CIRCULAR No. 3.467

Establishes criteria for the preparation of reports assessing the quality and adequacy of the internal control system and of non-compliance with legal and regulatory provisions and provides other measures.

The Board of Directors of the Central Bank of Brazil, in a session held on 11 September 2009, based on arts. 10, item IX, of Law No. 4.595, of 31 December 1964, 6 and 7 of Law No. 11.795, of 8 October 2008, 13 of Resolution No. 2.682, of 21 December 1999, and 46 of Resolution No. 3.442, of 28 February 2007,

D E C I D E D :

Art. 1 The report assessing the quality and adequacy of the internal control system, including electronic data processing and risk management systems, prepared as a result of the independent audit work, as provided for in art. 21, item II, of the Regulation annexed to Resolution No. 3.198, of 27 May 2004, and in art. 13, item II, of the Regulation annexed to Circular No. 3.192, of 5 June 2003, must cover the following relevant aspects, observing the nature, complexity and risk of the operations carried out by the audited institution:

I - control environment;

II - risk identification and assessment;

III - controls;

IV - information and communication;

V - monitoring and improvement; and

VI - identified deficiencies.

§ 1 The preparation of a report covering all the aspects described in the caput is mandatory in independent audit work carried out at:

I - multiple banks, commercial banks, development banks, investment banks and savings banks;

II - other institutions authorized to operate by the Central Bank of Brazil required to establish an audit committee under the terms of art. 10 of the Regulation annexed to Resolution No. 3.198, of 2004.

§ 2 For consortium administrators, credit cooperatives and other financial institutions not covered by § 1, the report mentioned in the caput must mandatorily address the description of the controls referred to in item III, without prejudice to reporting on the other aspects established in this article, when relevant.

Art. 2 The description of the aspects relating to the control environment provided for in art. 1, item I, must address the institution's control culture, including, at least, the following elements:

I - commitment to ethics and integrity: existence of evidence of the institution's management commitment to ethics and integrity, including, but not limited to, the establishment of a code of ethics and its dissemination within the organization;

II - technical competence: existence of evidence presented by the institution's management regarding the criteria adopted for the selection and evaluation of the professionals in its staff;

III - institutional policies: existence of evidence of such policies, as well as of processes that ensure their dissemination within the organization;

IV - risk management, internal controls and internal audit structure: existence of an organizational structure aimed at managing these aspects and other related ones, eventually present in the institution, indicating, at least, their hierarchical levels;

V - involvement of senior management with internal control and risk management issues: existence of evidence regarding management's involvement in such issues; and

VI - training and awareness policy for the staff regarding risks and internal controls: existence of a formal training policy and its scope.

Art. 3 The description of the aspects relating to risk identification and assessment referred to in art. 1, item II, must address the processes for identifying and assessing internal and external factors that may impair the achievement of the organization's objectives, including, at least, the following elements:

I - processes for identifying and measuring market, credit and operational risks; and

II - processes for validating pricing models and stress tests.

Art. 4 The description of the aspects relating to controls referred to in art. 1, item III, must address the activities of systematic monitoring, in order to allow the assessment of compliance with the institution's objectives, the established limits and the applicable laws and regulations, as well as to ensure the prompt correction of deviations, including, at least, the following elements:

I - policies and procedures regarding the segregation of activities, in order to avoid conflicts of interest and the accumulation of incompatible functions;

II - policies of specific and general authorizations; III - rules for the preparation of accounting and administrative reports; IV - accounting review and reconciliation processes, as well as periodic physical inspection procedures on the institution's assets; V - control procedures relating to risk management, including identification and quantification, reconciliation of positions, establishment and control of exposure limits and preparation of reports on positions held by the institution; VI - physical security; and VII - contingency or continuity plans.

Sole paragraph. The description mentioned in the caput must include controls aimed at preventing the institution's involvement in improper or illicit activities, in particular the procedures and controls to recognize, deter and report money laundering and terrorist financing activities.

Art. 5 The description of the aspects relating to information and communication referred to in art. 1, item IV, must cover the channels that ensure employees, according to their corresponding level of activity, access to reliable, timely and understandable information considered relevant to their tasks and responsibilities, including, at least, the following elements:

I - security of the accounting systems and integration of the computerized systems with the institution's accounting records; and II - process of disseminating, at all levels of the organization, the policies of internal controls.

Art. 6 The description of the aspects related to monitoring and improvement referred to in art. 1, item V, must address the processes of review and updating of internal controls, in order to ensure the incorporation of measures related to new risks or to existing but unconsidered risks, including, at least, the following elements:

I - updating of assumptions, methodologies and risk management models; II - attributions of internal audit related to internal controls, risk management and the frequency of audit work in the last twelve months; III - continuous monitoring activities carried out during the development of operations; and IV - periodic security tests of information systems, especially those maintained in electronic media.

Art. 7 The report of non-compliance with legal and regulatory provisions, provided for in art. 21, item III, of the Regulation annexed to Resolution No. 3,198, of 2004, and in art. 13, item III, of the Regulation annexed to Circular No. 3,192, of 2003, may be presented as part of the report on the assessment of the quality and adequacy of the internal controls system, including electronic data processing and risk management systems.

Art. 8 In preparing the reports mentioned in arts. 1 and 7, the norms and procedures determined by the Securities and Exchange Commission (CVM), the Federal Accounting Council (CFC) and the Institute of Independent Auditors of Brazil (Ibracon) must be observed, in aspects not conflicting with the regulations established by the National Monetary Council and the Central Bank of Brazil.

Art. 9 The reports mentioned in arts. 1 and 7 must be issued within 45 (forty-five) days after the date of publication of the financial statements subject to independent audit, except for the situations provided for in art. 26 of Resolution No. 3,442, of February 28, 2007.

Sole paragraph. The provisions of this article also apply to the report referred to in art. 12 of Resolution No. 2,682, of December 21, 1999.

Art. 10. The institutions referred to in art. 1, when contracting or replacing independent audit services dealt with in arts. 1 of the Regulation annexed to Resolution No. 3,198, of 2004, and 1 of the Regulation annexed to Circular No. 3,192, of 2003, must register in the Information System on Entities of Interest of the Central Bank (Unicad), within a maximum period of 10 (ten) days counted from the contracting or replacement, the following registration data of the auditor:

I - name;

II - address;

III - registration number in the Individual Taxpayer Registry (CPF) or in the National Legal Entity Registry (CNPJ); and

IV - declaratory act of registration of the independent auditor with the CVM.

§ 1 The data related to the contracted auditor must be kept updated in Unicad, observing the period established in the caput.

§ 2 The documentation related to the replacement of the auditor must contain the reasons that determined the decision and the acknowledgment of the replaced auditor, who, in the event of non-compliance, must point out the justifications for their disagreement.

§ 3 The documentation referred to in § 2 must be kept at the institution at the disposal of the Central Bank of Brazil for a period of 5 (five) years.

§ 4 The provisions of this article also apply, where applicable, to the periodic replacement of the technical manager responsible for the audit of a credit cooperative, when the audit of financial statements is carried out by a cooperative audit entity referred to in art. 23 of Resolution No. 3,442, of 2007.

Art. 11. The data related to the director responsible for the monitoring, supervision and compliance with accounting and auditing norms and procedures, designated in the form of arts. 5 of the Regulation annexed to Resolution No. 3,198, of 2004, and 5 of the Regulation annexed to Circular No. 3,192, of 2003, must be registered within 10 (ten) days counted from the date of appointment and kept updated in Unicad.

§ 1 The information referred to in the caput must be complemented by a declaration signed by the director responsible for the monitoring, supervision and compliance with accounting and auditing norms and procedures, which must state that:

I - they are aware of their obligations; and

II - they are responsible for the attributions provided for in arts. 5 of the Regulation annexed to Resolution No. 3,198, of 2004, and 5 of the Regulation annexed to Circular No. 3,192, of 2003.

§ 2 The declaration referred to in § 1 must be kept at the institution at the disposal of the Central Bank of Brazil for a period of 5 (five) years.

Art. 12. The director responsible for the monitoring, supervision and compliance with accounting and auditing norms and procedures, when summoned by the Central Bank of Brazil, must appear accompanied by the independent auditor or by the technical manager responsible for the cooperative audit entity referred to in § 1 of art. 23 of Resolution No. 3,442, of 2007.

Art. 13. The Central Bank of Brazil, based on facts verified in the institutions referred to in art. 1, may, without prejudice to other measures provided for in current legislation and regulations:

I - require the provision of additional information and clarifications;

II - determine the performance of complementary examinations; and

III - determine that the work performed by an independent auditor or by a cooperative audit entity be reviewed by another auditor.

Art. 14. The reports dealt with in arts. 1 and 7 must be prepared in the form established in this circular from the base date of December 31, 2009.

Art. 15. This circular enters into force on the date of its publication.

CENTRAL BANK OF BRAZIL

Art. 16. Circular No. 2,676, of April 10, 1996, is revoked.

Brasília, September 14, 2009.

Anthero de Moraes MeirellesAntonio
Director
Gustavo Matos do Vale
Director

This text does not replace the one published in the DOU and in Sisbacen.