Circular Letter CVM/SNC/GNA No. 01/2016

SECURITY AND EXCHANGE COMMISSION OF BRAZIL
Rua Sete de Setembro, 111/2-5th and 23-34th Floors – Center – Rio de Janeiro - RJ – CEP: 20050-901 – Brazil Tel.: (21) 3554-8686 - www.cvm.gov.br

CIRCULAR LETTER/CVM/SNC/GNA No. 01/2016
Rio de Janeiro, January 21, 2016.

Subject: Clarifications regarding the performance of auditors within the securities market

Dear Independent Auditor,

During the last fiscal year, we noted instances of non-compliance with the regulations governing registration and activity within the securities market, for which we request the special attention of the independent auditor registered with this Commission.

Furthermore, we also consider it important to reaffirm information on certain matters related to the activity of independent auditing within the securities market, for which deviations related to the adoption and application of independent auditing professional standards were also verified.

1. Periodic Information (Art. 16 – CVM Instruction No. 308/99)

Independent auditors must submit to the CVM, by the end of April of each year, information related to their performance in the securities market, as per Annex VI to CVM Instruction No. 308/99. This information is important support for the CVM to evaluate the auditors' capacity to adequately serve their clients and also allows for a global understanding of this activity in the market.

The Superintendence of Accounting and Auditing Standards - SNC recommends that such information be submitted via the internet, on the CVM website. The submission must be made through the option “CENTRAL DE SISTEMAS” (Systems Central), selecting next the option “SISTEMA CVMWEB” (CVMWEB System) and then the option “ENVIO DE DOCUMENTOS” (Document Submission). At this stage, there are two options for submitting the information: i) Document submission via form and ii) Document upload. Finally, the option “Informe Anual de Auditor Independente” (Annual Report of Independent Auditor) must be selected. The “document upload” option should be used only by those auditors who have more than 10 (ten) clients that are publicly held companies (or entities under the supervision of the CVM), as in this case, it is necessary to create a file (XML standard) to forward the required information. Late submission of this information subjects auditors to a penalty fine, as provided in Art. 18 of CVM Instruction No. 308/99.

2. Registration Update (CVM Instruction No. 510/11)

Regardless of the submission of the periodic information required by CVM Instruction No. 308/99, it is also necessary for independent auditors to keep their registration updated, observing a deadline of up to 07 (seven) days from the event that caused the alteration. To do so, independent auditors must access their registration data on the CVM website, proceeding with the appropriate update. In addition to the required update, annually (between May 1 and 31), it is the responsibility of the Independent Auditor to confirm that their registration data remains valid, by issuing the Electronic Conformity Declaration, established by CVM Instruction No. 510/11. The Electronic Conformity Declaration must be issued by accessing the option “CENTRAL DE SISTEMAS” (Systems Central), selecting next the option “SISTEMA CVMWEB” (CVMWEB System) and then the option “ATUALIZAÇÃO CADASTRAL” (Registration Update), followed by “DECLARAÇÃO ELETRÔNICA DE CONFORMIDADE” (Electronic Conformity Declaration), on the CVM website. It is important to emphasize that, even in cases where there are no changes in the data on the website, the Electronic Conformity Declaration must be issued.

For the issuance of the Electronic Conformity Declaration, the independent auditor must be chosen (click on the box before the auditor's name), confirming the registration data, or altering it if necessary, and then activating the option “ENVIAR FORMULÁRIO” (Send Form). After sending the Electronic Conformity Declaration, the information “Formulário já enviado? SIM” (Form already sent? YES) will appear.

Non-compliance with the provisions of Art. 1 of CVM Instruction No. 510/11 subjects the participant to a daily penalty fine, provided for in Art. 5 of the cited Instruction.

3. Communications regarding Arts. 7 and 7-A of CVM Instruction No. 301/99.

With a view to faithful compliance with CVM Instruction No. 301/99, particularly regarding the provisions of Arts. 7 and 7-A, we reiterate that in the event that no communication referred to in the caput of Art. 7 of the aforementioned Instruction has been made to the Financial Activities Control Council – COAF, the independent auditor must communicate by the end of January the non-occurrence in the previous calendar year of transactions or proposed transactions subject to communication, in accordance with Art. 7-A (“negative declaration”), through the SISCOAF system.

Due to an agreement signed with the Federal Council of Accounting - CFC, the negative declaration (if applicable) must be made in the CFC environment of SISCOAF. Nothing prevents the auditor registered with the CVM from spontaneously, and in a supplementary manner, also sending suspicious communications or a negative declaration to the CVM segment.

4. External Quality Review Program (Art. 33 – CVM Instruction No. 308/99)

We remind you that independent auditors must submit to an external review performed by another auditor registered with the CVM, with a view to also evaluating compliance with technical and professional standards, in accordance with a specific standard issued by the Federal Council of Accounting (CFC). Currently, CFC Resolution No. 1.323/11 regulates the matter, and it must be observed by independent auditors.

Non-compliance with the Program established by the CFC, as well as the determinations contained in CVM Instruction No. 308/99, may lead to the application of fines, in addition to other applicable administrative measures, including the initiation of an administrative sanctioning process.

Specifically regarding the performance of the reviewing auditor, we have observed several problems in the execution of review work. These problems are, for the most part, related to the depth of examinations performed, as well as to the obtaining of appropriate and sufficient audit evidence, in order to support the opinion issued at the end of the work.

Unfortunately, some reviewing auditors have not yet assimilated the importance of the External Quality Review Program, as well as their role within this context. In the last year, through routine inspections provided for in our Risk-Based Supervision Program – SBR, we identified review work inconsistent with the determinations contained in the specific standard. We remind you that, upon identifying such occurrences, specific administrative procedures will be initiated, subjecting reviewing auditors to the application of penalties provided for in legislation.

5. Continuing Professional Education Program (Art. 34 – CVM Instruction No. 308/99)

Aiming to maintain a high standard of technical qualification and constant update regarding professional standards, accounting and auditing procedures, and standards related to the exercise of their activity in the securities market, independent auditors registered with the CVM must maintain, for themselves and their technical staff, a continuing education program consistent with the guidelines approved by the CFC, contained in NBC PG 12 (R1). Non-compliance with the Program established by the CFC, as well as the determinations contained in CVM Instruction No. 308/99, may lead to the application of fines, in addition to other applicable administrative measures, including the initiation of an administrative sanctioning process.

It is worth clarifying that, due to joint action with the Continuing Professional Education Commission – CEPC, established by the Federal Council of Accounting – CFC for the management and monitoring of the Program, it is not necessary to submit an activity report to the CVM. This report must be delivered annually (by January 31) to the respective Regional Council of Accounting. Proof of compliance with the Continuing Professional Education Program is forwarded by the CEPC/CFC after analysis of the reports presented by professionals, considering the courses, events, and other activities homologated by the CFC/CRCs system.

Additionally, it is important to emphasize that CVM Deliberation No. 570/09, intended for the provision of specific continuing education by independent auditors, in the years 2009, 2010, and 2011, due to the adoption of international accounting standards in our environment, lost its effectiveness once its effects ceased after those fiscal years. Therefore, there is no justification for the submission of reports for the purpose of its compliance, a fact that has been common among independent auditors.

We also highlight that independent auditors must have mechanisms for timely monitoring of changes in independent auditing professional standards issued by the Federal Council of Accounting - CFC and, when applicable, by the Institute of Independent Auditors of Brazil - IBRACON, and standards that regulate the independent auditing activity within the Securities Market.

6. Auditor Rotation (Art. 31 – CVM Instruction No. 308/99)

In recent fiscal years, instances of non-compliance with the provisions of Art. 31 of CVM Instruction No. 308/99, which deals with auditor rotation, have been identified: “The Independent Auditor - Natural Person and the Independent Auditor - Legal Entity cannot provide services to the same client for a period longer than five consecutive years, counted from the date of this Instruction, requiring a minimum interval of three years for their re-hiring”, regardless of the period during which the auditor provided services to the audited entity.

Regarding this topic, we highlight that the only permitted exception is that in which the audited company has a Statutory Audit Committee – CAE, installed and operating, on a date prior to the hiring of the independent auditor; and that this auditor is a legal entity, as provided for in Art. 31-A of the same Instruction, conditioning, furthermore, the observation of the requirements contained in Arts. 31-B to 31-F, all of the same Instruction. It must be emphasized that the primary responsibility for meeting the rotation requirement lies with the auditor, resigning from the client when a situation characterizing non-compliance with the standard is verified, notwithstanding the responsibility of the audited entity's administrators for the eventual hiring and maintenance of independent auditors that do not meet the conditions provided for in the Instruction (Art. 27 – CVM Instruction No. 308/99).

It is important to highlight that we have observed some occurrences that, ultimately, result in infringement of the auditor rotation rule. In this sense, we warn that auditor rotation cannot be carried out with another audit firm with which the replaced auditor has common interests, nor can it use the same physical and operational structure as the previous auditors. Examples of situations that may characterize non-compliance with the auditor rotation rule, in addition to others of the same nature, include:
a) existence of common partners; b) existence of common technical managers; c) use of the same address (headquarters and offices, if any); d) direct kinship relationship between partners and technical managers of the audit firms (replaced and current); or e) creation of “new” audit firms for service provision, with the existence of partners previously linked to the replaced auditor.

Additionally, we draw attention to the eventual re-hiring of the replaced auditor. Regardless of whether or not the period defined in the standard for consecutive audit services to the same client is reached (five years in normal situations; up to ten years in cases where there is a CAE), their re-hiring can only occur after a period of 03 (three) years. For example, if AUDITOR “A”, after 02 (two) years of providing services to the audited entity, was replaced by AUDITOR “B”, AUDITOR “A” can only return to provide audit services after three years from their replacement, in any circumstance.

7. Preparation of Audit Reports

With the objective of providing guidance regarding the preparation of the independent auditor's report on the financial statements of publicly held companies, in light of the independent auditing professional standards issued by the Federal Council of Accounting, and the standards that regulate the independent auditing activity within the Securities Market, we list below examples of problems observed in the drafting of the independent auditor's report that have appeared recurrently:

• Lack of the expression “with reservation” in the title of the opinion paragraph with reservation:
  Cases were identified where reports were issued with a modified opinion, however, the expression “with reservation” was not included in the title of the respective opinion paragraph, as established in NBC TA 705, approved by CFC Resolution No. 1.232/09.

“When the auditor modifies the opinion on the financial statements, they must, in addition to the specific elements required by NBC TA 700, include a paragraph in their independent auditor's report that provides a description of the matter that gave rise to the modification. The auditor must place this paragraph immediately before the opinion paragraph in their independent auditor's report, using the title “Basis for qualified opinion,” “Basis for adverse opinion” or “Basis for disclaimer of opinion”, as appropriate (see item A17).”

• Lack of description and quantification of the relevant effects that gave rise to the basis for modification of the opinion:
  Cases were identified where reports were issued with a modified opinion, however, the description and quantification of the financial effects of the distortion that gave rise to the modification in the opinion were not included, as established in NBC TA 705, approved by CFC Resolution No. 1.232/09.

“If there is a material misstatement in the financial statements related to specific values in these financial statements (including quantitative disclosures), the auditor must include in the paragraph containing the basis for modification a description and quantification of the financial effects of the misstatement, unless it is impracticable. If it is not practicable to quantify the financial effects, the auditor must specify this in the said paragraph containing the basis for modification (see item A18).”

• Lack of citation of misstatements or non-disclosure of information in explanatory notes:
  During the execution of activities provided for in the scope of Risk-Based Supervision, cases were observed where, despite the eventual misstatement in the information or non-disclosure of information required in accounting pronouncements and existing regulations, the reports were issued without any mention of such facts, as required in NBC TA 705, approved by CFC Resolution No. 1.232/09.

“18. If there is a material misstatement in the financial statements, related to disclosures in the explanatory notes, the auditor must include an explanation of how the disclosures are distorted in the paragraph containing the basis for modification.
19. If there is a material misstatement of the financial statements, related to the non-disclosure of information that should be disclosed, the auditor must:
(a) discuss the non-disclosure with those charged with governance; (b) describe the nature of the omitted information in the paragraph containing the basis for modification; and (c) unless prohibited by law or regulation, include the omitted disclosures, provided it is practicable and that the auditor has obtained appropriate and sufficient audit evidence on the omitted information (see item A19).”

8. Issuance of Detailed Report (Art. 25, item II, CVM Instr. No. 308/99)

Art. 25, item II, of CVM Instruction No. 308/99 provides that the independent auditor must prepare and forward to the management and, when requested, to the Fiscal Council, a detailed report containing their observations regarding deficiencies or ineffectiveness of the internal controls and accounting procedures of the audited entity.

In this sense, reaffirming the provisions of the cited normative text, we clarify that it is our understanding that the issuance of the aforementioned detailed report at the end of the work is mandatory, in any circumstance, regardless of whether deficiencies or ineffectiveness were identified or not in the examined environment. That is, although the independent auditing professional standard dealing with the subject (NBC TA 265) determines the mention in the report only of significant deficiencies, if any, the detailed report required by CVM Instruction No. 308/99 is more comprehensive, requiring the issuance of the report at the end of each work. Furthermore, it is important to emphasize that said report, in consonance with the cited professional standard, must segregate significant deficiencies from those that are not significant. Obviously, in those extremely rare situations where the independent auditor concludes that no internal control deficiencies (significant or not) were identified, the report to be issued will be affirmative, that is, it must affirm the non-identification of internal control deficiencies, whether significant or not, during the performance of the work. It is important to remember that it is the responsibility of the audited entity's management to ensure the adequacy of the internal controls they determined as necessary to allow for the preparation of financial statements free from material misstatement, and for the auditor, to consider internal control to plan audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of internal control.

This procedure enables sufficient proof that the independent auditor performed the evaluation of internal controls and accounting procedures provided for in the standard issued by the CVM and by independent auditing professional standards.

Still regarding said report, we have observed delays in delivering the “final version” to the audited entity and its subsequent insertion into the final audit file. When questioned, some auditors state that the delay originates from the delay in the return of comments made by the entities' management regarding the points identified there. Regarding this topic, we remind you that according to NBC TA 265 – Communication of Internal Control Deficiencies, the deadline for issuing written communication is detailed in item A13, as follows:

“When determining when to issue written communication, the auditor may consider whether the receipt of this communication would be an important factor to allow those charged with governance to perform their overall supervision responsibilities. Furthermore, for entities registered on a stock exchange in certain jurisdictions, those charged with governance may have to receive the written communication from the auditor before the date of approval of the financial statements to perform specific responsibilities regarding internal control, for regulatory purposes, or to meet other purposes. For other entities, the auditor may issue the written communication at a later date. However, in the latter case, considering that the auditor's written communication on significant deficiencies is part of the final audit file, the written communication is subject to the requirement of item 14 of NBC TA 230, which requires the auditor to timely assemble the final audit file. NBC TA 230 establishes that the appropriate time limit for completing the assembly of the final audit file is normally no more than 60 days after the date of the independent auditor's report (NBC TA 230, item A21)”. (our emphasis)

Therefore, we understand that the independent auditor must make efforts to receive management comments within a period of up to 60 (sixty) days after the date of the respective audit report. In cases where there is no response from management, the fact must be recorded in that final audit file, along with the discussion version forwarded, being considered “final” from that moment on.

Finally, we inform that doubts related to registration and performance within the securities market can be resolved through the phones (21) 3554-8397 or 3554-8615, or by email: gna@cvm.gov.br.

Sincerely,

Signed Original

Madson de Gusmão Vasconcelos
Superintendent of Accounting and Auditing Standards In Exercise