Circular Letter CVM/SNC/GNA No. 01/2019

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686 CIRCULAR LETTER/CVM/SNC/GNA No. 01/2019 Rio de Janeiro, April 25, 2019.
Subject: Clarifications regarding the performance of the independent accounting auditor within the securities market

Dear Independent Auditor,

As a direct result of our supervision and inspection actions regarding the auditing activity within the securities market, we list below some points related to registration with the CVM, performance in the securities market, and the application of professional standards for independent accounting auditing in the execution of work, for which we request special attention from the independent auditor registered with this Commission.

1. Periodic Information (Art. 16 – CVM Instruction No. 308/99)

Independent auditors must send information related to their performance in the securities market to the CVM by the last business day of April each year, in accordance with Annex VI to CVM Instruction No. 308/99. This information is important support for the CVM to evaluate the auditors' capacity to adequately serve their clients.

Such information must be sent via the internet, on the CVM website. The submission must be made through the option “CENTRAL DE SISTEMAS” (Systems Central), selecting next the option “SISTEMA CVMWEB” (CVMWEB System) and then the option “ENVIO DE DOCUMENTOS” (Document Submission). At this stage, there are two options for submitting information: i) Document submission via form and ii) Document upload. Finally, the option “Informe Anual de Auditor Independente” (Annual Report of Independent Auditor) must be selected. The “document upload” option should only be used by those auditors who have more than 10 (ten) clients that are public companies (or part of the securities market or incentivized companies), as in this case, it is necessary to create a file (XML standard) to submit the required information.

The late submission of this information subjects auditors to a coercive fine, as provided in Art. 18 of CVM Instruction No. 308/99.

We also alert that Annex VI to CVM Instruction No. 308/99 was amended by CVM Instruction No. 591/17, with the elimination of item 8 (Continuing Education). Thus, whether via form submission or document upload, there is no longer a need to report courses and training completed in the reference year of the report.

We inform that a change has been made to the procedure for presenting such information. Now, when accessing the CVMWEB system to present the Annual Periodic Information provided for in Art. 16 of CVM Instruction No. 308/99, the auditor will be automatically directed to the verification of their registration data. After validation of the registration data, or its update, the auditor must mandatorily issue the Electronic Conformity Declaration. Only after this procedure will the independent auditor be redirected to the presentation of the Annual Periodic Information.

2. Registration Update and Electronic Conformity Declaration (Art. 1, item II of CVM Instruction No. 510/11, with amendments by CVM Instruction No. 604/18)

Regardless of the presentation of periodic information required by CVM Instruction No. 308/99, it is also necessary for independent auditors to keep their registration updated, observing a deadline of up to 07 (seven) business days from the event that caused the alteration. To do so, independent auditors must access their registration data on the CVM website, proceeding with the appropriate update. In addition to the required update, annually and by the last business day of April (according to the new wording of item II, Art. 1 of CVM Instruction No. 510/11, amended by CVM Instruction No. 604/18), the Independent Auditor must confirm that their registration data remains valid, by issuing the Electronic Conformity Declaration, established by CVM Instruction No. 510/11. The Electronic Conformity Declaration must be issued by accessing the option “CENTRAL DE SISTEMAS” (Systems Central), selecting next the option “SISTEMA CVMWEB” (CVMWEB System) and then the option “ATUALIZAÇÃO CADASTRAL” (Registration Update), followed by “DECLARAÇÃO ELETRÔNICA DE CONFORMIDADE” (Electronic Conformity Declaration), on the CVM website. It is important to emphasize that, even in cases where there are no alterations in the data on the website, the Electronic Conformity Declaration must be issued.

With the aim of facilitating the presentation of the Electronic Conformity Declaration, avoiding delays or non-presentation, a new functionality has been made available on the CVM website. Now, when accessing the CVMWEB system for the transmission of the Annual Periodic Information provided for in Art. 16 of CVM Instruction No. 308/99 (item 01 above), which has the same presentation deadline, the auditor will be automatically directed to the verification of their registration data and updates that may be necessary. After confirmation of the registration data, or its update, the auditor will be directed to the issuance of the Electronic Conformity Declaration. Once the Electronic Conformity Declaration is issued, the auditor will be redirected to the presentation of the Annual Periodic Information.

For the issuance of the Electronic Conformity Declaration, the independent auditor must be selected (click on the box located before the auditor's name), confirming the registration data, or altering it if necessary, and then activating the option “ENVIAR FORMULÁRIO” (SEND FORM). After sending the Electronic Conformity Declaration, the information “Formulário já enviado? SIM” (Form already sent? YES) will appear.

Finally, we emphasize that the non-presentation of the Electronic Conformity Declaration, or its presentation with delay, subjects the participant to a daily coercive fine, provided for in Art. 5 of CVM Instruction No. 510/11.

3. Communications regarding Arts. 7 and 7-A of CVM Instruction No. 301/99.

With a view to faithful compliance with CVM Instruction No. 301/99, in particular, as provided in Articles 7 and 7-A, we reiterate that in the event that no communication referred to in the caput of said Art. 7 of the mentioned Instruction has been made to the Financial Activities Control Council – COAF, the independent auditor must communicate by the last business day of January, the non-occurrence in the previous calendar year of transactions or proposed transactions subject to communication, in accordance with Art. 7-A (“negative declaration”), through the SISCOAF system.

Due to an agreement signed with the Federal Council of Accounting – CFC, the negative declaration (if applicable) must be made in the CFC environment of SISCOAF. Nothing prevents the auditor registered with the CVM from spontaneously, and in a supplementary manner, also sending suspicious communications or negative declaration to the CVM segment of SISCOAF.

4. External Quality Review Program (Art. 33 – CVM Instruction No. 308/99)

We remind you that independent auditors must submit to an external quality review to be carried out by another auditor registered with the CVM, with a view to also evaluating compliance with technical and professional standards, in accordance with a specific standard issued by the CFC. Currently, NBC PA 11 regulates the matter, to be observed by independent auditors.

Specifically regarding the performance of the reviewing auditor, we have observed various problems in the execution of review work. Such problems are, for the most part, related to the depth of examinations performed, as well as to the obtaining of appropriate and sufficient audit evidence, so as to support the opinion issued at the end of the work.

It is important to emphasize that, from the sample of reviewing auditors selected for inspections in response to the Risk-Based Supervision Program (SBR) adopted by the CVM in recent years, we identified a high recurrence of problems in the execution of review work by reviewing auditors, leading to the adoption of complementary administrative procedures by this Autarchy, including the initiation of administrative sanctioning processes (Accusation Term).

Non-compliance with the Program established by the CFC by the reviewed auditor also entails the application of administrative sanctions. In this sense, we remind you that §5 of Art. 33 of ICVM 308/99, included by ICVM 591/17, establishes:

“§5 Non-compliance with the provisions of the caput in at least 2 (two) of the last 5 (five) years will result in the immediate suspension of the registration of the Independent Auditor – Natural Person, or the Independent Auditor – Legal Entity, until a new review of their quality control is presented, according to the guidelines of the Federal Council of Accounting, with a report issued without reservations, duly approved by the Management Committee of the External Quality Review Program, or equivalent, established by the Federal Council of Accounting – CFC.”

It is important to emphasize that, already in 2018, 04 (four) auditors who again incurred non-compliance with the External Quality Review Program, in the manner provided for in §5 cited above, had their registrations suspended at the CVM. In such cases, and in those that are identified in the future, the auditor who wishes to reactivate their registration must, by their own act and without prior indication by the External Quality Review Committee – CRE, indicate their reviewing auditor to the CRE, submitting themselves to external quality review, within the deadlines and procedures defined by the standard governing the Program. At the end of the review, its result, conclusions, and recommendations must be presented to the CRE, so that the Committee can analyze the review performed by the reviewing auditor, approving it or not.

In any case, the reactivation of the independent auditor's (reviewed) registration with the CVM will only occur if the external quality review process is approved by the CRE and provided that the external quality review report does not contain any reservations (report of adequate quality system review 1). Reports issued with reservations (report of quality system review with deficiencies), abstention of opinion (report of quality system review with scope limitation to the reviewer's work), or adverse (report of inadequate quality system review), even if they meet the requirements provided for in the standard and are approved by the CRE, will not be considered valid for the reactivation of independent auditor registration.

5. Continuing Professional Education Program (Art. 34 – CVM Instruction No. 308/99)

With the objective of maintaining a high standard of technical qualification and constant update regarding professional standards, accounting and auditing procedures, and standards related to the exercise of their activity in the securities market, independent auditors registered with the CVM must maintain, for themselves and their technical staff, a continuing education program in accordance with the guidelines approved by the CFC, contained in NBC PG 12 (R1).

In this regard, we remind you that non-compliance with the Continuing Professional Education Program by independent auditors – natural persons and independent auditors – legal entities, as well as their partners and/or technical managers, entails the application of administrative sanctions. On this subject, we bring §§ 1 and 2 of Art. 34 of ICVM 308/99, included by ICVM 591/17, which establish:

Ҥ 1 The provisions of the caput apply to Independent Auditors РNatural Persons and to partners, whether or not they exercise the auditing activity, technical managers, directors, supervisors, and managers of Independent Auditors РLegal Entities.

§ 2 Non-compliance with the provisions of the caput in at least 2 (two) of the last 5 (five) years will result in the immediate suspension of the registration of the Independent Auditor – Natural Person, or the registration as technical manager of Independent Auditor – Legal Entity, until a new certificate of approval in the Technical Qualification Exam, provided for in Art. 30 of this Instruction, is presented, regardless of the adoption of other applicable administrative measures.”

• The review reports cited in parentheses reflect the types of reports contained in the review of NBC PA 11, approved on December 8, 2017, with effects from 01.01.2019.

It is worth clarifying that, due to the joint action of this Autarchy with the Continuing Professional Education Commission – CEPC, established by the CFC for the management and monitoring of the Program, it is not necessary to present the annual activity report related to Continuing Education to the CVM. Said report must be delivered annually to the respective Regional Council of Accounting – CRC, as defined in NBC PG 12 (R1). Compliance with the Continuing Professional Education Program is homologated by the CFC/CRCs system.

We highlight that, regardless of participation in external courses and activities, independent auditors must have mechanisms for timely monitoring of changes in independent auditing professional standards issued by the CFC and, when applicable, by the Institute of Independent Auditors of Brazil - IBRACON, and standards that regulate the independent auditing activity within the securities market.

On this occasion, we inform independent auditors who promote internal courses for points in the Continuing Professional Education Program that such courses may be subject to “in loco” inspection by the CVM. The inspection may occur without prior notice and aims to verify their effective realization, the existence of satisfactory attendance controls, the effective participation of instructors indicated during the homologation of the course, and also the effective application of the curricular content approved by the CFC/CRCs system.

6. Auditor Rotation (Art. 31 – CVM Instruction No. 308/99)

We remind you that the Independent Auditor – Natural Person and the Independent Auditor – Legal Entity cannot provide services for the same client for a period exceeding five consecutive years, requiring a minimum interval of three years for their re-hiring, regardless of the period in which the auditor provided services to the audited entity.

For its part, we highlight that the only exception permitted is that in which the audited company has a Statutory Audit Committee – CAE, installed and operating, prior to the hiring of the independent auditor; and that this auditor is a legal entity, as provided for in Art. 31-A of the same Instruction, conditioning, furthermore, to the observation of the requirements contained in Arts. 31-B to 31-F, all of the same Instruction. It must be emphasized that the primary responsibility of the auditor is to meet the rotation requirement, renouncing the client when a situation characterizing non-compliance with the standard is verified, notwithstanding the responsibility of the audited entity's administrators for the eventual hiring and maintenance of independent auditors who do not meet the conditions provided for in the Instruction (Art. 27 – CVM Instruction No. 308/99). At the moment, Art. 31-A of ICVM 308/99 is in the process of alteration, having already passed through a public hearing period.

We also alert that rotation cannot be carried out with another audit firm with which the replaced auditor has common interests, nor that they use the same physical and operational structure as the previous auditors. Below, we cite some examples of situations that may characterize non-observance of the auditor rotation rule, as well as others of the same nature:

a) use of the same address (headquarters and offices, if any); b) direct kinship relationship between partners and technical managers of audit firms (replaced and current); or c) creation of “new” audit firms for service provision, with the existence of partners and/or technical managers previously linked to the replaced auditor.

Additionally, we draw attention to the eventual re-hiring of the replaced auditor. Regardless of whether or not the period defined in the standard for the provision of consecutive audit services for the same client is reached (five years, in normal situations; up to ten years for cases where there is a CAE, operating and in adherence to the requirements of ICVM 308/99), its re-hiring can only occur after a period of 03 (three) years. For example, if AUDITOR “A”, after 02 (two) years of providing services to the audited entity, was replaced by AUDITOR “B”, AUDITOR “A” can only return to providing audit services after 03 (three) years of their replacement, in any hypothesis.

7. Issuance of Detailed Report (Art. 25, item II, CVM Instruction No. 308/99)

Art. 25, item II, of ICVM 308/99, with wording given by ICVM 591/17, provides that the independent auditor must “prepare and send to the administration and the Fiscal Council, a detailed report containing their observations regarding the internal controls and accounting procedures of the audited entity, describing, furthermore, any deficiencies or inefficiencies identified during the work.”

In this sense, ratifying the provisions in the cited normative text, we clarify that the issuance of said detailed report at the end of the work is expressly mandatory, in any hypothesis, regardless of whether deficiencies or inefficiencies have been identified or not in the examined environment. That is, although the independent auditing professional standard dealing with the subject (NBC TA 265) determines the mention in the report only of significant deficiencies, if any, the detailed report required by ICVM 308/99 is more comprehensive, requiring the issuance of the report at the end of each work.

Furthermore, it is important to emphasize that said report, in consonance with the cited professional standard, must segregate significant deficiencies from non-significant ones. In those extremely rare situations where the independent auditor concludes by the non-identification of internal control deficiencies (significant or not), the report to be issued will be affirmative, that is, it must affirm the non-identification of internal control deficiencies, whether significant or not, during the execution of the work.

Such procedure enables minimal proof that the independent auditor executed the evaluation of internal controls and accounting procedures provided for in the standard issued by the CVM and by independent auditing professional standards. It is always important to remember that it is the responsibility of the audited entity's administration to ensure the adequacy of the internal controls they deemed necessary to allow the preparation of financial statements free from material misstatement, and for the auditor to consider internal control to plan audit procedures that are appropriate in the circumstances; but not for the purpose of expressing an opinion on the effectiveness of internal control.

In this context, we reinforce that the auditor must, furthermore, during the execution of audit work in subsequent years, establish specific monitoring of those deficiencies pointed out in the previous report, as well as their outcome in relation to the administration's actions, to determine whether such deficiencies should continue to be communicated in the detailed report, or if those initially considered “non-significant” have altered their status due to their recurrence, without actions by the administration of the audited entity over the examined periods.

It is also important to remember, regarding said report, that in NBC TA 265 – Communication of Internal Control Deficiencies, the deadline for issuing written communication is detailed in item A13, as follows:

“When determining when to issue written communication, the auditor may consider whether the receipt of this communication would be an important factor to allow those charged with governance to perform their general supervision responsibilities. Furthermore, for entities registered on a stock exchange in certain jurisdictions, those charged with governance may have to receive the written communication from the auditor before the date of approval of the financial statements to perform specific responsibilities regarding internal control, for regulatory purposes or to meet other purposes. For other entities, the auditor may issue the written communication at a later date. However, in the latter case, considering that the auditor's written communication on significant deficiencies is part of the final audit file, the written communication is subject to the requirement of item 14 of NBC TA 230, which requires the auditor to timely assemble the final audit file. NBC TA 230 establishes that the appropriate time limit for completing the assembly of the final audit file is normally no more than 60 days after the date of the independent auditor's report (NBC TA 230, item A21)”. (our emphasis)

Therefore, the independent auditor must make efforts to receive the administration's comments within a period of up to 60 (sixty) days after the date of the respective audit report. In cases where there is no response from the administration, the fact must be included in that final audit file, along with the version for discussion sent, being considered “final” from that moment.

8. New Audit Report and Key Audit Matters

As is widely known, in 2016, the audit report was altered in its form and content. There was, in this first year of application of the standard, doubt and discussion regarding

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686

within the scope of the new section, given that the standard treated the inclusion of the main audit subjects for listed companies as mandatory. In response to a consultation from IBRACON regarding the scope of this term, the CVM Collegiate Board decided:

“After discussion of the subject, the Collegiate Board unanimously decided to partially grant IBRACON’s appeal in order to establish the understanding that, within the scope of the market regulated by the CVM and for the purposes of NBC TA 701, the concept of listed entities encompasses entities authorized by a market administrator for the trading of their securities on an organized market. Notwithstanding, in line with the understanding of the SNC, the Collegiate Board recognized the importance and convenience that the innovations brought by that audit standard be observed by all entities registered with the CVM. Thus, the Collegiate Board decided to return the topic to the SNC to prioritize a regulatory amendment process to expressly provide for the disclosure of KAMs for all entities registered with the CVM, already in relation to fiscal years to be closed from 31.12.2017.”

Following the recommendation of the collegiate board, ICVM 308/99 was revisited and, after a public hearing process, amended by the issuance of Instruction CVM 591, which provided, from 2017, the inclusion of Key Audit Matters (KAMs) for all entities regulated or supervised by the CVM, including investment funds (for fiscal years ending on or after 31.12.2017), as determined by item VIII, of Art. 25 of Instruction CVM 308:

“VIII – communicate the main audit matters in the audit reports of financial statements of all entities regulated or supervised by the CVM, in accordance with the independent audit professional standards approved by the Federal Council of Accountancy - CFC.”

In turn, in connection with international discussions on the subject, the Institute of Independent Auditors of Brazil – IBRACON, issued circular no. 07/2017 – DN, in which it strongly recommends the explicit inclusion of the results of audit procedures in the KAMs and provides some examples of their presentation, making it clear that these are merely illustrative examples and without the purpose of suggesting any standardized wording, which would be incompatible with the main objectives of the new report, which are ultimately to make it more informative and transparent to its users.

It is relevant to emphasize that, in order to achieve such objectives, it is essential that the description of the procedures carried out by the auditor and the results achieved present relevant informational content for users, not restricting themselves to generic presentations of what was done and vague statements regarding the adequacy of the subject as a whole to the financial statements.

Regarding the content, it is reasonable to conclude that various users expect that the following items, among others possible, be described in the Key Audit Matters section, even if not fully required by NBC TA 701, which we understand as improvements applicable by the auditor when preparing their audit report:

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686

• specific audit procedures for the risk under discussion;
• information on the use of the work of specialists and/or internal auditors;
• specific audit procedures related to applicable internal controls and how, as a result of the application of the procedures carried out by the auditor, possible deficiencies in their effectiveness were detected;
• any difficulties in applying the prescribed procedures;
• changes in the planning of procedures executed, in the scope or in the depth of audit tests;
• whether, during the execution of audit procedures, adjustments were identified, recorded or not by the entity's administration, even if they are not considered material by the auditor.

Additionally, considering the dynamics of the economic and business environment, as well as the diversity of activities, processes, and systems of the audited entities, it is expected that audit reports be effectively individualized, not being mere repetitions of the key audit matters of the previous year, nor composed of standardized subjects (KAMs), established internally by the audit firm, for the firm as a whole or by the sector of activity of the audited entities.

In this sense, we have received some consultations regarding the audit reports issued for the purpose of complying with items I, II, and III, art. 25-A of Instruction CVM no. 480/09, added by Instruction CVM no. 600/18 and the need for the Key Audit Matters section for each set of financial statements of separate assets. On this subject, we remind you that each separate asset is considered an entity that reports information for the purpose of preparing individual financial statements. Therefore, independent audit professional standards must be observed when issuing the respective audit report, including NBC TA 701 which deals with the subject.

With the clarifications above, we understand that the effective achievement of the objectives of the new audit standards will be guaranteed, providing greater transparency about the audit work performed and greater utility to various users for their decision-making.

9. Technical Qualification Examination (art. 30, Instruction CVM no. 308/99)

On 21.08.2015, NBCPA 13 (R2) was approved, which deals with the Technical Qualification Examination, instituted by the Federal Council of Accountancy – CFC. Thus, considering that the aforementioned NBCPA 13 (R2) altered the functioning model of said Examination, creating a specific test for acting in entities regulated by this Autarchy, it is worth remembering the provision in article 30, of ICVM 308/99, which determines that the Technical Qualification Examination will be carried out with a view to qualifying the independent auditor for the exercise of the activity of auditing financial statements for all entities comprising the securities market.

NBCPA 13 (R2), in its item 3, letter “b”, instituted the specific test for acting in entities regulated by the Securities and Exchange Commission (CVM). That is, from the entry into force of NBCPA 13 (R2), the Technical Qualification Examination – “CVM” became the technical qualification examination necessary for registration with this Autarchy.

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686

Additionally, it is worth clarifying that approval in a specific technical qualification examination “CVM” is, only, one of the necessary requirements for registration with the CVM. The fact of being active in the National Register of Independent Auditors (CNAI), maintained by the Federal Council of Accountancy, does not guarantee, by itself, compliance with this requirement, given that many professionals included in the CNAI were not approved in the Technical Qualification Examination, but migrated from the CVM register when it was created.

In turn, with the adoption of the specific technical qualification examination “CVM”, we highlight that, after being approved in that contest, and until their registration or record with the CVM, the professional interested in obtaining such prerogative must remain up to date with the requirements of the Continuing Professional Education Program, proving their regularity through a specific certificate issued by the Federal Council of Accountancy.

10. Composition of audit teams (art. 25, item VII, Instruction CVM no. 308/99)

One of the novelties presented in the alteration of ICVM 308/99 that occurred in 2017 concerns the composition of the teams that carry out audit activities. Item VII, art. 25 of ICVM 308/99 determines that the auditor must:

“
VII – ensure that all partners, directors, managers, supervisors or any other members, with a management function, in the team destined to the exercise of the audit activity in entities regulated by the CVM, have been approved in a specific Technical Qualification Examination for the CVM.
”

Thus, when planning audit teams, auditors must pay attention to the fact that all those components who exercise a management function, such as partners, directors, managers or supervisors, among other possible positions, have been approved in a specific Technical Qualification Examination for the CVM.

It is important to emphasize that item VII of art. 25, combined with the provision in the caput and in §1º of art. 34, all of the aforementioned ICVM 308/99, ratifies the obligation that such professionals pay attention to the annual compliance with the Continuing Professional Education Program, after their approval in said examination. Non-compliance with the guidelines imposed by the Federal Council of Accountancy regarding the Continuing Education Program by the aforementioned professionals may lead to the adoption of administrative measures against the independent auditors linked to them, as stated in item 05 of this circular.

11. Single Register (art. 11, sole paragraph, Instruction CVM no. 308/99)

The alteration introduced in art. 11, sole paragraph, of ICVM 308/99 sought to establish a relationship of equity between the treatment given to the independent auditor – natural person and the independent auditor – legal entity and their technical managers. As stated in the standard,

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686

it is not permitted to register, in the category of Independent Auditor - Natural Person, a accountant who is a partner, director or technical manager or who has an employment link with Independent Auditor - Legal Entity. However, for the partner, or technical manager, of an independent auditor – legal entity registered with the CVM, this impediment did not apply.
We had, therefore, an asymmetric situation that benefited one participant to the detriment of another.

It is worth mentioning that the limitation of participation of a partner to only one audit society registered with the CVM does not characterize non-observance of the constitutional right of free association. In truth, there is no impediment to the free association of the professional; they may have as many associations and participations as they desire, even within the same economic group. However, participation in independent auditor – legal entity registered with the CVM, whether as a partner or as a technical manager, will be limited to only 01 (one) audit society.

It is worth noting that the SNC, after surveying the audit societies reached by this measure, has summoned some audit societies to adopt measures to regularize the registration of the society with this autarchy. We highlight that audit societies reached by the new requirement that do not regularize their registration within the deadline granted for such, will have their registrations with the CVM automatically cancelled. From then on, for the granting of a new registration, the audit society, its partners and technical managers will have to comply with all the requirements provided for in ICVM 308/99.

12. New Digital Protocol

Since January of this year, the CVM's new Digital Protocol system has been available. The objective of the new system is to allow complete automation of the flow of receipt, distribution, and routing of documents received by the Autarchy, making this service more agile and efficient. In this new version, it is possible to follow the progress of requests during all stages.

Without intermediaries, independent auditors can perform the protocol directly with the Audit Standards Management, which can redirect the demand in case of errors. Among the benefits of automating this service are the reduction in document delivery time and the increase in transparency in this routing, since the auditor can follow it from the beginning to the end of their demand. Documents delivered in person or received via Post Office will continue to be treated by the area responsible for receiving these documents, which will perform the registration and digitization in the new Digital Protocol.

The Digital Protocol does not exclude the other CVM service channels, such as, for example, the Public Hearings channel, Process View, CVMWEB, among others. On the CVM portal, on the SERVICE page, the auditor can consult which channel is most appropriate for their demand.

To use the new Digital Protocol, access the Federal Government Services Portal (https://scp.brasilcidadao.gov.br/scp/login) and register. For more information, go to the CVM portal (www.cvm.gov.br) on the Digital Protocol item. In case of doubt, contact the Information Management Division (DINF/SOI) by email dinf@cvm.gov.br or by phone (21) 3554-8411.

Finally, we inform that doubts related to registration and acting within the scope of the securities market can be resolved through the phones (21) 3554-8397 or 3554-8615, or by email: gna@cvm.gov.br.

Sincerely,

Signed original by
MADSON DE GUSMÃO VASCONCELOS
Audit Standards Manager

Signed original by
JOSÉ CARLOS BEZERRA DA SILVA
Superintendent of Accounting and Audit Standards