CVM Resolution No. 23 of February 25, 2021

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION (CVM) Rua Sete de Setembro, 111/2-5º and 23-34º Floors, Centro, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2º, 3º and 4º Floors, Bela Vista, São Paulo/ SP – ZIP: 01333-010 – Brazil - Tel.: (11) 2146-2000 SCN Q.02 – Bl. A – Ed. Corporate Financial Center, S.404/4º Floor, Brasília/DF – ZIP: 70712-900 – Brazil -Tel.: (61) 3327-2030/2031 www.cvm.gov.br

CVM RESOLUTION NO. 23, OF FEBRUARY 25, 2021
Provides for the registration and exercise of independent auditing activities within the securities market, defines the duties and responsibilities of the administrators of audited entities in their relationship with independent auditors.

THE PRESIDENT OF THE COMMISSION OF SECURITIES AND EXCHANGE COMMISSION – CVM makes public that the Board, in a meeting held on February 24, 2021, based on the provisions of arts. 1, item V, 8, item I, 22, sole paragraph, item IV and 26, §§ 1 and 2, of Law No. 6.385, of December 7, 1976, and having in view the provisions of art. 177, § 3, of Law No. 6.404, of December 15, 1976, APPROVED the following Resolution:

CHAPTER I – REGISTRATION, ITS CATEGORIES AND CONDITIONS

Art. 1. The independent auditor, to exercise activities within the securities market, is subject to registration with the Securities and Exchange Commission, regulated by this Resolution.

Art. 2. The registration of independent auditors comprises two categories:
I – Independent Auditor - Natural Person (AIPN), granted to the accountant who meets the requirements set forth in arts. 3 and 5 of this Resolution; and II – Independent Auditor – Legal Entity (AIPJ), granted to the professional society that meets the requirements set forth in arts. 4 and 6 of this Instruction.

§ 1. The Securities and Exchange Commission maintains, furthermore, a registry of technical managers authorized to issue and sign audit reports, on behalf of each society, within the securities market.

§ 2. For the purposes of this Resolution, technical managers comprise partners and other accountants who maintain a professional link of any nature with the audit society, who meet the requirements contained in this Resolution.

§ 3. The Independent Auditor – Legal Entity is co-responsible for compliance with this Resolution, regarding professional conduct, the exercise of activities, and the issuance of opinions and audit reports, by its technical managers.

Art. 3. For the purposes of registration in the category of Independent Auditor - Natural Person, the interested party must meet the following conditions:
I – be registered with the Regional Council of Accounting, in the category of accountant; II – have exercised accounting statements auditing activities, within the national territory, for a period of not less than five years, consecutive or not, counted from the date of registration with the Regional Council of Accounting, in the category of accountant, in accordance with art. 7; III – be exercising independent auditing activities, maintaining a professional office legalized in his own name, with facilities compatible with the exercise of the activity, in conditions that guarantee the custody, security, and confidentiality of documents and information resulting from this activity, as well as privacy in dealings with clients; IV – possess permanently updated knowledge about the business sector, the businesses, and the accounting and operational practices of its clients, as well as possess adequate operational structure for its number and size; and V – have passed the technical qualification exam provided for in art. 30.

Art. 4. For the purposes of registration in the category of Independent Auditor - Legal Entity, the interested party must meet the following conditions:
I – have its corporate object exclusively focused on the provision of professional auditing services and other services inherent to the accounting profession; II – that all partners are accountants and that, at least half of them, are registered as technical managers, as provided in §§ 1 and 2 of art. 2; III – be regularly registered, as well as its partners and other technical managers, with the Regional Council of Accounting; IV – have all technical managers authorized to issue and sign audit reports on behalf of the society, as provided in §§ 1 and 2 of art. 2, exercised accounting statements auditing activities, proven in accordance with art. 7; within the national territory for a period of not less than five years, consecutive or not, counted from the date of registration with the Regional Council of Accounting, in the category of accountant; V – have all technical managers approved in the technical qualification exam provided for in art. 30; VI – maintain a legalized professional office in the name of the society, with facilities compatible with the exercise of independent auditing activities, in conditions that guarantee the custody, security, and confidentiality of documents and information resulting from this activity, as well as privacy in dealings with clients; and VII – maintain a permanent technical staff adequate to the number and size of its clients, with constantly updated knowledge about their business sector, businesses, accounting, and operational practices.

CHAPTER II - INSTRUCTION OF THE REGISTRATION APPLICATION

Art. 5. The application for registration of Independent Auditor - Natural Person must be accompanied by the following documents:
I – request (Annex “A”);
II – copy of the professional identity card of the accountant, or equivalent certificate, issued by the Regional Council of Accounting; III – registration information (Annex “B”); IV – copy of the Location and Operation License, or equivalent competent document, issued by the City Hall of the Municipality where the applicant exercises the activity, which proves the legalization of the office in his own name; V – proof of the exercise of auditing activities, as provided in art. 7; VI – certificate of approval in the technical qualification exam, provided for in art. 30; and VII – Certificate of Regularity to prove compliance with the Continuing Professional Education Program by the accountant, from the year following his approval in the Technical Qualification Exam referred to in the previous item, in accordance with art. 34 of this Resolution and with the guidelines approved by the CFC.

Art. 6. The application for registration of Independent Auditor - Legal Entity must be accompanied by the following documents:
I – request, containing the information provided in Annex “C”; II – constituent acts in current and updated versions, duly registered in the competent registry in accordance with specific legislation and registered with the Regional Council of Accounting; III – list of addresses of the headquarters and offices, if applicable; IV – list of entities in which the society, its partners, and technical managers have participation in the share capital and who operate or provide services within the securities market, indicating their respective areas of activity; V – copy of the Location and Operation License or equivalent competent document, issued by the City Hall, of the headquarters and offices, if applicable, which proves their legalization; VI – copy of the National Legal Entity Registry of the Ministry of Finance of the headquarters and offices, if applicable; VII – copy of the Registration License issued by the Regional Council of Accounting of the headquarters and offices, if applicable; VIII – indication of up to two partners as representatives of the society before the CVM, who will be responsible for pursuing and forwarding the provision of clarifications related to the compliance with this Resolution and with the exercise of professional activities within the securities market; IX – copy of the professional identity card of the accountant, or equivalent certificate issued by the Regional Council of Accounting, of the partners and other technical managers; X – registration information of the partners and other technical managers (Annex “B”); XI – proof of the exercise of auditing activities by each of the technical managers, in accordance with art. 7; XII – certificate of approval in the technical qualification exam of each of the technical managers, provided for in art. 30; XIII – Certificate of Regularity to prove compliance with the Continuing Professional Education Program by the technical manager, from the year following his approval in the Technical Qualification Exam referred to in the previous item, in accordance with art. 34 of this Resolution and with the guidelines approved by the CFC; and XIV – accounting statements regarding:
a) the last social year closed, if the period provided by law for its preparation has already elapsed; or b) the penultimate social year closed, in other cases.

Art. 6-A. The application for registration of a technical manager of an Independent Auditor – Legal Entity, already registered with the CVM, must be accompanied by the following documents:
I – simple request, signed by the society's representative, indicating the name of the professional to be included in the registry; II – registration information of the technical manager (Annex “B”); III – copy of the professional identity card of the accountant, or equivalent certificate, issued by the Regional Council of Accounting; IV – proof of the exercise of auditing activities by the new technical manager, as provided in art. 7; V – certificate of approval in the technical qualification exam of each of the technical managers, provided for in art. 30; and VI – Certificate of Regularity to prove compliance with the Continuing Professional Education Program by the technical manager, from the year following his approval in the Technical Qualification Exam referred to in the previous item, in accordance with art. 34 of this Resolution and with the guidelines approved by the CFC.

CHAPTER III - PROOF OF AUDITING ACTIVITY

Art. 7. The exercise of auditing activities may be proven by presenting the following documents:
I – copies of audit opinions or reports accompanied by the audited accounting statements, issued and signed by the interested party, published in specialized newspapers or magazines or made available on the worldwide computer network, one publication being sufficient for each year; or II – copy of the individual employee registration or declaration of the audit society registered with the CVM, signed by its representative partner, and copy of the professional work booklet, observing the provisions of §§ 2 and 3 of this article.

§ 1. At the discretion of the CVM, the proof of experience in accounting statements auditing work may also be satisfied by presenting copies of audit opinions or reports and respective detailed reports, issued and signed by the interested party, accompanied by the respective accounting statements, authenticated by the audited entity, containing express authorization for such documents to be presented to the Securities and Exchange Commission, for the purpose of proving the auditing activity of the interested party, one proof being sufficient for each year.

§ 2. In the cases provided for in item II of this article, the exercise for a period of five years in a management, supervisory, or directorship position in the area of accounting statements auditing must be proven, from the date of registration in the category of accountant.

§ 3. The proof of compliance with the provisions of this article may be made in partial periods, consecutive or not, provided that the sum of the period of exercise of activities is not less than five years.

CHAPTER IV - EXAMINATION OF THE APPLICATION AND DEADLINE FOR GRANTING REGISTRATION AS AN AUDITOR OR REGISTRY AS A TECHNICAL MANAGER

Art. 8. The application for registration as an independent auditor, or for the registry of a technical manager of an Independent Auditor – Legal Entity, must be subject to examination by the Securities and Exchange Commission, which may require the completion of the initially presented documents, their updating, as well as the presentation of other documents, including audit working papers, that it deems necessary.

Art. 9. The deadline for granting registration is thirty days from the date of protocol entry of the application at the CVM.

§ 1. If the period elapses without any manifestation from the Commission, it is presumed that the registration application was approved, and the interested party may request the issuance of the respective Declaratory Act, except in cases where it is verified that the same is not properly instructed and documented.

§ 2. The thirty-day period must be suspended only once if the CVM requests additional information or documents necessary for the examination of the registration application, or conditions its approval to modifications in the relevant documentation.

§ 3. The CVM is assured, for final manifestation, a period corresponding to five business days, if the remainder of the period provided in § 2 is less than this.

Art. 10. The application for registration as an Independent Auditor – Legal Entity must be denied when it includes an accountant who, in accordance with arts. 15 and 35 of this Resolution, has had his registration cancelled or suspended by the Securities and Exchange Commission, while the penalty has not been fully served.

Sole paragraph. The application for registration as an Independent Auditor - Natural Person must also, under the same conditions, be denied.

Art. 11. Registration in the category of Independent Auditor - Natural Person is not permitted for an accountant who is a partner, director, or technical manager, or who has a professional link of any nature with an Independent Auditor - Legal Entity.

Sole paragraph: The participation of the same partner, or the assumption of technical responsibility by the same accountant, in more than one Independent Auditor – Legal Entity registered with the Securities and Exchange Commission is prohibited.

Art. 12. If the application is approved, the Securities and Exchange Commission must issue the competent Declaratory Act and publish it in the Official Gazette of the Union.

Sole paragraph. The Declaratory Act, published in the Official Gazette of the Union, constitutes proof of registration with the CVM, valid throughout the national territory.

Art. 13. If the application is denied, the Securities and Exchange Commission must notify the interested party by correspondence, with clarification of the reasons that caused the denial.

Art. 14. From the denying decision, a voluntary appeal may be filed with the Board of the Securities and Exchange Commission, in accordance with the current regulations.

CHAPTER V - CASES OF AUTOMATIC SUSPENSION AND CANCELLATION

Art. 15. The Independent Auditor - Natural Person, the Independent Auditor – Legal Entity, and their technical managers may have, respectively, their registration and registry suspended or cancelled, without prejudice to other legal sanctions applicable, in cases where:
I – the falsity of the documents or declarations presented to obtain registration with the Securities and Exchange Commission is proven; II – any of the conditions necessary for its granting or maintenance are not complied with, or a prohibiting situation is verified; III – they have suffered a penalty of suspension or cancellation of professional registration, with final judgment, applied by the profession's regulatory body; or IV – by final judicial decision:
a) declared insolvent; b) convicted in a criminal process of an infamating nature, or for a crime or misdemeanor of economic content; c) barred from holding public office; or d) declared incapable of exercising their civil rights. V - bankruptcy, liquidation, or dissolution is decreed.

§ 1. The CVM must previously notify the independent auditor of the decision to suspend or cancel his registration, in accordance with this article, granting him a period of ten business days, counted from the date of receipt of the notification, to present his reasons for defense or to regularize his registration.

§ 2. From the decision to suspend or cancel the registration, as provided in this article, a voluntary appeal, with suspensive effect, may be filed with the Board of this Commission, in accordance with the other current regulations.

CHAPTER VI - PERIODIC AND OCCASIONAL INFORMATION

Art. 16. The Independent Auditor - Natural Person and the Independent Auditor - Legal Entity must submit annually, by the last business day of April, through the worldwide computer network, the information requested in Annex “D”, relating to the previous year.

Art. 17. Without prejudice to the Securities and Exchange Commission's ability to request the updating of any documents and information at any time, independent auditors must, whenever there is a change, send to the CVM, within thirty days of the date of its occurrence:
a) changes to the corporate contract, duly registered in the competent registry in accordance with specific legislation and registered with the Regional Council of Accounting; b) copy of the professional identity card of the accountant or equivalent certificate of the new partners; and c) Registration Information (Annex “B”) of the new partners.

Art. 18. Independent auditors who do not present the information indicated in arts. 16, 17, and in §§ 1 and 2 of art. 28, within the deadlines specified in this Resolution, are subject to the daily fine provided for in the specific norm dealing with coercive fines.

Sole paragraph. The value of the coercive fine referred to in the caput will be reduced by half when the independent auditor does not have clients within the securities market.

CHAPTER VII - NORMS RELATING TO THE EXERCISE OF AUDITING ACTIVITIES IN THE SECURITIES MARKET

Art. 19. The independent auditor, in the exercise of his activities within the securities market, must comply with and enforce, by his employees and agents, the specific norms issued by the Securities and Exchange Commission.

Art. 20. The Independent Auditor - Natural Person and the Independent Auditor - Legal Entity, all its partners, and members of the technical staff must also observe the norms issued by the Federal Council of Accounting - CFC and the technical pronouncements of the Brazilian Institute of Accountants - IBRACON, regarding professional conduct, the exercise of activities, and the issuance of opinions and audit reports.

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5º and 23-34º Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2º, 3º and 4º Floors, Bela Vista, São Paulo/ SP – CEP: 01333-010 – Brazil - Tel.: (11) 2146-2000 SCN Q.02 – Bl. A – Ed. Corporate Financial Center, S.404/4º Floor, Brasília/DF – CEP: 70712-900 – Brazil -Tel.: (61) 3327-2030/2031 www.cvm.gov.br CVM RESOLUTION NO. 23, OF FEBRUARY 25, 2021

Art. 21. Audit reports and documents intended to satisfy the requirements of the Securities and Exchange Commission must be issued and signed, indicating only the professional category and the registration number with the Regional Council of Accounting, when a Natural Person, or with the indication of the professional category, the registration number and the registration with the Regional Council of Accounting, respectively, of the technical manager and the company, when a Legal Entity.

CHAPTER VIII - SCENARIOS OF IMPEDIMENT AND INCOMPATIBILITY

Art. 22. Independent Auditors – Natural Persons, partners, and other members of the technical staff of Independent Auditors – Legal Entities may not perform independent audits when their performance in the audited entity, its subsidiaries, holding companies, or members of the same economic group involves infringement of the norms of the Federal Council of Accounting - CFC regarding independence.

Art. 23. It is prohibited for the Independent Auditor and for natural and legal persons linked to it, as defined in the CFC independence norms, in relation to entities whose accounting audit service is under their charge:
I – acquire or maintain securities issued by the entity, its subsidiaries, holding companies, or members of the same economic group; or II – provide consulting services that may characterize the loss of objectivity and independence. Sole paragraph. Examples of consulting services provided for in the caput of this article are:
I – advisory on organizational restructuring;
II – business valuation;
III – asset revaluation;
IV – determination of values for the establishment of provisions or technical reserves and provisions for contingencies; V – tax planning; VI – remodeling of accounting, information, and internal control systems; or VII – any other product or service that influences or may influence decisions taken by the administration of the audited institution.

Art. 24. The independent auditor must resign from the function in the event of the situations provided for in Article 22.
Sole paragraph. Upon finding non-compliance with the provisions of this article, the Securities and Exchange Commission may determine the substitution of the independent auditor.

CHAPTER IX - DUTIES AND RESPONSIBILITIES OF INDEPENDENT AUDITORS

Art. 25. In the exercise of their activities within the securities market, the independent auditor must, additionally:
I – verify:
a) whether the financial statements and the audit report were disclosed in the media where their publication is mandatory and whether these correspond to the audited financial statements and the originally issued report; b) whether the accounting and financial information and analyses presented in the entity's management report are consistent with the audited financial statements; c) whether the allocation of the entity's results complies with corporate law provisions, its bylaws, and the norms issued by the CVM; and d) any non-compliance with applicable legal and regulatory provisions regarding the activities of the audited entity and/or regarding its status as an entity integrated into the securities market, which have, or may have, relevant effects on the audited entity's financial statements or operations. II – prepare and send to the administration and the Fiscal Council, a detailed report containing their observations regarding the internal controls and accounting procedures of the audited entity, also describing any deficiencies or inefficiencies identified during the work; III – keep in good custody for a minimum period of five years, or for a longer period determined by this Commission in the case of an Administrative Inquiry, all documentation, correspondence, working papers, reports, and opinions related to the exercise of their functions; IV – clearly indicate, and to what extent, the accounts or subgroups of assets, liabilities, results, and equity affected by the adoption of accounting procedures conflicting with the Fundamental Accounting Principles, as well as the effects on mandatory dividends and earnings or loss per share, as applicable, whenever issuing a review report of interim information or an adverse or qualified audit report; V – provide access to CVM inspection and provide or allow reproduction of the documents referred to in item III, which served as the basis for issuing the review report of interim information or audit report; and VI – enable, in the case of substitution by another auditor, safeguarding confidentiality aspects and with prior consent of the audited entity, access by the new contracted auditor to the documents and information that served as the basis for issuing the review reports of interim information or audit reports of previous fiscal years. VII – ensure that all partners, directors, managers, supervisors, or any other members with management functions in the team designated to exercise the audit activity in entities regulated by the CVM, have passed the Specific Technical Qualification Examination for the CVM. VIII – communicate the main audit matters in the audit reports of financial statements of all entities regulated or supervised by the CVM, in accordance with the independent audit professional norms approved by the Federal Council of Accounting - CFC. IX – in cases of using the prerogative provided for in the caput of Article 31-A, evaluate and document in their working papers compliance
with the installation, composition, and functioning requirements provided for in Articles 31-A, 31-B, and 31-C, as well as, after that evaluation, to document the resignation from audit work when they conclude there are non-conformities with normative requirements. Sole paragraph. Upon finding any relevant irregularity regarding what is established in items I and II, the independent auditor must communicate the fact to the CVM, in writing, within a maximum period of twenty days, counted from the date of its occurrence.

CHAPTER X - DUTIES AND RESPONSIBILITIES OF ADMINISTRATORS AND THE FISCAL COUNCIL

Art. 26. The entity, when contracting independent audit services, must provide the auditor with all elements and conditions necessary for the perfect performance of their functions.
§ 1º The audited entity must provide the independent auditor with the management responsibility letter, in accordance with the norms approved by the Federal Council of Accounting - CFC.

§ 2º The responsibility of the administrators of the audited entities for the information contained in the financial statements, or in the declarations provided, does not eliminate the responsibility of the independent auditor regarding their review report of interim information or audit report, nor does it exempt them from adopting the audit procedures required under the circumstances.

Art. 27. The administrators of the audited entities must be held responsible for hiring independent auditors who do not meet the conditions provided for in this Resolution, especially regarding their independence and the regularity of their registration with the Securities and Exchange Commission. Sole paragraph. Without prejudice to applicable legal sanctions, upon finding the lack of independence of the auditor or the absence of registration with this CVM, the audit work is considered void for compliance with the law and the norms of the Commission.

Art. 28. The administration of the audited entity must, within twenty days, notify the CVM of the change of auditor, with or without rescission of the audit service contract, with justification for the change, which must include the consent of the replaced auditor. § 1º If the period elapses without any manifestation by the administration of the audited entity regarding the required information, the independent auditor must notify the CVM of the substitution, within ten days, counted from the date of the expiration of the period granted to the administration of the entity. § 2º The independent auditor who does not agree with the justification presented for their substitution must send the reasons for their disagreement to the CVM, within thirty days, counted from the date of the substitution. § 3º Non-compliance with the provisions of this article subjects the entity and the independent auditor to a daily coercive fine, in accordance with Article 18 of this Resolution.

Art. 29. The fiscal council of the audited entity, when functioning, must verify the correct compliance by the administrators with the provisions of Articles 27 and 28.

CHAPTER XI - TECHNICAL QUALIFICATION EXAMINATION

Art. 30. The technical qualification examination must be performed, at least once every year, with a view to qualifying the independent auditor to exercise the activity of auditing financial statements for all entities integrated into the securities market.

Sole paragraph. The technical qualification examination must be applied by the Federal Council of Accounting - CFC jointly with the Brazilian Institute of Accountants - IBRACON or by an institution indicated by the CVM, in the manner to be defined in a specific act.

CHAPTER XII - AUDITOR ROTATION

Art. 31. The Independent Auditor – Natural Person and the Independent Auditor – Legal Entity may not provide services to the same client for a period exceeding five consecutive fiscal years, requiring a minimum interval of three fiscal years for their re-hiring.

Art. 31-A The period established in Article 31 of this Resolution is up to 10 (ten) consecutive fiscal years if:
I – the audited company has a Statutory Audit Committee - SAC functioning permanently; and II – the auditor is a legal entity.
§ 1º To use the prerogative provided for in the caput, the SAC must be installed and fully functioning by the date of closure of the third fiscal year following the hiring of the independent auditor, and remain functioning after that date and while using the aforementioned prerogative. § 2º Having adopted the prerogative provided for in the caput, the independent auditor must rotate the technical manager, director, manager, and any other member of the audit team with management functions, in a period not exceeding 5 (five) consecutive fiscal years, with a minimum interval of 3 (three) fiscal years for their return.

Art. 31-B. The SAC must:
I – be provided for in the company's bylaws;
II – be an advisory body directly linked to the board of directors; III – meet whenever necessary, but at least bimonthly, so that accounting information is always reviewed before its disclosure; IV – have its own internal regulations, approved by the board of directors, which detail its functions, as well as its operational procedures; V – have a coordinator, whose activities must be defined in the internal regulations;

VI – have means to receive complaints, including confidential ones, internal and external to the company, on matters related to the scope of its activities; and VII – have operational autonomy and annual or project-based budget allocation, within limits approved by the board of directors, to conduct or determine the realization of consultations, evaluations, and investigations within the scope of its activities, including the hiring and use of independent external specialists.

§ 1º The meetings of the SAC must be recorded in minutes.

§ 2º The coordinator of the SAC, accompanied by other SAC members when necessary or convenient, must:
I – meet with the board of directors, at least quarterly; and II – attend the company's ordinary general assembly.

Art. 31-C. The SAC must be composed of, at least, 3 (three) members, indicated by the board of directors, who will hold their positions for, at most, 10 (ten) years, being:
I – at least, 1 (one) member of the company's board of directors, who does not participate in the management; and II – a majority of independent members.

§ 1º The participation of company directors, its subsidiaries, holding company, affiliates, or jointly controlled companies, directly or indirectly, in the SAC is prohibited.

§ 2º To fulfill the independence requirement of item II of the caput, the SAC member:
I – cannot be, or have been, in the last 5 (five) years:
a) director or employee of the company, its holding company, subsidiary, affiliate, or jointly controlled company, directly or indirectly; or b) partner, technical manager, or team member of the Independent Auditor – Legal Entity; and II – cannot be a spouse, relative in the direct or collateral line, up to the third degree, and by affinity, up to the second degree, of the persons referred to in item I.

§ 3º The members of the SAC must meet the requirements provided for in Article 147 of Law No. 6.404, of December 15, 1976.

§ 4º Having served a mandate for any period, the members of the SAC may only return to integrate such body, in the same company, after at least 3 (three) years have elapsed from the end of the mandate.

§ 5º At least 1 (one) of the SAC members must have recognized experience in corporate accounting matters.

§ 6º To fulfill the recognized experience requirement in corporate accounting matters, provided for in § 5º of the caput, the SAC member must possess:
I – knowledge of generally accepted accounting principles and financial statements; II – ability to evaluate the application of these principles regarding the main accounting estimates; III – experience preparing, auditing, analyzing, or evaluating financial statements that have a level of scope and complexity comparable to that of the company; IV – educational training compatible with the corporate accounting knowledge necessary for the SAC's activities; and V – knowledge of internal controls and corporate accounting procedures.

§ 7º Compliance with the requirements provided for in § 6º of the caput must be proven by means of documentation kept at the company's headquarters, available to the CVM, for a period of 5 (five) years counted from the last day of the SAC member's mandate.

§ 8º The members of the SAC must maintain an impartial and skeptical posture in the performance of their activities and, above all, regarding the estimates present in the financial statements and the management of the company.

§ 9º The substitution of a SAC member must be communicated to the CVM within 10 days counted from their substitution.

Art. 31-D. It is the responsibility of the SAC to:
I – advise on the hiring and dismissal of the independent auditor for the preparation of independent external audit or for any other service; II – supervise the activities:
a) of the independent auditors, in order to evaluate:

their independence;
the quality of services provided; and
the adequacy of services provided to the company's needs;
b) of the company's internal controls area; c) of the company's internal audit area; and d) of the company's financial statement preparation area; III – monitor the quality and integrity:
a) of internal control mechanisms; b) of quarterly information, interim statements, and financial statements of the company; and c) of information and measurements disclosed based on adjusted accounting data and non-accounting data that add elements not provided for in the structure of usual financial reports; IV – evaluate and monitor the company's risk exposures, possibly requesting detailed information on policies and procedures related to:
a) management remuneration; b) the use of company assets; and c) expenses incurred on behalf of the company; V – evaluate and monitor, together with the administration and the internal audit area, the adequacy of related-party transactions carried out by the company and their respective disclosures; and VI – prepare an annual summary report, to be presented together with the financial statements, containing the description of:
a) its activities, results, conclusions reached, and recommendations made; and b) any situations in which there is a significant divergence between the company's administration, the independent auditors, and the SAC regarding the company's financial statements.

Art. 31-E. The company must keep at its headquarters and available to the CVM, for a period of 5 (five) years, a detailed annual report prepared by the SAC, containing the description of:
a) its activities, results, conclusions reached, and recommendations made; and b) any situations in which there is a significant divergence between the company's administration, the independent auditors, and the SAC regarding the company's financial statements.

Art. 31-F. Independent auditors must meet the demands of the SAC in all matters within its competence.

CHAPTER XIII - INTERNAL QUALITY CONTROL

Art. 32. The independent auditor must implement an internal quality control program, according to the guidelines emanating from the Federal Council of Accounting – CFC and the Brazilian Institute of Accountants - IBRACON, which aims to ensure full compliance with the norms governing the activity of auditing financial statements and the norms issued by this Securities and Exchange Commission.

§ 1º The internal quality control program must be established according to the structure of its technical team and the complexity of the services under its charge, in the case of Independent Auditor - Legal Entity, and regarding technical-professional competence, in the case of Independent Auditor - Natural Person.

§ 2º The internal quality control program may be developed jointly with other independent auditors or in partnership with a specialized institution, and the Independent Auditor - Legal Entity must indicate a responsible partner for the implementation and conduct of this program.

§ 3º The internal quality control program must be required after twelve months of the publication of the norms and guidelines approved by the Federal Council of Accounting – CFC that regulate this matter.

CHAPTER XIV - EXTERNAL QUALITY CONTROL

Art. 33. Independent auditors must, every four-year cycle, submit to a review of their quality control, according to the guidelines emanating from the Federal Council of Accounting - CFC, which must be performed by another independent auditor, also registered with the Securities and Exchange Commission.

COMISSÃO DE VALORES MOBILIÁRIOS
Rua Sete de Setembro, 111/2-5º e 23-34º Andares, Centro, Rio de Janeiro/RJ – CEP: 20050-901 – Brasil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2º, 3º e 4º Andares, Bela Vista, São Paulo/ SP – CEP: 01333-010 – Brasil - Tel.: (11) 2146-2000 SCN Q.02 – Bl. A – Ed. Corporate Financial Center, S.404/4º Andar, Brasília/DF – CEP: 70712-900 – Brasil -Tel.: (61) 3327-2030/2031 www.cvm.gov.br RESOLUÇÃO CVM Nº 23, DE 25 DE FEVEREIRO DE 2021

§ 1º In the case of an Independent Auditor - Legal Entity, the quality control review must be carried out by an audit firm that has a structure compatible with the work to be developed.

§ 2º The reviewing auditor must issue a quality control review report to be sent to the independent auditor and to the Federal Council of Accounting – CFC, within the timeframes defined by him.

§ 3º The independent auditor responsible for the quality control review must also observe, with respect to the reviewed auditor, the independence standards approved by the Federal Council of Accounting - CFC.

§ 4º Non-compliance with the provisions of the caput in at least 2 (two) of the last 5 (five) years results in the immediate suspension of the registration of the Independent Auditor – Natural Person, or the Independent Auditor – Legal Entity, until a new review of its quality control is presented, according to the guidelines of the Federal Council of Accounting, with a report issued without reservations, duly approved by the Management Committee of the External Quality Review Program, or equivalent, established by the Federal Council of Accounting – CFC.

CHAPTER XV - CONTINUING EDUCATION PROGRAM

Art. 34. Independent auditors must maintain a continuing education policy for themselves, in the case of a Natural Person, and for all their partners and staff, if a legal entity, as the case may be, according to the guidelines approved by the Federal Council of Accounting - CFC, with a view to ensuring quality and full compliance with the standards governing the exercise of the activity of auditing financial statements.

§ 1º The provisions of the caput apply to Independent Auditors – Natural Persons and to partners, whether or not they exercise the auditing activity, technical managers, directors, supervisors and managers of Independent Auditors - Legal Entities.

§ 2º Non-compliance with the provisions of the caput in at least 2 (two) of the last 5 (five) years results in the immediate suspension of the registration of the Independent Auditor – Natural Person, or the registration as a technical manager of an Independent Auditor – Legal Entity, until a new certificate of approval in the Technical Qualification Examination, provided for in art. 30 of this Resolution, is presented, regardless of the adoption of other applicable administrative measures.

CHAPTER XVI - PENALTIES

Art. 35. The Independent Auditor – Natural Person, the Independent Auditor – Legal Entity and their technical managers may be warned, fined, or have their registration with the Securities and Exchange Commission suspended or cancelled, without prejudice to other legal sanctions applicable, when:

I – act in disagreement with the legal and regulatory standards that govern the securities market, including non-compliance with the provisions of this Resolution;

II – perform an inept or fraudulent audit, falsify data or numbers, or withhold information that they are obliged to reveal; or

III – use, for their own benefit or that of third parties, or allow third parties to use information to which they have had access as a result of the exercise of the auditing activity.

Art. 36. Non-compliance with the provisions contained in this Resolution subjects its offenders to the penalties provided for in art. 11 of Law No. 6.385/76.

Art. 37. It constitutes a serious offense, for the purposes of the provisions of § 3º of art. 11 of Law No. 6.385/76, the non-compliance with the provisions of arts. 20, 22, 23, 25, 31, 32, 33 and items II and III of art. 35 of this Resolution.

Art. 38. The Securities and Exchange Commission must give notice, in a publication in the Official Gazette of the Union, of the cancellation or suspension of the registration of an independent auditor and communicate the occurrence to the Federal Council of Accounting, by electronic message or availability on its page on the worldwide computer network, in cases of application of the penalties provided for in this Resolution.

Sole Paragraph. In the case of cancellation, the documents and declarations presented for obtaining and maintaining the registration remain available to the interested party, for a period of sixty days, after which they may be destroyed.

Art. 39. The Securities and Exchange Commission must keep updated and available to the market, the list of independent auditors who have been penalized in an administrative inquiry.

CHAPTER XVII – FINAL PROVISIONS

Art. 40. The following Instructions are revoked:

I – 308, of May 14, 1999;

II – 591, of October 26, 2017; and

III – 611, of August 15, 2019.

Art. 41. This Resolution enters into force on April 1, 2021.

Electronically signed by
MARCELO BARBOSA
President

ANNEX “A” TO CVM RESOLUTION NO. 23, OF FEBRUARY 25, 2021
Application for registration of Independent Auditor - Natural Person, as provided for in art.
5º, item I

TO
THE SECURITIES AND EXCHANGE COMMISSION
Rio de Janeiro - RJ

(Full name) requests the registration of “Independent Auditor - Natural Person”, for which it attaches:

1 - copy of the professional identity card of the accountant, or equivalent certificate, issued by the Regional Council of Accounting, indicating the date of homologation of the registration in the category of accountant;

2 - cadastral information (Annex “B”);

3 - copy of the License for Location and Operation, or equivalent competent document, issued by the City Hall;

4 - copy of the certificate of approval in the technical qualification exam;

5 - documents to prove the exercise of the auditing activity, in accordance with art. 7º; and

6 - proof of having left the auditor staff of “Independent Auditor - Legal Entity” (if applicable, as per art. 11).

Place and date
Full name and signature
CRC - no.

ANNEX “B” TO CVM RESOLUTION NO. 23, OF FEBRUARY 25, 2021
Cadastral Information, as per art. 5º, item III

1 - Full name:

2 - Personal address:
(indicate the street, number, complement, neighborhood, city, state, ZIP code, phone, email, etc.).

3 - Nationality, place and date of birth:

4 - Parentage:

5 - Marital status: (if married, indicate the name of the spouse and the marital regime).

6 - Identity document: (indicate registration number, date of issue and issuing body).

7 - Professional identity document:
(indicate registration number, date of issue and Regional Council of Accounting issuing).

8 - Number of registration in the Individual Taxpayer Registry of the Ministry of Finance:

9 - Name of the “Independent Auditor - Legal Entity” registered with the Securities and Exchange Commission, of which he is a partner, director or employee (when applicable):
(indicate the name or corporate name in the assumption of obtaining the registration).

10 - Professional address:
(indicate the street, number, complement, neighborhood, city, state, ZIP code, phone, email, etc.).

11 - Participation as a partner or shareholder of entities, including the spouse and dependents:
(list, separately, the participation of the own and dependents, indicating the name/corporate name, the number of shares or quotas held and the percentage of participation or inform that there is nothing to declare).

12 - Complementary information, at the discretion of the applicant:

Place and date
Full name and signature
CRC - no.

ANNEX “C” TO CVM RESOLUTION NO. 23, OF FEBRUARY 25, 2021
Application for registration of Independent Auditor - Legal Entity, as per art. 6º, item I

Of the Society:
a) constitutive act equivalent and subsequent amendments registered in the competent registry in accordance with specific legislation and the Regional Council of Accounting; b) address of the headquarters and each of the branches and/or offices, if applicable (indicate the street, number, complement and neighborhood, ZIP code, city, state, phone, email, etc); c) list of entities that operate or provide services within the scope of the securities market, indicating their respective areas of activity, in which the society, its partners and technical managers have participation in the social capital; d) proof of registration in the National Registry of Legal Entities of the Ministry of Finance, of the headquarters and each of the branches and/or offices (if applicable); e) license for Location and Operation or equivalent competent document, issued by the City Hall of the headquarters and each of the branches and/or offices (if applicable); f) license issued by the Regional Council of Accounting, of the headquarters and each of the branches and/or offices (if applicable); and g) list of partners and other accountants who are part of the staff of technical managers, authorized to issue and sign audit reports on behalf of the society within the scope of the securities market.
Of the partners and technical managers:
a) Cadastral Information (Annex B); b) professional identity card of the accountant, or equivalent certificate issued by the Regional Council of Accounting indicating the date on which the registration was granted; c) certificate of approval in the technical qualification exam (specific test for acting in entities regulated by the CVM), of the technical managers; d) documents to prove the exercise of the auditing activity of the technical managers authorized to issue and sign audit reports on behalf of the society within the scope of the securities market; and

e) Proof of technical responsibility link, in the case of professionals who are not partners.

ANNEX “D” TO CVM RESOLUTION NO. 23, OF FEBRUARY 25, 2021
Annual Report, as per art. 16

Identification of the Independent Auditor:
1.a) full name (if a natural person) or; name or corporate name (if a legal entity) 1.b) address(es) (the legal entity must indicate the address of the headquarters and all branches and/or offices) 1.c) name of the representative partner(s) before the CVM (legal entity);
Nominal list of entities for which it provides auditing services, subdivided into:
2.a) Open Companies:
Open Companies (a) Date (b) +10% (c)
(a) list in alphabetical order, regardless of the line of activity, all companies registered with the CVM, with shares traded on a stock exchange or over-the-counter market.
(b) in the case of the first audit, indicate the date of the contract.
(c) indicate the percentage of participation in relation to total revenue when it is greater than 10%.

2.b) Members of the Securities Market:
Members of the MVM (d) Date (e) +10% (f)
(d) list the institutions, societies or entities that make up the securities market, namely: Stock Exchange, Securities Brokers, Securities Distributors, Foreign Capital Conversion Funds, Mutual Equity Funds, Foreign Investment Funds, Providers of Fungible Custody Services, Foreign Capital Investment Societies, Providers of Certificate Issuance Services, Providers of Portfolio Administration Services, Privatization Funds, Real Estate Funds, Emerging Companies Funds, Companies Issuing Investment Certificates in the Audiovisual Area.

(e) in the case of the first audit, indicate the date of the contract.
(f) indicate the percentage of participation in relation to total revenue when it is greater than 10%.

2.c) Incentivized Companies:
Incentivized Companies (g) Date (h) +10% (i)
(g) list the companies benefiting from tax incentives, provided for in Law No. 8.167/91, as provided for in Decree-Law No. 2.298/86.

(h) in the case of the first audit, indicate the date of the contract.
(i) indicate the percentage of participation in relation to total revenue when it is greater than 10%.

Number of entities not covered by the previous items:
(indicate the number of entities audited during the previous fiscal year, which do not fit into the previous items)
Annual revenue value and hours worked in auditing services, as discriminated;
Revenue in Auditing Services: R$
Percentage of revenue in auditing in relation to total revenue: % Total hours worked in auditing in the exercise:

4-A) financial statements (if a legal entity);

Criteria adopted in determining professional fees:
(describe briefly the criteria used to establish the charging of fees for services rendered)
Number of partners and permanent employees in the technical area:

Number of partners:
Total number of employees in the technical area:

List of entities in which the society, its partners and technical managers have participation in the social capital and that operate or provide services within the scope of the securities market, indicating their respective areas of activity or changes occurred during the period:
Entities (name or corporate name) Line of activity

IMPORTANT OBSERVATIONS REGARDING THE PRESENTATION OF ANNUAL INFORMATION:
All items must be answered. If there is no information to be presented in any item, the expression “NOT APPLICABLE” must be indicated.
The deadline for presenting this information is until the last business day of April.
The document must be signed by the Independent Auditor - Natural Person or by the partner representing the Independent Auditor - Legal Entity before the CVM.

CVM Resolution No. 23 of February 25, 2021

Lineage: In force