Resolution CMN No. 2554 — Provisions on the Implementation and Operation of an Internal Control System

RESOLUTION NO. 002554

Dispenses on the implementation and operation of an internal control system.

The CENTRAL BANK OF BRAZIL, in accordance with Article 9 of Law No. 4,595 of December 31, 1964, makes public that the MONETARY COUNCIL NATIONAL, in a session held on September 24, 1998, having regard to the provisions of Article 4, item VIII, of the aforementioned Law, Articles 9 and 10 of Law No. 4,728 of July 14, 1965, and Law No. 6,099 of September 12, 1974, with the amendments introduced by Law No. 7,132 of October 26, 1983,

RESOLVES:

Article 1. Determine that financial institutions and other institutions authorized to operate by the Central Bank of Brazil implement and operate internal controls focused on the activities developed by them, their financial, operational, and managerial information systems, and compliance with the legal and regulatory norms applicable to them.

Paragraph 1. The internal controls, regardless of the size of the institution, must be effective and consistent with the nature, complexity, and risk of the operations carried out by it.

Paragraph 2. It is the responsibility of the institution's board of directors:

I - the implementation and operation of an effective internal control structure by defining control activities for all levels of the institution's business;

II - the establishment of objectives and procedures pertinent to the same;

III - the systematic verification of the adoption and compliance with the procedures defined based on the provision of item II.

Article 2. The internal controls, the provisions of which must be accessible to all employees of the institution to ensure that their respective role in the process and the responsibilities assigned to the various levels of the organization are known, must provide for:

I - the definition of responsibilities within the institution;

II - the segregation of activities assigned to members of the institution so as to avoid conflicts of interest, as well as means to adequately minimize and monitor areas identified as potential conflicts of the kind;

III - means to identify and evaluate internal and external factors that may adversely affect the achievement of the institution's objectives;

IV - the existence of communication channels that ensure that employees, according to their corresponding level of operation, have access to reliable, timely, and understandable information considered relevant for their tasks and responsibilities;

V - the continuous evaluation of the various risks associated with the institution's activities;

VI - the systematic monitoring of the activities developed, so that it can be evaluated whether the institution's objectives are being achieved, whether the established limits and applicable laws and regulations are being complied with, as well as ensuring that any deviations can be promptly corrected;

VII - the existence of periodic security tests for information systems, especially those maintained in electronic media.

Paragraph 1. The internal controls must be periodically reviewed and updated, so that measures related to new or previously unaddressed risks are incorporated into them.

Paragraph 2. The internal audit activity must be part of the internal control system.

Paragraph 3. The activity referred to in paragraph 2, when not executed by a specific unit of the institution itself or of an institution part of the same financial conglomerate, may be exercised:

I - by an independent auditor duly registered with the Securities and Exchange Commission - CVM, provided that it is not the one responsible for the audit of the financial statements;

II - by the audit of the entity or class association or central body to which the institution is affiliated;

III - by the audit of an entity or class association of other institutions authorized to operate by the Central Bank, by agreement, previously approved by it, signed between the entity to which the institution is affiliated and the service provider entity.

Paragraph 4. In the case where the internal audit activity is exercised by its own unit, it must be directly subordinate to the board of directors or, in the absence thereof, to the institution's management.

Paragraph 5. In the case where the internal audit activity is exercised according to one of the options established in paragraph 3, the person responsible for its execution must report directly to the board of directors or, in the absence thereof, to the institution's management.

Paragraph 6. The options established in paragraph 3, items II and III, may only be exercised by credit cooperatives and by securities brokerage companies, foreign exchange brokerage companies, and securities distribution companies not part of financial conglomerates.

Article 3. The systematic monitoring of activities related to the internal control system must be the subject of reports, at least semi-annually, containing:

I - the conclusions of the examinations carried out;

II - the recommendations regarding any deficiencies, with the establishment of a schedule for remedying them, when applicable;

III - the statement of those responsible for the corresponding areas regarding the deficiencies found in previous verifications and the measures effectively adopted to remedy them.

Sole Paragraph. The conclusions, recommendations, and statements referred to in items I, II, and III of this article:

I - must be submitted to the board of directors or, in the absence thereof, to the management, as well as to the institution's external auditor;

II - must remain available to the Central Bank of Brazil for a period of 5 (five) years.

Article 4. It is incumbent upon the institution's management, in addition to the responsibilities listed in Article 1, paragraph 2, to promote high ethical standards and integrity and an organizational culture that demonstrates and emphasizes, to all employees, the importance of internal controls and the role of each in the process.

Article 5. The internal control system must be implemented by December 31, 1999, observing the following schedule:

I - definition of the internal structures that will make the implementation and corresponding monitoring effective - by January 31, 1999;

II - definition and availability of pertinent procedures - by June 30, 1999.

Sole Paragraph. The institution's external auditor must make specific mention, in its opinions, of the compliance with the schedule established in this article.

Article 6. The Central Bank of Brazil is authorized to:

I - determine the adoption of additional controls in cases where inadequacy of the controls implemented by the institution is confirmed;

II - impose more restrictive operational limits on the institution that fails to comply with the determination under item I within the established deadline;

III - issue norms and adopt measures deemed necessary for the execution of the provisions of this Resolution, including the alteration of the schedule referred to in Article 5.

Article 7. This Resolution enters into force on the date of its publication.

Brasília, September 24, 1998

Gustavo H. B. Franco
President

Note: Re-transmitted due to an error in paragraph 6 of Article 2.