Technical Standards for Internal Audit for Members of the Financial System

NRP-15
TECHNICAL STANDARDS FOR INTERNAL AUDIT FOR MEMBERS OF THE FINANCIAL SYSTEM Approval:
08/03/2017
Validity: 03/04/2017

The COMMITTEE OF STANDARDS OF THE CENTRAL BANK OF RESERVE OF EL SALVADOR,

CONSIDERING:

I. That in accordance with Article 2, second paragraph, of the Law on Supervision and Regulation of the Financial System, for the proper functioning of the Financial Supervision and Regulation System, it is required that members of the financial system and other supervised entities comply with current regulations and the adoption of the highest standards of conduct in the development of their business, acts, and operations, in accordance with what is established in the aforementioned Law, in other applicable laws, in regulations, and in technical standards issued for such effect.

II. That Article 7 of the Law on Supervision and Regulation of the Financial System establishes the entities subject to the supervision of the Superintendence of the Financial System.

III. That in accordance with Article 35, first paragraph, and letters a) and b) of the Law on Supervision and Regulation of the Financial System, directors, managers, and other officials holding positions of direction or administration in members of the financial system must conduct their business, acts, and operations complying with the highest ethical standards of conduct and acting with the due diligence of a good merchant in their own business, being obligated to comply with and ensure that in the institution they direct or work in, compliance with the legal, regulatory, and normative provisions that regulate the activity of members of the financial system, as well as with the instructions issued by the Superintendence of the Financial System in accordance with their legal powers.

IV. That in accordance with Article 36, second paragraph, of the Law on Supervision and Regulation of the Financial System, directors, administrators, managers, internal and external auditors, other officials, and other persons providing services to any member of the financial system must report to the Superintendence of the Financial System the operations that it has required, particularly those carried out or that have been carried out between it and its shareholders or administrators, and those related to the financial conglomerate to which it belongs, if applicable; and that the form, periodicity, and circumstances in which these operations must be reported will be established in the technical standards issued for such effect.

V. That in accordance with Article 39, letter b) of the Law on Supervision and Regulation of the Financial System, the Audit Committee of members of the financial system must follow up on the observations made in the reports of the internal auditor, the external auditor, the Superintendence of the Financial System, and other public institutions, to correct them or to contribute to their resolution, which must be reported promptly to the Superintendence of the Financial System.

VI. That in accordance with Article 40, first and third paragraphs, of the Law on Supervision and Regulation of the Financial System, the Superintendent may cite or take testimony at any time from any person who has knowledge of any fact that needs to be clarified in any operation of the supervised entities, and that directors, administrators, managers, employees, external auditors, other officials, and other persons providing services in any member of the financial system must inform the Superintendence of the Financial System of all events of which they have knowledge in the performance of their functions that suggest the existence of facts or circumstances that could be considered illegal, or that could put at risk the stability and functioning of the member of the financial system.

VII. That it is of utmost importance that in every entity, the Internal Audit Activity is exercised to guarantee to the Board of Directors, Senior Management, supervisors, and the general public, a proper functioning of the administrative and financial operations of the entity and to allow it to permanently evaluate the effectiveness and efficiency of its internal control systems, risk management, and corporate governance; the reliability and integrity of financial and operational information; as well as to reduce potential risks of losses and damage to the entity's reputation.

VIII. That international standards suggest, among other good practice activities, that the Internal Audit Activity must provide independent and objective assurance and consultation on the quality and effectiveness of its internal control, risk management, governance, and processes, implying for this to be competent, honest, and professional for the functions it performs; as well as to gradually adapt its work procedures and techniques to a risk-based audit approach, aspects fundamentally required for the exercise of the Internal Audit Activity of supervised entities.

IX. That in accordance with Article 99, letters a) and f) of the Law on Supervision and Regulation of the Financial System, the Central Bank of Reserve of El Salvador is the institution responsible for the approval of technical standards on any other aspect inherent to risk management by supervised entities; and on the issuance of requirements applicable to internal auditors of members of the financial system, and also to serve as a fundamental support activity for the supervision and control carried out by the Superintendence of the Financial System.

THEREFORE, by virtue of the regulatory powers conferred upon it by Article 99 of the Law on Supervision and Regulation of the Financial System,

AGREES to issue the following:

TECHNICAL STANDARDS FOR INTERNAL AUDIT FOR MEMBERS OF THE FINANCIAL SYSTEM

CHAPTER I
OBJECT, SUBJECTS, AND TERMS

Object
Art. 1.- The object of these Standards is to establish the minimum provisions that entities must consider for the exercise of the internal audit activity, thereby fostering and strengthening the adoption of work procedures and techniques with a risk-based audit approach, in accordance with the size, nature of their operations, business segmentation, and organizational complexity of each entity.

Subjects
Art. 2.- The subjects of these Standards are the following entities:
a) Banks established in El Salvador, their offices abroad, and their subsidiaries; branches and offices of foreign banks established in the country; b) Companies that, in accordance with the law, form part of financial conglomerates, or that the Superintendence declares as such, which includes both their holding companies and their member companies; c) Pension fund management institutions; d) Insurance companies, their branches abroad, and branches of foreign insurance companies established in the country; e) Stock exchanges, stockbrokerage firms, companies specialized in the deposit and custody of securities, risk rating agencies, agents specialized in securities valuation, and general warehouses for deposit; f) Cooperative banks, savings and credit societies, and federations regulated by the Law on Cooperative Banks and Savings and Credit Societies; g) Mutual guarantee companies and their local guarantors; h) Companies that provide complementary services to the financial services of members of the financial system, particularly those in which they participate as investors; i) Administrators or operators of payment systems and securities settlement systems; j) The Social Fund for Housing and the National Fund for Popular Housing; k) The National Institute of Pensions of Public Employees and the Salvadoran Institute of Social Security, the latter with respect to the Public Pension System, the Occupational Risk Regime, and technical health reserves; l) The Social Prevision Institute of the Armed Forces; m) The Agricultural Development Bank, the Mortgage Bank of El Salvador, S.A., and the Development Bank of El Salvador, insofar as it does not contradict their creation laws nor what is provided by the Court of Accounts; n) The Solidarity Fund for the Micro-Enterprise Family, insofar as it does not contradict their creation laws nor what is provided by the Court of Accounts; o) The Salvadoran Investment Corporation; p) Foreign currency exchange houses; q) Securitization companies and the funds they manage; r) The Deposit Guarantee Institute; s) Product and services exchanges; t) Investment fund managers and the funds they manage; u) Money Transfer Companies and Agents whose country of origin is El Salvador in accordance with what is established in the Technical Standards for Registration, Obligations, and Operation of Entities that Carry Out Money Sending or Receiving Operations (NRP-12); (1) v) Electronic Money Provider Companies; and (1) w) Investment banks, their offices abroad, and their subsidiaries. (1)

Terms
Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning:
a) Agent: The legal entity with domicile in the Republic of El Salvador that establishes a contractual relationship with one or more Money Transfer Companies, which carry out money sending or receiving operations, systematically or substantially, by any means, at the national and international level; b) Senior Management: The Executive President, General Manager, or acting person, and the executives who report directly to them; c) Internal Auditor: Person responsible for the effective management of the internal audit activity in accordance with what is regulated in these Standards and the internal audit charters of each entity; d) Internal Audit: According to the International Standards for the Professional Practice of Internal Audit, issued by the Institute of Internal Auditors, it is an independent and objective assurance and consulting activity, conceived to add value and improve the operations of an entity. The internal audit activity helps an entity to achieve its objectives by providing a systematic and disciplined approach to evaluate and improve the effectiveness of risk management, control, and corporate governance processes; e) Code of Ethics for Internal Auditors: The current Code of Ethics of the Institute of Internal Auditors that contains relevant principles for the profession and the exercise of internal audit, and rules of conduct that describe the standards of behavior expected to be observed by internal auditors; f) Conflict of Interest: Refers to any relationship that goes against the best interest of the entity. A conflict of interest can undermine a person's ability to perform their obligations and responsibilities objectively; g) Control: Any measure taken by the Board of Directors, Senior Management, and other parties designated and approved for this purpose by the Board of Directors, to manage risks and increase the probability of achieving established objectives and goals; h) Compliance: Adherence to policies, plans, procedures, laws, regulations, contracts, and other requirements; i) Money Transfer Company or MTC: National or foreign legal entity that, meeting the requirements of its country of origin, provides the service of sending or receiving money, systematically or substantially, by any means, whether its own or third-party; j) Entity: Subject obliged to comply with the provisions of these Standards, listed in Article 2 thereof; k) Charter: Formal written document of the internal audit activity that defines the purpose, authority, and responsibility of said activity. The Charter establishes the position of the internal audit activity within the entity, authorizes access to records, personnel, and relevant assets for the execution of work, and defines the scope of internal audit activities. This document legitimizes the internal audit activity in the entity, granting full work access, independence, and objectivity of the internal audit team as such. Guidelines, mandates, regulations, policies, among others, defined
by the internal audit activity as such may be understood as Charter; l) Risk Management: Strategic process carried out by entities, through which they identify, measure, control, and monitor the different types of risks to which they are exposed and the interrelationships that arise between them, to provide reasonable assurance in the achievement of their objectives. Such management must be in accordance with the magnitude of the entity's activities, businesses, and resources; m) Significant Events: Those events that may have a significant impact on the financial situation and stability of the entity, or on the achievement of its economic and financial objectives. An event has a significant impact when its omission or incorrect presentation can influence the economic decisions that are made; n) Independence: Freedom from conditions that threaten the ability of the internal audit activity to carry out its responsibilities in a neutral manner; o) Pension Institutions: Pension Fund Administrators (AFP), National Institute of Pensions of Public Employees (INPEP), and Salvadoran Institute of Social Security (ISSS); p) Supervisory Board: Body that exercises in Cooperative Associations the supervision of all activities of the entity and audits the acts of administrative bodies as well as employees; q) Board of Directors: Collegial body responsible for the administration of the entity, with supervisory and control functions. For the case of Cooperative Associations, it will be the Board of Administration, in accordance with what is stipulated in Article 40 of the General Law of Cooperative Associations; r) Objectivity: Independent mental attitude that allows internal auditors to carry out their work with confidence in the product of their labor and without compromising its quality. Objectivity requires that internal auditors do not subordinate their judgment to that of others on audit matters; s) Superintendence: Superintendence of the Financial System; t) Outsourcing of the internal audit activity: Occurs when the entity hires an external service provider, that is, a natural or legal person distinct from the entity, to carry out the internal audit activity; and u) IAU: Internal Audit Unit. Composed of one person or a group of professionals who exercise the internal audit activity in an entity.

CHAPTER II
ON THE EXECUTION OF THE INTERNAL AUDIT ACTIVITY

Responsibilities of the Board of Directors
Art. 4.- With the objective that entities have an effective exercise of the internal audit activity, the Board of Directors of these will be responsible at least for the following:
a) Ensure that the entity has a structure that allows the internal audit activity to be carried out in accordance with its size, nature of its operations, business segmentation, and organizational complexity; in addition, it must take appropriate actions so that said activity has the necessary human, technical, and material resources for adequate and effective execution of its functions; b) Ensure that the IAU exercises the internal audit activity with absolute independence and authority, in accordance with the provisions established in these Standards; c) That members of the IAU possess the necessary competencies to perform their functions effectively, efficiently, and timely; such that the IAU has the capacity to present and technically and professionally substantiate its points of view, findings, and conclusions directly with the Audit Committee and the Board of Directors, contributing to the latter to supervise Senior Management; d) Approve the internal audit Charter; e) Approve the annual internal audit plan and respective modifications; f) Stipulate the remuneration of the Internal Auditor in accordance with the entity's remuneration policies and practices; in accordance with the hierarchy of its functions and adequately structured to avoid the origin of conflicts of interest, ensuring that independence and objectivity are maintained; and g) Appoint, transfer, suspend, dismiss, or accept the resignation of the Internal Auditor. Any of these decisions, duly reasoned, must be recorded in the respective minutes book and send a certified copy of the corresponding agreement to the Superintendence within five business days, counted from the date on which the act has been materialized. In the event that the Board of Directors appoints an interim Internal Auditor, this person will exercise their functions for a maximum period of six months from their appointment, must comply with the requirements set forth in Article 9 of these Standards.

Internal Audit Activity
Art. 5.- The internal audit activity must be independent and objective; of assurance and consulting; structured to add value and recommend improvements in the entity's processes and operations; supporting the Board of Directors and Senior Management in the fulfillment of their objectives; applying a systematic and disciplined approach in the evaluation and improvement of the quality, effectiveness, and efficiency of risk management, internal control, and corporate governance processes. When the entity requires it, it may advise on internal control elements in new projects, products, and services, ensuring due compliance with laws, standards, and other applicable provisions to the entity.

Risk-based Audit
Art. 6.- The internal audit activity must apply a methodology that focuses primarily on the inherent risk of business processes or activities and offers assurance that the risk is being managed by the Board of Directors within the defined risk appetite level.
The IAU must perform periodic reviews of the areas subject to examination, based on the results of its risk assessment, which include policies, procedures, and management measures established in response to the current legal framework.

Compliance with Codes of Ethics
Art. 7.- Those who exercise the internal audit activity must comply with the entity's code of ethics, those issued by the Institute of Internal Auditors, and other applicable regulations.
These codes apply to both persons and entities that provide internal audit services. The purpose of these codes will be to promote a culture of ethics in the internal audit profession.

Internal Audit Charter
Art. 8.- Entities must have an Internal Audit Charter that describes the purpose, authority, and responsibility of the internal audit activity, which must be reviewed at least once a year and include at least the following:
a) The objectives and scope of the internal audit activity; b) Powers and prohibitions of the internal audit activity; c) The organizational location and to whom the management of the internal audit activity will report within the entity; d) The responsibility and authority of the Internal Auditor to evaluate the effectiveness of risk management, internal control, and governance processes of the institution, among others; and e) Unrestricted access to the entity's records, personnel, and assets for the performance of their work.

On the Internal Auditor
Art. 9.- The Internal Auditor must work full-time and hold a university degree in public accounting or related to the internal audit activity. If the degree is different, at least three years of experience in audit work on financial topics must be accredited, as well as knowledge and mastery in topics related to risk management, internal control, and corporate governance. To qualify for the position of Internal Auditor, in addition to meeting the requirements mentioned in the previous paragraph, the person must not be in any of the following circumstances:
a) Having been convicted by a final judgment in the country or abroad for the commission or participation in any crime; b) Having conflicts of interest with the supervised entity or with the legal entities that are part of the financial conglomerate to which it belongs; and c) In the case of Internal Auditors of the IAUs of Pension Fund Administrators, what is established in Article 55 of the Law on the Pension Savings System must be observed. The resume of the Internal Auditor and the sworn declaration, in accordance with Annex No. 1 of these Standards, must be sent to the Superintendence within fifteen business days following the assumption of office, where it is stated that they are not in any of the situations exposed in the previous letters.

Responsibilities of the Internal Auditor
Art. 10.- The Internal Auditor must be responsible, at least, for the following:
a) Choose human resources according to the predefined education and experience criteria of the position to effectively fulfill the professional mandate of competence and professional care; b) Ensure that the IAU has the appropriate, sufficient, and effectively assigned material and technological resources to comply with the plan approved by the Board of Directors; c) Design the risk-based audit plan incorporating the comments of Senior Management, and prior validation by the Audit Committee, submit it to the consideration of the entity's Board of Directors for approval; d) Maintain supervision of personnel and contracted services related to the internal audit activity, to verify the quality of these and at the same time guarantee

NRP-15
TECHNICAL STANDARDS FOR INTERNAL AUDIT FOR MEMBERS OF THE FINANCIAL SYSTEM Approval:
08/03/2017
Validity: 03/04/2017

...adequate feedback of results to the corresponding personnel of the UAI, regarding the work performed by external experts. Likewise, verify that the use of experts does not compromise the independence and objectivity of the Internal Audit activity nor the confidentiality or reserve of the entities' information; e) Develop and maintain a quality assurance and improvement program; f) Establish policies and procedures to guide the internal audit activity, in accordance with the size and structure of the UAI as well as the complexity of its work; and g) Immediately and directly inform the Audit Committee in writing of the occurrence of significant facts or of all those events of which it has knowledge in the performance of its functions that suggest the existence of facts or circumstances that could be considered illegal, or that could put the stability and functioning of the entity at risk. This communication must be made within 10 business days following the conclusion of the corresponding evaluations and the issuance of the report. Taking into account the circumstances and importance, the Internal Auditor must inform the Superintendence in advance of the significant facts under examination and send preliminary reports if deemed appropriate. Regarding the UAI's knowledge of divergences between the Risk Unit and Senior Management, and that these have not been reported by the Risk Unit to the Board of Directors regarding the level of risk facing the entity, the Internal Auditor must inform the Board of Directors about such divergences.

Internal Audit Staff Rotation Policy
Art. 11.- With the objective of preventing similar or routine tasks from negatively affecting the critical and objective judgment capacity of the UAI staff, entities must have rotation policies for personnel within this unit, considering for this purpose the experience and competence of its members, except in those entities where, due to the size of their organizational structure, the foregoing is not applicable.

Information Protection
Art. 12.- The Internal Auditor, as well as his collaborators, must be diligent in protecting the information obtained, respecting confidentiality, and not using it for personal or third-party benefit or for malicious actions that detrimentally affect the entity.

UAI Functions
Art. 13.- The functions corresponding to the UAI will include, according to the nature of the business, for the purposes of its audit activity and in accordance with the risk assessment performed by said UAI to establish its annual audit plan, the following:
a) Independently evaluate the effectiveness and efficiency of the internal control systems and processes, risk management, and corporate governance created by the business units and support functions;

NRP-15
TECHNICAL STANDARDS FOR INTERNAL AUDIT FOR MEMBERS OF THE FINANCIAL SYSTEM Approval:
08/03/2017
Validity: 03/04/2017

b) Define the methodologies and strategies to be used in audits of the companies forming a financial conglomerate, when applicable, in accordance with the applicable legal framework; and c) Examine compliance with applicable legal and regulatory provisions; as well as the entity's internal policies, plans, and procedures. In fulfillment of its functions, the UAI must have unrestricted or unlimited access to all information, assets, and personnel of the entity. Likewise, without prior notice, it may conduct audits, inspections, reviews, and any other necessary activity without impediment or detriment. Those who perform the internal audit activity must receive systematic, permanent, and timely training, whether internal or external, on matters related to their functions. The number of required training hours annually shall not be less than forty (40) hours.

CHAPTER III
ON THE INTERNAL AUDIT PROCESS

Business Understanding and Risk Assessment
Art. 14.- The UAI must obtain sufficient understanding of the information and internal control systems as well as the entity's businesses and risks to systematically plan the audit and develop an effective approach to it. The UAI must also employ professional judgment to assess audit risk and design audit procedures to ensure that this risk is reduced to an acceptably low level.

Annual Work Plan
Art. 15.- The UAI must prepare an annually ordered work plan systematically oriented to consider compliance with international standards for the practice of internal audit, the provisions of these Standards, and must also include aspects contemplated according to the entity's own risk-based audit methodology implemented, and must be evaluated by the Audit Committee for approval by the entity's Board of Directors. The UAI's annual plan will include, according to the nature of the business, for the purposes of its audit universe and in accordance with the risk assessment, the following:
a) The loan portfolio, investment portfolio, deposits, received loans, own issuance securities, guarantees and sureties, letters of credit, other international operations, and capital redemption, for the case of investment banks, active and passive operations in legal or foreign currency according to what is established in article 41 of its same Law, when applicable and according to its risk assessment; (1) b) That merchandise deposited in General Warehouses is

NRP-15
TECHNICAL STANDARDS FOR INTERNAL AUDIT FOR MEMBERS OF THE FINANCIAL SYSTEM Approval:
08/03/2017
Validity: 03/04/2017

registered in the Unique Register Ledger Book and that the corresponding deposit certificates and pledge bonds have been issued; likewise, the corresponding encumbrances registered when the latter have been negotiated with third parties; to the entities that apply; c) The production of insurance premiums, claims, reinsurance, salvages, and recoveries, investments, contingencies for granted guarantees, calculations of technical and mathematical reserves, diversification of investments, minimum net worth, and solvency margin, when applicable and according to its risk assessment; d) Business cycles of the pension system, such as: affiliation and transfers; collection and crediting of contributions; granting and payment of benefits; contracting and execution of disability and survivorship insurance; pension fund investments and their valuation; risks in the generation of the entity's and pension fund's financial statements, as well as the availability, income, and expenses of Pension Institutions, among others, when applicable and according to its risk assessment; e) Negotiation of securities on the stock exchange, such as the registration of buy and sell orders, their negotiation, settlement, compensation, and custody of securities, when applicable and according to its risk assessment; f) Transactions negotiated in a products and services exchange, including procedures and activities prior to and during negotiation, contracts for the transfer of goods and services, as well as the monitoring of closed contracts until their settlement, when applicable and according to its risk assessment; g) Constitution, administration, valuation, and liquidation of third-party administered funds, when applicable and according to its risk assessment; h) The effective, timely, and adequate implementation of instructions emanating from observations made by the Superintendence, external auditors, as well as those made by internal audit within the entity; i) Compliance with corporate governance practices, as well as formulating recommendations deemed pertinent to contribute to the improvement of such practices, in such a way that the objectives of promoting ethics and corporate values are fulfilled by the Board of Directors for the entity's members, and the risk of fraud is mitigated; and j) Information systems and the methods and procedures established to guarantee the quality, timeliness, security of information, and business continuity. A copy of this work plan accompanied by the certification of the Board of Directors' approval agreement must be sent to the Superintendence during the month of December of the preceding year. Additionally, a copy must be sent to the entity's external auditors within five business days following their appointment at the Entity's General Shareholders' Meeting. In case modifications to the plan are necessary, these must be reviewed by the Audit Committee for approval by the Board of Directors. Such modifications, in case activities are
eliminated or new ones incorporated, must be sent to the Superintendence and external auditors within the following ten business days after their approval, attaching the necessary justifications. Art. 16.- In the definition of the annual work plan, the following must be included at a minimum:
a) Establishment of objectives and scope and their relationship with the entity's strategic plan; b) Evaluation of the internal control structure and risk assessment; c) Audit universe; d) Audit risk level by process and component of the financial statements; e) Determination of areas and processes to be audited, duly justified; and f) Resources necessary for the execution of the plan, including the personnel available to the UAI and the time budget for the planned work, deducting from the latter, vacation periods, staff training, time estimates for extraordinary work, and unforeseen situations. Likewise, to fulfill the provisions described in the literals of this article, the entity must perform a schedule of audits to be conducted in different periods of the year.

Audit Reports
Art. 17.- Internal audit reports will be presented first to the officials in charge of the evaluated areas to obtain action plans and adoption of preventive and corrective measures as appropriate; these reports must be presented to the Audit Committee and quarterly to the Board of Directors, for their knowledge. Art. 18.- The Internal Auditor must send quarterly to the Superintendence, within thirty days following the close of the corresponding quarter, a report containing at a minimum the following:
a) The degree of compliance with the annual work plan, schedule of planned and performed work; and b) Summary of audit reports issued during the period, which must comprise, at a minimum, the following:
i. Reference or code, report name; date of issuance and distribution thereof;
ii. Objectives and scope;
iii. Main findings, identifying the condition, causes, and effects, as well as recommended measures;

NRP-15
TECHNICAL STANDARDS FOR INTERNAL AUDIT FOR MEMBERS OF THE FINANCIAL SYSTEM Approval:
08/03/2017
Validity: 03/04/2017

iv. Pending and ongoing resolution findings, which includes, the condition, date of finding, implemented or projected actions, responsible party, and expected resolution date; and
v. Observations from reports issued by the Superintendence and by external auditors.

Art. 19.- The presence of the Internal Auditor at Board of Directors meetings is recommended when matters related to the reports he issues are discussed. Decisions adopted regarding this must be recorded in the corresponding minutes book.

Information Submission to the Superintendence
Art. 20.- The information requested in articles 15 and 18 of these Standards will be sent through the means established by the Superintendence, which will be communicated within a maximum period of thirty business days following the entry into force of these Standards.

Document Filing
Art. 21.- The UAI must maintain a file with the supporting documentation of its reports in electronic or physical media that allows the Superintendence and authorized external auditors to verify the scope and results of the activities performed, including the monitoring and implementation of recommendations. It is the UAI's obligation to maintain the aforementioned information for a minimum period of fifteen years.

Quality Controls
Art. 22.- The Audit Committee will verify that quality control programs are carried out, including internal and external review processes, in order to establish security levels that guarantee that the work performed by the UAI is in accordance with audit standards, organization manuals, procedures, and other applicable norms, maintaining high levels of efficiency and effectiveness in the work performed. The results of quality evaluations must be known by the Audit Committee. The frequency of internal reviews will be at least once a year; external reviews must be conducted, at a minimum, once every five years. Internal reviews will be conducted through self-evaluations or by other persons within the entity who have knowledge of internal audit profession standards and the provisions of these Standards. External reviews must be conducted by independent, qualified reviewers from outside the entity, who are natural or legal persons distinct from the entity and who have no conflict of interest in the performance of their work.

NRP-15
TECHNICAL STANDARDS FOR INTERNAL AUDIT FOR MEMBERS OF THE FINANCIAL SYSTEM Approval:
08/03/2017
Validity: 03/04/2017

Follow-up
Art. 23.- The Board of Directors and the Audit Committee must ensure that observations and recommendations contained in reports issued by the Superintendence, external auditors, and the UAI itself are remedied, for which the corresponding follow-up must be given.

Financial Conglomerates
Art. 24.- In the case of financial conglomerates referred to in Chapter I of Title Five of the Banks Law, the UAI may be the same for all member entities of the financial conglomerate, except for pension fund administrators.
With prior consultation with the Board of Directors, the Internal Auditor of the holding company or controlling bank must define the internal audit strategy to be used in the companies forming the financial conglomerates and determine the internal organization of the activity, both at the holding level and at the level of the companies that integrate it, with the objective of ensuring the quality and methodology of internal audit employed. The UAI must have effective control systems to verify that all companies controlled by a bank or a sole-purpose holding company comply with policies established by the Board of Directors, local regulations, and those of their parent company.

CHAPTER IV
OTHER PROVISIONS AND VALIDITY

Art. 25.- For the case of Cooperative Associations, the Supervisory Board will have responsibility for the internal audit activity, which will be supported by the work performed by officials designated by the Administration Council for such purposes, according to its organizational complexity. Outsourcing of Internal Audit Activity Art. 26.- Entities whose organizational structure and volume of operations do not allow them to hire an Internal Auditor may outsource the internal audit activity and comply clearly and explicitly through contract with the provisions of these Standards. Such outsourcing must be based on the entity's needs, resources, complexity, and volume of transactions. In case the entity outsources the internal audit activity, contracts must include necessary clauses to ensure compliance with internal policies and procedures, as well as proper handling and confidentiality of information, clearly including the scope and responsibilities of the provider, especially regarding reserve and confidentiality; additionally, clauses must be included obligating them to document the services they provide, clearly establishing that documents, inputs, and working papers are the property of the contracting entity. Likewise, clauses must be included that allow the Superintendence to adequately review the work performed by external providers to the entities receiving the services. Furthermore, entities must maintain an orderly record of all contracted services related to the internal audit activity containing the provider's name, counterparty, type of service, contract amount, and validity. This control must be available to the Superintendence, when required. Entities will be responsible for ensuring that those who outsource the internal audit activity have the necessary suitability and adequate human resources for the execution of said activity according to what is required in these Standards. Likewise, it must ensure that the external service provider does not meet the following conditions:
a) That it has not been hired in the previous 3 years to perform any consulting in any area within the entity; b) The external service provider who has participated in any internal audit contract must not provide consulting services to any function of the entity that it has audited in the last year; and c) That the external service provider is not the same company that provides external audit services to the entity. Requirements for Specialized Service Providers Art. 27.- Entities may hire an external service provider for the execution of internal audit activity for specific specialized processes, such as information system audits. Entities that hire companies or independent professionals to supply specialized service audit services must require from them experience and specialization in said practice, for which it will be preferable that they are accredited through valid professional certifications. For the case of information system audits, the company or natural or legal person that developed said system cannot be hired to audit the same system. Procedures in Process Art. 28.- The administrative procedures and resources that were pending on the date of validity of these Standards will continue to be performed according to the regulation with which they were initiated.

NRP-15
TECHNICAL STANDARDS FOR INTERNAL AUDIT FOR MEMBERS OF THE FINANCIAL SYSTEM Approval:
08/03/2017
Validity: 03/04/2017

Repeal
Art. 29.-
-04), approved in
Board of Directors Session No. CD-09/97 of March 5, 1997, of the approved by the Superintendent of Pensions on December 28, 2000 and whose Organic Laws were repealed by Legislative Decree number 592 containing the Law of Supervision and Regulation of the Financial System, published in Official Gazette number 23, Volume 30, dated February 2, 2011. Unforeseen Aspects Art. 30.- Aspects not provided for in regulatory matters in these Standards will be resolved by the Central Reserve Bank of El Salvador through its Standards Committee. Validity Art. 31.- These Technical Standards will enter into force starting from April 3, 2017. MODIFICATIONS:
(1) Modifications in article 2 and 15 approved by the Standards Committee of the Central Reserve Bank of El Salvador, in Session No. CN-08/2025, of September 30, 2025, with validity starting from October 15, 2025.

NRP-15
TECHNICAL STANDARDS FOR INTERNAL AUDIT FOR MEMBERS OF THE FINANCIAL SYSTEM Approval:
08/03/2017
Validity: 03/04/2017

Annex No. 1

MODEL OF SWORN STATEMENT FOR BEING AN INTERNAL AUDITOR OF AN ENTITY MEMBER OF THE FINANCIAL SYSTEM

In the city of San Salvador, at _______ hours on the day ________ of _______ of two thousand ____. Before me, _______ notary of the domicile of ______________ appears the gentleman _________ of ________________ years, (profession) _______, of the domicile _____________ whom I know (or do not know), holder of (or identify by) Unique Identity Document number (or passport number)________, who acts in his own name, and HE SAYS: That in his capacity as director (manager or administrator) of the society ___________________, UNDER OATH HE MAKES THE FOLLOWING DECLARATIONS: A) That he has knowledge in financial or marketing topics. B) That he has not been judicially qualified as responsible for a culpable or fraudulent bankruptcy. C) That he has not been administratively or judicially sanctioned for participating in a serious violation of laws and norms of a financial nature, both in national and foreign jurisdiction. D) That he has not been convicted by a final judgment in the country or abroad for having committed or participated fraudulently in the commission of any crime. E) That it has not been judicially proven his participation in activities related to drug trafficking and connected crimes, terrorism financing, money laundering, and asset laundering, both in the national and foreign jurisdiction. The undersigned notary certifies: that he explained to the declarant what is established in the Penal Code, regarding the crime of ideological falsity, regulated in article two hundred and eighty-four. Thus the declarant expressed himself, whom I explained the legal effects of the present notarial act, which consists of _____ sheet(s) front and back; and read to him by me, in a single act without interruption and entirely, he ratifies its content and we sign. I CERTIFY. (1)

The Sworn Statement must comply with what is established in the Notary Law.