SBS Resolution No. 01132-2025: Amending the Internal Audit Regulation, the Internal Audit Regulation for Credit Unions Not Authorized to Operate with Public Funds, and Circular No. G-161-2012

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000 1 Lima, March 24, 2025 S.B.S. Resolution No. 01132-2025

The Superintendent of Banking, Insurance and
Private Pension Fund Administrators

WHEREAS:
That, in accordance with the provisions of Article 180 of the General Law of the Financial System and the Insurance System and Organic Law of the Superintendency of Banking and Insurance, Law No. 26702 and its amendments, hereinafter the General Law, it corresponds to this Superintendency to establish the internal audit requirements and standards for companies in the financial and insurance system; That, by SBS Resolution No. 11699-2008 and its amendments, the Internal Audit Regulation was approved; That, pursuant to subsection e) of Article 57 of the Single Ordered Text of the Private Pension Fund Administration System Law, approved by Supreme Decree No. 054-97-EF, it is the attribution and obligation of the Superintendency to oversee the AFP in compliance with the legal provisions and administrative directives governing them, which is why it is appropriate to include them within the scope of application of the Internal Audit Regulation; That, by Circular G-161-2012, provisions were issued on internal and external evaluations for the Quality Assurance and Improvement Program (PAMC); That, additionally, based on the provisions of the Twenty-Fourth Final and Complementary Provision of the General Law, by SBS Resolution No. 1298-2022, the Internal Audit Regulation for Credit Unions Not Authorized to Operate with Public Funds was approved; That, The Institute of Internal Auditors (IIA) has published the Global Internal Audit Standards, whose international validity applies as of 01.09.2025; That, considering that the work carried out by the internal audit of supervised companies constitutes a fundamental mechanism of support for the supervision and control carried out by this Superintendency, it is necessary to update the reference to the international standards in force in the Internal Audit Regulation approved by SBS Resolution No. 11699-2008 and its amendments, the Internal Audit Regulation for Credit Unions Not Authorized to Operate with Public Funds approved by SBS Resolution No. 1298-2022, as well as Circular No. G-161-2012; Counting on the prior and positive technical report of viability of the norm of the Deputy Superintendency of Cooperatives and with the approval of the Deputy Superintendencies of Banking and Microfinance, of Insurance, of Private Pension Fund Administrators, of Risks, of Cooperatives and of Legal Advice; and, In use of the attribution conferred by numeral 7 of Article 349, as well as in numeral 4-A of the Twenty-Fourth and the Thirty-Second Final and Complementary Provision of the General Law;

RESOLVES:

Article One.- To replace the fourth paragraph of Article 7 and Article 9 of the Internal Audit Regulation, approved by SBS Resolution No. 11699-2008 and its amendments, with the following text:

"Article 7.- Competence of internal audit and significant subcontracting (...)
The experience and specialization required for the professional practice of internal audit may be accredited, among others, through current professional certifications of international prestige such as the Certified Internal Auditor (CIA), issued by The Institute of Internal Auditors (IIA) and the Certified Information Systems Auditor (CISA), issued by ISACA. (...)
Article 9.- Norms and standards for the practice of internal audit
To the extent that it does not oppose the provisions of the Superintendency's regulations, the standards issued by The Institute of Internal Auditors (IIA) shall apply. In the case of systems auditors, the audit guidelines provided by ISACA shall be taken into consideration."

Article Two.- To replace numeral 3 "Quality Assurance and Improvement Program (PAMC)" of Circular No. G-161-2012, with the following text:

"3. Quality Assurance and Improvement Program (PAMC) Companies must have a quality assurance and improvement program for the internal audit function, in accordance with standards 8.3 'Quality' and 8.4 'External quality assessment' of Principle 8 'Board oversight' and standard 12.1 'Internal quality assessment' of Principle 12 'Enhance quality'. Said program must include internal and external evaluations. Internal evaluations Companies must carry out permanent monitoring, and carry out periodic internal evaluations, at least annually, of the performance of the internal audit function, in accordance with standard 8.3 'Quality' of Principle 8 'Board oversight' and standard 12.1 'Internal quality assessment' of Principle 12 'Enhance quality'. In the case of the systems audit service, internal evaluations must take into account compliance with the audit guidelines issued by ISACA. External evaluations Companies must carry out external evaluations, in accordance with standards 8.3 'Quality' and 8.4 'External quality assessment' of Principle 8 'Board oversight', and they must be carried out at least once every five years. External evaluations shall be carried out by a qualified and independent reviewer or review team, who accredits having the required knowledge and experience, who is not related to the company through management or ownership ties and who has not carried out consulting activities for the company on matters related to the internal audit function during the two years prior to the start of the review. The Audit Committee must approve the hiring of the reviewer or review team in charge of the external evaluation. Likewise, companies must inform the Superintendency about the independent reviews, at least thirty (30) days before the start of the review. The Superintendency may request that said review include extended procedures in the areas it deems necessary. Additionally, it may request at any time that the expected review be brought forward within the five-year cycle."

Article Three.- To replace Article 10 of the Internal Audit Regulation for Credit Unions Not Authorized to Operate with Public Funds, approved by SBS Resolution No. 1298-2022, with the following text:

"Article 10. Norms and standards for the practice of internal audit The internal audit activity must conform to the provisions established by this Superintendency and, to the extent that it does not oppose said provisions, the standards issued by The Institute of Internal Auditors (IIA) shall apply. In the case of systems auditors, the audit guidelines provided by ISACA shall be taken into consideration."

Article Four.- This norm enters into force the day following its publication in the Official Gazette El Peruano.

Register, communicate and publish.
SERGIO JAVIER ESPINOSA CHIROQUE
SUPERINTENDENT OF BANKING, INSURANCE AND AFP