CMN Resolution No. 4,879 — Regulates Internal Audit Activity at Institutions Authorized by the Central Bank of Brazil

CMN Resolution No. 4,879

CMN RESOLUTION NO. 4,879, OF DECEMBER 23, 2020

Regulates the internal audit activity at institutions authorized to operate by the Central Bank of Brazil.

The Central Bank of Brazil, in accordance with Article 9 of Law No. 4,595, of December 31, 1964, makes it public that the National Monetary Council, in a session held from December 18 to 23, 2020, based on Articles 4, item VIII, of the aforementioned Law, and Article 1, paragraph 1, of Complementary Law No. 130, of April 17, 2009,

RESOLVES:

CHAPTER I

OBJECT AND SCOPE OF APPLICATION

Article 1. This Resolution regulates the internal audit activity at institutions authorized to operate by the Central Bank of Brazil.

Sole paragraph. The provisions of this Resolution do not apply:

I - to consortium administrators and payment institutions, which must observe the regulation issued by the Central Bank of Brazil in the exercise of their legal attributes; and

I - to consortium administrators, payment institutions, securities brokerage firms, securities distribution firms, and currency brokerage firms, which must observe the regulation issued by the Central Bank of Brazil in the exercise of their legal attributes; (Amended, effective March 1, 2024, by CMN Resolution No. 5,117, of January 25, 2024.)

II - to credit cooperatives classified in Segment 5 (S5), as defined in current regulation, that are part of two- or three-tier systems.

CHAPTER II

INTERNAL AUDIT ACTIVITY

Section I

Obligation

Article 2. The institutions mentioned in Article 1 must implement and maintain an internal audit activity compatible with the nature, size, complexity, structure, risk profile, and business model of the institution.

Sole paragraph. The internal audit activity referred to in the caput must have the necessary conditions for the independent, autonomous, and impartial evaluation of the quality and effectiveness of the institution's internal control systems and processes, risk management, and corporate governance.

Article 3. The internal audit activity must be carried out by a specific unit of the institution, or of an institution belonging to the same prudential conglomerate, directly subordinate to the board of directors.

§ 1. The internal audit activity referred to in the caput may be carried out by an independent auditor duly qualified, in accordance with current regulation, to provide independent audit services to institutions authorized to operate by the Central Bank of Brazil, provided that this auditor is not responsible for the audit of the institution's financial statements or for any other activity with a potential conflict of interest.

§ 2. The provisions of § 1 do not apply to institutions that, in accordance with current regulation, are required to constitute an audit committee.

Article 4. The internal audit activity is permitted at credit cooperatives, securities brokerage firms, currency brokerage firms, securities distribution firms, microentrepreneur and small business credit societies, credit societies, financing and investment societies, leasing societies, real estate credit societies, savings and loan associations, mortgage companies, direct credit societies, and peer-to-peer lending societies:

I - by the audit of the class entity or central body to which the institution is affiliated; or

II - by the audit of a class entity of other institutions authorized to operate by the Central Bank of Brazil, through an agreement, previously approved by the Central Bank, entered into between the entity to which the institution is affiliated and the entity providing the service.

Section II

Essential Characteristics

Article 5. The internal audit activity must:

I - be independent of the audited activities;

II - be continuous and effective; and

III - have:

a) sufficient resources for the performance of audit work;

b) defined and effective communication channels, to report findings and evaluations resulting from audit work; and

c) personnel in sufficient quantity, adequately trained, and with the necessary experience to exercise their functions.

Article 6. The appointment, designation, dismissal, or release of the head of the internal audit activity must be approved by the board of directors and communicated to the Central Bank of Brazil.

Section III

Audit Team Members

Article 7. For the performance of the internal audit activity, team members must:

I - act with independence, autonomy, impartiality, diligence, integrity, and professional ethics;

II - have professional competence, including the knowledge and experience of each internal auditor and of internal auditors collectively, so that the internal audit team has the capacity to collect, understand, examine, evaluate information, and judge results; and

III - report to and be accountable to the board of directors and the audit committee, when constituted, on all matters related to the performance of their activities, in accordance with the internal audit regulation mentioned in Article 15.

Article 8. The institutions mentioned in Article 1 must guarantee to audit team members, in the performance of their activities:

I - a permanent communication channel with senior management, allowing them to act corrective, appropriately, and timely, in response to recommendations resulting from internal audit work;

II - authority to evaluate the institution's own functions and outsourced functions; and

III - free access to any information of the institution.

Article 9. It is prohibited for a member of the internal audit team:

I - to be involved in the development and implementation of specific measures related to internal controls; and

II - to act in the audit of activities for which they were responsible, before at least twelve months have elapsed.

Article 10. The remuneration policy for members of the internal audit team must be adequate to attract qualified and experienced professionals and be determined independently of the performance of business areas, so as not to generate conflicts of interest.

Article 10. (Revoked, effective January 1, 2025, by CMN Resolution No. 5,177, of September 26, 2024.)

Section IV

Scope

Article 11. The scope of the internal audit activity must consider all functions of the institution, including outsourced ones.

Sole paragraph. In the case of a leading institution of a prudential conglomerate, the scope of the internal audit activity must also consider the functions of the institutions belonging to the conglomerate.

Article 12. In the performance of the internal audit activity, the following must be evaluated, at least:

I - the effectiveness and efficiency of internal control systems and processes, risk management, and corporate governance, considering current risks and potential future risks;

II - the reliability, effectiveness, and integrity of management information processes and systems;

III - compliance with the legal framework, sub-legal regulation, recommendations of regulatory bodies, and internal codes of conduct applicable to the institution's workforce;

IV - the safeguarding of assets and activities related to the financial function of the institution; and

V - the activities, systems, and processes recommended or determined by the Central Bank of Brazil, in the exercise of its supervisory attributes.

Article 13. Regarding the risk management structure and the capital management structure, the scope of the internal audit activity must include the evaluation of adequacy and effectiveness, at least:

I - of policies and strategies for the management of credit, market, interest rate variation risks for instruments classified in the banking book (IRRBB), operational, liquidity, socio-environmental, and other relevant risks;

II - of systems, routines, and procedures for risk management;

III - of models for risk management, considering the premises, methodologies used, and their performance;

IV - of the capital maintained by the institution to face the risks to which it is exposed;

V - of target planning and capital needs, considering the strategic objectives of the institution; and

VI - of other aspects subject to evaluation by internal audit by determination of current legislation and regulation issued by the National Monetary Council and the Central Bank of Brazil.

Article 14. The Central Bank of Brazil is authorized to determine:

I - the inclusion of work in the scope of internal audit and the execution of specific work; and

II - the adoption of measures aimed at improving internal audit processes.

CHAPTER III

REGULATION OF THE INTERNAL AUDIT ACTIVITY

Article 15. The institutions mentioned in Article 1 must elaborate and maintain a specific regulation for the internal audit activity, approved by the board of directors and the audit committee, when constituted.

Sole paragraph. The regulation of the internal audit activity of credit cooperatives must also be approved by the general assembly.

Article 16. The regulation of the internal audit activity must provide, at least:

I - the objective and scope of the internal audit activity;

II - the position of the internal audit unit in the institution's structure, if applicable;

III - the essential characteristics of the internal audit activity, observing the provisions of Section II of Chapter II of this Resolution;

IV - the attributes, prohibitions, and remuneration policy applicable to audit team members, as defined in Section III of Chapter II of this Resolution;

IV - the attributes and prohibitions applicable to audit team members, as defined in Section III of Chapter II of this Resolution; (Amended, effective January 1, 2025, by CMN Resolution No. 5,177, of September 26, 2024.)

V - the definition of the obligation, form, and organizational components to which internal auditors must communicate the results of the performance of their functions;

VI - the duties and responsibilities of the head of the internal audit activity;

VII - the requirement of observance of recognized internal audit standards; and

VIII - procedures for coordinating the internal audit activity with independent audit.

CHAPTER IV

PLANNING AND EXECUTION OF THE INTERNAL AUDIT ACTIVITY

Article 17. The planning of the internal audit activity must be carried out in accordance with the guidelines established by the board of directors, considering all relevant factors and risks related to the areas, activities, products, and processes subject to audit.

Article 18. The execution of the internal audit activity must cover the collection and analysis of information, as well as the performance of tests, which adequately support conclusions and recommendations to the board of directors.

Article 19. Those responsible for the internal audit activity of the institutions mentioned in Article 1 must prepare the following documents:

I - annual internal audit plan, based on audit risk assessment, containing, at least, the processes that will be part of the scope of the internal audit activity, the classification of these processes by risk level, the proposed schedule, and allocation of available resources;

II - for each specific work of the activity:

a) specific work plan, with definition of scope, schedule, and relevant factors in the execution of the work, such as the nature, timing, and extent of internal audit procedures to be applied, allocation of human resources, and availability of appropriate budget for execution;

b) working papers, with record of facts, information, and evidence obtained during the audit, in order to demonstrate examinations performed and justify conclusions and recommendations; and

c) report of conclusions and recommendations resulting from internal audit work;

III - follow-up report on measures taken to comply with recommendations; and

IV - annual internal audit report, containing a summary of audit work results, main conclusions, recommendations, and measures taken by the entity's management.

Sole paragraph. The annual internal audit plan and the annual internal audit report must be approved by the board of directors and the audit committee, when constituted.

CHAPTER V

DUTIES OF MANAGEMENT

Article 20. The board of directors must:

I - ensure the independence and effectiveness of the internal audit activity, even when performed by third parties, in accordance with Articles 3 and 4;

II - provide the necessary means for the internal audit activity to be performed adequately, in accordance with this Resolution; and

III - promptly inform those responsible for the internal audit activity of any material change occurring in the strategy, policies, and risk management processes of the institution.

Article 21. The board of directors is responsible for the institution's compliance with the norms and procedures applicable to the internal audit activity.

CHAPTER VI

FINAL PROVISIONS

Article 22. In the performance of the internal audit activity, the audit norms and procedures established by the National Monetary Council, the Central Bank of Brazil, and, insofar as not conflicting with these, by the Federal Council of Accounting and the Institute of Internal Auditors of Brazil must be observed.

Article 23. For the institutions referred to in Article 1 that do not have a board of directors, the duties, competencies, and requirements provided for in this Resolution must be attributed to the institution's management.

Article 24. Delegation to another authority of the responsibilities, duties, and competencies of the board of directors, the audit committee, and the institution's management defined in this Resolution is prohibited.

Article 25. The institutions mentioned in Article 1 must keep available to the Central Bank of Brazil:

I - the current regulation of the internal audit activity, referred to in Article 15; and

II - the documents referred to in Article 19, for a minimum period of five years.

Article 26. The Central Bank of Brazil is authorized to issue norms and adopt measures necessary for the compliance with this Resolution, including establishing simplified procedures for the observance of the provisions of Articles 12 and 13 by institutions classified in Segment 5 (S5), as defined in current regulation.

Article 27. The following are revoked:

I - Resolution No. 4,588, of June 29, 2017; and

II - Article 46 of Resolution No. 4,656, of April 26, 2018.

Article 28. This Resolution enters into force on January 1, 2021.

Bruno Serra Fernandes
President of the Central Bank of Brazil, substitute