Circular Letter CVM/SNC/GNA No. 01/2017

SECURITY AND EXCHANGE COMMISSION OF BRAZIL
Rua Sete de Setembro, 111/2-5th and 23-34th Floors – Center – Rio de Janeiro - RJ – CEP: 20050-901 – Brazil Tel.: (21) 3554-8686 - www.cvm.gov.br

CIRCULAR LETTER/CVM/SNC/GNA No. 01/2017

Rio de Janeiro, January 12, 2017.

Subject: Clarifications related to the auditor's role within the securities market

Dear Independent Auditor,

As a direct result of our supervision and inspection actions regarding the auditing activity within the securities market, we list below some points related to the performance and application of independent auditing professional standards, for which we request special attention from the independent auditor registered with this Commission.

1. Periodic Information (Art. 16 – CVM Instruction No. 308/99)

Independent auditors must submit to the CVM, by the last business day of April each year, information related to their performance in the securities market, as per Annex VI to CVM Instruction No. 308/99. This information is important support for the CVM to assess the auditors' capacity to adequately serve their clients.

The Superintendence of Accounting and Auditing Standards - SNC recommends that such information be submitted via the internet, on the CVM website. The submission must be made through the "SYSTEMS CENTRAL" option, selecting next the "CVMWEB SYSTEM" option and then the "DOCUMENT SUBMISSION" option. At this stage, there are two options for submitting the information: i) Document submission via form and ii) Document upload. Finally, the "Annual Report of Independent Auditor" option must be selected. The "document upload" option should be used only by those auditors who have more than 10 (ten) clients that are publicly held companies (or other entities under the CVM's inspection scope), as in this case, it is necessary to create a file (XML standard) to submit the required information. Late submission of this information subjects auditors to a penalty fine, as provided in Art. 18 of CVM Instruction No. 308/99.

2. Registration Update (CVM Instruction No. 510/11)

Regardless of the submission of periodic information required by CVM Instruction No. 308/99, it is also necessary for independent auditors to keep their registration updated, observing a deadline of up to 07 (seven) business days from the event that caused the alteration. To do so, independent auditors must access their registration data on the CVM website and proceed with the appropriate update. In addition to the required update, annually (between May 1st and May 31st), the Independent Auditor must confirm that their registration data remains valid, by issuing the Electronic Conformity Declaration, established by CVM Instruction No. 510/11. The Electronic Conformity Declaration must be issued by accessing the "SYSTEMS CENTRAL" option, selecting next the "CVMWEB SYSTEM" option and then the "REGISTRATION UPDATE" option, followed by "ELECTRONIC CONFORMITY DECLARATION", on the CVM website. It is important to emphasize that, even in cases where there are no alterations to the data on the website, the Electronic Conformity Declaration must be issued.

For the issuance of the Electronic Conformity Declaration, the independent auditor must be chosen (click on the box before the auditor's name), confirming the registration data, or altering it if necessary, and then activating the "SEND FORM" option. After sending the Electronic Conformity Declaration, the following information will appear: Form already sent? YES.

Finally, we emphasize that the Electronic Conformity Declaration will only be counted if performed in the month of May, as defined in the cited norm, and that non-compliance with the provisions of Art. 1 of CVM Instruction No. 510/11 subjects the participant to a daily penalty fine, provided for in Art. 5 of the cited Instruction.

3. Communications regarding Arts. 7 and 7-A of CVM Instruction No. 301/99.

With a view to faithful compliance with CVM Instruction No. 301/99, particularly regarding the provisions of Articles 7 and 7-A, we reiterate that in the event that no communication referred to in the caput of said Art. 7 of the mentioned Instruction has been made to the Financial Activities Control Council – COAF, the independent auditor must communicate by the last business day of January, the non-occurrence in the previous calendar year of transactions or proposed transactions subject to communication, under the terms of Art. 7-A ("negative declaration"), through the SISCOAF system.

Due to an agreement signed with the Federal Council of Accounting - CFC, the negative declaration (if applicable) must be made in the CFC environment of SISCOAF. Nothing prevents the auditor registered with the CVM from spontaneously, and in a supplementary manner, also sending suspicious communications or negative declarations to the CVM segment of SISCOAF.

Opportune to mention that CVM Instruction No. 301/99 is being reviewed and that the public hearing on the new norm has been extended until 02/16/2017. More information can be obtained at:

"http://www.cvm.gov.br/export/sites/cvm/audiencias_publicas/ap_sdm/anexos/2016/sdm0916 Edital.pdf"

4. External Quality Review Program (Art. 33 – CVM Instruction No. 308/99)

We remind you that independent auditors must submit to an external quality review to be performed by another auditor registered with the CVM, with the aim of also evaluating compliance with technical and professional standards, in accordance with a specific norm issued by the CFC. Currently, NBC PA 11 regulates the matter, and it must be observed by independent auditors.

Non-compliance with the Program established by the CFC, as well as the determinations contained in CVM Instruction No. 308/99, may lead to the application of fines, in addition to other applicable administrative measures, including the initiation of an administrative sanctioning process.

Specifically regarding the performance of the reviewing auditor, we have observed various problems in the execution of review work. These problems are, for the most part, related to the depth of the examinations performed, as well as to the obtaining of appropriate and sufficient audit evidence, in order to support the opinion issued at the end of the work.

It is important to emphasize that, from the sample of reviewing auditors selected for inspections in response to the Risk-Based Supervision Program (SBR) adopted by the CVM in recent years, we identified a high recurrence of problems in the execution of review work by reviewing auditors, leading to the adoption of complementary administrative procedures by this Autarchy, including the initiation of administrative sanctioning processes (Term of Accusation).

5. Continuing Professional Education Program (Art. 34 – CVM Instruction No. 308/99)

With the objective of maintaining a high standard of technical qualification and constant update regarding professional standards, accounting and auditing procedures, and standards related to the exercise of their activity in the securities market, independent auditors registered with the CVM must maintain, for themselves and for their technical staff, a continuing education program consistent with the guidelines approved by the CFC, contained in NBC PG 12 (R1). Non-compliance with the Program established by the CFC, as well as the determinations contained in CVM Instruction No. 308/99, may lead to the application of fines, in addition to other applicable administrative measures, including the initiation of an administrative sanctioning process.

It is worth clarifying that, due to joint action with the Continuing Professional Education Commission – CEPC, established by the CFC for the management and monitoring of the Program, it is not necessary to submit an activity report to the CVM. This report must be delivered annually (by January 31) to the respective Regional Council of Accounting – CRC, as defined in NBC PG 12 (R1). Proof of compliance with the Continuing Professional Education Program is forwarded by the CEPC/CFC after analysis of the reports presented by professionals, considering the courses, events, and other activities homologated by the CFC/CRCs system.

We highlight that, regardless of participation in external courses and activities, independent auditors must have mechanisms for timely monitoring of changes in independent auditing professional standards issued by the CFC and, when applicable, by the Institute of Independent Auditors of Brazil - IBRACON, and standards that regulate the independent auditing activity within the securities market.

6. Auditor Rotation (Art. 31 – CVM Instruction No. 308/99)

In recent fiscal years, occurrences of non-compliance with the provisions of Art. 31 of CVM Instruction No. 308/99, which deals with auditor rotation, have been identified: "The Independent Auditor - Natural Person and the Independent Auditor - Legal Entity cannot provide services for the same client for a period longer than five consecutive years, counted from the date of this Instruction, requiring a minimum interval of three years for their re-hiring", regardless of the period during which the auditor provided services to the audited entity.

Regarding this topic, we highlight that the only permitted exception is that in which the audited company has a Statutory Audit Committee – CAE, installed and operating, prior to the hiring of the independent auditor; and that this auditor is a legal entity, as provided for in Art. 31-A of the same Instruction, conditioning, furthermore, the observation of the requirements contained in Arts. 31-B to 31-F, all of the same Instruction. The primary responsibility of the auditor to meet the rotation requirement must be emphasized, renouncing the client when a situation characterizing non-compliance with the norm is verified, notwithstanding the responsibility of the audited entity's administrators for the eventual hiring and maintenance of independent auditors who do not meet the conditions provided in the Instruction (Art. 27 – CVM Instruction No. 308/99).

We also alert that auditor rotation cannot be carried out with another audit society with which the replaced auditor has common interests, nor one that uses the same physical and operational structure as the previous auditors. Examples of situations that may characterize non-compliance with the auditor rotation rule, in addition to others of the same nature, include:
a) existence of common partners; b) existence of common technical managers; c) use of the same address (headquarters and offices, if any); d) direct kinship relationship between partners and technical managers of the audit societies (replaced and current); or e) creation of "new" audit societies to provide services, with the existence of partners previously linked to the replaced auditor.

Additionally, we draw attention to the eventual re-hiring of the replaced auditor. Regardless of whether or not the period defined in the norm for the provision of consecutive audit services for the same client is reached (five years in normal situations; up to ten years for cases where there is a CAE), their re-hiring can only occur after a period of 03 (three) years. For example, if AUDITOR "A", after 02 (two) years of providing services to the audited entity, was replaced by AUDITOR "B", AUDITOR "A" can only return to provide audit services after 03 (three) years from their replacement, in any hypothesis.

7. Issuance of Circumstantial Report (Art. 25, item II, CVM Instruction No. 308/99)

Art. 25, item II, of CVM Instruction No. 308/99 provides that the independent auditor must "prepare and send to the administration and, when requested, to the Fiscal Council, a circumstantial report containing their observations regarding deficiencies or inefficacy of the internal controls and accounting procedures of the audited entity".

In this sense, ratifying the provisions in the cited normative text, we clarify that it is our understanding that the issuance of the aforementioned circumstantial report at the end of the work is mandatory, in any hypothesis, regardless of whether deficiencies or inefficacies were identified or not in the examined environment. That is, although the independent auditing professional standard dealing with the subject (NBC TA 265) determines the mention in the report only of significant deficiencies, if any, the circumstantial report required by CVM Instruction No. 308/99 is more comprehensive, requiring the issuance of the report at the end of each work.

Furthermore, it is important to emphasize that this report, in consonance with the cited professional standard, must segregate significant deficiencies from non-significant ones. In those extremely rare situations where the independent auditor concludes that no internal control deficiencies (significant or not) were identified, the report to be issued will be affirmative, that is, it must affirm the non-identification of internal control deficiencies, whether significant or not, during the performance of the work. It is important to remember that it is the responsibility of the audited entity's administration to ensure the adequacy of the internal controls they determined as necessary to allow the preparation of financial statements free from material misstatement, and for the auditor to consider internal control to plan audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of internal control.

Such a procedure allows for minimal proof that the independent auditor executed the evaluation of internal controls and accounting procedures provided for in the norm issued by the CVM and by independent auditing professional standards.

On the other hand, when analyzing the aforementioned circumstantial reports within the scope of our Risk-Based Supervision, we have observed that, although formally issued, some submitted reports are superficial, with generic information and without any relevant content for the administration to use it as a tool for improving internal controls, the main objective of its preparation. Additionally, it was verified that, in some reports, the segregation of significant deficiencies from others was not done expressly. In this sense, although we recognize that the professional auditing standard itself (NBC TA 265) does not present a report model, we remind you that the circumstantial report must contain a detailed description of the deficiencies and inefficacy of the internal controls and accounting procedures adopted by the audited entity, followed by recommendations for the required corrections, as defined in items A15 and A28 of the cited norm, and the express segregation of significant deficiencies from others is also indispensable. It is important to note that, although the NBC TA 265 standard allows for verbal communications, it is our understanding that written communication provides the auditor with formal evidence of their performance, and therefore, it is the recommended option for communication.

In this context, we reinforce that the auditor must, furthermore, during the performance of audit work in subsequent years, establish specific monitoring of those deficiencies pointed out in the previous report, as well as their outcome in relation to the administration's actions, to determine whether such deficiencies should continue to be communicated in the circumstantial report.

Regarding said report, we remind you that, according to NBC TA 265 – Communication of Internal Control Deficiencies, the deadline for issuing written communication is detailed in item A13, as follows:

"When determining when to issue written communication, the auditor may consider whether the receipt of this communication would be an important factor to allow those charged with governance to perform their overall supervision responsibilities. Furthermore, for entities listed on a stock exchange in certain jurisdictions, those charged with governance may have to receive written communication from the auditor before the date of approval of the financial statements to perform specific responsibilities regarding internal control, for regulatory purposes, or to meet other purposes. For other entities, the auditor may issue written communication at a later date. However, in the latter case, considering that the auditor's written communication about significant deficiencies is part of the final audit file, the written communication is subject to the requirement of item 14 of NBC TA 230, which requires the auditor to timely assemble the final audit file. NBC TA 230 establishes that the appropriate time limit for completing the assembly of the final audit file is normally no more than 60 days after the date of the independent auditor's report (NBC TA 230, item A21)". (our emphasis)

Therefore, we understand that the independent auditor must make efforts to receive the administration's comments within a period of up to 60 (sixty) days after the date of the respective audit report. In cases where there is no response from the administration, the fact must be included in that final audit file, along with the draft version sent, being considered "final" from that moment.

8. New Audit Report

As is widely known, in 2016, the audit report was altered in its form and content, and it must be applied to audits of financial statements for periods ending on or after December 31, 2016. During the alteration process and to adapt the independent auditing professional standards, the CFC promoted the update of several auditing professional standards. Regarding this topic, the Institute of Independent Auditors of Brazil – IBRACON, issued Circular No. 04/2016 – DN, listing the standards directly impacted:

• NBC TA 200 - General Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with Auditing Standards
• NBC TA 210 - Agreeing to the Terms of Audit Engagements
• NBC TA 220 - Quality Control for an Audit of Financial Statements
• NBC TA 230 - Audit Documentation
• NBC TA 240 - The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements
• NBC TA 260 – Communication with Those Charged with Governance
• NBC TA 300 - Planning an Audit of Financial Statements
• NBC TA 315 - Identifying and Assessing the Risks of Material Misstatement through Understanding the Entity and Its Environment
• NBC TA 320 - Materiality in Planning and Performing an Audit
• NBC TA 330 - The Auditor's Responses to Assessed Risks
• NBC TA 450 - Evaluation of Misstatements Identified during the Audit
• NBC TA 500 - Audit Evidence
• NBC TA 510 - Initial Engagements – Opening Balances
• NBC TA 540 - Auditing Accounting Estimates, Including Fair Value Estimates, and Related Disclosures
• NBC TA 560 - Subsequent Events
• NBC TA 570 – Going Concern
• NBC TA 580 - Written Representations
• NBC TA 600 – Special Considerations – Audits of Group Financial Statements, Including the Work of Component Auditors
• NBC TA 700 – Forming an Opinion and Reporting on Financial Statements
• NBC TA 701 – Communicating Key Audit Matters in the Independent Auditor's Report (new standard)
• NBC TA 705 – Modifications to the Opinion in the Independent Auditor's Report
• NBC TA 706 – Emphasis of Matter Paragraphs and Other Matter Paragraphs in the Independent Auditor's Report
• NBC TA 710 - Comparative Information – Corresponding Figures and Comparative Financial Statements
• NBC TA 720 – The Auditor's Responsibilities Relating to Other Information.

Additionally, and in a summarized manner, we can highlight that the main changes introduced in the new audit report are:
a) Reordering of the auditor's report, with the opinion being presented in the first section; b) Enhanced and more detailed description of the auditor's responsibilities and an affirmative statement regarding their independence and compliance with relevant ethical responsibilities according to the Code of Professional Ethics for Accountants; c) Improvement of the report and some additional requirements regarding going concern; d) New section in the report to deal with information accompanying the financial statements; and e) Inclusion of a new section to communicate Key Audit Matters (KAM), according to the provisions of NBC TA 701.

Regarding this topic, we remind you that Key Audit Matters (KAMs) are selected by the auditor from those topics communicated to the entity's governance bodies and that, in the auditor's judgment, were of greatest importance among those that required significant attention during the performance of the audit work.

Still regarding Key Audit Matters (KAMs), it is worth remembering that their identification by the auditor depends on a risk assessment process whose necessary information for such analysis is not entirely available to the professional before their confirmation as the entity's auditor and the effective start of the work. Therefore, we consider it inappropriate for Key Audit Matters to already appear in the engagement letter or other related documents, even hypothetically, as their definition will only occur effectively with the progress of the audit work.

Finally, we inform that doubts related to registration and performance within the securities market can be resolved through the phones (21) 3554-8397 or 3554-8615, or by email: gna@cvm.gov.br.

Sincerely,

Signed Original by
MADSON DE GUSMÃO VASCONCELOS
Manager of Auditing Standards

Signed Original by
JOSÉ CARLOS BEZERRA DA SILVA
Superintendent of Accounting and Auditing Standards