Resolution CMN No. 3198 — Amends and Consolidates Regulations on Independent Audit Services for Financial Institutions, Authorized Institutions, and Clearing and Settlement Service Providers

RESOLUTION NO. 003198

Amends and consolidates the regulation regarding the provision of independent audit services for financial institutions, other institutions authorized to operate by the Central Bank of Brazil, and for clearing houses and providers of clearing and settlement services.

THE CENTRAL BANK OF BRAZIL, in accordance with Article 9 of Law No. 4,595 of December 31, 1964, makes public that the NATIONAL MONETARY COUNCIL, in a session held on May 27, 2004, having regard to the provisions of Article 3, item VI, and based on Articles 4, items VIII and XII, and 10, item XI, of the aforementioned law, with the wording given by Articles 19 and 20 of Law No. 7,730 of January 31, 1989, Article 2 of Law No. 4,728 of July 14, 1965, and Articles 22, § 2, and 26, § 3 of Law No. 6,385 of December 7, 1976, with the wordings given, respectively, by Article 1 of Decree No. 3,995 of October 31, 2001, and Article 14 of Law No. 9,447 of March 14, 1997,

RESOLVED:

Article 1. To amend and consolidate, in accordance with the attached regulation, the regulation regarding the provision of independent audit services for financial institutions, other institutions authorized to operate by the Central Bank of Brazil, and for clearing houses and providers of clearing and settlement services.

Article 2. This resolution enters into force on the date of its publication.

Article 3. Resolutions No. 3,081 of May 29, 2003, and No. 3,170 of January 30, 2004, are hereby repealed.

São Paulo, May 27, 2004.

Henrique de Campos Meirelles
President

--------------------------------------------------------------------- Attached Regulation to Resolution No. 3,198 of May 27, 2004, which amends and consolidates the regulation regarding the provision of independent audit services for financial institutions, other institutions authorized to operate by the Central Bank of Brazil, and for clearing houses and providers of clearing and settlement services.

Chapter I
ON MANDATORY AUDIT

Article 1. The following must be audited by independent auditors registered with the Securities and Exchange Commission (CVM) and who meet the minimum requirements to be established by the Central Bank of Brazil:

I - The financial statements, including explanatory notes:

a) of financial institutions and other institutions authorized to operate by the Central Bank of Brazil, except for microentrepreneur credit societies;

b) of clearing houses and providers of clearing and settlement services;

II - The financial statements provided for in Articles 3 and 10 of Resolution No. 2,723 of May 31, 2000;

III - The Quarterly Financial Information document (IFT), referred to in Article 1 of Circular No. 2,990 of June 28, 2000, in the form of special review.

Article 2. The independent auditor may be an individual or a legal entity.

Chapter II
ON THE RESPONSIBILITY OF MANAGEMENT

Article 3. The institutions, clearing houses, and service providers referred to in Article 1 must provide the independent auditor with all data, information, and conditions necessary for the effective performance of their services, as well as the management letter of responsibility, in accordance with the standards of the Federal Council of Accountancy (CFC).

Sole Paragraph. The responsibility of the administrators of the institutions, clearing houses, and service providers for the information contained in the financial statements or other information provided does not exempt the independent auditor from the responsibility related to the preparation of the reports required by this regulation or from the audit opinion, nor does it relieve them of the adoption of adequate audit procedures.

Article 4. The administrators of the institutions, clearing houses, and service providers referred to in Article 1 shall be held responsible for hiring an independent auditor who does not meet the requirements provided for in this regulation.

Sole Paragraph. If non-compliance with the requirements established in this regulation is confirmed, the audit services will be considered ineffective for compliance with the norms emanating from the National Monetary Council and the Central Bank of Brazil.

Article 5. The institutions, clearing houses, and service providers referred to in Article 1 must designate a technically qualified director to answer, before the Central Bank of Brazil, for the monitoring, supervision, and compliance with the accounting standards and procedures provided for in the current regulation.

§ 1. In institutions that do not have an audit committee constituted in accordance with this regulation, as well as in clearing houses and service providers, the director must also answer for the monitoring, supervision, and compliance with the standards and procedures for independent audit provided for in the current regulation.

§ 2. The designated director shall be held responsible for the information provided and for the occurrence of situations indicating fraud, negligence, imprudence, or incompetence in the exercise of their functions, without prejudice to the application of penalties provided for in the current legislation.

Chapter III
ON THE INDEPENDENCE OF THE AUDITOR

Article 6. The hiring and maintenance of an independent auditor by the institutions, clearing houses, and service providers referred to in Article 1 are prohibited if any of the following situations are established:

I - occurrence of any circumstances of impediment or incompatibility for the provision of independent audit services provided for in the norms and regulations of the CVM, the CFC, or the Institute of Independent Auditors of Brazil (Ibracon);

II - direct or indirect shareholding by the independent auditor, technical manager, director, manager, supervisor, or any other member with managerial functions in the team involved in the audit work, in the audited entity or its affiliates;

III - existence of active or passive operations with the audited entity or its affiliates, including through investment funds administered by them, of responsibility or with guarantee by the independent auditor, technical manager, director, manager, supervisor, or any other member with managerial functions in the team involved in the audit work at the institution;

IV - participation of the technical manager, director, manager, supervisor, or any other member with managerial functions of the independent auditor replaced in accordance with Article 9, in the independent audit work performed by their successor for the same entity, within a period of less than one year after replacement;

V - payment of fees and reimbursement of expenses of the independent auditor, related to the base year of the financial statements subject to audit, by the audited entity, individually or together with its affiliates, representing equal to or greater than 25% (twenty-five percent) of the total revenue of the independent auditor in that year.

§ 1. The establishment of the situations described, relative to an affiliate of the independent auditor, also implies a prohibition on hiring and maintaining this auditor.

§ 2. The prohibition provided for in item III does not apply to credit and leasing operations with an original term equal to or greater than two years, carried out prior to the hiring of independent audit services.

§ 3. The provisions of this article do not dispense with the verification, by the institutions, clearing houses, service providers, and independent auditors, of other situations that may affect independence.

§ 4. If, at any time, the existence of a situation that may affect the independence of the auditor is verified, the institutions, clearing houses, and service providers must provide for its regularization, which may imply the replacement of the independent auditor, without prejudice to the provisions of Article 9.

Article 7. The hiring by the institutions, clearing houses, and service providers referred to in Article 1 of a technical manager, director, manager, supervisor, or any other member with managerial functions of the team involved in audit work in the last twelve months for a position related to services that constitute impediment or incompatibility for the provision of independent audit services, or that allows influence on the administration of the institution, is prohibited.

Article 8. The independent auditor must prepare and adequately document their independence policy, which must be available to the Central Bank of Brazil and the audit committee of the audited entity, when installed, evidencing, in addition to the situations provided for in this regulation, others that, in their judgment, may affect their independence, as well as the internal control procedures adopted to monitor, identify, and prevent their occurrence.

Chapter IV
ON THE PERIODIC SUBSTITUTION OF THE AUDITOR

Article 9. The institutions, clearing houses, and service providers referred to in Article 1 must proceed to the substitution of the contracted independent auditor, at the latest, after opinions have been issued regarding five complete social fiscal years.

§ 1. For the purpose of counting the period provided for in the main text, opinions regarding complete social fiscal years are those related to the financial statements of the base date of December 31.

§ 2. The re-hiring of an independent auditor may only be carried out after three years have elapsed, counted from the date of its replacement.

Chapter V
ON THE AUDIT COMMITTEE

Article 10. Institutions referred to in Article 1, item I, letter "a", which have presented at the close of the last two social fiscal years:

I - Reference Equity (PR) equal to or greater than R$1,000,000,000.00 (one billion reais); or

II - administration of third-party resources in an amount equal to or greater than R$1,000,000,000.00 (one billion reais); or

III - sum of deposit collections and administration of third-party resources in an amount equal to or greater than R$5,000,000,000.00 (five billion reais).

must constitute a statutory body called an audit committee.

§ 1. Leading institutions responsible for preparing the consolidated financial statements of financial conglomerates that fall under the provisions established in the main text must constitute an audit committee to fulfill the duties and responsibilities provided for in this regulation, regarding institutions belonging to such conglomerates that do not have the obligation to individually constitute the aforementioned committee.

§ 2. The use of the term "audit committee" is restricted to a statutory body constituted in accordance with this regulation.

§ 3. Institutions must create adequate conditions for the functioning of the audit committee.

§ 4. Institutions must have the audit committee fully operational by March 31 of the subsequent fiscal year to the years provided for in the main text, fulfilling its duties even with respect to the financial statements of that base date.

§ 5. For institutions that fall under the provisions of the main text or § 1, regarding the fiscal years of 2002 and 2003, the audit committee must be installed and fully operational by July 1, 2004.

§ 6. The extinction of the audit committee:

I - may only occur if the institution no longer presents the conditions contained in the main text or § 1, for the period specified therein;

II - depends on prior authorization from the Central Bank of Brazil;

III - is conditioned upon the fulfillment of its duties regarding the social fiscal years in which its operation is required.

Article 11. Financial conglomerates, alternatively to the provisions of Article 10, may constitute a single audit committee, through the leading institutions, to fulfill the duties and responsibilities provided for in this regulation, regarding the institutions that comprise it.

§ 1. In cases where the leading institution is privately held and the conglomerate is integrated by an institution whose shares are traded on an exchange, the constitution of the audit committee must observe one of the following alternatives:

I - a single audit committee composed, in addition to, at least, three directors of the leading institution, by at least three more members who meet the provisions of Article 13, item I and § 1; or

II - constitution of a specific committee by the institution with shares traded on an exchange, all of whose members meet the provisions of Article 13, item I and § 1, with the audit committee of the leading institution responsible for fulfilling the duties and responsibilities within the other institutions.

§ 2. The use of the facility provided for in this article must be expressly established in a decision of the assembly of each institution belonging to the conglomerate.

Article 12. The audit committee must be composed of at least three members, observing that the maximum term must be five years for institutions with shares traded on a securities exchange and no fixed term for those with closed capital.

§ 1. The number of members, criteria for appointment, dismissal, and remuneration, term of office, and duties of the audit committee must be expressly stated in the institution's bylaws or articles of incorporation.

§ 2. At least one of the members of the audit committee must have proven knowledge in the areas of accounting and auditing that qualify them for the function.

§ 3. A member of the audit committee may only return to integrate such a body in the same institution after at least three years have elapsed from the end of their previous term.

§ 4. The function of a member of the audit committee is non-delegable.

§ 5. In the event of a term shorter than that provided for in the main text, it may be renewed up to a limit of five years with prior authorization from the Central Bank of Brazil.

Article 13. In addition to the provisions of Resolution No. 3,041 of November 28, 2002, which establishes conditions for the exercise of positions in statutory bodies of financial institutions and other institutions authorized to operate by the Central Bank of Brazil, the basic conditions for the exercise of a member of the audit committee are:

I - in institutions with shares traded on an exchange:

a) not be, or have been in the last twelve months:

1. director of the institution or its affiliates;

2. employee of the institution or its affiliates;

3. technical manager, director, manager, supervisor, or any other member with managerial functions in the team involved in audit work at the institution;

4. member of the statutory audit committee of the institution or its affiliates;

b) not be a spouse, or relative in the direct line, collateral line, and by affinity, up to the second degree of the persons referred to in letter "a", items 1 and 3;

c) not receive any other type of remuneration from the institution or its affiliates other than that related to their function as a member of the audit committee;

II - in privately held institutions:

a) that the members of the audit committee are also directors of the institution, with at least one year of actual exercise in the position, with the participation of, at most, three more members who meet the provisions of item I and § 1;

b) mandatory participation of the director referred to in Article 5, waiving the requirement of actual exercise time in the position.

§ 1. In institutions with shares traded on an exchange whose control is held by the Union, states, or Federal District, the basic conditions, in addition to those provided for in item I, are:

I - not holding a licensed official position within the respective governments;

II - not being, or having been in the last twelve months, holding an official position or function within the respective governments.

§ 2. If a member of the audit committee of the institution is also a member of the board of directors of the institution or its affiliates, in the case of institutions with shares traded on an exchange, or of the executive board, in the case of closed institutions, the option for remuneration related to one of the positions is permitted.

§ 3. Upon duly justified request from privately held institutions, the Central Bank of Brazil may waive the requirement of minimum actual exercise time in the position provided for in item II, letter "a".

Article 14. The audit committee must report directly to the board of directors or, in its absence, to the executive board of the institution.

Article 15. The duties of the audit committee are:

I - establish the operational rules for its own functioning, which must be approved by the board of directors or, in its absence, by the executive board of the institution, formalized in writing and made available to the respective shareholders or partners;

II - recommend, to the administration of the institution, the entity to be hired for the provision of independent audit services, as well as the replacement of the provider of these services, if deemed necessary;

III - review, prior to publication, the semi-annual financial statements, including explanatory notes, management reports, and the independent auditor's opinion;

IV - evaluate the effectiveness of independent and internal audits, including regarding the verification of compliance with legal and regulatory provisions applicable to the institution, as well as regulations and internal codes;

V - evaluate the compliance, by the administration of the institution, with the recommendations made by independent or internal auditors;

VI - establish and disseminate procedures for receiving and treating information regarding non-compliance with legal and regulatory provisions applicable to the institution, as well as regulations and internal codes, including provisions for specific procedures to protect the provider and the confidentiality of the information;

VII - recommend, to the executive board of the institution, correction or improvement of policies, practices, and procedures identified within the scope of its duties;

VIII - meet, at least quarterly, with the executive board of the institution, with independent audit, and with internal audit to verify compliance with their recommendations or inquiries, including with respect to the planning of their respective audit work, formalizing, in minutes, the contents of such meetings;

IX - verify, during the meetings provided for in item VIII, the compliance with their recommendations by the executive board of the institution;

X - meet with the statutory audit committee and board of directors, upon request by the same, to discuss policies, practices, and procedures identified within the scope of their respective competencies;

XI - other duties determined by the Central Bank of Brazil.

Article 16. The audit committee may, within the scope of its duties, use the work of specialists.

Sole Paragraph. The use of the work of specialists does not exempt the audit committee from its responsibilities.

Article 17. The audit committee must prepare, at the end of the semesters ending on June 30 and December 31, a document called the audit committee report containing, at minimum, the following information:

I - activities performed within the scope of its duties, during the period;

II - evaluation of the effectiveness of the institution's internal control systems, with emphasis on compliance with the provisions of Resolution No. 2,554 of September 24, 1998, and with evidence of detected deficiencies;

III - description of the recommendations presented to the executive board, with evidence of those not accepted and respective justifications;

IV - evaluation of the effectiveness of independent and internal audits, including regarding the verification of compliance with legal and regulatory provisions applicable to the institution, as well as regulations and internal codes, with evidence of detected deficiencies;

V - evaluation of the quality of the financial statements related to the respective periods, with emphasis on the application of accounting practices adopted in Brazil and compliance with norms issued by the Central Bank of Brazil, with evidence of detected deficiencies.

§ 1. The audit committee must keep the audit committee report available to the Central Bank of Brazil and the board of directors of the institution for a minimum period of five years, counted from its preparation.

§ 2. The audit committee must publish, together with the semi-annual financial statements, a summary of the audit committee report, evidencing the main information contained in that document.

Chapter VI
OF THE CERTIFICATION EXAM

Art. 18. The hiring or maintenance of independent auditors by the institutions, clearing houses, and service providers referred to in Art. 1 is conditioned upon the approval of the technical manager, director, manager, supervisor, or any other member with a management role in the team involved in the audit work, in a certification exam organized by the CFC in conjunction with Ibracon.

§ 1. Compliance with the formality provided for in this article must be provided for within a maximum period of two years, counted from May 30, 2003.

§ 2. The formality provided for in the caput must be renewed with a frequency not exceeding five years, counted from the date of the last qualification.

§ 3. In the case of an auditor who has ceased to perform the activities provided for in the caput for a period equal to or greater than one year, the maintenance of their qualification is subject to the renewal of the formality provided for in this article with a frequency not exceeding two years, counted from the return to said activities, observed the limit provided for in § 2.

Art. 19. The Central Bank of Brazil is authorized to admit, at its discretion, the holding of certification exams by market type or set of activities.

Chapter VII
OF THE PROVISION OF SERVICES BY THE AUDITOR

Art. 20. The independent auditor must observe, in the provision of their services, the audit standards and procedures established by the National Monetary Council, by the Central Bank of Brazil, and, insofar as they are not conflicting with these, those determined by the CVM, by the CFC, and by Ibracon.

Art. 21. The independent auditor must prepare, as a result of the audit work performed on the institutions, clearing houses, and service providers referred to in Art. 1, the following reports:

I - audit report, expressing their opinion on the accounting statements and respective explanatory notes, including regarding adequacy to the accounting standards issued by the National Monetary Council and the Central Bank of Brazil;

II - report on the evaluation of the quality and adequacy of the internal control system, including electronic data processing systems and risk management systems, evidencing the identified deficiencies;

III - report on non-compliance with legal and regulatory provisions, which have, or may have, relevant impacts on the accounting statements or on the operations of the audited entity;

IV - others required by the Central Bank of Brazil.

§ 1. The independent auditor's reports must be prepared considering the same period and base date as the accounting statements to which they refer.

§ 2. The audited entities, as well as their respective independent auditors, must keep at the disposal of the Central Bank of Brazil, for a minimum period of five years, or for a longer period in the event of express determination by that Autarchy, the reports referred to in this article, as well as the working papers, correspondence, service provision contracts, and other documents related to the audit work.

Chapter VIII
OF GENERAL PROVISIONS

Art. 22. For the purposes of this regulation, affiliated entities are understood to be those directly or indirectly linked, by shareholding or by effective operational control, characterized by common administration or management, or by acting in the market under the same brand or trade name.

Art. 23. The independent auditor and the audit committee, when installed, must, individually or jointly, formally notify the Central Bank of Brazil, within a maximum period of three business days from identification, of the existence or evidence of error or fraud represented by:

I - non-observance of legal and regulatory standards, which place the continuity of the audited entity at risk;

II - frauds of any value perpetrated by the administration of the institution;

III - relevant frauds perpetrated by employees of the entity or third parties;

IV - errors that result in relevant misstatements in the entity's accounting statements.

§ 1. For the purposes of this regulation, the concepts of error and fraud established in standards and regulations of the CFC or Ibracon must be observed.

§ 2. The independent auditor, internal audit, and the audit committee, when installed, must maintain immediate communication among themselves regarding the identification of the events provided for in this article.

Art. 24. The board of directors of the institution, clearing house, or service provider must formally notify the independent auditor and the audit committee, when installed, within a maximum period of 24 hours from identification, of the occurrence of the events referred to in Art. 23.

Art. 25. The performance of independent audit on the institutions, clearing houses, or service providers referred to in Art. 1 does not exclude or limit the supervisory action exercised by the Central Bank of Brazil.

Art. 26. A specific clause must be included in the contracts entered into between the institutions, clearing houses, and service providers referred to in Art. 1 and their respective independent auditors, authorizing the Central Bank of Brazil, at any time, access to the independent auditor's working papers, as well as to any other documents that served as the basis or evidence for the issuance of the reports prepared in accordance with Art. 21, upon formal request, within the scope of the attributions of said Autarchy, observed the limits provided for in the legislation in force.

Art. 27. The independent auditor, in addition to the provisions of this regulation, must observe the standards, regulations, and procedures of the CVM, CFC, and Ibracon regarding:

I - duties and responsibilities of independent auditors;

II - technical qualification examination;

III - internal quality control;

IV - external quality control;

V - continuing education program, including provision for specific activities related to independent audit in financial institutions.

Sole Paragraph. Activities related to external quality control may also be performed by the Central Bank of Brazil, without prejudice to the guidelines issued by the organizations referred to in the caput.