Resolution CMN No. 3056 — Regulates internal audit of financial institutions and other entities authorized by the Central Bank of Brazil

RESOLUTION NO. 3056

Regulates the internal audit of financial institutions and other entities authorized to operate by the Central Bank of Brazil.

THE CENTRAL BANK OF BRAZIL, in accordance with Article 9 of Law No. 4,595 of December 31, 1964, makes public that the NATIONAL MONETARY COUNCIL, in a session held on December 19, 2002, based on Articles 3, item VI, 4, items VIII and XII, and 10, item XI, with the wording given by Articles 19 and 20 of Law No. 7,730 of January 31, 1989, of the aforementioned law, Article 2 of Law No. 4,728 of July 14, 1965, and Article 22, paragraph 2, and Article 26, paragraph 3, of Law No. 6,385 of December 7, 1976, with the wordings given, respectively, by Article 1 of Decree No. 3,995 of October 31, 2001, and Article 14 of Law No. 9,447 of March 14, 1997,

RESOLVES:

Article 1. Amend Article 2 of Resolution No. 2,554 of September 24, 1998, which shall enter into force with the following wording:

"Article 2. Internal controls, the provisions of which must be accessible to all employees of the institution in order to ensure that their respective roles in the process and the responsibilities assigned to the various levels of the organization are known, must provide for:

I - the definition of responsibilities within the institution;

II - the segregation of activities assigned to members of the institution in a manner that avoids conflicts of interest, as well as means to adequately minimize and monitor areas identified as having potential conflicts of the kind;

III - means to identify and evaluate internal and external factors that may adversely affect the achievement of the institution's objectives;

IV - the existence of communication channels that ensure that employees, according to their corresponding level of operation, have access to reliable, timely, and understandable information considered relevant to their tasks and responsibilities;

V - the continuous assessment of the various risks associated with the institution's activities;

VI - the systematic monitoring of the activities carried out, in order to evaluate whether the institution's objectives are being achieved, whether the established limits and applicable laws and regulations are being complied with, as well as to ensure that any deviations can be promptly corrected;

VII - the existence of periodic security tests for information systems, especially those maintained in electronic media.

Paragraph 1. Internal controls must be periodically reviewed and updated, in a manner that incorporates measures related to new risks or risks not previously addressed.

Paragraph 2. The internal audit activity must be part of the internal control system.

Paragraph 3. The activity referred to in paragraph 2, when not carried out by a specific unit of the institution itself or of an institution belonging to the same financial conglomerate, may be performed:

I - by an independent auditor duly registered with the Securities and Exchange Commission (CVM), provided that it is not the one responsible for the audit of the financial statements;

II - by the audit of the entity or class association or central body to which the institution is affiliated;

III - by the audit of an entity or class association of other entities authorized to operate by the Central Bank of Brazil, through an agreement, previously approved by the Central Bank, signed between the entity to which the institution is affiliated and the entity providing the service.

Paragraph 4. In the case where the internal audit activity is carried out by a unit of the institution itself, it must be directly subordinate to the board of directors or, in the absence thereof, to the management of the institution.

Paragraph 5. In the case where the internal audit activity is carried out according to one of the options established in paragraph 3, the person responsible for its execution must report directly to the board of directors or, in the absence thereof, to the management of the institution.

Paragraph 6. The options established in paragraph 3, items II and III, may only be exercised by credit cooperatives and by securities and securities brokers, currency brokers, and securities distribution companies not part of financial conglomerates.

Paragraph 7. In any of the situations provided for in this article, the institution must keep available and guarantee unrestricted access by the Central Bank of Brazil to the working papers, reports, and any other documents prepared by the institution's internal audit." (New wording)

Article 2. This resolution enters into force on the date of its publication.

Brasília, December 19, 2002

Arminio Fraga Neto
President