SEI Document No. 2302544

COMMISSION OF SECURITIES AND EXCHANGE (CVM)
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686

Circular Letter No. 01/2025/CVM/SNC/GNA
Rio de Janeiro, May 5, 2025.

To Independent Auditors and their respective Technical Managers

Subject: Clarifications related to the performance of the independent accounting auditor within the securities market.

Dear Auditors,

In this sense, it is important to recall the foundations that guide the actions of the Securities and Exchange Commission (CVM) regarding independent auditing within the securities market:

the importance of an independent auditing system as an indispensable support for the regulatory body;
the figure of the independent auditor as an essential element for market credibility and as an instrument of inestimable value in investor protection, insofar as its function is to ensure the fidelity and reliability of the audited entity's financial statements;
the accuracy and clarity of the financial statements, including the disclosure in explanatory notes of information essential for viewing the patrimonial and financial situation and the results of the audited entity, also depend on an effective auditing system and, fundamentally, on the auditor's awareness of their true role within this context; and
the need for the market to have highly qualified independent auditors who, at the same time, enjoy a high degree of independence in the exercise of their activity.

Sincerely,

Paulo Roberto Gonçalves Ferreira
Superintendent of Accounting and Auditing Standards - SNC

Madson de Gusmão Vasconcelos
Manager of Auditing Standards – GNA

INDEX

TOPICS RELATED TO THE REGISTRATION, UPDATE, AND MAINTENANCE OF THE INDEPENDENT AUDITOR'S REGISTRATION WITH THE CVM
1.1 Registration as an Independent Auditor (Art. 1 to 4 of CVM Resolution No. 23/2021)
1.1.1 Of the forms of registration as an Independent Auditor
1.1.2 Of the obtaining and maintenance of registration as an Independent Auditor
1.1.3 Of the payment of the Inspection Fee
1.2 INFOAUDI
1.2.1 Of access to the system and delegation to proxies
1.2.2 Of the administration and maintenance of the registration in the system
1.2.3 Of access to the quick manuals for registration and update requests
1.2.4 Of the issuance of the Registration Confirmation Certificate and the history as an independent auditor with the CVM
1.2.5 Of the characteristics of the files sent with the system
1.2.6 Of the inclusion of partners and technical managers and other contractual changes
1.2.7 Of the cancellation of registration or the exclusion of a technical manager
1.3 Proof of the exercise of the auditing activity, as provided in art. 7 (item V, art. 5; item XI, art. 6; item IV, art. 6-A of CVM Resolution No. 23/2021)
1.4 Professional Identity Card for Accountants, or equivalent certificate, issued by the Regional Council of Accounting (CRC) (item II, art. 5; item IX, art. 6; item III, art. 6-A of CVM Resolution No. 23/2021)
1.5 Location and Operation License, or equivalent capable document (item IV, art. 5; item V, art. 6 of CVM Resolution No. 23/2021)
1.6 Certificate of approval in a technical qualification exam (specific exam – CVM), provided for in art. 30 (item VI, art. 5; item XII, art. 6; item V, art. 6-A of CVM Resolution No. 23/2021)
1.6.1 Of the need to take the technical qualification exam
1.6.2 Of the change of category or transfer of registration
1.6.3 Of the approval in the technical qualification exam by the members of the audit teams
1.7 Annual Periodic Information (Art. 16 – CVM Resolution No. 23/2021)
1.8 Single Registration (art. 11, sole paragraph, CVM Resolution No. 23/2021)
1.9 External Quality Review Program (Art. 33 – CVM Resolution No. 23/2021)
1.9.1 Of the submission of the external quality review by peers
1.9.2 Of the performance of the reviewing auditor
1.9.3 Of the suspension of the auditor's registration with the CVM
1.9.4 Of the forms of failing to comply with the External Quality Review Program
1.9.5 Of the reactivation of the registration suspended for non-compliance with the External Quality Review Program
1.10 Continuing Professional Education Program (Art. 34 – CVM Resolution No. 23/2021)
1.10.1 Of the non-compliance with the Continuing Education Program and the suspension of registration
1.10.2 Of the presentation of the annual report of activities related to Continuing Education
1.11 Registration Update and Electronic Declaration of Conformity (art. 2, items I and II of CVM Resolution No. 51/2021)
1.11.1 Of the registration update
1.11.2 Of the issuance of the Electronic Declaration of Conformity
1.11.3 Of the penalty fine for failure to deliver or delay in presenting the Electronic Declaration of Conformity
1.12 Independent Auditor – Legal Entity: Corporate Types and Liability of Partners
TOPICS RELATED TO THE EXECUTION OF WORK AND AUDIT DOCUMENTATION
2.1 CVM Resolution No. 23/2021
2.1.1 Hypotheses of impediment and incompatibility (Art. 22 to 24 - CVM Resolution No. 23/2021)
2.1.2 Issuance of Circumstantial Report (art. 25, item II, CVM Resolution No. 23/2021)
2.1.3 Composition of audit teams (art. 25, item VII, CVM Resolution No. 23/2021)
2.1.4 Auditor Rotation (Art. 31 to 31A – CVM Resolution No. 23/2021)
2.1.4.1 Re-hiring of the Auditor
2.1.4.2 Possibility of extending the service provision period for Companies with Statutory Audit Committee (CAE)
2.1.4.3 Documentation of the installation, composition, and functioning requirements of the CAE
2.1.4.4 Re-election of CAE members
2.1.4.5 Use of a single CAE for the Group
2.1.5 Published summary statements (in printed newspapers)
2.1.6 Relevant aspects to be observed in the review of Explanatory Notes and in the assessment of other information contained in the audited Financial Statements
2.2 Auditing Standards
2.2.1 Audit Report and Key Audit Matters
2.2.2 Preparation of audit reports – modification of opinion
2.2.3 Criteria for sample selection in auditing
2.2.4 Professional judgment and transparency in the audit report
2.2.5 Immaterial distortions with significant potential to become material in the future
2.2.6 Auditing of accounting estimates and related disclosures - NBC TA 540 (R2)
2.2.7 Quality Control – Implementation of NBC PA 01 - Quality Management for Firms (Legal and Natural Persons) of Independent Auditors (corresponding to International Standard on Quality Management – ISQM 1)
2.3 Investment Funds
2.3.1 Auditing of financial statements of Credit Rights Investment Funds - FIDC, Real Estate Receivable Certificates - CRI, and Agribusiness Receivable Certificates - CRA
2.3.2 Assessment of qualification as an investment entity – Participation Investment Funds
2.3.3 Assessment of the classification of financial assets (REITs and PEI-Funds)
2.4 Sustainability
2.4.1 CVM RESOLUTION NO. 193, OF OCTOBER 20, 2023 - preparation and disclosure of the report on financial information related to sustainability, based on the international standard issued by the International Sustainability Standards Board - ISSB
2.5 Other topics
2.5.1 Recognition of tax credits and their possible effects on the audit report
OTHER RELEVANT TOPICS
3.1 Digital Protocol
3.2 Communications related to art. 24 of CVM Resolution No. 50/2021
3.3 Main issues pointed out in recent years by IFIAR
TOPICS RELATED TO THE REGISTRATION, UPDATE, AND MAINTENANCE OF THE INDEPENDENT AUDITOR'S REGISTRATION WITH THE CVM

1.1 Registration as an Independent Auditor (Art. 1 to 4 of CVM Resolution No. 23/2021)

1.1.1 Of the forms of registration as an Independent Auditor

The activity of independent auditing is the prerogative of the accountant legally qualified and registered with the Regional Council of Accounting (CRC). Thus, registration with the CVM does not characterize a limitation or a new professional category. Therefore, there are no incompatibilities between the norms issued by the CVM and the disciplinary regime of the CRC.

CVM Resolution No. 23/2021 maintains two forms of registration:

Independent Auditor – Natural Person (AIPN), granted to the accountant legally qualified and who meets the other requirements established in arts. 3, 5, and 7; and
Independent Auditor – Legal Entity (AIPJ), granted to the society integrated exclusively by accountants, registered with the Regional Council of Accounting and who meets the other requirements established in arts. 4, 6, and 7.

At this time, it is important to highlight that it is not permitted for legal entities registered as accounting organizations with the respective Regional Council of Accounting to be part of the corporate structure of audit societies registered with the CVM as Independent Auditor – Legal Entity (AIPJ).

For partners or other accountants who maintain a professional link of any nature with the AIPJ registered with the CVM to issue and sign assurance (audit) or limited (interim information review) reports, or external quality control review reports in the name of the society, it is mandatory to be registered as a technical manager with the CVM. In this sense, it is important to remember that the technical manager with the CVM is the professional to whom the responsibility for the conduct, execution, and issuance of the audit report in audit work within the securities market is attributed, and, consequently, the burden of any related deviations, as well as the responsibility of the audit society itself registered as an independent auditor with the CVM.

1.1.2 Of the obtaining and maintenance of registration as an Independent Auditor

To obtain or maintain registration with the CVM, the corporate object of audit societies must be exclusively focused on the provision of professional auditing services and other services inherent to the accounting profession, as established in item I of art. 4 of CVM Resolution No. 23/2021, which does not include participation/investment in other entities and the sale of training and preparatory courses, among others.

It is required that at least half of the partners of the AIPJ be technical managers before the CVM to exercise the auditing activity, within the securities market, in the name of the society 1. If, after the society's registration is obtained, there is a change in the corporate structure, whether by exclusion or admission of partners, it is imperative that this proportion be maintained, under penalty of suspension or even cancellation of the respective registration until the situation is regularized 2.

1.1.3 Of the payment of the Inspection Fee

Since 01/01/2022, for registration as an independent auditor, proof of payment of the Inspection Fee for the exercise of the police power legally attributed to the CVM under Law 7.940/1989 and its amendments 3 is mandatory. The payment is annual and must be in full, pro-rata payment is not admitted, and it is further noted that the inspection fee has a tax nature, and in case of default, it may be registered in the Federal Active Debt with the additions provided for in art. 5 of the aforementioned Law 7.940/1989. More information regarding the inspection fee can be obtained at https://www.gov.br/cvm/ptbr/assuntos/regulados/taxa-de-fiscalizacao.

1.2 INFOAUDI

1.2.1 Of access to the system and delegation to proxies

The new auditor registration and information system - "INFOAUDI" was made available to all AIPN and AIPJ Representatives in June/2024, for users who already had registration in the CVMWEB system (used for sending Annual Information and Electronic Declaration of Conformity).

To use INFOAUDI, it is mandatory to have an account created on GOV.BR, as login in that environment is necessary to access the system. Once logged into GOV.BR, simply access the option "PARTICIPANT REGISTRATION UPDATE" > "INFOAUDI - Auditor Management" or access directly (always requiring GOV.BR login) the link: https://cvmweb.cvm.gov.br/swb/default.asp?sg_sistema=sic.

To delegate access to new proxies, it is necessary for AIPJ Representatives, or AIPN, to perform the delegation after accessing CVMWEB. Access for delegation is on the CVMWEB home screen, in "CVM PARTICIPANT SERVICES" > "ACCOUNT ADMINISTRATION" > "TASK DELEGATION", selecting the "INFOAUDI" (Auditors) option.

1 CVM Resolution No. 23, final part of item II of art. 4.
2 CVM Resolution No. 23, art. 15, II.
3 Art. 4, items III and V as amended by MP 1.072/2021 converted into Law 14.317/2022.

COMISSÃO DE VALORES MOBILIÁRIOS
Rua Sete de Setembro, 111/2-5º e 23-34º Andares, Centro, Rio de Janeiro/RJ – CEP: 20050-901 – Brasil - Tel.: (21) 3554-8686

1.2.2 From the administration and maintenance of the registry in the system

INFOAUDI represents an advancement in the administration and maintenance of the registry and information related to auditors registered with the CVM, where the auditors themselves and their proxies (delegated via the system) can interact more quickly and practically in maintaining and updating their registry data.

When registering a new request in INFOAUDI, an electronic administrative process (SEI) is automatically generated, whose data will be confirmed and validated by the Audit Standards Management (GNA) of the Accounting and Audit Standards Superintendence (SNC) of the CVM, which may approve, deny, or request compliance with certain requirements. The progress of the analysis can be tracked within the INFOAUDI system itself.

Initially, the request registered in INFOAUDI remains in a pending situation, which means it is under analysis - with the GNA. If, in the evaluation of the process by the Management, the need for adjustment or completion of information/documentation is identified, it will remain under requirement - with the Auditor (requiring, obligatorily, action by the applicant, via INFOAUDI).

When the request is updated by the auditor, the process returns again for analysis by the GNA.

1.2.3 From access to quick manuals for requesting registration and registry updates

To facilitate the use of the new system, the following is available on its home screen: “Quick Manual for Access to InfoAudi for Registration Request” and “Quick Manual for Access to InfoAudi for Registry Update (independent auditors already registered with the CVM)”, with instructions for applicants for new registrations and with the main functionalities of the system to be used by independent auditors already registered with the CVM, respectively. Among the functionalities contained in the Manual for Registry Update, we highlight:

Address (Change/Addition/Exclusion): Allows changing data from an already registered address, including a new type of address, or excluding one already provided, upon presentation of supporting documentation that will be evaluated by the GNA with subsequent approval or denial of the request.
Social Name/Name: Allows changing the Social Name (in the case of AIPJ) or the Name (in the case of AIPN), upon presentation of supporting documentation that will be evaluated by the GNA with subsequent approval or denial of the request.
Professional Council (available only for AIPN): Allows changing the type of CRC - from provisional to ordinary or from ordinary to transferred - upon presentation of supporting documentation that will be evaluated by the GNA with subsequent approval or denial of the request.
Partner/Representative/Responsible Director (available only for AIPJ): Allows changing, including, or excluding any data related to Partners, Representatives, or Responsible Director of an AIPJ. Whether regarding the insertion of a new type of responsible person, exclusion, or alteration of an already registered one (change of type, name, transfer of professional council (CRC), email) - upon presentation of supporting documentation that will be evaluated by the GNA with subsequent approval or denial of the request.
Contractual Changes (Others) (available only for AIPJ): Allows including a new contractual change registered in the Civil Registry of Legal Entities. We remind you that, according to article 17 of CVM Resolution No. 23/2021, contractual changes must be presented within 30 days of their occurrence (considered the date of registration in the RCPJ, due to the characteristic of public recognition) and, considering that the cost for registration in the respective instances is the same (for each registered change), there is no logical reason for such registrations to be made in batches. Thus, we strongly recommend that companies carry out the respective registrations as contractual changes are executed, promoting greater speed in this procedure for the CVM and, consequently, in registry updates.
Movement (Addition/Exclusion) (available only for AIPJ): Allows including or excluding a professional as Technical Responsible in an AIPJ. Upon presentation of supporting documentation that will be evaluated by the GNA with subsequent approval or denial of the request.
Data Update (available only for AIPJ): Allows changing, including, or excluding any data related to Technical Responsible persons already registered in an AIPJ (change of name, transfer of professional council (CRC), email).

1.2.4 From the issuance of the Registration Confirmation Certificate and the history as an independent auditor with the CVM

It is also possible, using INFOAUDI, for the auditor themselves to issue their Registration Confirmation Certificate, previously requested by independent auditors via Digital Protocol and issued in the format of an Office. With this, as many certificates as necessary can be issued through the system, and they can be validated and confirmed directly on the internet by the recipient, assisting in case of eventual professional hiring.

Furthermore, the independent auditor's history with the CVM, previously exclusive to the regulator, is also available in INFOAUDI. The registry form, with all management of information about the independent auditor with the CVM, can be accessed by the user themselves in the system, and it is possible to consult the updated list with the technical responsible persons authorized to issue and sign audit and review reports on behalf of the audit firm.

1.2.5 From the characteristics of the files sent along with the system

It is important to highlight some relevant information for the use of INFOAUDI:

Only files in PDF format should be attached to the System.
The maximum size of each transmitted file is 20MB.
Each document must be digitized individually, resulting in a PDF file per document. For example: The auditor needs to send 3 documents to the CVM: 1) professional identity card - CRC of the partner; 2) Change of Social Contract of the audit firm; and 3) Certificate of Technical Qualification Examination. Then he must create 3 separate files, each containing only 1 digitized document.
Each digitized file must be saved with a descriptive name of the content of the document, which does not exceed 100 characters (including spaces). For example: In the situation above, the files could be named as: CART CRC SOCIO [NAME]; [XNºX] ALT CONT SOC; CERT EQT SOCIO/RT [NAME].
Each attached file must have a specific and different name from the others. If it is necessary to send more than one file for a certain type of document, some difference at the end of the file name can be used to individualize it. For example: RELATORIO AUDITORIA ANO 2024; RELATORIO AUDITORIA ANO 2024 PARTE 1; RELATORIO AUDITORIA ANO 2024 PARTE 2.
It is possible to use the same "document type" for several files. For example: 5 files of type "Proof of exercise of audit activity".

1.2.6 From the inclusion of partners and technical responsible persons and other contractual changes

All requests for inclusion of new partners or new technical responsible persons must inform the individual professional email of the respective partner/technical responsible person, including, in the Registry Information file.
The presentation of a new contractual change, by itself, already generates a process of type "Contractual Change (Others)". However, it is mandatory to also register the specific processes, if the said change also treats (or among other issues) partner/representative/director responsible/technical responsible, address and/or social name, thus encompassing each of the situations individually. For example: 1 process for inclusion of partner [XXX], 1 process for exclusion of partner [YYY], 1 process for change of address of branch [ZZZ], in addition to the process of "Contractual Change (Others)".
In other words, it is essential to open all other specific processes simultaneously with the opening of the Contractual Change process, and vice versa, under penalty of denial of those that are in the GNA analysis queue.
Remembering that: (i) the opening of additional processes does not exclude the possibility of complementary requests to the Contractual Change process or even other processes derived from the final analysis; and (ii) the contractual change process (Contractual Change - Others), which we call primary, will only be processed after all analyses, requirements, pending items, and associated processes are resolved.
The request for inclusion of a new Technical Responsible linked to an AIPJ with active registration, whether he is a registered partner, entrant (needs first to exist an approved request for inclusion as a partner), or accountant with professional link (needs to present CTPS), must be carried out in the option "Audit Management - Registry Update => Technical Responsible - Movement (Addition/Exclusion)".
The option "Audit Management - Request Registration" should only be used by the professional if there is the intention to act as an AIPN; that is, without link to a Legal Entity. Such option requires, even, the prior payment of a specific supervision fee.
When a process is evaluated with requirements, an automatic email from the System is sent to the auditor, with the Office attached, in which the GNA's analysis is detailed, informing about the need to complement documents and/or information within the deadline of 15 (fifteen) business days.
The System also sends continuous automatic daily emails, as reminders, when the process has not yet had its requirements met.
In this context, the auditor must necessarily take measures, within INFOAUDI, in the original process itself - see item "2.3 Complement information/documents (Requirements)" of the Manual, even if the evaluation indicated the opening of an additional process. In other words, the original process must always be updated so that new analysis can proceed.

1.2.7 From the cancellation of registration or the exclusion of technical responsible person

The cancellation of registration as AIPN or AIPJ or the exclusion of technical responsible persons can be done through a signed and dated declaration by the representative in the case of Legal Entity or by the auditor themselves in the case of Natural Person, attached to the specific request in INFOAUDI. The declaration must indicate the professionals' awareness of the exclusion from the registry of technical responsible persons and the need to comply with the requirements of CVM Resolution No. 23/2021, in case they do not maintain their registries active with the CVM, including new approval in the CVM Technical Qualification Examination for future registrations as AIPN or inclusions as technical responsible of AIPJ, even if it is from the same society from which they were excluded. The list of technical responsible persons authorized to sign audit reports can be consulted on the CVM website, by accessing the link http://sistemas.cvm.gov.br/?CadGeral and typing the social name or CNPJ number of the respective audit firm.

1.3 Proof of the exercise of audit activity, as provided in art. 7º (inciso V, art. 5º; inciso XI, art. 6º; inciso IV, art. 6º-A of CVM Resolution No. 23/2021)

Among the other conditions for obtaining registration, it is fundamental that the exercise of audit activity be proven, which basically comprises the issuance and signing of audit opinions or reports, for a minimum period of 05 (five) years, consecutive or not. This period is counted from the interested party's registration in the CRC, in the category of accountant. The exercise of audit activity prior to this registration in the category of accountant constitutes non-compliance with professional standards and will not be considered in the analysis of the registration request, being subject, furthermore, to communication to the CFC/CRCs system due to the irregular exercise of the profession.

The said proof must be met, exclusively, in the following manner:
a) Published Audit Reports: The accountant must present audit reports (reasonable assurance) signed and published in a newspaper, specialized magazine, or on the internet, with at least one publication per year. The publication must include the report, financial statements, and explanatory notes, and be carried out in accordance with the standards of the Federal Council of Accountancy (CFC). The name of the newspaper/magazine or the address of the site, in the case of publications on specific pages, and the date of publication must be provided. b) Acting as an Employee of an Audit Firm: The accountant must prove that they exercised audit activity in an audit firm registered with the CVM, with the date of registration as an accountant being the starting point for counting experience. The proof can be made through a copy of the individual employee registration or declaration of the society, detailing the admission, exit, positions, and function changes. For registration as an AIPN, it is necessary to prove that the accountant is no longer part of the society. To prove the exercise of audit activity in the manner indicated in item “b” above, it is necessary:

Present supporting documentation:
o copy of the individual employee registration of the accountant in the employing audit firm, containing all information required by specific regulation. A declaration signed by a partner representative of the employing audit firm will also be admitted, in which the accountant's qualification; the dates of admission and exit from employment (if applicable); the position or function in which they were admitted, and the dates when position or function changes occurred, must necessarily appear. o copy of the work and social security card (CTPS) of the interested accountant, comprising the pages containing: the number and series of the CTPS; the holder's qualification; the annotations regarding employment contracts and changes in salaries, vacations, positions, or functions exercised. Copies of CTPS pages that are blank, i.e., in which no annotations have been recorded, do not need to be presented.
Prove acting in a management or supervisory position: It is necessary to prove that the accountant exercised, for five years, positions of direction, management, or supervision in the audit of financial statements. The experience period in these positions can be counted based on partial periods, consecutive or not, as long as the sum is not less than five years.
The CVM may also, at its exclusive discretion, accept proof of the exercise of audit activity through the presentation of unpublished works 4, containing the respective reasonable assurance report (audit), the corresponding detailed report (final report, encompassing the entire audited period), and the respective audited financial statements. To guarantee professional secrecy and authenticity, the audited entity must authenticate the documents and authorize their presentation to the CVM, exclusively to prove the exercise of audit. The authentication must include the signature of the legal representative of the audited entity on each page, indicating that the copy matches the original. This proof will also be subject to the evaluation of the quality of the work, which may include the request to make the working papers available to the CVM. The detailed report must contain, at minimum, the following information: the name or social name of the audited entity; the period covered by the examination; description of the deficiencies and ineffectiveness of the internal controls and accounting procedures adopted by the audited entity followed by recommendations for the required corrections; and the date of issuance, identification, and signature of the responsible auditor.

1.4 Professional identity card of the accountant, or equivalent certificate, issued by the Regional Council of Accountancy (inciso II, art. 5º; inciso IX, art. 6º; inciso III, art. 6º-A of CVM Resolution No. 23/2021)

The interested party must present a copy of the accountant's identity card, in the category of accountant, or an equivalent registration certificate issued by the CRC, in case the registration date does not appear on their card. This is because, in the absence of the said date, for the purpose of the initial term for counting the time of exercise of audit activity in the manner of art. 7º, the date of issuance of the presented card will be considered. Therefore, when there is a new issuance of the card, it is recommended that previous copies also be sent, so that the oldest issuance date can be considered the initial term for counting the time of exercise of audit activity. Although it is possible to deliver only the “equivalent certificate, issued by the Regional Council of Accountancy” according to the standard 5, it is also recommended to present the digital file of the professional identity card generated from the CRCDigital application (Professional Card – Export) or the printout of the registration data consultation (including registration date and current status) of the accounting professional in the respective CRC registry, in case the physical professional identity card or the professional qualification certificate do not indicate the date of the professional's registration, prejudicing the verification of compliance with art. 7º of the same resolution. Thus, for the purpose of complying with the aforementioned provisions, the professional qualification certificate that does not contain the date of the professional's registration in the category of accountant is not considered an equivalent certificate to the accountant's professional identity card.

1.5 Location and Operation License, or equivalent capable document (inciso IV, art. 5º; inciso V, art. 6º of CVM Resolution No. 23/2021)

Regarding the proof of a legal office in the person's own name, the Location and Operation License or equivalent capable document issued by the City Hall of the municipality where the professional exercises their activity must be sent. The following cases will not be accepted:

AIPN – document issued in the name of a potential society of which the interested party is a member; and
AIPJ – document issued in the name of a natural person, even if they are part of the partnership of the requesting audit firm, nor document issued in the name of another society.
In the event that the activity exercised by the AIPN or the AIPJ is dispensed with or exempt from a location and operation license by the City Hall of the municipality where the said activity is exercised, the respective reference indicating the municipal regulation that supports the said exemption or waiver must be sent, as well as the equivalent document, which among others, may be:
the municipal taxpayer registration form or the registry data form of the AIPN or AIPJ at the respective city hall;
the specific consultation of exemption or waiver of license of the AIPN or AIPJ on the respective city hall's page on the worldwide web;

4 CVM Resolution No. 23, art. 7°, §1º.
5 CVM Resolution No. 23, art 5°, II, art. 6°, IX and art. 6°-A, III.

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686

the specific declaration of exemption or waiver of the AIPN or AIPJ license issued by the respective municipal mayor's office;
if provided for in municipal regulations, the self-declaration presented by the AIPN or AIPJ to the respective municipal mayor's office regarding its classification in a scenario of exemption or waiver of a license for location and operation.

1.6 Certificate of approval in technical qualification exam (specific exam – CVM), provided for in art. 30 (item VI, art. 5º; item XII, art. 6º; item V, art. 6º-A of CVM Resolution nº 23/2021)

1.6.1 On the necessity of taking the technical qualification exam
NBC PA 13 (R3), which deals with the Technical Qualification Exam, established by the CFC, created a specific exam for acting in entities regulated by the CVM, according to article 30 of CVM Resolution n.º 23/2021. NBC PA 13 (R3) determines that the Technical Qualification Exam will be taken for the authorization to exercise the activity of auditing financial statements for all entities included in the securities market. Therefore, for the registration of Independent Auditor (AIPN or AIPJ) with the CVM, it is necessary to present the certificate of approval in the specific (CVM) technical qualification exam 6.

The Certificate of Registration in the CNAI is not sufficient because it only proves that the accountant is registered as an independent auditor, but does not attest that he passed the specific technical qualification exam required by the CVM to act as the technical manager of audit firms. As is well known, many professionals included in the CNAI were migrated to the CVM registry without approval in the exam, as they already had registration prior to the creation of the specific exam.

The certificate can be obtained on the website of the Federal Council of Accounting (CFC) on the worldwide computer network (https://cfc.org.br/desenvolvimento-profissional-einstitucional/exames/certificados/).

1.6.2 On the change of category or transfer of registration
Accountants already registered with the CVM as technical managers or AIPN who wish to change category or transfer to the registry of another AIPJ do not need to present the certificate of approval in the technical qualification exam if the change occurs concomitantly, that is, without discontinuity of the professional's registration with the CVM. Thus, professionals who were previously registered with the CVM as technical managers of an audit firm are subject to proof of approval in said exam (Technical Qualification - CVM) if the request for inclusion in another auditor, or in an audit firm of which they were previously technical manager, occurs after the cancellation of their registration as technical manager with the previous auditor or in that audit firm where they exercised Items VI of art. 5º, XII of art. 6º and V of art. 6º-A of CVM Resolution nº 23/2021.
Annex Circular Letter CVM SNC GNA 01 2025 (2315998) SEI 19957.003477/2025-32 / pg. 16

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686 this function.
After approval in the contest and until registration or recording with the CVM, the professional interested in obtaining such prerogative must remain up to date with the requirements of the Continuing Professional Education Program, proving its regularity through a specific certificate issued by the CFC 7. Otherwise, the applicant must obtain approval in the specific technical qualification exam for the CVM again.

1.6.3 On approval in the technical qualification exam by members of audit teams
All members of audit teams who perform managerial functions must also be approved in said exam.
In the event that the audit report issued within the scope of the securities market contains signatures of other accountants not registered as technical managers (RT) with the CVM, they must also have been previously approved in a specific "CVM" technical qualification exam, under penalty of the respective audit firm and its technical manager (RT), registered with this agency and also signatory of the audit report, infringing item VII of art. 25 of CVM Resolution nº 23/2021.

1.7 Annual Periodic Information (Art. 16 – CVM Resolution Nº 23/2021)
Independent auditors must send to the CVM, by the last business day of April of each year, information related to their activity in the securities market, according to Annex D to CVM Resolution n.º 23/2021 8. This information is important support for the CVM to evaluate the auditors' capacity to adequately serve their clients.

Such information must be sent via the internet, on the CVM page. The submission must be made through the option “REGULATED (https://www.gov.br/cvm/ptbr/assuntos/regulados)”, selecting next the option “DOCUMENT SUBMISSION – CVMWEB (https://cvmweb.cvm.gov.br/swb/default.asp?sg_sistema=scw)” and, finally, the option “DOCUMENT SUBMISSION”.

With the aim of facilitating the presentation of the Electronic Conformity Declaration, avoiding delays or non-presentation, since 2020, when accessing the CVMWEB system to present Annual Periodic Information, the auditor is automatically directed to the verification of their registration data. After validation of the registration data, or their update, the auditor must issue the Electronic Conformity Declaration and, only then, is redirected to the presentation of Annual Periodic Information.

At this stage, there are two options for forwarding information: i) Document submission via form and ii) Document upload. Finally, the option “Annual Report of Independent Auditor” must be selected. The “document upload” option should be used only by those auditors who have more than 10 (ten) clients that are publicly held companies (or part of the securities market or incentivized companies), since, in this case, it is necessary to create a file (XML standard) to forward the required information.

Additionally, from the effectiveness of CVM Resolution nº 23/2021, Annex D presents in item 4.A the request for presentation of the financial statements of the audit firm (only legal entity) referring to the social year that serves as the basis for the annual information being presented, if the period provided by law for its elaboration has already elapsed; or to the penultimate closed social year, in other cases. The file containing the financial statements must be in “PDF” format and must be sent together with the Annual Information through the document upload option made available.

Non-observance of the deadline for sending the information treated in this topic entails the charge of a daily coercive fine of R$ 200.00 (two hundred reais) 9.

There is no longer a need to inform about courses and training carried out in the year of competence of the report, as this information is sent directly by the CFC to the CVM.

1.8 Single registration (art. 11, sole paragraph, CVM Resolution n.º 23/202)
The sole paragraph of art. 11 of CVM Resolution n.º 23/2021 seeks to ensure equity in the treatment given to the AIPN and the AIPJ and their technical managers. The rule does not allow the registration in the category of AIPN of an accountant who is a partner, director, or technical manager or who has a professional link of any nature with an AIPJ.

In this way, an asymmetric situation was corrected that allowed partners or technical managers of AIPJ registered with the CVM to act in another audit firm also registered with the CVM.

It is worth mentioning that the limitation of participation of a partner in only one audit firm registered with the CVM does not violate the constitutional right to free association. The professional can have as many associations and participations as desired, even within the same economic group. However, participation in an AIPJ registered with the CVM will be limited to only 01 (one) audit firm. Therefore, requests for new registrations or inclusion of technical managers that are out of compliance with this determination will be promptly denied.

9 Provided for in CVM Resolution n° 23, art. 1, in light of CVM Resolution n° 47/2021.
Annex Circular Letter CVM SNC GNA 01 2025 (2315998) SEI 19957.003477/2025-32 / pg. 18

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686

1.9 External Quality Review Program (Art. 33 – CVM Resolution n.º 23/2021)

1.9.1 On the submission of external quality review by peers
Independent auditors must submit to the external quality review carried out by another auditor registered with the CVM 10, in consonance with technical and professional standards, especially NBC PA 11 issued by the CFC.

The review must be carried out by another independent auditor also registered with the CVM with a structure compatible with the work to be developed, even for AIPN or AIPJ constituted as a Single-Person Limited Company (SLU). The external review report of quality control must be signed by a technical manager registered with the CVM or an AIPN registered with this agency, as applicable.

1.9.2 On the performance of the reviewing auditor
Specifically regarding the performance of the reviewing auditor, within the scope of the Risk-Based Supervision Program (SBR) adopted by the CVM in recent years, recurrent problems have been observed in peer reviews, mostly related to the depth of examinations and the obtaining of appropriate and sufficient audit evidence to support the opinion. As a result, the Agency adopted complementary administrative procedures, including the initiation of sanctioning processes (Accusation Term). In this sense, it is worth highlighting that the reviewing auditor must verify especially if the reviewed party complies with the Continuing Professional Education Program (NBC PG 12 R4) and the procedures to be observed by accounting professionals and organizations to comply with the obligations provided for in Law n.º 9.613/1998 (CFC Resolution 1530/2017), in addition to the requirements of the external quality review questionnaire.

1.9.3 On the suspension of the auditor's registration with the CVM
Non-compliance with the review program in at least 2 (two) of the last 5 (five) years leads to the suspension of the auditor's registration until a new review is presented and approved 11.

Since 2018, auditors who reoffend in non-compliance with the External Quality Review Program will have their registrations suspended with the CVM and, if they wish to reactivate their registration, they must, by their own act and without the need for prior indication by the External Quality Review Committee – CRE, indicate their reviewing auditor to the CRE, submitting themselves to the external quality review, within the deadlines and procedures defined by the rule governing the Program. At the end of the review, its result, conclusions and recommendations must be presented to the CRE so that the review carried out can be analyzed, approving it or not.

10 CVM Resolution n° 23/2021, art.33.
11 CVM Resolution n° 23/2021, art. 33, §4º.
Annex Circular Letter CVM SNC GNA 01 2025 (2315998) SEI 19957.003477/2025-32 / pg. 19

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686

1.9.4 On the ways to infringe compliance with the External Quality Review Program
An attempt to infringe compliance with the External Quality Review Program is observed, notably in two ways:
a) Independent auditors indicated by the CFC for the External Quality Review Program who cancel their registration with the CVM and request new registration, in the same exercise or the following, to avoid the review. Even in these cases, according to CVM and CFC regulations, the auditor should submit to the Program in the next exercise (counting from the new registration). However, some do not comply with this requirement upon return. The SNC understands that even so, these auditors fail to comply with external quality control for two exercises 12. Thus, in identified and future cases, the SNC will adopt the suspension provided for in the rule. b) Some independent auditors, although they submit to the External Quality Review Program when indicated annually by the CFC, present recurrent problems in their reviews, making the approval of the review by the CRE-CFC unviable, being automatically indicated for the following year. It is understood that the recurrence of this practice, year after year, constitutes an attempt to circumvent compliance with the external quality review. In this way, we remind you that such auditors are subject to suspension of registration, in addition to the adoption of other administrative measures applicable to the case.

1.9.5 On the reactivation of the registration suspended for non-compliance with the External Quality Review Program
The reactivation of the registration suspended for non-compliance with the External Quality Review Program will occur only if the process is approved by the CRE/CFC without any deficiency pointed out (quality system review report “without deficiencies”). Reports with any other opinion, even in compliance with the rule and approved by the CRE/CFC, will not be considered valid for the reactivation of the independent auditor's registration with the CVM. Submission to the External Quality Review Program for these suspended auditors is voluntary, at the request of the auditor himself, being mandatory only for active auditors in the CVM registry and indicated by the CRE/CFC. We emphasize that this reactivation of registration is not automatic, and it is up to the suspended auditor to make the request to the CVM.

12 CVM Resolution n° 33, art. 33, § 4º.
Annex Circular Letter CVM SNC GNA 01 2025 (2315998) SEI 19957.003477/2025-32 / pg. 20

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686

1.10 Continuing Professional Education Program (Art. 34 – CVM Resolution n.º 23/2021)

1.10.1 On non-compliance with the Continuing Education Program and suspension of registration
Aiming to maintain a high standard of technical qualification and constant update regarding professional standards, accounting and audit procedures, and standards related to the exercise of their activity in the securities market, independent auditors registered with the CVM must maintain, for themselves and their technical staff, a continuing education program in accordance with the guidelines approved by the CFC, contained in NBC PG 12 (R4).

Non-compliance with the Continuing Professional Education Program in at least 2 (two) of the last 5 (five) years by AIPNs and AIPJs, as well as their partners and/or technical managers, entails the immediate suspension of registration until a new certificate of approval in the Technical Qualification Exam is presented 13.

1.10.2 On the presentation of the annual report of activities related to Continuing Education
Due to the joint action of this Agency with the Continuing Professional Education Commission – CEPC, established by the CFC for management and monitoring of the Program, it is not necessary to present the annual report of activities related to Continuing Education to the CVM. Said report must be delivered annually to the respective Regional Council of Accounting – CRC, as defined in NBC PG 12 (R4). Compliance with the Continuing Professional Education Program is homologated by the CFC/CRCs system.

We remind you that, regardless of participation in external courses and activities, independent auditors must have mechanisms for timely monitoring of changes in independent audit professional standards emanating from the CFC and, when applicable, from the Institute of Independent Auditors of Brazil - IBRACON, and the standards that regulate the activity of independent audit within the scope of the securities market.

At the request of the CFC, we also inform that, considering the control of the covid-19 pandemic and the resumption of in-person activities, the minimum score required for professionals obliged to comply with the Program returned, starting from 2022, to its normative condition, that is, 40 (forty) points – with at least 12 (twelve) points to be fulfilled with knowledge acquisition activities, contained in Table I of Annex II – as provided for in item 7 of NBC PG 12 (R4).

13 CVM Resolution n° 23, art. 34, § 2º.
Annex Circular Letter CVM SNC GNA 01 2025 (2315998) SEI 19957.003477/2025-32 / pg. 21

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686

1.11 Registration Update and Electronic Conformity Declaration (art. 2º, items I and II of CVM Resolution n.º 51/2021)

1.11.1 On registration update
Regardless of the presentation of periodic information, it is also necessary that independent auditors keep their registration up to date, observing a deadline of up to 07 (seven) business days counted from the date of the fact that caused the alteration. For this, it is necessary for independent auditors to access their registration data on the CVM page. In addition to on-demand updates, annually until the 30th day of April 14, the Independent Auditor must confirm that their registration data remain valid, with the issuance of the Electronic Conformity Declaration.

Opportunistically, considering that all communications from the CVM with independent auditors are carried out through electronic messages (e-mail), we reinforce the need for such addresses to be updated.

Still on this topic, we remind you that the e-mail informed as the link of communication with the CVM is not protected by message barriers (anti-spam), as such functionality prevents the reception of forwarded messages. Unfortunately, we have received several message returns due to this tool. We highlight that such addresses are freely updated by independent auditors, characterizing the primary source of communication with the CVM. Thus, the existence of these control tools is the sole responsibility of independent auditors, who assume the risk of their maintenance.

1.11.2 On the issuance of the Electronic Conformity Declaration
The Electronic Conformity Declaration must be issued by accessing the option “REGULATED (https://www.gov.br/cvm/pt-br/assuntos/regulados)”, selecting the option “PARTICIPANT SERVICES CVM” and then the option “PARTICIPANT REGISTRATION UPDATE”, followed by “ELECTRONIC CONFORMITY DECLARATION”, on the CVM page. It is important to emphasize that, even in cases where there are no alterations in the data on the site, the Electronic Conformity Declaration must be issued.

For the issuance of the Electronic Conformity Declaration, the independent auditor must be selected (click on the box before the auditor's name), confirming the registration data, or altering them if necessary, and then activating the option “SEND FORM”. After sending the Electronic Conformity Declaration, the information “Form already sent? YES” will appear.

14 CVM Resolution n.º 51/2021, art. 2º, II.
Annex Circular Letter CVM SNC GNA 01 2025 (2315998) SEI 19957.003477/2025-32 / pg. 22

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686

1.11.3 On the coercive fine for failure to deliver or delay in presenting the Electronic Conformity Declaration
Finally, we emphasize that the non-presentation of the Electronic Conformity Declaration, or its presentation with delay, subjects the participant to a daily coercive fine 15 in the amount of R$ 200.00 (two hundred reais) for the legal entity participant and R$ 100.00 (one hundred reais) for the natural person participant.

1.12 Independent Auditor – Legal Entity: corporate types and partner responsibility
Regarding the corporate type, based on the Civil Code (CC), the single-profession accountant society is of a simple nature16, not business. Thus, their registration must be made in the Civil Registry of Legal Entities (RCPJ)17, even if they adopt corporate types of business societies18.

Enunciation nº 57, of the I Session of Civil Law, confirms that the choice for the business type does not alter the simple nature of the society, and Enunciation nº 382, of the IV Session of Civil Law, explains that the registration follows the nature of the activity (business or not) and the other issues follow the rules of the adopted corporate type.

CVM Resolution nº 23/2021 changed the permitted corporate types for audit firms registered with the CVM and eliminated the requirement of joint and several unlimited liability among partners, dispensing the need to constitute as a pure simple society and specific clauses in the articles of association.

In this sense, the normative changes do not require adjustments in the articles of association of audit firms to comply with CVM Resolution nº 23/2021; therefore, current contracts remain valid for maintaining registration. Any contractual alterations, which reflect the partners' desire to adopt the possibilities introduced by the normative changes, can be made at any time and must be sent to the CVM for registration update, according to art. 17 of the resolution.

Still on the subject, it is opportune to highlight that the Specialized Federal Prosecutor's Office attached to the Securities and Exchange Commission (PFE) manifested the understanding that “no legal or regulatory foundation is envisioned to prohibit audit firms from adopting the corporate type of single-person limited company (SLU), provided for in §1º of art. 1.052 of the Civil Code [...] If the independent auditor adopts the form of a single-person society, they must register in the category of legal entity independent auditor”.

2 TOPICS RELATED TO THE EXECUTION OF WORKS AND DOCUMENTATION OF

15 CVM Resolution nº 51/2021, art. 6°.
16 Article 966 of the CC.
17 Final part of article 1.150 of the CC.
18 Final part of article 983 of the CC.
Annex Circular Letter CVM SNC GNA 01 2025 (2315998) SEI 19957.003477/2025-32 / pg. 23

COMMISSION OF SECURITIES AND EXCHANGES
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686 AUDIT
2.1 CVM Resolution No. 23/2021
2.1.1 Circumstances of Impediment and Incompatibility (Art. 22 to 24 - CVM Resolution No. 23/2021)
The SNC understands that independence is perhaps the greatest, if not the only, factor that differentiates the accounting professional who works within a company from that who provides independent audit services. Technical competence, responsibility, integrity, objectivity, and ethics are elements common to both. The great differentiator is the degree of independence to which both are subject. Furthermore, the most relevant aspect of independence is not the fact that the auditor is independent, but rather whether he, in addition, appears to be independent, that is, whether the people who are supposed to benefit from his work see the auditor as an independent person or firm. This is fundamental for the maintenance of confidence in the system. Considering mainly this last aspect, CVM Resolution No. 23/2021 prohibits the provision of certain consulting services to audit client companies, such as: corporate restructuring, business valuation, asset revaluation, determination of the values of provisions or technical reserves and provisions for contingencies, tax planning, and remodeling of accounting, information, and internal control systems. At this time, it is worth clarifying that the restriction imposed by item II of Art. 23 of CVM Resolution No. 23/2021 does not constitute an obstacle to the exercise of the professional activity, since it does not establish an absolute prohibition on the provision of audit services or consulting services, but merely prevents both services from being provided, simultaneously, by the same independent auditor to the same client, within the securities market. Additionally, CVM Resolution No. 23/2021 prohibits the independent auditor and persons linked to him from acquiring or maintaining securities or financial instruments of the audited entity. Persons linked to the independent auditor are those with whom he maintains a bond, relationship, participation, or interest, as defined by the Federal Council of Accounting (CFC) in professional independence standards and which prevent him from executing audit services.

2.1.2 Issuance of Detailed Report (Art. 25, item II, CVM Resolution No. 23/2021)
Art. 25, item II, of CVM Resolution No. 23/2021 provides that the independent auditor must "prepare and send to the management and the Fiscal Council, a detailed report containing his observations regarding the internal controls and the Anexo Oficio Circular CVM SNC GNA 01 2025 (2315998) SEI 19957.003477/2025-32 / pg. 24

COMMISSION OF SECURITIES AND EXCHANGES
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686 accounting procedures of the audited entity, describing, furthermore, any deficiencies or inefficiencies identified during the course of the work".
In this sense, ratifying the provisions of the cited normative text, we clarify that the issuance of said detailed report at the end of the work is expressly mandatory in any circumstance, regardless of whether deficiencies or inefficiencies were identified or not in the examined environment.
That is, although the independent audit professional standard dealing with the subject (NBC TA 265) determines the mention in the report only of significant deficiencies, if any, the detailed report required by CVM Resolution No. 23/2021 is more comprehensive, requiring the issuance of the report at the end of each work.
We reinforce that the detailed report must contain, at a minimum, among other information, the description of the deficiencies and inefficiencies of the internal controls and the accounting procedures adopted by the audited entity, accompanied by the recommendations of the independent auditors for the corrections that may be necessary. As can be seen, such points constitute the minimum set of information that the detailed report must contain. However, they do not exhaust the content of said report. Furthermore, it is important to emphasize that said report, in consonance with the cited professional standard, must segregate significant deficiencies from those that are not significant. In those extremely rare situations where the independent auditor concludes that there is no identification of internal control deficiencies (significant or not), the report to be issued will be affirmative, that is, it must affirm the non-identification of internal control deficiencies, whether significant or not, during the performance of the work. Such procedure allows for minimal proof that the independent auditor performed the evaluation of internal controls and accounting procedures provided for in the standard issued by the CVM and by independent audit professional standards. It is always important to remember that it is the responsibility of the management of the audited entity to ensure the adequacy of the internal controls it determined as necessary to allow the preparation of financial statements free from material misstatement, and for the auditor to consider internal control to plan audit procedures that are appropriate in the circumstances; but not for the purpose of expressing an opinion on the effectiveness of internal control. In this context, we reinforce that the auditor must, furthermore, during the course of audit work in subsequent years, establish specific monitoring of those deficiencies pointed out in the previous report, as well as their outcome in relation to management's actions, to determine whether such deficiencies should continue to be communicated in the detailed report or, furthermore, whether those initially considered "not significant" have altered their status due to their recurrence, without actions by the Anexo Oficio Circular CVM SNC GNA 01 2025 (2315998) SEI 19957.003477/2025-32 / pg. 25

COMMISSION OF SECURITIES AND EXCHANGES
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686 management of the audited entity over the examined periods.
Additionally, the auditor must evaluate whether the set of deficiencies individually not significant may, when analyzed together, represent a significant deficiency, considering their relevance in the context of the audited entity's internal controls.
It is also important to remember, regarding said report, that in NBC TA 265 – Communication of Internal Control Deficiencies, the deadline for issuing written communication is detailed in item A13, as follows:
When determining when to issue written communication, the auditor may consider whether the receipt of this communication would be an important factor to allow those responsible for governance to perform their general supervision responsibilities. Furthermore, for entities registered in stock exchanges in certain jurisdictions, those responsible for governance may have to receive written communication from the auditor before the date of approval of the financial statements to perform specific responsibilities regarding internal control, for regulatory purposes or to meet other purposes. For other entities, the auditor may issue the written communication at a later date. However, in the latter case, considering that the auditor's written communication on significant deficiencies is part of the final audit file, the written communication is subject to the requirement of item 14 of NBC TA 230, which requires the auditor to timely assemble the final audit file. NBC TA 230 establishes that the appropriate time limit for the completion of the assembly of the final audit file is normally no more than 60 days after the date of the report of the independent auditor (NBC TA 230, item A21). (our emphasis) Therefore, the independent auditor must make efforts to receive management's comments within a period of up to 60 (sixty) days after the date of the respective audit report. In cases where there is no response from management, the fact must be recorded in that final audit file, together with the version for discussion sent, being considered "final" from that moment.

2.1.3 Composition of audit teams (Art. 25, item VII, CVM Resolution No. 23/2021)
Item VII, Art. 25, of CVM Resolution No. 23/2021 determines that the auditor must:
Anexo Oficio Circular CVM SNC GNA 01 2025 (2315998) SEI 19957.003477/2025-32 / pg. 26

COMMISSION OF SECURITIES AND EXCHANGES
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686 VII – ensure that all partners, directors, managers, supervisors or any other members, with a management function, in the team designated for the exercise of the activity of audit in entities regulated by the CVM, have been approved in a Specific Technical Qualification Exam for the CVM. Thus, when planning audit teams, auditors must pay attention to the fact that all those components who exercise a management function, such as partners, directors, managers or supervisors, among other possible positions, have been approved in the Specific Technical Qualification Exam for the CVM. It is important to highlight that item VII of Art. 25, combined with the provisions of the caput and §1 of Art. 34, all of the cited CVM Resolution No. 23/2021, ratifies the obligation that such professionals pay attention to the annual compliance with the Continuing Professional Education Program, after their approval in said exam. Non-compliance with the guidelines imposed by the Federal Council of Accounting regarding the Professional Education Program by the cited professionals may lead to the adoption of administrative measures against the independent auditors linked to them. Regarding specifically the accountants already registered as technical managers authorized to issue and sign audit reports on behalf of each audit firm, within the securities market, it should be noted that, upon their applications for inclusion in the technical managers registry, these complied with all the requirements that allowed the approval of their registration requests by the CVM. Thus, it is settled understanding in the SNC that technical managers, as such already registered in this autarchy and as long as they maintain their current active registration, do not need to be approved in the Specific Technical Qualification Exam for the CVM, even though the voluntary performance of said exam is a technically recommendable condition as it is addressed to the indispensable and continuous technical improvement of professionals who act in the securities market.

2.1.4 Auditor Rotation (Art. 31 to 31A – CVM Resolution No. 23/2021)
According to Art. 31 of CVM Resolution No. 23/2021, the Independent Auditor – Natural Person and the Independent Auditor – Legal Entity cannot provide services to the same client for a period longer than five consecutive fiscal years, requiring a minimum interval of three fiscal years for re-hiring.
In other words, the rule of mandatory rotation of independent auditors is composed of the conjunction of the maximum term of affiliation and the minimum interval of absence, both necessary to achieve the objective sought by the normative activity in establishing the aforementioned rule.
There is no hypothesis provided for in CVM Resolution No. 23/2021 that contemplates the Anexo Oficio Circular CVM SNC GNA 01 2025 (2315998) SEI 19957.003477/2025-32 / pg. 27

COMMISSION OF SECURITIES AND EXCHANGES
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686 reduction of the minimum interval established. There is no proportionality relationship between the period of affiliation and the term of the minimum interval of absence. Thus, regardless of the duration of the term of affiliation of the independent auditor with the audited entity, before the start of a new term of affiliation, the minimum interval of three fiscal years must be respected. At this point, it is worth emphasizing that it is the primary responsibility of the auditor to meet the rotation requirement, renouncing the client in case of non-compliance with the standard. Notwithstanding, as provided in Art. 27 of the aforementioned standard, the administrators of the audited entity must be held responsible for the eventual hiring and maintenance of independent auditors who do not meet the conditions provided for in the Resolution. No less relevant, rotation cannot be carried out with another audit firm with which the replaced auditor has common interests, nor one that uses the same physical and operational structure as the previous auditors. Examples of situations that may characterize non-observance of the auditor rotation rule include:
a) use of the same address (headquarters and offices, if any); b) direct kinship relationship between partners and technical managers of the audit firms (replaced and current); c) creation of "new" audit firms for service provision, with partners and/or technical managers previously linked to the replaced auditor.

2.1.4.1 Re-hiring of the Auditor
We draw attention to the eventual re-hiring of the replaced auditor.
Regardless of whether or not the period defined in the standard for the provision of consecutive audit services to the same client is reached, re-hiring can only occur after a period of three fiscal years. For example, if AUDITOR "A", after two fiscal years of service provision to the audited, was replaced by AUDITOR "B", AUDITOR "A" can only return to provide audit services after three fiscal years have passed since his replacement.

2.1.4.2 Possibility of extension of the service provision period for Companies with Statutory Audit Committee (CAE)
Art. 31-A of CVM Resolution No. 23/2021 establishes an exception regarding the maximum term of affiliation, allowing its extension to up to ten years, if the audited entity has a CAE installed and fully functioning until the date of closing of the third fiscal year from the hiring of the independent auditor, and that it remains in operation after that date while using the prerogative. Furthermore, the auditor must be a legal entity and meet the requirements of Arts. 31-B to 31-F of the aforementioned resolution.

2.1.4.3 Documentation of the installation, composition, and functioning requirements of the CAE
We highlight that the independent auditor must evaluate and document in his working papers the compliance with the installation, composition, and functioning requirements of the CAE provided for in Arts. 31-A, 31-B, and 31-C of CVM Resolution No. 23/2021.
It should be noted that, according to NBC TA 230 (R1), audit documentation is the record of the audit procedures performed, the relevant evidence obtained, and the conclusions reached by the auditor. This includes documents and notes prepared during the course of the work or obtained from other sources, which record the evidence of the work performed by the auditor and support his opinion and comments, and not just copies of documents. We remind you that the auditor must prepare audit documentation sufficiently complete and detailed to allow an experienced auditor, with no prior involvement with the audit, to understand the work performed. Audit evidence is fundamental, as it comprises the information used by the auditor to reach the conclusions on which his opinion recorded in the respective audit report is based, as defined by NBC TA 500 (R1). Therefore, the mere attachment of meeting minutes, internal regulations, or citations regarding the evaluation of the personal condition of a CAE member, without an objective and highlighted analysis of the content of the discussions, functioning, determinations, and requirements to meet the standard's requirements, does not meet these objectives. Likewise, analyses performed without formal documents that prove subjective conclusions incur the same deficiency.

2.1.4.4 Re-election of CAE members
It is understood that it is possible to re-elect CAE members by re-election, without an interregnum between mandates. However, in the event of any gap between mandates, CAE members can only return to integrate such body, in the same company, after at least three years have passed from the end of the mandate (as explicitly stated in § 4 of Art. 31-C of Resolution No. 23/21).

2.1.4.5 Use of a single CAE for the Group
Finally, we highlight that there is no normative impediment to the use of a single CAE for a parent company and its wholly-owned subsidiaries and other open companies of the Group. However, to ensure full compliance with CVM Resolution No. 23/2021, individualized actions are necessary for each company. Below, some of these actions are exemplified:

provision of the CAE in the Bylaws of each company;
Anexo Oficio Circular CVM SNC GNA 01 2025 (2315998) SEI 19957.003477/2025-32 / pg. 29

COMMISSION OF SECURITIES AND EXCHANGES
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686

direct link of the CAE to the Board of Directors of each company or direct link of the CAE to the Board of Directors of the parent company, provided that the duties of said committee regarding wholly-owned subsidiaries are duly formalized in the bylaws, internal regulations, and other pertinent documents of the parent company and the other companies;
coordination of meeting dates, so that, in addition to occurring at least bimonthly, it is possible to review the financial statements of each company in the Group before their disclosure;
the CAE of each company must have its own internal regulations approved by the respective board of directors, detailing its functions, as well as its operational procedures;
the CAE must have means to receive and control separately the complaints of each company;
the CAE must have operational autonomy and budget allocation, within the limits approved by each board of directors;
the CAE coordinator must attend the ordinary general assembly of each company;
the CAE must supervise the activities of the internal controls area, internal audit, and the financial statement preparation area of each company;
the CAE must, for each company, monitor the quality and integrity: a) of internal control mechanisms; b) of quarterly information, interim financial statements, and financial statements of the company; and c) of information and measurements disclosed based on adjusted accounting data and non-accounting data that add elements not provided for in the structure of usual financial report statements;
the CAE must evaluate and monitor the risk exposures of each company separately;
the CAE must evaluate and monitor, together with the management and the internal audit area of each company, the adequacy of related-party transactions carried out by the companies and their respective disclosures;
the CAE must prepare a summarized annual report, to be presented together with the financial statements, with the required content, for each company.

2.1.5 Published summarized statements (in printed newspaper)
Guidance Opinion 39 published by the CVM on December 20, 2021, deals with the requirements to be observed in the publication of summarized financial statements, according to the new wording of Art. 289, I and II, of Law 6.404/76:
https://www.gov.br/cvm/pt-br/assuntos/noticias/cvm-divulga-parecer-de-orientacaosobre-demonstracoes-financeiras-resumidas.
We highlight that the summarized report of the independent auditor, when published, must be prepared from the complete independent auditor's report, which must be duly disclosed in an electronic address clearly referenced in the summarized publication.
In our monitoring activities, it has already been possible to observe that some important information recorded in the audit report is being omitted in the final summarized form ("extract of the relevant information of the report"). We remind you that item 4 of CVM Guidance Opinion No. 39 defines the minimum content that the summarized independent auditor's report must contain. However, this minimum content does not limit its application, nor does it exclude the need for disclosure of other relevant information existing in the audit report. Thus, it is the understanding of this SNC that, if when recording emphasis paragraphs in his report, the auditor considers it necessary to draw the attention of users to a subject presented or disclosed in the financial statements that, in his judgment, is of such importance that it is fundamental for the understanding by users of the financial statements, it is not acceptable that such information be excluded from the summarized audit report. This understanding applies to any emphasis paragraph contained in the auditor's report and, in an even more substantial way, to those related to the risk of continuity of the audited entity. We therefore ratify that it is the responsibility of the independent auditor to verify if the information published in condensed form is in consonance with the complete audited financial statements and with the report issued by the independent auditor on these complete financial statements, in line with the provisions of article 25, I of CVM Resolution 23/2021. We also clarify, as also disclosed in Circular No. 01/2022 issued by Ibracon, that the publication of summarized financial statements cannot be accompanied by the publication of the auditor's report on the complete financial statements, issued within the scope of NBC TA 700. The publication of an "extract of the relevant information of the report" does not confuse with the publication of parts of the report nor does it consist of an opinion on the aforementioned summarized financial statements.

2.1.6 Relevant aspects to be observed in the review of the Explanatory Notes and in the evaluation of the other information contained in the Audited Financial Statements
As informed by the Department of Corporate Relations - SEP, in the result Anexo Oficio Circular CVM SNC GNA 01 2025 (2315998) SEI 19957.003477/2025-32 / pg. 31

COMISSÃO DE VALORES MOBILIÁRIOS
Rua Sete de Setembro, 111/2-5º e 23-34º Andares, Centro, Rio de Janeiro/RJ – CEP: 20050-901 – Brasil - Tel.: (21) 3554-8686

of its actions related to the registration requests of public companies, several requirements related to the disclosure of financial information were identified.

From the requirements carried out to conclude the aforementioned analyses, it was possible to identify that the 5 (five) most frequent requirements are related to:
a) deficient disclosure of accounting policies applied to the Company, notably when it is verified that the Company mostly restricted itself to transcribing or paraphrasing accounting standards, thus without compliance with OCPC 07 (R1); b) deficient disclosure of information on Related Parties, without compliance with CPC 05 (R1), particularly regarding the disclosure of rates and terms of loans between related parties; c) absence of disclosure of information on the Relationship with Independent Auditors, contrary to CVM Resolution No. 80/2022 (Annex C – Item 9); d) failures in disclosing the reconciliation of non-accounting nature information (LAJIDA/EBTIDA or LAJIDA/EBTIDA adjusted) with accounting information, thus without compliance with CVM Resolution No. 156/2022; and e) deficient disclosure of assumptions in impairment tests, thus without compliance with CPC 01 (R1), mainly regarding the disclosure of discount rates and growth rates and assumptions.

On one hand, such information is under the primary responsibility of the companies' administration, with them being responsible for paying special attention to the standards related to the preparation of Financial Statements and Interim Statements regarding the aforementioned themes, as well as to the guidelines contained in CIRCULAR LETTER/CVM/SNC/SEP No. 01/2025 (and circular letters from previous years); on the other hand, it is the responsibility of the independent auditor to make efforts in analyzing the content of that information presented together with the respective audited accounting statements, recommending necessary adjustments and improvements, in order to allow better understanding by the various users and, primarily, its adequacy to the applicable financial reporting framework.

Still in this sense, depending on the type, the relevance of the inadequately disclosed information, and its possible effects on the degree of understanding by its users of those accounting statements, it is the auditor's responsibility to evaluate, in light of the provisions of independent audit professional standards, the need to cite the fact in their audit report, considering, including, the possibility of issuing a modified opinion.

Finally, it is relevant to highlight that in initial registration requests for public companies, the auditor will be held responsible for the opinion issued in the respective audit report and for the conduct of audit work and procedures that served as the basis for their opinion, in case there are deviations related to the applicable financial reporting framework and its disclosures.

Annex Circular Letter CVM SNC GNA 01 2025 (2315998) SEI 19957.003477/2025-32 / pg. 32

COMISSÃO DE VALORES MOBILIÁRIOS
Rua Sete de Setembro, 111/2-5º e 23-34º Andares, Centro, Rio de Janeiro/RJ – CEP: 20050-901 – Brasil - Tel.: (21) 3554-8686

2.2 Audit Standards

2.2.1 Audit Report and Key Audit Matters

After several years of adaptation to the determinations contained in standard NBC TA 701, we understand that its informational objectives have been achieved. However, it is relevant to emphasize that, in order to achieve such objectives, it is essential that the description of the procedures carried out by the auditor and the results achieved present relevant informational content for users, not restricting themselves to generic presentations of what was done and vague statements regarding the adequacy of the subject as a whole to the accounting statements.

Regarding the content, various users expect that the following items, among others possible, be described in the Key Audit Matters section, even if not fully required by NBC TA 701, which we understand as improvements applicable by the auditor when preparing their audit report:

specific audit procedures for the risk in discussion;
information on the use of the work of specialists and/or internal auditors;
specific audit procedures related to applicable internal controls and whether, as a result of the application of procedures carried out by the auditor, possible deficiencies in their effectiveness were detected;
possible difficulties in applying planned procedures;
changes in the planning of procedures executed, in scope or depth of audit tests;
whether, during the execution of audit procedures, adjustments were identified, recorded or not by the entity's administration, even if they are not considered material by the auditor.

Additionally, considering the dynamics of the economic and business environment, as well as the diversity of activities, processes, and systems of the audited entities, it is expected that audit reports be effectively individualized, not being mere repetitions of the key audit matters from the previous year, nor composed of standardized key audit matters (KAMs) established internally by the audit firm, for the firm as a whole or by sector of activity of the audited entities.

In this sense, regarding the financial statements of separate estates and the provisions of item VIII, art. 25, of CVM Resolution No. 23/2021, which deals with Key Audit Matters, we remind you that each separate estate is considered an entity that reports information for the purpose of preparing individual financial statements. Therefore, independent audit professional standards must be observed when issuing the respective audit report, including NBC TA 701, which deals with the subject.

2.2.2 Preparation of audit reports – modification of opinion

It is common to detect the issuance of some audit (or review) reports of annual statements and interim statements that, in our judgment, were in disagreement with independent audit professional standards. Such reports were related to companies undergoing criminal investigation processes, including those of their directors and managers.

Although we understand that this is a complex theme, of extreme relevance, and involves professional judgment, we have verified that some auditors opt to issue their opinion in a manner inconsistent with the guidelines contained in audit professional standards, more precisely, NBC TA 700, NBC TA 705, and NBC TA 706. In this sense, we remind you that the auditor must modify the opinion in their report when:
a) they conclude, based on the audit evidence obtained, that the accounting statements as a whole present material misstatements; or b) they are unable to obtain appropriate and sufficient audit evidence to conclude that the accounting statements as a whole do not present material misstatements.

Timely, we highlight that NBC TA 705, the professional standard dealing with the modification of opinion, is clear in defining the situations in which modifications are required:

Qualified Opinion
7. The auditor must express a “Qualified Opinion” when:
(a) they, having obtained appropriate and sufficient audit evidence, conclude that the misstatements, individually or in aggregate, are material, but not pervasive in the accounting statements; or (b) it is not possible for them to obtain appropriate and sufficient audit evidence to support their opinion, but they conclude that the possible effects of undetected misstatements on the accounting statements, if any, could be material, but not pervasive.

Annex Circular Letter CVM SNC GNA 01 2025 (2315998) SEI 19957.003477/2025-32 / pg. 34

COMISSÃO DE VALORES MOBILIÁRIOS
Rua Sete de Setembro, 111/2-5º e 23-34º Andares, Centro, Rio de Janeiro/RJ – CEP: 20050-901 – Brasil - Tel.: (21) 3554-8686

Adverse Opinion
8. The auditor must express an “Adverse Opinion” when, having obtained appropriate and sufficient audit evidence, they conclude that the misstatements, individually or in aggregate, are material and pervasive to the accounting statements.

Disclaimer of Opinion
9. The auditor must refrain from expressing an opinion when they are unable to obtain appropriate and sufficient audit evidence to support their opinion and they conclude that the possible effects of undetected misstatements on the accounting statements, if any, could be material and pervasive.
10. The auditor must refrain from expressing an opinion when, in extremely rare circumstances involving various uncertainties, they conclude that, regardless of having obtained appropriate and sufficient audit evidence on each of the uncertainties, it is not possible to express an opinion on the accounting statements due to the possible interaction of the uncertainties and their possible cumulative effect on those accounting statements.

Still on the subject, it is necessary to remember that CVM Resolution No. 23/2021, in its article 25, item IV, clearly defines the need to measure the impact on the audited accounting statements when issuing the respective audit report, in cases of modification of opinion (qualified or adverse), as follows:

Art. 25. In the exercise of their activities within the securities market, the independent auditor must, additionally:
...
IV - clearly indicate, and by how much, the accounts or subgroups of assets, liabilities, results, and equity that are affected by the adoption of accounting procedures conflicting with the Fundamental Accounting Principles, as well as the effects on mandatory dividends and earnings or loss per share, as applicable, whenever issuing a review report of interim information or an adverse or qualified audit report.

Still on the subject, we remind you that after the issuance of several alert letters by SNC, and concomitant interaction with Ibracon, the Federal Council of Accounting (CFC) published, in 2021, the Audit Technical Communication (CTA) 30, which standardizes and guides independent auditors on the impacts on audit, measurement, and assessment arising from these situations. The Technical Communication also guides on the possible reflections on the opinion contained in the audit reports of the financial statements of entities involved in matters related to non-compliance with laws and regulations, illegal acts, or fraud, and therefore must be consulted in the occurrence of such situations.

2.2.3 Sample selection criteria in audit

NBC TA 500 (R1) – “Audit Evidence” deals with the auditor's responsibility in defining and executing audit procedures to obtain appropriate and sufficient audit evidence to reach reasonable conclusions that support their audit opinion, providing guidance on the means available for the auditor to select items for testing, with audit sampling being one of them.

The aforementioned standard establishes that “when defining control tests and detail tests, the auditor must determine means to select items to be tested that are effective for carrying out audit procedures.”

In this sense, its item A63 clarifies:
An effective test provides appropriate audit evidence to the extent that, considered with other audit evidence obtained or to be obtained, it will be sufficient for the auditor's purposes. When selecting items to be tested, item 7 requires the auditor to determine the relevance and reliability of the information to be used as audit evidence; another aspect of effectiveness (sufficiency) is an important consideration in selecting items to be tested. The means available to the auditor for selecting items to be tested are:
(a) selection of all items (examination of 100%); (b) selection of specific items; and (c) audit sampling.

The application of any of these means or a combination of them may be appropriate depending on the specific circumstances, for example, the risks of material misstatement related to the assertion being tested, and the practicality and efficiency of the different means.

In this regard, we consider it relevant to highlight that the test carried out on a selection of specific items does not provide audit evidence regarding the rest of the population. Thus, the audit conclusion obtained with the aforementioned test is limited to the selected items, which generates a need for additional audit procedures for the rest of the population.

On this occasion, it is important to remember that item A12 of NBC TA 530 – “Audit Sampling” guides that, since the purpose of sampling is to provide a reasonable basis for the auditor to conclude regarding the population from which the sample is selected, it is important that the auditor selects a representative sample, in order to avoid bias through the choice of sample items that have characteristics typical of the population.

According to NBC TA 530, “the auditor must determine a sample size sufficient to reduce sampling risk to an acceptable minimum level”, further clarifying that items must be selected “in such a way that each sampling unit of the population has the same chance of being selected.”

In this line, despite the fact that the professional standard does not define the sample size for this purpose, it is inadmissible that, based solely on the auditor's personal professional judgment, the sample is considered representative of the analyzed population, due to the quantitative insufficiency of selected items or the irrelevance of the items analyzed in that context, due to disregard for statistical procedures, common sense, or professional skepticism. Thus, we reaffirm that the entire process of selection and composition of samples must be documented with a detailed description of the criteria and grounds that justify its structure. Generic citations do not meet the requirements of professional standards.

2.2.4 Professional judgment and transparency in the audit report

It is essential for the fulfillment of the independent auditor's role that their opinion be clearly expressed through a written report. This involves, among other information, transparency in communicating key audit matters, the preparation of emphasis paragraphs, when applicable, and the description of the subjects that gave rise to the modification of the opinion. These items require additional attention from the auditor, considering the needs of users of the accounting statements, and must be written in a way that allows users to fully understand the information transmitted.

As described in NBC TA 701, the communication of key audit matters aims to make the audit report more informative, providing greater transparency about the audit performed and providing additional information to users, to assist them in understanding the subjects that, according to the auditor's professional judgment, were most important in the audit of the accounting statements for the current period. In addition, it can help in understanding the entity and the areas that involved significant judgment by the administration.

In complement, NBC TA 706, in items 8, A1, and A2, defines that, if the auditor considers it necessary to draw users' attention to a subject presented or disclosed in the accounting statements that, in their judgment, is fundamental for understanding, they must include an emphasis paragraph in their report. This is valid since, when NBC TA 701 applies, the subject has not been determined as a Key Audit Matter. If the subject is defined as a Key Audit Matter and the auditor considers it relevant to draw more attention to its relative importance, there are other ways to highlight it, such as (i) presenting it more prominently in the “Key Audit Matters” section, or (ii) inserting additional information about the subject in the description of that key audit matter. In this way, the provisions of the standard will be met, conferring greater transparency and significant informational content for users.

For sensitive themes identified during audit work, which have been the subject of professional judgment, both by preparers of accounting statements and by independent auditors, the CVM technical areas recommend adopting the following steps, extracted from a conceptual framework for professional judgment, also reported in Circular Letter CVM/SNC/SEP 01/23:

Elucidate the problem and the informational objectives to be achieved;
Consider the alternatives and available choices;
Gather and evaluate the necessary information;
Reach a conclusion; and
Articulate and document the rationale for the decision.

It is important to avoid “mental traps” in the professional judgment process, which can arise from informational constraints, influences, preconceived ideas, and biases. Teams of experienced professionals on the subject help to mitigate these risks, but do not exempt the auditor from their responsibility for their independent opinion and the application of the requirements of the applicable professional standards. The auditor must be attentive to signs of administration bias, as described in item 2.2.6 of this Circular Letter. To achieve the intended degree of transparency, such communications must not be standardized, but must be drafted specifically for the subject and for the entity to which they refer.

Finally, item A30 of NBC TA 200 (R1) warns that professional judgment must be adequately documented and must not be used as justification for decisions that, otherwise, are not supported by the facts and circumstances of the work nor by appropriate and sufficient audit evidence.

Annex Circular Letter CVM SNC GNA 01 2025 (2315998) SEI 19957.003477/2025-32 / pg. 38

COMISSÃO DE VALORES MOBILIÁRIOS
Rua Sete de Setembro, 111/2-5º e 23-34º Andares, Centro, Rio de Janeiro/RJ – CEP: 20050-901 – Brasil - Tel.: (21) 3554-8686

2.2.5 Immaterial misstatements with significant potential to become material in the future

As a basis for the auditor's opinion, NBC TA standards require that they obtain reasonable assurance that the accounting statements as a whole are free from material misstatement, regardless of whether caused by fraud or error.

Thus, the concept of materiality is applied by the auditor in planning and executing the audit, as well as in evaluating the effect of identified misstatements on the accounting statements. In general, misstatements, including omissions, are considered material if it is reasonable to expect that, individually or jointly, they will influence the economic decisions of users made based on the accounting statements.

Judgments about materiality are established taking into account the circumstances involved and are affected by the auditor's perception of the needs of the users of the accounting statements and by the size or nature of a misstatement, or by a combination of both.

In this sense, we highlight that, when evaluating the “size” of the identified misstatements, the auditor must, including, consider their potential for growth in the long term, that is, their potential to become material in the future.

2.2.6 Audit of accounting estimates and related disclosures - NBC TA 540 (R2)

We have verified, in recent years, recurrent failures by auditors in meeting the requirements of NBC TA 540 (R1) / NBC TA 540 (R2), in the audit of accounting estimates, including, but not limited to, the audit of impairment tests, fair value, and related disclosures.

Thus, follow our considerations on the main non-compliances verified:

as part of the validation of the calculation methodology used, it is expected that the auditor, among other procedures, verify the comparison of historically calculated estimates with what was actually realized, analyzing the reasons for the discrepancies verified, and also whether the methodology needs any adjustment to be used again in the audited period;
when planning the use of independent calculations (including sensitivity analyses), the auditor must establish an expectation formalizing in their working papers the acceptable limits of difference in relation to the administration's calculations and what their objective is with that work;
it is essential that the auditor validate the assumptions and data (including historical data) used to calculate the estimate;

Annex Circular Letter CVM SNC GNA 01 2025 (2315998) SEI 19957.003477/2025-32 / pg. 39

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5º and 23-34º Floors, Center, Rio de Janeiro/RJ – ZIP Code: 20050-901 – Brazil - Tel.: (21) 3554-8686

it is the responsibility of the auditor to verify whether the required disclosures are being made, requesting from management any necessary adjustments;
evaluate possible impacts on their audit report or the inclusion of the subject in the detailed report, when applicable;
the value of the estimate reflected in the financial statements (valuation reports, mainly) having been calculated by independent experts hired by the audit client does not exempt the auditor from the procedures described above, nor from the other requirements of auditing standards, including the verification and review of the reasonableness of premises and projections used; and
management's judgment must present neutrality, and the auditor must evaluate possible biases of management.

2.2.7 Internal Quality Control - implementation of NBC PA 01 - Quality Management for Firms (Legal and Natural Persons) of Independent Auditors (corresponding to International Standard on Quality Management – ISQM 1)

In 2021, the Federal Council of Accountancy (CFC) altered the standard dealing with the quality control process of audit firms (NBC PA 01), previously denominated Quality Control for Firms (Legal and Natural Persons) of Independent Auditors (corresponding to International Standards on Quality Control – ISQC 1), giving new wording to the standard which became denominated NBC PA 01 – Quality Management for Firms (Legal and Natural Persons) of Independent Auditors (corresponding to International Standard on Quality Management – ISQM 1).

As is known to all, NBC PA 01 (ISQM 1) deals with the responsibilities of the audit firm for the development (design), implementation, and operation of a quality management system for audits and for reviews of financial statements, as well as other assurance work and related services, because, like its predecessor, NBC PA 01 (ISQM 1) applies to audit and review work of financial statements, other assurance work, and related services, performed in accordance with NBCs TA, NBCs TR, NBCs TO, and NBCs TSC standards.

NBC PA 01 establishes that the adoption of the quality management system be done in two stages. The first, which should have been concluded by the end of 2022, with the planning and implementation of quality management systems; and the second with the evaluation of the quality management system – which should be carried out within one year from December 31, 2022, that is, by December 31, 2023.

In this sense, we highlight that the execution of the activities proposed in the standard, as well as the observance of its schedule by auditors registered with CVM is mandatory, with each stage subject to specific procedures of this agency for verification of compliance. It is important to remember that non-compliance with the aforementioned standard, in those terms, may lead to the adoption of administrative sanctions by this Superintendence regarding auditors who incur in irregularity, given the provisions of articles 20 and 32 (§§ 1, 2, and 3) of CVM Resolution No. 23/21.

Still on the subject, it is important to establish that the quality reviewer of audit work on financial statements, review of interim information, or other applicable assurance work, whether he is an individual internal to the audit firm or an external professional hired by it (NBC PA 02), as well as the person responsible for these work and signatory of the respective reports, must be registered with CVM as a technical manager authorized to issue and sign audit and review reports, on behalf of the respective audit firm, within the scope of the securities market.

2.3 Investment Funds

2.3.1 Audit of financial statements of Investment Funds in Credit Rights - FIDC, Real Estate Receivables Certificates - CRI, and Agricultural Business Receivables Certificates - CRA

CIRCULAR LETTER/CVM/SIN/SNC No. 01/2012, guides independent auditors who act in "FIDC" funds regarding certain procedures that they must execute regarding the credit rights held by the funds, including the verification of existence and adequate pricing, considering, furthermore, issues related to provisions for losses on these rights, which is dealt with by CVM Instruction No. 489/11.

In this context, we reinforce that the aforementioned CIRCULAR LETTER also applies to audit procedures to be executed for the financial statements of separate estates of CRI and CRA, in order to complement the guidelines of CIRCULAR LETTER No. 2/2019/CVM/SIN/SNC, through which we highlighted that the operating dynamics of CRI and CRA are similar to those of FIDC.

2.3.2 Evaluation of qualification as an investment entity – Investment Funds in Participations

It is part of the auditor's obligations to confirm that the audited entity that reports as an investment entity actually qualifies as such, in accordance with the applicable accounting standards.

However, it was verified, throughout 2022, 2023, and 2024, audit work on investment funds in participations (FIP), where the auditor did not perform audit procedures to confirm the qualification of the audited fund as an investment entity, according to the provisions of articles 4 and 5 of CVM Instruction No. 579/2016.

It is important to clarify that the aforementioned article 4 brings four conditions for the qualification of a FIP as an investment entity, which must be met cumulatively. In this regard, we draw attention to its item III, which requires that the fund substantially measure and evaluate the performance of its investments, for management model purposes, based on fair value. We also remind, in line with what is described in item B85-F of CPC 36 (R3), that, to qualify as an investment entity, the entity/fund must not keep its investments indefinitely.

It is necessary for the investment entity to have clearly defined an exit strategy, documenting how it plans to realize the capital appreciation of all its investments, including a concrete deadline to divest the aforementioned assets.

2.3.3 Evaluation of the classification of financial assets (REITs and FIP-EI)

Similarly to the previous item, we emphasize that it is part of the auditor's obligations to confirm that the classification of the audited entity's financial assets is in accordance with the applicable accounting standards.

In this sense, audit work was identified on investment funds where the auditor did not perform audit procedures to confirm the correct classification of the audited fund's financial assets, according to the provisions of Technical Pronouncement CPC 48.

Obviously, without review and evaluation by auditors of the classification of these financial assets, it is not possible to obtain comfort regarding the reasonableness of the measurement and recognition of those assets registered by the fund administrators and reflected in the respective financial statements, nor their adequacy regarding specific CVM standards dealing with the subject, as the case may be. In this regard, it is important to remember that, for the correct evaluation of the classification of financial assets, it is necessary to evaluate and understand the entity's business model for managing financial assets, as well as the contractual cash flow characteristics of these assets.

2.4 Sustainability

2.4.1 CVM RESOLUTION NO. 193, OF OCTOBER 20, 2023 - preparation and disclosure of the report of financial information related to sustainability, based on the international standard issued by the International Sustainability Standards Board - ISSB.

CVM Resolution No. 193/23, and its amendments promoted by CVM Resolution No. 219, of October 29, 2024, deals with the preparation and disclosure of the report of financial information related to sustainability.

The option to prepare and disclose a report of financial information related to sustainability is established, on a voluntary basis, starting from fiscal years beginning on or after January 1, 2024, by open companies, investment funds, and securitization companies, based on the international standard issued by the International Sustainability Standards Board - ISSB.

If the entity opts for voluntary adoption in the manner established by the standard, it must use the financial information disclosure standards related to sustainability, as issued in English by the ISSB, until the process of internalizing the aforementioned standards in the Brazilian jurisdiction is completed.

Investment funds and securitization companies may declare the option, or its revision until the end of the fiscal year prior to the first preparation and disclosure of the report of financial information related to sustainability, through a market communication.

The first preparation and disclosure of a report of financial information related to sustainability implies its continuity during all periods of voluntary adoption.

We also highlight the obligation to prepare and disclose the report of financial information related to sustainability, based on ISSB standards, for open companies, starting from fiscal years beginning on or after January 1, 2026.

The aforementioned CVM Resolution No. 193/23 also determines that entities must archive the report of financial information related to sustainability through an electronic system available on the CVM's page on the worldwide computer network, observing the following deadlines:

in fiscal years of voluntary adoption: until the last day of the 9th (ninth) month following the end of the fiscal year;
in the first fiscal year of mandatory adoption: on the same date of delivery of the Reference Form - FRE; and
from the second fiscal year of mandatory adoption: within 3 (three) months counted from the end of the fiscal year or on the same date of sending the financial statements, whichever occurs first.

The report of financial information related to sustainability must be subject to assurance by an independent auditor registered with CVM, in accordance with the standards issued by the Federal Council of Accountancy – CFC, observing that those issued for information related up to the fiscal year of 2025 must receive limited assurance; and for those issued for information related to fiscal years beginning on or after January 1, 2026, reasonable assurance must be issued.

2.5 Other matters

2.5.1 Recognition of tax credits and their possible impacts on the audit report

During the supervision and inspection activity of the audit activity within the scope of the securities market, it is normal for us to identify situations that demonstrate potential problems, with direct impacts on users of accounting information. Currently, an item with this characteristic is the recognition of tax credits and their possible reflections in the financial statements and, finally, the respective audit report. Situations such as the Expansion of the Concept of Input – PIS and COFINS and the exclusion of ICMS from the PIS and COFINS calculation base have drawn the attention of this Superintendence, mainly regarding the position of some independent auditors in blatant non-observance of basic concepts of the accounting conceptual structure currently in force worldwide.

Regarding the subject, we reinforce that Circular Letter/CVM/SNC/SEP 01/21 deals with the subject comprehensively, and should be considered when deciding on the recognition of such values by companies or in issuing an opinion in the audit report by their auditors.

3 OTHER RELEVANT TOPICS

3.1 Digital Protocol

The objective of the Digital Protocol system is to allow complete automation of the flow of receipt, distribution, and routing of documents received by the Agency, which are not covered by INFOAUDI, making this service more agile and efficient.

Without intermediaries, independent auditors may perform the protocol directly to the Audit Standards Management, which may redirect the demand in case of errors. Among the benefits of automating this service are the reduction in document delivery time and the increase in transparency in this routing, since the auditor can monitor it from start to finish of their demand.

We highlight that documents must be preceded by an introductory letter signed by the representative of the audit firm, describing the objective of the documented protocol.

Documents delivered in person or received via Post Office will continue to be treated by the area responsible for receiving these documents, which will perform the registration and digitization in the new Digital Protocol, as long as they do not refer to processes/operations treated via INFOAUDI.

It goes without saying that the Digital Protocol does not exclude the other CVM service channels, such as, for example, Hearings with Individuals, Process Review, CVMWEB, among others. On the CVM portal, on the SERVICE page, the auditor can consult which is the most appropriate channel for their demand. However, presentation of documents, requests for information, and inquiries of any kind will no longer be accepted via email or by phone, and under no circumstances will requests/documentation inherent to INFOAUDI be received.

We reinforce that to use the new Digital Protocol, access the Federal Government Service Portal (https://www.gov.br/pt-br/servicos/protocolar-documentos-junto-acvm) and register. For more information, access (https://www.gov.br/cvm/pt-br/canais_atendimento/protocolo-digital) In case of doubt, contact the Information Management Division (DINF/SAD) via email dinf@cvm.gov.br or by phone (21) 3554-8677.

Finally, we emphasize the relevance of the guidelines contained in the latest Joint Circular Letters, issued by the Superintendence of Accounting and Audit Standards – SNC and by the Superintendence of Corporate Relations - SEP, all available on our internet page (http://www.cvm.gov.br/legislacao/index.html?buscado=true&contCategoriasCheck=1&vimDaCategoria=/legislacao/oficioscirculares/snc-sep/).

3.2 Communications regarding art. 24 of CVM Resolution No. 50/2021

With a view to faithful compliance with CVM Resolution No. 50/2021, particularly regarding the provisions of article 24, we reiterate that, for the purposes of the provisions of item I of art. 11 of Law No. 9.613 of 1998, independent auditors must perform monitoring, analysis, and communication considering, at minimum, the application of procedures provided for in specific regulation issued by the CFC.

Due to a convention signed with the Federal Council of Accountancy - CFC, the negative declaration (if applicable) must be made in the CFC environment of SISCOAF. Nothing prevents the auditor registered with CVM from spontaneously, and on a supplementary basis, also sending suspicious communications or negative declaration to the CVM segment of SISCOAF.

3.3 Main issues pointed out in recent years by IFIAR

We list below the topics of the main findings in auditor inspections in recent years, pointed out by regulators associated with IFIAR, and consistent with those also verified in our supervision work and inspections, for which we recommend attention by auditors:

Accounting estimates, including fair value measurement:

reasonableness of premises – when testing an accounting estimate, failure to evaluate the reasonableness of premises, including consideration of contradictory or inconsistent evidence;
failure in the sufficiency of tests of data accuracy;
failure to perform sufficient risk assessment procedures;
failure in the adequate consideration of bias indicators;
failure in the consideration of relevant variables;
failure in the evaluation of how management considered alternative premises.

Internal control tests:

failure to obtain sufficient persuasive evidence to support confidence in manual internal controls;
failure to sufficiently test controls over, or the accuracy and completeness of, data or reports produced by management;
failure to sufficiently test general information technology controls;
failure to sufficiently evaluate the severity of control deficiencies;
failure to adequately adjust tests as a result of ineffective controls;
failure to adequately assess the adequacy of confidence in the work of others.

Revenue Recognition:

failure to sufficiently understand the terms and conditions of complex agreements and the impact on accounting;
failure in procedures to determine if revenue was recognized in the correct period;
failure to assess and appropriately respond to fraud risks in revenue recognition.

Adequacy of presentation and disclosure in financial statements:

failure to sufficiently consider the adequacy of disclosures in notes (excluding segment information)
failure to identify or assess the adequacy of classifications and presentations of financial statements, including Cash Flow Statements;
failure to evaluate and test segment information

Audit sampling:

insufficient sample to reduce sampling risk to an acceptable low level;
sample selected for testing is biased and/or not representative of the population;
failure to identify the nature and cause of any deviation and to project errors to the population;
failure to design appropriate procedures to achieve the test objective and/or to perform adequate alternative procedures when necessary.

Group audit:

failure to sufficiently consider the nature, timing, and extent of involvement with the work of component auditors, including evidence of reviews performed;
failure to develop a group audit plan and/or appropriately communicate instructions to the component auditor;
failure to appropriately calculate materiality for the group and for related audit components;
failure to appropriately resolve points identified by the component auditor.

Use of technology (Artificial Intelligence - AI) in audits:

failure in the evaluation and monitoring of the impact of technological resources on audit quality, including the lack of clear processes to measure their effectiveness;
failure in defining responsibilities between global networks and local firms for monitoring and supervision of the use of technological tools;
failure in the governance of the use of Generative Artificial Intelligence (“GenAI”), including the absence of robust policies to mitigate risks such as bias, loss of confidentiality, and unethical use;
failure to ensure that auditors maintain control over technological tools, applying adequate professional judgment in their use;
failure to implement effective training so that auditors understand and correctly interpret the results of tools based on AI/GenAI;
failure in the supervision and continuous certification of technological tools to ensure quality, reliability, and compliance with regulatory standards;
failure in transparency regarding the use of GenAI in critical areas of the audit, hindering internal monitoring and regulatory inspections;
failure to consider the impacts of AI/GenAI on the reliability of the audited entities' financial reports, including risks of bias and lack of explainability.

Circular Letter CVM/SNC/GNA 01/25: Clarifications Regarding the Role of the Independent Auditor in the Securities Market

Lineage: In force