Technical Standards for Internal Audit for Members of the Financial System

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 1 of 17 CNBCR-02/2017 NRP-15 TECHNICAL STANDARDS FOR INTERNAL AUDIT FOR MEMBERS OF THE FINANCIAL SYSTEM Approval: 08/03/2017 Validity: 03/04/2017

The COMMITTEE OF STANDARDS OF THE CENTRAL RESERVE BANK OF EL SALVADOR,

CONSIDERING:

I. That in accordance with Article 2, second paragraph of the Law for the Supervision and Regulation of the Financial System, for the proper functioning of the Financial Supervision and Regulation System, it is required that members of the financial system and other supervised entities comply with current regulations and adopt the highest standards of conduct in the development of their business, acts, and operations, in accordance with the aforementioned Law, other applicable laws, regulations, and technical standards issued for such effect.

II. That Article 7 of the Law for the Supervision and Regulation of the Financial System establishes the entities subject to the supervision of the Superintendence of the Financial System.

III. That in accordance with Article 35, first paragraph and letters a) and b) of the Law for the Supervision and Regulation of the Financial System, directors, managers, and other officials holding positions of direction or administration in members of the financial system must conduct their business, acts, and operations complying with the highest ethical standards of conduct and acting with the due diligence of a good merchant in their own business, being obligated to comply with and ensure that in the institution they direct or work for, the legal, regulatory, and normative provisions that regulate the activity of members of the financial system are known and complied with, as well as the instructions issued by the Superintendence of the Financial System in accordance with their legal powers.

IV. That in accordance with Article 36, second paragraph of the Law for the Supervision and Regulation of the Financial System, directors, administrators, managers, internal and external auditors, other officials, and other persons who provide services to any member of the financial system, must report to the Superintendence of the Financial System the operations that it has required them to report, particularly those carried out or that have been carried out between that entity and its shareholders or administrators and those related to the financial conglomerate to which they belong, if applicable; and that the form, periodicity, and circumstances in which these operations must be reported will be established in the technical standards issued for such effect.

V. That in accordance with Article 39, letter b) of the Law for the Supervision and Regulation of the Financial System, the Audit Committee of members of the financial system must follow up on the observations made in the reports of the internal auditor, the external auditor, the Superintendence of the Financial System, and other public institutions, to correct them or contribute to their resolution, which must be reported timely to the Superintendence of the Financial System.

VI. That in accordance with Article 40, first and third paragraphs of the Law for the Supervision and Regulation of the Financial System, the Superintendent may cite or take testimony at any time from any person who has knowledge of any fact that needs clarification in some operation of the supervised entities, and that directors, administrators, managers, employees, external auditors, other officials, and other persons who provide services in any member of the financial system, must inform the Superintendence of the Financial System of all those events of which they have had knowledge in the performance of their functions that make it presumable the existence of facts or circumstances that could be considered illegal, or that could put at risk the stability and functioning of the member of the financial system.

VII. That it is of utmost importance that in every entity, the Internal Audit Activity is exercised to guarantee to the Board of Directors, Senior Management, supervisors, and the general public, a good functioning of the administrative and financial operations of the entity and to allow the same to permanently evaluate the effectiveness and efficiency of its internal control systems, risk management, and corporate governance; the reliability and integrity of financial and operational information; as well as to reduce potential risks of losses and damage to the reputation of the entity.

VIII. That international standards suggest, among other good practice activities, that the Internal Audit Activity must provide the entity with independent and objective assurance and consultation on the quality and effectiveness of its internal control, risk management, governance, and processes, implying for this to be competent, honest, and professional for the functions it performs; as well as to gradually adapt its work procedures and techniques to a risk-based audit approach, aspects fundamentally required for the exercise of the Internal Audit Activity of supervised entities.

IX. That in accordance with Article 99, letters a) and f) of the Law for the Supervision and Regulation of the Financial System, the Central Reserve Bank of El Salvador is the institution responsible for the approval of technical standards on any other aspect inherent to risk management by supervised entities; and on the issuance of requirements exigible to internal auditors of members of the financial system and also, to serve as a fundamental support activity to the supervision and control carried out by the Superintendence of the Financial System.

THEREFORE, by virtue of the regulatory powers conferred upon it by Article 99 of the Law for the Supervision and Regulation of the Financial System, AGREES to issue the following: TECHNICAL STANDARDS FOR INTERNAL AUDIT FOR MEMBERS OF THE FINANCIAL SYSTEM

CHAPTER I OBJECT, SUBJECTS, AND TERMS

Object Art. 1.- The object of these Standards is to establish the minimum provisions that entities must consider for the exercise of the internal audit activity and thus foster and strengthen the adoption of work procedures and techniques with a risk-based audit approach, in accordance with the size, nature of their operations, business segmentation, and organizational complexity of each entity.

Subjects Art. 2.- The subjects of these Standards are the following entities: a) Banks constituted in El Salvador, their offices abroad, and their subsidiaries; branches and offices of foreign banks established in the country; b) Companies that, in accordance with the law, form financial conglomerates, or that the Superintendence declares as such, which includes both their holding companies and their member companies; c) Pension fund management institutions; d) Insurance companies, their branches abroad, and the branches of foreign insurance companies established in the country; e) Stock exchanges, brokerage houses, companies specialized in the deposit and custody of securities, risk classifiers, agents specialized in the valuation of securities, and general warehouses of deposit; f) Cooperative banks, savings and credit societies, and federations regulated by the Law of Cooperative Banks and Savings and Credit Societies; g) Reciprocal guarantee companies and their local re-insurers; h) Companies that offer complementary services to the financial services of members of the financial system, particularly those in which they participate as investors; i) Management or operating companies of payment systems and securities settlement; j) The Social Fund for Housing and the National Fund for Popular Housing;

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 2 of 17 CNBCR-02/2017 NRP-15 TECHNICAL STANDARDS FOR INTERNAL AUDIT FOR MEMBERS OF THE FINANCIAL SYSTEM Approval: 08/03/2017 Validity: 03/04/2017 k) The National Institute of Pensions for Public Employees and the Salvadoran Social Security Institute, the latter with respect to the Public Pension System, the Professional Risks Regime, and technical health reserves; l) The Social Prevision Institute of the Armed Forces; m) The Agricultural Development Bank, the Mortgage Bank of El Salvador, S.A., and the Development Bank of El Salvador, insofar as it does not contradict their creation laws nor what is established by the Court of Accounts; n) The Solidarity Fund for the Micro-entrepreneurial Family, insofar as it does not contradict their creation laws nor what is established by the Court of Accounts; o) The Salvadoran Investment Corporation; p) Foreign currency exchange houses; q) Securitization companies and the funds they manage; r) The Deposit Guarantee Institute; s) Product and services exchanges; t) Investment fund managers and the funds they manage; u) Money Transfer Companies and Agents whose country of origin is El Salvador in accordance with what is established in the Technical Standards for the Registration, Obligations, and Functioning of Entities that Carry Out Money Sending or Receiving Operations (NRP-12); (1) v) Electronic Money Provider Companies; and (1) w) Investment banks, their offices abroad, and their subsidiaries. (1)

Terms Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning: a) Agent: It is the legal person with domicile in the Republic of El Salvador that establishes a contractual relationship with one or more Money Transfer Companies, which carry out money sending or receiving operations, systematically or substantially, by any means, nationally and internationally; b) Senior Management: The Executive President, General Manager, or whoever acts in their place, and the executives who report directly to them; c) Internal Auditor: Person responsible for the effective management of the internal audit activity in accordance with what is regulated in these Standards and the internal audit statutes of each entity; d) Internal Audit: According to the International Standards for the Professional Practice of Internal Audit, issued by the Institute of Internal Auditors, it is an independent and objective assurance and consultation activity, conceived to add value and improve the operations of an entity. The internal audit activity helps an entity to meet its objectives by providing a systematic and disciplined approach to evaluate and improve the effectiveness of risk management, control, and corporate governance processes; e) Code of Ethics for Internal Auditors: Current code of ethics of the Institute of Internal Auditors that contains relevant principles for the profession and the exercise of internal audit, and rules of conduct that describe the standards of behavior that are expected to be observed by internal auditors; f) Conflict of Interest: Refers to any relationship that goes against the best interest of the entity. A conflict of interest can undermine a person's ability to perform their obligations and responsibilities objectively; g) Control: Any measure taken by the Board of Directors, Senior Management, and other parties designated and approved for this purpose by the Board of Directors, to manage risks and increase the probability of achieving established objectives and goals; h) Compliance: Adherence to policies, plans, procedures, laws, regulations, contracts, and other requirements; i) Money Transfer Company or MTC: National or foreign legal person that, meeting the requirements of its country of origin, provides the service of sending or receiving money, systematically or substantially, by any means, whether own or third-party; j) Entity: Subject obliged to comply with the provisions of these Standards, listed in Article 2 thereof; k) Statute: Formal written document of the internal audit activity that defines the purpose, authority, and responsibility of said activity. The Statute establishes the position of the internal audit activity within the entity, authorizes access to records, personnel, and relevant assets for the execution of the work, and defines the scope of internal audit activities. This document legitimizes the internal audit activity in the entity, gives full work access, independence, and objectivity of the internal audit team as such. Guidelines, mandates, regulations, policies, among others, that the internal audit activity has defined as such may be understood as the Statute; l) Risk Management: Strategic process carried out by entities, through which they identify, measure, control, and monitor the different types of risks to which they are exposed and the interrelationships that arise between them, to provide reasonable assurance in the achievement of their objectives. Such management must be in accordance with the magnitude of the entity's activities, businesses, and resources; m) Significant Events: Those events that can have a significant impact on the financial situation and stability of the entity, or on the achievement of its economic and financial objectives. An event has a significant impact when its omission or incorrect presentation can influence the economic decisions that are made; n) Independence: Freedom from conditions that threaten the ability of the internal audit activity to carry out its responsibilities in a neutral manner; o) Pension Institutions: Pension Fund Administrators (AFP), National Institute of Pensions for Public Employees (INPEP), and Salvadoran Social Security Institute (ISSS); p) Supervisory Board: Body that exercises in Cooperative Associations the supervision of all activities of the entity and audits the acts of administrative bodies as well as employees;

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 3 of 17 CNBCR-02/2017 NRP-15 TECHNICAL STANDARDS FOR INTERNAL AUDIT FOR MEMBERS OF THE FINANCIAL SYSTEM Approval: 08/03/2017 Validity: 03/04/2017 q) Board of Directors: Collegiate body in charge of the administration of the entity, with supervisory and control functions. In the case of Cooperative Associations, it will be the Board of Administration, in accordance with what is stipulated in Article 40 of the General Law of Cooperative Associations; r) Objectivity: Independent mental attitude that allows internal auditors to carry out their work with confidence in the product of their labor and without compromising its quality. Objectivity requires that internal auditors do not subordinate their judgment to that of others on audit matters; s) Superintendence: Superintendence of the Financial System; t) Outsourcing of the internal audit activity: It occurs when the entity hires an external service provider, that is, a natural or legal person different from the entity, for the performance of the internal audit activity; and u) IAU: Internal Audit Unit. Composed of a person or group of professionals who exercise the internal audit activity in an entity.

CHAPTER II ON THE EXECUTION OF THE INTERNAL AUDIT ACTIVITY

Responsibilities of the Board of Directors Art. 4.- With the objective that entities have an effective exercise of the internal audit activity, the Board of Directors of these will be responsible at least for the following: a) Ensure that the entity has a structure that allows the internal audit activity to be carried out in accordance with its size, nature of its operations, business segmentation, and organizational complexity; in addition, it must take appropriate actions so that this activity has the necessary human, technical, and material resources for the adequate and effective execution of its functions; b) Ensure that the IAU exercises the internal audit activity with absolute independence and authority, in accordance with the provisions established in these Standards; c) That members of the IAU possess the necessary competencies to perform their functions effectively, efficiently, and timely; such that the IAU has the capacity to present and support technically and professionally its points of view, findings, and conclusions directly with the Audit Committee and the Board of Directors, contributing to the latter to supervise Senior Management; d) Approve the internal audit statute; e) Approve the annual internal audit plan and the respective modifications; f) Stipulate the remuneration of the Internal Auditor in accordance with the entity's remuneration policies and practices; in accordance with the hierarchy of its functions and adequately structured to avoid the origin of conflicts of interest, ensuring that independence and objectivity are maintained; and g) Appoint, transfer, suspend, dismiss, or accept the resignation of the Internal Auditor. Any of these decisions, duly reasoned, must be recorded in the respective minutes book and send a certified copy of the corresponding agreement to the Superintendence within five business days, counted from the date on which the act has been materialized. In the event that the Board of Directors appoints an interim Internal Auditor, this person will exercise their functions for a maximum period of six months from their appointment, complying with the requirements set forth in Article 9 of these Standards.

Internal Audit Activity Art. 5.- The internal audit activity must be independent and objective; of assurance and consultation; structured to add value and recommend improvements in the processes and operations of the entity; supporting the Board of Directors and Senior Management in the fulfillment of their objectives; applying a systematic and disciplined approach in the evaluation and improvement of the quality of the effectiveness and efficiency of risk management, internal control, and corporate governance processes. When the entity requires it, it may advise on internal control elements in new projects, products, and services ensuring due compliance with laws, standards, and other applicable provisions to the entity.

Risk-based Audit Art. 6.- The internal audit activity must apply a methodology that focuses mainly on the inherent risk of business processes or activities and that offers guarantees that the risk is being managed by the Board of Directors within the defined risk appetite level. The IAU must carry out periodic reviews of the areas subject to examination, based on the results of its risk assessment, which include policies, procedures, and management measures established in response to the current legal framework.

Compliance with Codes of Ethics Art. 7.- Those who exercise the internal audit activity must comply with the entity's code of ethics, those issued by the Institute of Internal Auditors, and other applicable regulations. These codes will apply to both persons and entities that provide internal audit services. The purpose of these codes will be to promote a culture of ethics in the internal audit profession.

Internal Audit Statute Art. 8.- Entities must have an Internal Audit Statute that describes the purpose, authority, and responsibility of the internal audit activity, which must be reviewed at least once a year and include at least the following: a) The objectives and scope of the internal audit activity; b) Powers and prohibitions of the internal audit activity;

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 4 of 17 CNBCR-02/2017 NRP-15 TECHNICAL STANDARDS FOR INTERNAL AUDIT FOR MEMBERS OF THE FINANCIAL SYSTEM Approval: 08/03/2017 Validity: 03/04/2017 c) The organizational location and to whom the management of the internal audit activity will report within the entity; d) The responsibility and authority of the Internal Auditor to evaluate the effectiveness of risk management, internal control, and governance processes of the institution, among others; and e) Unrestricted access to records, personnel, and assets of the entity for the performance of their work.

On the Internal Auditor Art. 9.- The Internal Auditor must work full-time and hold a bachelor's degree in public accounting or related to the internal audit activity. If the degree is different, at least three years of experience in audit work on financial topics must be accredited, as well as knowledge and mastery in topics related to risk management, internal control, and corporate governance. To opt for the position of Internal Auditor, in addition to meeting the requirements mentioned in the previous paragraph, they must not be in any of the following circumstances: a) Having been convicted by a final judgment in the country or abroad for the commission or participation in any crime; b) Having conflicts of interest with the supervised entity or with the legal persons that are part of the financial conglomerate to which they belong; and c) In the case of Internal Auditors of the IAUs of Pension Fund Administrators, what is established in Article 55 of the Law of the Sist