CMN Resolution No. 4588 — Regulates Internal Audit Activity in Financial Institutions and Other Entities Authorized by the Central Bank of Brazil

---

The Central Bank of Brazil, in accordance with Article 9 of Law No. 4,595 of December 31, 1964, makes public that the National Monetary Council, in a session held on June 29, 2017, based on Articles 4, item VIII, of the aforementioned Law and Article 1, paragraph 1, of Complementary Law No. 130 of April 17, 2009,

R E S O L V E D:

CHAPTER I

OF THE OBJECT AND SCOPE OF APPLICATION

Art. 1 This Resolution regulates the internal audit activity in financial institutions and other institutions authorized to operate by the Central Bank of Brazil.

Sole paragraph. The provisions of this Resolution do not apply:

I - to consortium administrators and payment institutions, which must observe the regulation issued by the Central Bank of Brazil, in the exercise of their legal powers; and

II - to credit cooperatives classified in Segment 5 (S5), as defined in current regulation, which are part of two- or three-tier systems.

CHAPTER II

OF THE INTERNAL AUDIT ACTIVITY

Section I

Of the Obligation

Art. 2 The institutions mentioned in Art. 1 must implement and maintain an internal audit activity compatible with the nature, size, complexity, structure, risk profile, and business model of the institution.

Sole paragraph. The internal audit activity referred to in the caput must have the necessary conditions for the independent, autonomous, and impartial assessment of the quality and effectiveness of the institution's internal control systems and processes, risk management, and corporate governance.

Art. 3 The internal audit activity must be carried out by a specific unit of the institution, or of an institution belonging to the same financial conglomerate, directly subordinate to the board of directors.

§ 1 The internal audit activity referred to in the caput may be carried out by an independent auditor duly qualified, in accordance with current regulation, to provide independent audit services to financial institutions and other institutions authorized to operate by the Central Bank of Brazil, provided that this auditor is not responsible for the audit of the institution's financial statements or for any other activity with a potential conflict of interest.

§ 2 The provisions of § 1 do not apply to institutions that, in accordance with current regulation, are required to establish an audit committee.

Art. 4 The internal audit activity is admitted in credit cooperatives, securities brokerage firms, foreign exchange brokerage firms, securities distribution firms, microentrepreneur and small business credit societies, credit, financing and investment societies, leasing companies, real estate credit societies, savings and loan associations, and mortgage companies:

I - by the audit of the class entity or central body to which the institution is affiliated; or

II - by the audit of a class entity of other institutions authorized to operate by the Central Bank of Brazil, through an agreement, previously approved by the Central Bank of Brazil, entered into between the entity to which the institution is affiliated and the entity providing the service.

Section II

Of the Essential Characteristics

Art. 5 The internal audit activity must:

I - be independent of the audited activities;

II - be continuous and effective; and

III - have:

a) sufficient resources for the performance of audit work;

b) defined and effective communication channels, to report findings and assessments resulting from audit work; and

c) personnel in sufficient quantity, adequately trained and with the necessary experience to perform their functions.

Art. 6 The appointment, designation, dismissal, or release of the head of the internal audit activity must be approved by the board of directors and communicated to the Central Bank of Brazil.

Section III

Of the Audit Team Members

Art. 7 For the performance of the internal audit activity, team members must:

I - act with independence, autonomy, impartiality, diligence, integrity, and professional ethics;

II - have professional competence, including the knowledge and experience of each internal auditor and of internal auditors collectively, so that the internal audit team has the capacity to collect, understand, examine, and evaluate information and to judge results; and

III - report and be accountable to the board of directors and to the audit committee, when constituted, on all matters related to the performance of their activities, in accordance with the internal audit regulation mentioned in Art. 15.

Art. 8 The institutions mentioned in Art. 1 must guarantee to the audit team members, in the performance of their activities:

I - a permanent communication channel with senior management, which allows this management to act correctly, appropriately, and timely, in response to recommendations resulting from internal audit work;

II - authority to evaluate the institution's own functions and outsourced functions; and

III - free access to any information of the institution.

Art. 9 It is prohibited for a member of the internal audit team:

I - to be involved in the development and implementation of specific measures relating to internal controls; and

II - to act in the audit of activities for which they had responsibility, before at least twelve months have elapsed.

Art. 10 The remuneration policy of the internal audit team members must be determined independently of the performance of the business areas, so as not to generate a conflict of interest.

Section IV

Of the Scope

Art. 11 The scope of the internal audit activity must consider all functions of the institution, including outsourced ones.

Sole paragraph. In the case of a leading institution of a prudential conglomerate, the scope of the internal audit activity must also consider the functions of the institutions comprising the conglomerate.

Art. 12 In the performance of the internal audit activity, the following must be evaluated, at least:

I - the effectiveness and efficiency of internal control systems and processes, risk management, and corporate governance, considering current risks and potential future risks;

II - the reliability, effectiveness, and integrity of management information processes and systems;

III - compliance with the legal framework, sub-legal regulation, recommendations of regulatory bodies, and internal codes of conduct applicable to the institution's workforce members;

IV - the safeguarding of assets and activities related to the financial function of the institution; and

V - the activities, systems, and processes recommended or determined by the Central Bank of Brazil, in the exercise of its supervisory powers.

Art. 13. Regarding the risk management structure and the capital management structure, the scope of the internal audit activity must include the assessment of the adequacy and effectiveness, at least:

I - of the policies and strategies for the management of credit, market, interest rate variation risks for instruments classified in the banking book (IRRBB), operational, liquidity, socio-environmental, and other relevant risks;

II - of the systems, routines, and procedures for risk management;

III - of the models for risk management, considering the premises, methodologies used, and their performance;

IV - of the capital maintained by the institution to face the risks to which it is exposed;

V - of target planning and capital needs, considering the strategic objectives of the institution; and

VI - of other aspects subject to the assessment of internal audit by determination of current legislation and regulation issued by the National Monetary Council and the Central Bank of Brazil.

Art. 14. The Central Bank of Brazil is authorized to determine:

I - the inclusion of work in the scope of internal audit and the execution of specific work; and

II - the adoption of measures aimed at improving internal audit processes.

CHAPTER III

OF THE INTERNAL AUDIT ACTIVITY REGULATIONS

Art. 15. The persons responsible for the internal audit activity of the institutions mentioned in Art. 1 must prepare and maintain a specific regulation for the internal audit activity, approved by the board of directors and by the audit committee, when constituted.

Sole paragraph. The internal audit activity regulation of credit cooperatives must also be approved by the general assembly.

Art. 16. The internal audit activity regulation must provide, at least:

I - the objective and scope of the internal audit activity;

II - the position of the internal audit unit in the institution's structure, if applicable;

III - the essential characteristics of the internal audit activity, observing the provisions of Section II of Chapter II of this Resolution;

IV - the attributes, prohibitions, and remuneration policy applicable to audit team members, as defined in Section III of Chapter II of this Resolution;

V - the definition of the obligation, form, and organizational components to which internal auditors must communicate the results of the performance of their functions;

VI - the duties and responsibilities of the head of the internal audit activity;

VII - the requirement of observance of recognized internal audit standards; and

VIII - the procedures for coordinating the internal audit activity with independent audit.

CHAPTER IV

OF THE PLANNING AND EXECUTION OF THE INTERNAL AUDIT ACTIVITY

Art. 17. The planning of the internal audit activity must be carried out in accordance with the guidelines established by the board of directors, considering all relevant factors and risks relating to the areas, activities, products, and processes subject to audit.

Art. 18. The execution of the internal audit activity must cover the collection and analysis of information, as well as the performance of tests, which adequately support the conclusions and recommendations to the board of directors.

Art. 19. The persons responsible for the internal audit activity of the institutions mentioned in Art. 1 must prepare the following documents:

I - annual internal audit plan, based on the assessment of audit risks, containing, at least, the processes that will be part of the scope of the internal audit activity, the classification of these processes by risk level, the proposed schedule, and allocation of available resources;

II - for each specific work of the internal audit activity:

a) specific work plan, with definition of the scope, schedule, and relevant factors in the execution of the work, such as the nature, timing, and extent of internal audit procedures to be applied, the allocation of human resources, and the availability of appropriate budget for execution;

b) working papers, with record of facts, information, and evidence obtained during the audit, in order to evidence the examinations performed and justify the conclusions and recommendations; and

c) report of the conclusions and recommendations resulting from the internal audit work;

III - follow-up report on the measures taken to comply with the recommendations; and

IV - annual internal audit report, containing a summary of the results of the audit work, its main conclusions, recommendations, and measures taken by the entity's management.

Sole paragraph. The annual internal audit plan and the annual internal audit report must be approved by the board of directors and by the audit committee, when constituted.

CHAPTER V

OF THE DUTIES OF MANAGEMENT

Art. 20. The board of directors must:

I - ensure the independence and effectiveness of the internal audit activity, even when exercised by third parties, in accordance with Arts. 3 and 4;

II - provide the necessary means for the internal audit activity to be exercised adequately, in accordance with this Resolution; and

III - promptly inform the persons responsible for the internal audit activity when any material change occurs in the strategy, policies, and risk management processes of the institution.

Art. 21. The board of directors is responsible for the observance, by the institution, of the norms and procedures applicable to the internal audit activity.

CHAPTER VI

FINAL PROVISIONS

Art. 22. In the performance of the internal audit activity, the audit norms and procedures established by the National Monetary Council, the Central Bank of Brazil, and, insofar as not conflicting with these, those determined by the Federal Council of Accountancy and the Institute of Internal Auditors of Brazil must be observed.

Art. 23. For the institutions referred to in Art. 1 that do not have a board of directors, the duties, competencies, and requirements provided for in this Resolution must be attributed to the management of the institution.

Art. 24. Delegation to another authority of the responsibilities, duties, and competencies of the board of directors, the audit committee, and the management of the institution defined in this Resolution is prohibited.

Art. 25. The institutions mentioned in Art. 1 must keep available to the Central Bank of Brazil:

I - the current regulation of the internal audit activity, referred to in Art. 15; and

II - the documents referred to in Art. 19, for a minimum period of five years.

Art. 26. The institutions mentioned in Art. 1 must implement the internal audit activity in accordance with the provisions of this Resolution by December 31, 2017.

Art. 27. The Central Bank of Brazil is authorized to issue norms and adopt measures necessary for the compliance with this Resolution, including establishing simplified procedures for the observance of the provisions of Arts. 12 and 13 by institutions classified in Segment 5 (S5), as defined in current regulation.

Art. 28. This Resolution enters into force on the date of its publication, producing effects from December 31, 2017.

Art. 29. The §§ 2 to 7 of Art. 2 of Resolution No. 2,554 of September 24, 1998, are revoked, effective December 31, 2017.

                Ilan Goldfajn  
                  President of the Central Bank of Brazil