Explanatory Note to CVM Instruction 308

Ref.: CVM Instruction No. 308, of May 14, 1999, which provides for the registration and exercise of the independent auditing activity within the securities market, defines the duties and responsibilities of the administrators of audited entities in their relationship with independent auditors, and revokes CVM Instructions No. 216, of June 29, 1994, and No. 275, of March 12, 1998.

1. INTRODUCTION

Law No. 6.385, of December 7, 1976, which regulates the securities market and created the Securities and Exchange Commission (Comissão de Valores Mobiliários - CVM), determines in Article 26 that only accounting audit firms or independent accounting auditors registered with the Securities and Exchange Commission may audit the financial statements of open companies and institutions, societies, or companies that are part of the distribution and intermediation system of securities.

Exercising the competence conferred upon it by law, the Securities and Exchange Commission initially issued, on October 24, 1978, CVM Instruction No. 04, establishing the first rules for the registration of independent auditors and defining the conditions under which refusal, suspension, or cancellation could be warranted.

It is important to note that, twenty years later and having undergone various normative changes, the fundamentals that guided the CVM's initial position remain valid and up-to-date. They are:

• the importance of an independent audit system as an indispensable support for the regulatory body;
• the figure of the independent auditor as an essential element for market credibility and as an instrument of inestimable value in investor protection, insofar as its function is to ensure the fidelity and reliability of the audited entity's financial statements;
• the accuracy and clarity of the financial statements, including disclosure in explanatory notes of information essential to viewing the entity's asset and financial situation and results, depend on an effective audit system and, fundamentally, on the auditor's awareness of their true role within this context; and
• the need for the market to have highly qualified independent auditors who, at the same time, enjoy a high degree of independence in the exercise of their activity.

The reformulation now implemented became imperative in light of recent facts, widely publicized, which led society in general to question the ability of independent auditors to meet the aforementioned fundamentals, casting doubt on the validity of the mandatory audit system. Considering that market confidence regarding the competence and independence of independent auditors is a fundamental requirement to be maintained, the CVM understood that it should revise its rules and institute new mechanisms aimed at maintaining those attributes.

Just like the preceding CVM Instructions No. 204/93 and 216/94, this Instruction, in addition to consolidating in a single normative text the regulation of the exercise of the auditing activity within the securities market, aims to introduce new mechanisms into this regulation, such as the technical qualification exam, the continuing education program, and internal and external quality controls, as well as to exemplify activities that characterize a conflict of interest when performed concurrently with the provision of independent auditing services for the same client.

In summary, with the reformulation, the CVM aims to equip this market with auditors who possess high technical qualification and, at the same time, the attributes of competence, ethics, and independence required of these professionals.

To achieve this objective, the CVM hopes to continue counting on the support and assistance provided by the regulatory bodies of the profession and by representative class institutions, also aiming to develop a self-regulation model, in which professional bodies would be primarily responsible for monitoring the independent auditing activity. It would be up to the CVM to verify the efficiency of the model, intervening in the process only in cases where the self-regulation system is not functioning satisfactorily.

2. REGISTRATION AS AN INDEPENDENT AUDITOR (Articles 1 to 6)

It should be clarified initially that registration with the CVM does not constitute a new professional category, nor does it mean restriction of the professional activity. On the contrary, the activity of independent auditing is a prerogative of the accountant legally qualified and registered with the Regional Council of Accounting (Conselho Regional de Contabilidade - CRC). This activity can be exercised individually or in a civil partnership, whose partners are all accountants, consequently, there are no incompatibilities between these rules and the disciplinary regime of the accountant professional category.

The new Instruction maintains the two existing forms of registration, namely: Independent Auditor – Natural Person, granted to the legally qualified accountant who meets the requirements established in Articles 3, 5, and 7, and Independent Auditor – Legal Entity, granted to the partnership integrated exclusively by accountants and registered with the Regional Council of Accounting, who meets the requirements established in Articles 4, 6, and 7. For a partner or any other person who has an employment link with the audit firm to issue and sign opinions and reports on behalf of the firm, it is mandatory to be registered as the technical manager with the Securities and Exchange Commission.

The rule maintains the requirement that at least half of the partners of the audit firm be registered as technical managers with the Securities and Exchange Commission to exercise the auditing activity within the securities market on behalf of the firm. If, after obtaining the firm's registration, there is a change in the partnership, whether by exclusion or admission of partners, it is imperative that this relationship be maintained, so that the registration is not suspended or even cancelled until the situation is normalized.

Among the other conditions for obtaining registration, it is fundamental to prove the exercise of the auditing activity for a minimum period of five years, consecutive or not. It should be clarified that this period is counted from the date of the interested party's registration with the Regional Council of Accounting (CRC), in the accountant category. The exercise of auditing activity prior to their registration with the CRC constitutes a violation of professional rules.

The interested party must present a copy of their accountant identity card, in the accountant category, or, at their option, a registration certificate issued by the Regional Council of Accounting. Regarding this, it is recommended that the interested party verify if their professional identity card contains the date of effective registration with the Regional Council of Accounting. Otherwise, it becomes necessary to send, in addition to the copy of the accountant's professional identity card, a certificate issued by the Regional Council of Accounting, which must necessarily contain the date of effective registration as an accountant.

Regarding proof of a legal office in one's own name, the License for Location and Operation (Alvará de Licença para Localização e Funcionamento) or an equivalent competent document issued by the City Hall of the municipality where the professional exercises their activity must be sent. In the case of registration as an Independent Auditor – Natural Person (AIPF), a document issued in the name of a partnership of which the interested party is a member will not be accepted.

The Instruction establishes that the audit firm must have the form of a "civil partnership," with a partnership agreement or equivalent constitutive act, duly registered with the Civil Registry of Legal Entities. Therefore, the partnership, in addition to what is established in the partnership agreement, must be subject to the provisions of the Civil Code applicable to them, especially Chapter XI of said code. Consequently, registration requests for partnerships that do not constitute themselves in this form and for those whose partnership agreements contain clauses conflicting or incompatible with the type of civil partnership required will be refused.

In the same vein, the request for partnerships that, although constituted in the form of a civil partnership, have expressions in their partnership agreement such as "limited," "by quotas of limited liability," "the partners' liability is limited to the amount of social capital," or that are subject to laws or decrees relevant to other types of partnerships, such as partnerships by quotas of limited liability, will be refused. When reformulating their partnership agreement, adapting it to registration rules, it is advisable to consolidate all clauses in force, avoiding the presentation of previous amendments.

3. PROOF OF AUDITING ACTIVITY (Article 7)

To obtain registration as an Independent Auditor – Natural Person, the interested party must prove having exercised the activity for five years, consecutive or not, from the date of their effective registration in the accountant category.

This proof must be met in the following manner:

a) by presenting auditing opinions issued and signed by the interested party published in a newspaper or specialized magazine, one publication being sufficient for each year. The published opinions, to be accepted, must be in accordance with the rules of the Federal Council of Accounting (Conselho Federal de Contabilidade - CFC). The publication must include, in addition to the auditing opinion, the set of financial statements and their respective explanatory notes. In these cases, it is important that the name of the newspaper or magazine and the date of publication are not omitted;

b) by proving that the interested party exercised the auditing activity as an employee of an audit firm registered with the CVM. This proof will be counted from the date of registration in the accountant category, whether this registration is provisional or definitive. In cases of registration requests as an Independent Auditor – Natural Person, the interested party must also prove that they are no longer part of the employee roster of the audit firm, in compliance with Article 14 of the Instruction.

To meet this requirement, the following must be presented: i) a copy of the employee registration of the audit firm where they worked, and ii) a copy of the interested party's work booklet, comprising the pages containing: the booklet number and series; the holder's qualification; the employment contract; and annotations regarding changes in salaries, vacations, positions, or functions performed (blank pages are dispensed with). A declaration signed by a partner representative of the employing audit firm will also be admitted in place of the employee registration copy, which must necessarily contain the dates of admission and departure from employment (if applicable) and the dates when changes in positions or functions performed occurred.

Proof that the interested party has exercised their auditing activity in a government entity, open company, or large company must be met in the manner described above.

An important fact to consider is that, in both situations mentioned above, the interested party must also prove having exercised, for at least two years, a position of direction, management, or supervision in the auditing of financial statements, under penalty of denial of the registration request or inclusion as technical manager of an Independent Auditor – Legal Entity.

The CVM may, at its exclusive discretion, accept that the proof of auditing activity be made by presenting work performed that has not been published. In this case, the interested party must present as proof of each work performed the auditing opinion, the corresponding detailed report, and the respective audited financial statements. Aiming to protect professional secrecy and guarantee authenticity, it is indispensable that these documents be authenticated by the audited entity, and must also contain authorization for them to be presented to the CVM for the exclusive purpose of proving the interested party's auditing activity. It is important to note that this proof will also be subject to an evaluation of the quality of the work performed and may also include the availability of the respective working papers for CVM inspection.

As guidance, we clarify that the detailed report must contain, at minimum, the following information: the name or denomination of the audited entity; the period covered by the examination; description of deficiencies and inefficacy of internal controls and accounting procedures adopted by the audited entity followed by recommendations for required corrections; and the date of issuance, identification, and signature of the responsible auditor.

4. APPROVAL OF REGISTRATION REQUEST (Articles 8 to 14)

The CVM commits to analyzing and granting the registration within thirty days, this period may be suspended only once, if additional information is requested or the completion or modification of the originally presented documents, with the CVM being assured five business days, after the requests are met, for final manifestation, if the remaining period is less than this.

If the registration request is properly documented and if the absence of manifestation by the CVM until the end of the established period is confirmed, it is presumed that the request is automatically approved, and the interested party may request the issuance of the competent Declaratory Act of registration.

5. PERIODIC INFORMATION (Article 16)

Independent auditors must send to the CVM, by the end of April of each year, some information related to their performance in the securities market, such as: list of their clients; total billing in auditing services and percentage relative to total billing; number of hours worked; list of associated companies; number of partners and employees in the technical area; and continuing education policy. This information is important support for the CVM to evaluate the auditors' ability to adequately serve their clients and also allows for a global knowledge of this activity in the capital market.

The late submission of this information, as well as the lack of updating of documents and information presented for registration purposes, subject auditors to penalty fines of R$ 50.00 or R$ 100.00 per day of delay, with these values being reduced by half when the auditor does not have clients within the scope of the securities market.

6. SCENARIOS OF IMPEDIMENT (Articles 22 and 23)

The CVM understands that independence is perhaps the greatest factor, if not the only one, that differentiates the accounting professional who works within the company from that who provides independent auditing services. Technical competence, responsibility, integrity, objectivity, and ethics are elements common to both. The great differentiator is the degree of independence to which both are subject. Moreover, the most relevant aspect of independence is not the fact that the auditor is independent, but rather if they, in addition, appear to be independent, that is, if the people who are supposed to benefit from their work see the auditor as an independent person or company. This is fundamental for maintaining confidence in the system.

Considering mainly this last aspect, the Instruction prohibits the provision of certain consulting services to audit client companies, such as: corporate restructuring, company valuation, asset revaluation, determination of the values of provisions or technical reserves and provisions for contingencies, tax planning, and remodeling of accounting, information, and internal control systems.

Furthermore, it is forbidden for the auditor and persons linked to them to acquire or maintain securities or financial instruments of the audited entity.

Persons linked to the independent auditor are those with whom they maintain a link, relationship, participation, or have an interest, as defined by the CFC in professional independence rules and which prevent them from executing auditing services.

Other conflicts of interest, such as: marital or kinship ties with clients; employment relationship; exercise of incompatible position or function; fixation of conditional or risk-based fees; and financial interests or partnership participation in the audited company, are already prohibited by the professional rules of the Federal Council of Accounting.

7. DUTIES AND RESPONSIBILITIES OF INDEPENDENT AUDITORS (Article 25)

The new Instruction, like the previous one, imposes some additional tasks on the auditor when they are acting in the securities market, which are:

• verify if the published statements and auditing opinion are in accordance with the audited statements and the opinion issued;
• verify if the information disclosed in the administration report is in consonance with the audited statements;
• prepare a report on deficiencies found in the internal controls of audited companies, informing the administration and the Fiscal Council; and
• verify, furthermore, if the destination given to the results was done in accordance with the provisions of the Companies Law, the company's bylaws, and the rules of the Securities and Exchange Commission. This is a very important item, especially for the minority shareholder.

8. TECHNICAL QUALIFICATION EXAM (Article 30)

The proposal for the exam aims to improve the technical qualification standard of auditors registered with this Commission. In addition to the experience of at least five years currently required, new interested parties seeking registration as an independent auditor with the CVM must submit to the technical qualification exam, whose application must be carried out by the Federal Council of Accounting – CFC together with the Brazilian Institute of Certified Public Accountants – IBRACON, with the CVM also able to indicate other institutions.

This exam will be held at least once a year and will also be subject to greater detail in specific regulation to be issued shortly. It will not be mandatory to take this technical qualification exam for auditors already registered with the CVM, as well as for those who will register during the period in which the exam has not been regulated.

The technical qualification exam reflects the CVM's concern with the performance of auditors exclusively within the scope of the securities market, not confusing with the regulation of the Federal Council of Accounting, which already provides for the professional competence exam for obtaining accountant registration.

9. AUDITOR ROTATION (Article 31)

Given that the provision of auditing services for the same client for a long period can compromise the quality of this service or even the auditor's independence in the view of the external public, the Instruction establishes that the independent auditor cannot provide services for the same client for a period exceeding 5 (five) years, with their return being admitted after a minimum period of 3 (three) years has elapsed. This period is counted from the date of publication of the Instruction, not reaching past time.

10. INTERNAL QUALITY CONTROL (Article 32)

Aiming to harmonize the independent auditing activity exercised in Brazil with that practiced in more developed countries, and still, in line with the principles recommended by the Council of Securities Regulators of the Americas - COSRA, the CVM now requires, from all independent auditors, the implementation of an internal quality program, in order to guarantee that there is within the audit firm a verification system regarding the degree of adherence to technical and professional standards.

The internal quality control program must take into account the structure of the audit firm and the complexity of the services under their responsibility. This requirement is also in line with recent rules issued by the Federal Council of Accounting and with the requirements of the Brazilian Institute of Certified Public Accountants, which will be the bodies responsible for establishing and updating the guidelines for implementing this program.

11. EXTERNAL QUALITY CONTROL (Article 33)

In addition to the internal quality control program, auditors must submit, every 4 (four) years, to an external review ("peer-review") carried out by another auditor registered with the CVM, with a view to also assessing compliance with technical and professional standards. In the case of an audit firm, the review must be carried out by another firm, registered with the CVM, without link to the reviewed one and possessing a structure compatible with the work to be developed.

The reviewing auditor must send to the CVM and the reviewed auditor, by October 31 of the respective year, a report containing an exposition on the examination performed and on points of recommendation for improvement or correction of deficiencies found. The first review must occur at most within two years counted from the date of publication of the new Instruction.

This external quality control is indispensable for the creation of an efficient self-regulation system of the market, since the participants themselves would have the primary responsibility of verifying the quality of the work developed, without prejudice, obviously, to the action of the Regional Councils of Accounting which are responsible for monitoring accountants as a whole.

12. CONTINUING EDUCATION PROGRAM (Article 34)

Aiming to maintain a high standard of technical qualification and constant updating regarding professional rules, accounting and auditing procedures, and rules related to the exercise of their activity in the securities market, independent auditors registered with the CVM must maintain, for themselves and for their entire technical staff, a continuing education program in accordance with the guidelines approved by the CFC and IBRACON.

13. DUTIES OF ADMINISTRATORS (Article 26)

The CVM understands that an audit based on the concepts of independence and competence should not be considered as just another burden for the audited entity. Administrators must exercise maximum diligence in the choice and hiring of their auditor, as they may be held responsible when it is found that the hired auditor does not meet the requirements of technical qualification and independence, does not have an organizational structure compatible with the size and complexity of the service to be executed, and is not with their registration regularized with the CVM. Furthermore, the Instruction provides for the possibility of annulling the auditing work done by an auditor not registered with the CVM or where a lack of independence is found.

The administrator also has the duty, under penalty of fine, to communicate to the CVM (Superintendence of Accounting Standards and Auditing - SNC), within 20 (twenty) days, the replacement of their auditors, with a justified exposition of the reasons for this replacement, in which the auditor's consent must be stated.

Original signed by

FRANCISCO DA COSTA E SILVA
President