Technical Standards for the Provision of External Audit Services

NRP-18
EXTERNAL AUDIT
Approval: 03/27/2019
Validity: 05/02/2019

THE TECHNICAL COMMITTEE OF THE CENTRAL RESERVE BANK OF EL SALVADOR,

CONSIDERING:

I. That Article 7, third paragraph, of the Law on Supervision and Regulation of the Financial System establishes that the Superintendency will also supervise, whether they are natural or legal persons, external auditors, specifically regarding the performance of their functions and the provision of services to members of the Financial System.

II. That Article 35, letter f), of the Law on Supervision and Regulation of the Financial System establishes that adequate accounting disclosure of the economic and financial reality must be supported by both internal and external audits.

III. That Article 36, first paragraph, of the Law on Supervision and Regulation of the Financial System establishes that external auditors must provide an opinion to the General Shareholders' Meeting or superior administrative body and to the Board of Directors or governing body of the financial system member in question, regarding the integrity, adequacy, and effectiveness of internal control systems.

IV. That Article 36, second paragraph, of the Law on Supervision and Regulation of the Financial System establishes that the external auditor is one of the obligated subjects to report to the Financial System Superintendency the operations that it has requested, particularly those carried out or that have been carried out between a member of the financial system and its shareholders or administrators, and those related to the financial conglomerate to which it belongs, if applicable.

V. That Article 40, third paragraph, of the Law on Supervision and Regulation of the Financial System establishes that external auditors are, among others, obligated subjects to inform the Financial System Superintendency of all events of which they have become aware in the performance of their functions and that suggest the existence of facts or circumstances that could be considered illegal or that could put at risk the stability and functioning of the entity that is a member of the financial system.

VI. That Article 46, third paragraph, of the Comprehensive Law on the Pension System establishes that the minimum audit requirements that external auditors must comply with regarding the independent audits they carry out in Administrators will be established in the Technical Standards issued by the Central Reserve Bank through its Technical Committee. The Superintendency will have the authority to verify compliance with these minimum requirements. (1)

NRP-18
EXTERNAL AUDIT
Approval: 03/27/2019
Validity: 05/02/2019

VII. That Article 99, letter f), of the Law on Supervision and Regulation of the Financial System establishes that it is the responsibility of the Technical Committee of the Central Reserve Bank to issue requirements applicable to internal and external auditors as well as to the Audit Committees of the members of the financial system.

VIII. That Article 63 of the Banking Law and Article 44 of the Investment Banks Law establish that external auditors must inform the Superintendency about the compliance with the internal control policies and systems that banks must implement to manage their financial and operational risks; as well as those that allow them to know their clients in a reliable manner. (1)

IX. That according to what is established in Article 119 of the Banking Law, the financial statements of the member companies of a conglomerate, as well as the consolidated statements of the holding company, must be audited by the same external auditor registered with the Financial System Superintendency, and the member companies of a conglomerate located abroad must be audited by associated firms or correspondents of the holding company's auditors, and if this is not possible, by internationally recognized audit firms.

X. That Article 226, second paragraph, of the Banking Law and Article 59 of the Investment Banks Law establish obligations and functions of the external auditor when performing this function in banks and investment banks. (1)

XI. That Article 87, third paragraph, of the Insurance Companies Law establishes that external auditors regarding the independent audits they carry out in insurance companies must comply with the minimum requirements established by the Financial System Superintendency, a power that, in accordance with Article 101 of the Law on Supervision and Regulation of the Financial System, was transferred to the Central Bank through its Technical Committee.

XII. That Article 9, letter c), of the Securities Market Law establishes as one of the requirements to be presented to be registered as an issuer in the Public Stock Exchange Register the audited financial statements of the issuer, duly audited by external auditors registered in the Public Stock Exchange Register of the Superintendency.

XIII. That Article 83, third paragraph, of the Securities Market Law and Articles 29 and 62 of the Asset Securitization Law empower the Securities Superintendency to establish the minimum audit requirements that external auditors of entities subject to its control, oversight, and surveillance must comply with, a power that, in accordance with Article 101 of the Law on Supervision and Regulation of the Financial System, was transferred to the Central Bank through its Technical Committee.

NRP-18
EXTERNAL AUDIT
Approval: 03/27/2019
Validity: 05/02/2019

XIV. That it is necessary to harmonize and update the foundations required for the exercise of the external audit function for the members of the financial system supervised by the Financial System Superintendency, towards a risk-based audit approach in accordance with current laws and standards, and standards or norms adopted or issued by the Supervisory Council.

XV. That Article 9, second paragraph, number 11, of the Special Law for the Prevention, Control, and Sanction of Money Laundering, Terrorism Financing, and Financing of the Proliferation of Weapons of Mass Destruction regulates that obligated subjects must have external or specialized audit on risk management to evaluate and issue reports on the evaluation of the prevention system's management. (2)

THEREFORE,

by virtue of the regulatory powers conferred by Article 99 of the Law on Supervision and Regulation of the Financial System,

AGREES to issue the following:

TECHNICAL STANDARDS FOR THE PROVISION OF EXTERNAL AUDIT SERVICES

CHAPTER I
OBJECT, SUBJECTS, AND TERMS

Object
Art. 1.- These standards aim to establish the minimum provisions that regulate the professional external audit services provided by external audit firms, whether natural or legal persons, to members of the financial system and securities issuers. (2)

The additional services that the external auditor provides to members of the financial system and that are legally compatible or permitted in accordance with what is established in the Code of Ethics, issued or adopted by the Supervisory Council of the Public Accounting and Auditing Profession, will not be subject to these Standards.

Subjects
Art. 2.- The subjects obligated to comply with the provisions established in these Standards are external audit firms, whether natural or legal persons, that are registered in the Registry of the Financial System Superintendency and that provide their professional external audit services to the following entities:

a) Banks incorporated in El Salvador, their offices abroad, their subsidiaries, and the branches of foreign banks established in the country;

b) Companies that, in accordance with the law, form part of financial conglomerates or that the Superintendency declares as such, which includes both their holding companies and their member companies;

c) Pension fund management companies and the funds they manage;

d) Insurance companies, their branches abroad, and the branches of foreign insurance companies established in the country;

e) Stock exchanges, brokerage houses, companies specialized in the deposit and custody of securities, risk rating agencies, institutions that provide auxiliary services to the stock market, specialists in securities valuation, and general warehouses;

f) Cooperative banks, savings and credit societies, and federations regulated by the Cooperative Banks and Savings and Credit Societies Law;

g) Mutual guarantee societies and their local reinsurance providers;

h) Companies that offer complementary services to the financial services of members of the financial system, particularly those in which they participate as investors;

i) Management companies or operators of payment systems and securities settlement systems;

j) The Social Housing Fund and the National Popular Housing Fund;

k) The Salvadoran Institute of Pensions and the Salvadoran Institute of Social Security, the latter with respect to the Public Pension System, the Occupational Risks Regime, and health technical reserves, insofar as it does not contradict what is provided by the Comptroller General's Office of the Republic; (1)

l) The Social Welfare Institute of the Armed Forces, insofar as it does not contradict what is provided by the Comptroller General's Office of the Republic;

m) The Agricultural Development Bank, the Mortgage Bank of El Salvador, S.A., and the Development Bank of El Salvador, insofar as it does not contradict their creation laws nor what is provided by the Comptroller General's Office of the Republic;

n) The Salvadoran Investment Corporation;

o) Foreign currency exchange houses;

p) Securitizers and the funds they manage;

q) The Deposit Guarantee Institute and the Financial Sanitation and Strengthening Fund in all matters concerning their laws and regulations;

r) Product and services exchanges;

s) Investment fund managers and the funds they manage;

t) Money transfer companies and agents whose country of origin is El Salvador in accordance with what is established in the "Technical Standards for the Registration, Obligations, and Operation of Entities that Carry Out Money Sending or Receiving Operations through Subagents or Administrators of Subagents" (NRP-19); (1)

u) Electronic money provider companies; (1)

v) Securities issuers, in accordance with Articles 9 and 20 of the Securities Market Law; and (1)

w) Investment Banks incorporated in El Salvador, their offices abroad, and their subsidiaries. (1)

The entities mentioned in the letters of this article will be responsible for complying with the provisions established in Articles 5, 6, 9, and 10 of these Standards.

Terms
Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning: (2)

a) Shareholder: Direct owners of the shares of the entities subject to the application of these Standards; the term will also serve to refer to the associates of cooperative associations subject to the application of these Standards;

b) External auditors: External audit firms, whether natural or legal persons, that are registered in the Registry of the Financial System Superintendency;

c) AFP: Pension Fund Administrator; (1)

d) Central Bank: Central Reserve Bank of El Salvador;

e) Supervisory Council: Supervisory Council of the Public Accounting and Auditing Profession;

f) Internal control: The process designed, implemented, and maintained by the entity's governance responsible parties, management, and other personnel, with the aim of providing reasonable assurance regarding the achievement of the entity's objectives related to the reliability of financial information, the effectiveness and efficiency of operations, as well as compliance with applicable legal and regulatory provisions;

g) Fund(s): In matters of the securities market, to securitization funds or investment funds; in matters of pensions, to Pension Funds;

h) Fraud: Intentional act carried out by directors, managers, and other officials holding management or administrative positions responsible for the governance of the audited entity, employees, or third parties that involves the use of deception to obtain an unjust or illegal advantage;

i) ISSS: Salvadoran Institute of Social Security;

j) Non-compliance: Actions or omissions by the entity, intentional or not, that are contrary to current legal and regulatory provisions;

k) ISP: Salvadoran Institute of Pensions; (1)

l) Professional judgment: The application of relevant practical training, knowledge, and experience, in the context of auditing, accounting, and ethics standards, to make informed decisions about the appropriate course of action based on the circumstances of the audit engagement;

m) Board of Directors: Collegiate body responsible for the administration of the entity, with supervisory and control functions; in the case of Cooperative Associations, it will be the Board of Administration;

n) General Meeting: General Shareholders' Meeting, General Partners' Assembly, or its equivalent;

o) LCP: Public Procurement Law; (1)

p) AML/CFT/CPF: Money Laundering, Terrorism Financing, and Financing of the Proliferation of Weapons of Mass Destruction; (1) (2)

q) Pension Law: Comprehensive Law on the Pension System; (1)

r) ISA: International Standards on Auditing issued by the International Federation of Accountants (IFAC); (1)

s) Working papers: Audit documentation, physical and/or electronic, in accordance with current legislation, which includes the record of audit procedures applied, relevant audit evidence obtained, and conclusions reached by the auditor; (1)

t) PS: Pension System; (1)

u) SPP: Public Pension System, constituted by the ISSS and the ISP; (1)

v) Superintendency: Financial System Superintendency; and (1)

w) UIF: Financial Investigation Unit of the Attorney General's Office. (1)

CHAPTER II
ON EXTERNAL AUDIT, APPOINTMENT, AND SEPARATION OF EXTERNAL AUDITORS

Preliminary Provisions
Art. 4.- For the purposes of these Standards, external audit will be understood as the independent professional service provided by an external audit firm, which consists of the inspection and/or verification of the accounting of the entities mentioned in Article 2 of these Standards, in order to verify whether their accounts adequately reveal or do not reveal the equity, financial situation, and results obtained, in accordance with the legal, regulatory, and financial framework applicable to each entity.

The external auditor will carry out their work complying with these Standards, the legal framework applicable to them, the ethical and technical standards approved and/or adopted by the Supervisory Council, the International Standards on Auditing, from which, as a result, they can issue an independent opinion on whether the financial statements have been prepared, in all material aspects, in accordance with the legal, regulatory, and financial framework applicable to each entity, which provides reasonable assurance to users thereof, that they do not contain material errors or omissions.

The execution of the external audit must correspond to the business nature, equity strength, volume of operations, and legal and special provisions in the matter in which they carry out their operations.

Appointment of the auditor
Art. 5.- The appointment of the external auditor of the entities mentioned in Article 2 of these Standards will be the responsibility of the General Meeting or the administrative body that, by legal provision, has this attribution, who may also appoint the substitute external auditor.

The appointment will be made on the date the Ordinary General Shareholders' Meeting is held or on the date established in the legal provisions applicable to the members of the financial system.

The appointed external auditor must be independent of the financial system member that hires them, be registered in the Registry kept for such purposes by the Superintendency, and issue a sworn declaration in which they attest that the partners, directors, administrators, and persons in charge of directing auditors and who sign the audit reports during the period of their appointment are not in any of the circumstances that prevent them from providing external audit services, established in the legal framework applicable to their clients, as well as in the circumstances of loss of independence of judgment established in the Professional Code of Ethics for Auditors and Accountants, issued or adopted by the Supervisory Council.

In the case of banks, the limit of these entities audited by the same external auditor will be three. The same condition will apply to Savings and Credit Societies.

In the case of Investment Banks, the limit of these entities audited by the same audit firm will be three, in accordance with Article 61 of the Investment Banks Law. (1)

For the foregoing, in the case of the ISSS, the ISP, the Social Housing Fund, the National Popular Housing Fund, the Social Welfare Institute of the Armed Forces, the Development Bank of El Salvador, the Financial Sanitation and Strengthening Fund, the Salvadoran Investment Corporation, and the Agricultural Development Bank, the contracting and appointment process will be carried out in accordance with the provisions established in the special legislation applicable to each, the LCP, and its Regulations. (1)

The appointment will be for one year, prior to the technical opinion of the Audit Committee or the Evaluation Commission appointed for this purpose, as provided in the LCP. (1)

Communication of the appointment of the external auditor to the Superintendency Art. 6.- The entities listed in all the letters of Article 2 of these Standards must communicate to the Superintendency, no later than ten business days after the date of appointment, the name of the selected external auditor, attaching the certification of the minute point of the General Meeting or its equivalent where it was approved and the certified copy of the contract signed between the parties, which must contain the obligations of each of them, in accordance with the minimum requirements established in these Standards.

Access to working papers
Art. 7.- The external auditor must allow the Superintendency to know the execution of the audit at all times and to access the working papers, providing it with the information it requests through the means and form that it defines, considering at least what is indicated and the deadlines established in Article 23 of these Standards.

Rotation of external audit managers
Art. 8.- In order to strengthen the independence of external auditors, the manager, supervisor, and personnel responsible for the assigned audit must be rotated after five years of auditing the same entity.

Separation or resignation of the external auditor Art. 9.- The external auditor must notify in writing, explaining to the Superintendency the reasons for resignation from their position, the intention to do so, or the termination of their contract with the entity that hired them, notification which must be made no later than three business days after the event occurred. In case of termination, the entities mentioned in Article 2 of these Standards must notify the Superintendency in writing of the reasons for the termination of the contract with the external auditor and from what date it has occurred, indicating at the same time the name of the substitute and the date from which the latter will begin their functions. In these cases, the notifications must be made no later than three business days after their appointment.

Art. 10.- The General Meeting or the administrative body that, by legal provision, has this attribution may accept the resignation of external auditors or separate them from their function, within the validity of the contract, in case they breach the contract or when the Superintendency, in accordance with its legal powers, sanctions external auditors with suspension or cancellation in the respective registry.

CHAPTER III
PLANNING OF THE EXTERNAL AUDITOR'S WORK

NRP-18
EXTERNAL AUDIT
Approval: 27/03/2019
Validity: 02/05/2019

General Aspects

Art. 11.- External auditors subject to these Standards must submit the audit plan to the Superintendency no later than thirty business days after signing the service provision contract. The audit plan must include the overall strategy that determines the scope, timing, and direction of the audit and guides the development of the audit plan, such that the Superintendency has knowledge of the dates when control tests and analytical procedures will be performed, and their scope; the start dates and the deadline dates for the delivery of interim and final reports, respectively; the latter dates mentioned must be prior to the publication dates of the financial statements.

Art. 12.- In accordance with the provisions of Article 36 of the Law on Supervision and Regulation of the Financial System, with the objective that the external auditor opines on the integrity, adequacy, and effectiveness of the internal control systems of the audited entities. The audit plans of the entities listed in Article 2 of these Standards must include the following general aspects:

a) General information relative to:
i. Audit objectives;
ii. Background of the audited entity;
iii. Focus and scope of the audit;
iv. Dates for review and issuance of reports and/or management letters;
v. Personnel who will perform the audit;
vi. Risk assessment matrix;
vii. Program for visits to the entity and its agencies or branches, where applicable;
viii. Description of the study and evaluation of the auditee's internal control; and
ix. Audit programs, which must be in harmony with the assertions determined in the risk assessment. In the event that situations impacting the risk assessment are known, this program may be modified, which must be notified to the Superintendency no later than 10 business days after the change is implemented.

b) Verify that the entity has license contracts for the use of computer programs and/or software;

c) Verify that the audited entity has reviewed, through an independent technical expert, that the computer programs and/or software to be used for the generation of financial statements allow them to ensure that operations performed are properly recorded;

d) Evaluate compliance with legal and regulatory provisions regarding the prevention of risks of Money Laundering/Financing of Terrorism/Proliferation of Weapons of Mass Destruction (LDA/FT/FPADM) applicable to the audited entity and inform promptly the Board of Directors or equivalent body, Senior Management, the Compliance Officer, and the Financial Intelligence Unit (UIF), regarding any matter that has come to their knowledge in relation to the aforementioned risks; (1)

e) Verify compliance with procedures employed, internal policies, technical standards, and legislation applicable to the audited entity;

f) Review of the minutes of the General Meeting, Board of Directors, and various committees, as well as cross-referencing with the Superintendency during the examined period;

g) Send requests for balance confirmations to third parties, selectively, originating from operations with the audited entity; and

h) Comply with the requirements arising from the application of Articles 36 and 40 of the Law on Supervision and Regulation of the Financial System, regarding reporting to the Superintendency the operations that it requires, particularly those carried out or that have been carried out between the audited entity and its shareholders or administrators, and those related to the financial conglomerate to which it belongs, if applicable, and all events that they have become aware of in the performance of their functions and that suggest the existence of facts or circumstances that may be considered illegal or that could put the stability and functioning of the audited entity at risk.

Constituted Banks in El Salvador, Investment Banks, branches of foreign banks established in the country, and Savings and Credit Societies (1)

Art. 13.- To comply with what is established in Article 226 of the Banks Law and Article 59 of the Investment Banks Law, the planning of the audit of banks, investment banks, and savings and credit societies must comprise, as a minimum, in addition to the aspects included in Article 12 of these Standards, plans to effect the following: (1)

a) Evaluation of credit risk assets (loan portfolio and contingent operations), according to the techniques and procedures deemed appropriate by the external auditor, using the criteria established in the Standards for Classifying Credit Risk Assets and Establishing Prudential Reserves (NCB-022);

b) Conduct periodic examinations of the processes of the integrated risk systems employed by banks and savings and credit societies, as well as the management processes carried out by business units and the verifications of risk units;

c) Evaluation of the procedures used to determine the following:
i. The relationship between the equity fund and weighted assets, in accordance with what is established in Articles 41 and 42 of the Banks Law and Articles 24 and 25 of the Investment Banks Law. For the case of savings and credit societies, based on the equity fund requirement, established in Article 25 of the Cooperative Banks and Savings and Credit Societies Law; (1)
ii. The development of compliance tests of control policies and procedures for the management of financial and operational risks, with the objective of verifying compliance with what is indicated in Article 63 of the Banks Law and Article 44 of the Investment Banks Law; and (1)
iii. For the case of investment banks, the valuation of assets received as collateral, as well as investments made both locally and abroad. (1)

d) The debt limits regulated in Article 197 of the Banks Law and Article 161 of the Cooperative Banks and Savings and Credit Societies Law;

e) Credits and contracts with related persons regulated in Articles 203 and 204 of the Banks Law and Articles 19 and 20 of the Investment Banks Law; (1)

f) Compliance with the establishment, calculation, use, and remuneration of the liquidity reserve for financial entities, established in Chapter VI of Title Second of the Banks Law and Articles 30 to 36 of the Investment Banks Law; (1)

g) Verify the following components:
i. Liquidity;
ii. Investment portfolio;
iii. Loan portfolio;
iv. Deposits;
v. Guarantees and sureties;
vi. Import and export letters of credit;
vii. Guarantee letters;
viii. Income;
ix. Administrative expenses; and
x. Other assets.

h) Description of pending lawsuits that could harm the equity of the bank and savings and credit societies;

i) Description of relevant events that have occurred during the period;

j) Verify the effectiveness of the accounting control systems of banks and savings and credit societies; and

k) Verify compliance with internal policies and control systems that allow them to adequately manage their financial and operational risks; considering, among others, provisions regarding management, destination, and diversification of credit and investments, liquidity management, interest rates, and foreign currency operations, as well as those carried out abroad and the policies, practices, and procedures that allow them to reliably know their customers.

For the evaluation, the proper functioning of internal validation processes, the transparency and accessibility of the data flow associated with the risk measurement system and its processing must be considered. Likewise, it must review the minutes of the General Meeting, Board of Directors, or equivalent body, and various committees, as well as cross-referencing with the Superintendency, during the examined period.

Insurance Companies

Art. 14.- The planning of the audit of Insurance Companies must comprise, as a minimum, in addition to the aspects included in Article 12 of these Standards, plans to effect the following:

a) Evaluation of technical reserves in general, including risk in force reserves, mathematical reserves, actuarial reserves, claim reserves, and provision reserves, using the criteria defined in the “Standards for the Establishment of Technical Reserves of Insurance Companies” (NCS-011) and “Standards for the Establishment of Reserves for Provisional Insurance Derived from the Pension Savings System” (NCS-012);

b) Evaluation of premium receivables reserves and other asset reserves;

c) Evaluation of credit risk assets, including the techniques and procedures deemed appropriate by the external auditor, but using the criteria for the evaluation and qualification of debtors contained in the “Standards for Classifying Credit Risk Assets and Establishing Prudential Reserves” (NCB-022);

d) Evaluation of the procedures used to determine:
i. Related credits, as provided in Articles 27 and 28 of the Insurance Companies Law and Article 11 of the Regulations of the Insurance Companies Law;
ii. The verification of the solvency margin, as established in Article 31 of the Insurance Companies Law; and
iii. The limits on the distribution of investments referred to in Articles 34 and 35 of the Insurance Companies Law.

e) Examine the following components:
i. Availability;
ii. Investments;
iii. Credit portfolio;
iv. Premiums receivable;
v. Product premiums;
vi. Ceded premiums;
vii. Guarantees and sureties;
viii. Technical and mathematical reserves;
ix. Reinsurance and coinsurance;
x. Salvage and recoveries;
xi. Contingent operations;
xii. Claim expenses; and
xiii. Administrative expenses.

Cooperative Banks

Art. 15.- The planning of the external audit for cooperative banks must comprise, as a minimum, in addition to the aspects included in Article 12 of these Standards, plans to effect the following:

a) Evaluation of credit risk assets (loan portfolio and contingent operations), according to the techniques and procedures deemed appropriate by the external auditor, but employing the criteria for the evaluation and qualification of debtors contained in the “Standards for Classifying Credit Risk Assets and Establishing Prudential Reserves” (NCB-022), applicable to them;

b) The verification of the procedures used to determine the following:
i. The compliance with the capital redemption limit established in Article 22 of the Cooperative Banks and Savings and Credit Societies Law;
ii. The ownership limit in the paid-up share capital of a cooperative, established in Article 24 of the Cooperative Banks and Savings and Credit Societies Law;
iii. The equity fund requirement, established in Article 25 of the Cooperative Banks and Savings and Credit Societies Law;
iv. The calculations and the establishment of the liquidity reserve percentage to which cooperative banks are obligated, in accordance with Articles 27 and 28 of the Cooperative Banks and Savings and Credit Societies Law, and the “Technical Standards for the Calculation and Use of the Liquidity Reserve on Deposits and Other Obligations” (NRP-28); (1)
v. The fixed asset holding limit established in Article 45 of the Cooperative Banks and Savings and Credit Societies Law;
vi. The debt limits regulated in Article 48 of the Cooperative Banks and Savings and Credit Societies Law;
vii. Related credits regulated in Articles 49 and 50 of the Cooperative Banks and Savings and Credit Societies Law; and
viii. The portion of shares financed by cooperatives that can form part of the paid-up share capital, as established in letter b) of Article 125 of the Cooperative Banks and Savings and Credit Societies Law; and

c) Examination of the following components:
i. Liquidity;
ii. Investment portfolio;
iii. Loan portfolio;
iv. Deposits;
v. Remittances;
vi. Income; and
vii. Expenses.

Entities and Funds of the Securities Market

Art. 16.- The planning of the audit of entities and funds of the securities market, as well as securities issuers, must comprise, as a minimum, in addition to the aspects included in Article 12 of these Standards, plans to evaluate the following:

a) Risks and materiality:
i. Review of the risk assessment and management systems of the cycles identified in the operations by the services provided by the entities or funds to be audited;
ii. The evaluation of inherent and control risk and the identification of critical audit areas, as well as the evaluation of the audit risk level for each critical component and the confidence to be placed in the internal accounting controls;
iii. Identify and evaluate the risk of significant transactions with related parties;
iv. The preliminary level of materiality for audit purposes;
v. Evaluation of accounts that may originate contingencies; and
vi. Evaluation and auditor responsibility when considering fraud in a financial statement audit in accordance with the ISAs.

b) Minimum review areas:
i. The areas subject to evaluation will be determined based on the knowledge of the risk assessment and management systems of the entity or fund being audited and the audit risk, and must be evidenced in the planning thereof, as well as the mandatory review areas, in accordance with the business cycles in compliance with the application of the ISAs;
ii. For the case of third-party funds that include real estate, such as securitization funds and investment funds, the following must be considered: asset valuation reports to verify that they are in compliance with applicable regulations and the existence of construction supervision reports that have been performed by qualified professionals and based on regulations applicable to them; and
iii. Verification that the audited entity is receiving the services under the contracted terms.

Entities and Pension Funds

Art. 17.- The planning of the external audit of the AFPs (Administradoras de Fondos de Pensiones) must comprise, as a minimum, in addition to the aspects included in Article 12 of these Standards, plans to effect the following:

a) Review of compliance with the following aspects related to the SP Law: (1)
i. Investments held by the AFP in each type of Fund and in other societies related to the Pension System; (1)
ii. Operations carried out by the AFP with related societies, previously authorized by the Superintendency;
iii. Special Guarantee Contribution;
iv. Subscription and payment of share capital;
v. Minimum net equity requirements;
vi. Debt level; and
vii. Evaluation of control procedures related to provident service agents.

b) Review of internal prudential control policies that allow them to adequately manage their financial, regulatory, and operational risks, which have been approved by the Boards of Directors of the AFPs;

c) Review of the transfers of resources made between the AFPs and the Funds and vice versa; and

d) Review of policies, procedures, and an internal control structure implemented by the AFP for the administration and management of the Solidarity Guarantee Account; and

e) Examination of the following components:
i. Liquidity;
ii. Investments;
iii. Accounts receivable;
iv. Fixed assets;
v. Accounts payable and accrued expenses;
vi. Agencies and national and foreign representation offices;
vii. Income; and
viii. Expenses.

Art. 18.- The planning of the audit of Pension Funds must comprise, as a minimum, in addition to the aspects included in Article 12 of these Standards, plans to effect the following:

a) Review of compliance with the following aspects related to the SP Law: (1)
i. Management of current accounts;
ii. Investment policy;
iii. Diversification of investments by instrument, issuer, and issuance;
iv. Compliance and regularization of excesses in investment limits;
v. Statement of compliance that the AFP is giving to the investment policy;
vi. Evaluation and determination of collection actions on overdue contributions; and
vii. Evaluation and determination of the quotas of the individual accounts of affiliates, minimum return of the Fund, Return Fluctuation Reserve, and Special Guarantee Contribution.

b) Inventories and confirmations regarding securities deposited in custody;

c) Review of the benefit payment process including disability, survivorship, old age, and longevity pensions; and

d) Examination of the following components:
i. Liquidity;
ii. Accounts and documents receivable;
iii. Investments in securities;
iv. Obligations with Financial and Non-Financial Institutions;
v. Accounts payable;
vi. Special Guarantee Contribution, Amortization Fund, AFP quotas, and contributions to be credited;
vii. Movements recorded in the Solidarity Guarantee Account in the Conservative Fund, which are in conformity with the accounting information related to the same account and for the legal purposes for which it was created according to what is established in Article 119 of the SP Law; (1)
viii. Movements recorded in the account of balance advances to affiliates;
ix. Equity; and
x. Contingent and control accounts.

Art. 19.- The planning of the audit of institutions of the Public Pension System must comprise, as a minimum, in addition to the aspects included in Article 12, of these Standards, plans to effect the following:

a) Contribution collection system;

b) Benefit granting and follow-up system;

c) Other information systems used for the recording of their operations;

d) Compliance with investment guidelines;

e) Compliance with investment policies; and

f) Procedures to verify that funds received from Certificates of Provident Obligations have been used exclusively for the fulfillment of the destination established in Article 10 of the Special Law for the Issuance of Certificates of Provident Obligations and Dissolution of the Provident Obligations Trust. (1)

CHAPTER IV
QUALITY CONTROL EXECUTION OF EXTERNAL AUDIT WORK

Quality Control

Art. 20.- External auditors must perform quality control of their work, applying their own methodology, which must be based on regulations adopted or issued by the Supervisory Council in accordance with its powers contained in the Law Regulating the Practice of Accounting. The verification of quality control will be made known to the Superintendency, when it requires it from external auditors.

Art. 21.- External auditors must comply with what is established in the Professional Ethics Code for Accountants and Auditors issued or adopted by the Supervisory Council, especially with respect to ethical norms and principles contained in said Code.

Changes in policies, procedures, or mechanisms of external auditors

Art. 22.- When external auditors implement changes in the policies, procedures, or mechanisms used in the development of their work, relating to documentation processes, development of external audit, mechanisms for communication regarding observations of deficiencies in internal control, and others, they must be described in the working papers and reported to the Superintendency, within a period not exceeding thirty calendar days, from the date on which such changes were made.

Evidence of audit work

Art. 23.- Working papers and audit archives may be kept in physical or electronic form and must present evidence regarding:

a) The criteria for sample selection and scope thereof;

b) The nature, timing, and extent of the audit procedures applied, leaving a record of the following:
i. The characteristics that identify the items or issues on which tests have been performed;
ii. The person or persons who performed the audit work and the date on which it was completed;
iii. The person who reviewed the audit work performed, as well as the date and scope of said review;
iv. The organizational structure of the entity;
v. Information concerning the industry, economic and legislative environment in which the audited entity operates;
vi. Information on the approval, application, and maintenance of corporate governance practices;
vii. Evidence of the planning process, including the overall strategy and audit plan, as well as any significant change made in the development of the audit work, in the plan must include as a minimum: the detailed audit programs, in which they must incorporate the general objective and specific objectives of the program, detailed procedures, and authorization for their execution;
viii. Review of the legal compliance of the entity, of those aspects material to the audit;
ix. Follow-up of observations made by supervisory bodies on the audited entity;
x. Understanding of the accounting systems, internal control, and their risk assessment and management systems by the identified cycles;
xi. Documentation of relevant business information flows;
xii. Evaluation of the controls verified by the auditor;

NRP-18
EXTERNAL AUDITING
Approval: 03/27/2019
Effective: 05/02/2019

xiii. Evidence of inherent and control risk assessments and any reviews thereof;
xiv. Evidence of third-party confirmations performed;
xv. Assessment of the control environment, risk assessment process, information system and communication, control activities, and monitoring of controls;
xvi. Analysis of trends and key ratios;
xvii. Detail of existing controls in each critical audit area and those controls on which reliance is intended;
xviii. Conclusions reached for each component of the financial statements;
xix. Separate summary of audit findings; and
xx. Copy of the final financial statements and auditor's report, duly referenced.

It is the obligation of external auditors to maintain for at least five years, from the date of issuance of the report, in physical or electronic form, all working papers that served as the basis for issuing their opinion. For their preservation, external auditors may use electronic means or any other storage medium, which shall have the same probative value as the originals provided that the copies or reproductions are legally certified.

Use of Specialists
Art. 24.- External auditors must have specialists in computer systems, capable of evaluating the general and specific controls of information and communication technologies, contingency plans, and the recording of transactions, as well as the compilation of generated reports.

In the event that external auditors do not have specialized computer personnel, they must hire specialists to evaluate the internal control of the software used in the electronic data processing environment and the application of other audit procedures required in this type of environment, and may also hire specialists in other areas that are required for the development of the external auditing services of the audited entity.

These specialists must sign, with the auditing firm in charge, in harmony with the audited entity, clauses of confidentiality and reserve of the entity's information.

Legal Reference Framework
Art. 25.- It is the obligation of all external auditors registered in the Public Registry of the Superintendence to know and understand the content of the applicable laws and other provisions that regulate the entities listed in article 2 of these Standards.

Incompatibility with other professional services Art. 26.- The external auditor contracted by the entities mentioned in article 2 of these Standards may provide any other professional service to the audited entity, provided that such services are compatible with the function of external auditing, do not constitute legal violations, and do not put at risk the independence of the external auditor as established in the ISA and in the Professional Ethics Code issued or adopted by the Supervisory Council.

In the case of external auditors of banks and savings and credit societies, the function of external auditing is incompatible with the provision of any other service to the audited entity, in accordance with what is established in article 226 of the Banking Law and article 59 of the Investment Banks Law. (1)

Supervision of external audits
Art. 27.- The Superintendence may supervise at any time the compliance with the audit planning and the service contract celebrated between the entities mentioned in article 2 of these Standards and their external auditors.

CHAPTER V
REPORTS TO BE ISSUED BY EXTERNAL AUDITORS

Submission of the report
Art. 28.- Without prejudice to what their respective laws indicate, external auditors must submit to the Superintendence a copy of the financial statements report as of December 31 of each fiscal year, a copy of interim reports, when applicable, as well as other reports required for the entities mentioned in article 2 of these Standards on the same date they are delivered to the audited entity.

A report is understood to be the auditor's opinion, the financial statements, the notes to the financial statements, and other compliance reports.

Issuance of reports for Banks, Investment Banks, Cooperative Banks, and Savings and Credit Societies (1) Art. 29.- In the case of banks, investment banks, cooperative banks, and savings and credit societies, external auditors must issue with reference to December 31 of each fiscal year, the following: (1) a) Opinion on the financial statements as of December 31 of each fiscal year, prepared considering the requirements and content established in the ISA, in the applicable legal and regulatory framework, and must include the following:
i. Express statement that they have had access to the necessary information to issue their opinion;

NRP-18
EXTERNAL AUDITING
Approval: 03/27/2019
Effective: 05/02/2019

ii. Information on the entity's investments and financing to its subsidiaries; and
iii. Opinion on compliance with legal and regulatory provisions, especially those relating to the equity fund, credit limits, credits and contracts with related parties, and the sufficiency of impairment estimates.
b) Opinion on compliance with policies and control systems for managing the risks referred to in article 63 of the Banking Law, 44 of the Investment Banks Law, and 41 of the Cooperative Banks and Savings and Credit Societies Law; (1) c) Opinion on the sufficiency and effectiveness of the audited entity's internal control systems, referred to in article 35 of these Standards; and d) Separate note with the set of related credits.

Reports for insurance companies
Art. 30.- In the case of insurance companies, external auditors must issue with reference to December 31 of each fiscal year, the following:
a) Opinion on the financial statements as of December 31 of each fiscal year, prepared considering the requirements and content established in the ISA, in the applicable legal and regulatory framework, and must include in a separate note the set of credits between related parties; b) Opinion on the efficiency and effectiveness of the entity's internal control systems, in accordance with what is indicated in article 35 of these Standards; c) Opinion on compliance with legal and regulatory provisions, especially those relating to minimum net worth, solvency margin, diversification of investments; and d) Report on the sufficiency of technical reserves in general, which must include reserves for risks in course, mathematical reserves, pension reserves, claim reserves, and provision reserves, for which they must rely on an actuarial professional or, in general terms, a knowledgeable person in the matter. The report must contain what is established in article 31 of these Standards.

Art. 31.- The report on the sufficiency of technical reserves required in letter d) of article 30 of these Standards must contain as a minimum the following information:
a) Summary of the investments backing the net technical reserves and minimum net worth, separated by classes of financial instruments, in which the detail of the series, issuer, denomination, interest rate, nominal value, issuance dates, maturity dates, among others, must be included; b) Percentage of the technical reserves examined and explanation of the selection criteria for the sample by reserves for risks in course, mathematical reserves, pension reserves, claim reserves, and provision reserves;

NRP-18
EXTERNAL AUDITING
Approval: 03/27/2019
Effective: 05/02/2019

c) Detail of the calculations for the adjustments determined by sufficiencies or insufficiencies of the reserves mentioned in the previous number; and d) Supporting documentation of the evaluations performed, attaching the following tables:
i. Calculation of risk in course reserves, using the annexes contained in the Standards for the Constitution of Technical Reserves of Insurance Companies;
ii. Calculation of reported claim reserves, in which the total claim, reinsurance cession, and retention are included;
iii. Calculations of unreported claim reserves, in which the years taken as a base to determine the risk of the claims are included;
iv. Calculation of individual life mathematical reserves, for which the mortality tables, technical interest, and actuarial formulas indicated by the technical note of each class of insurance must be used;
v. Calculation of pension reserves, in which reserves for disability and survival, reserves for life annuities, and reserves for deferred life annuities are included; and
vi. Calculation of provision reserves, in which the total exposed amount, maximum probable loss, liability covered through excess of loss contracts, the agreed priority, the liabilities not covered by the cedent, and the solvency margin for catastrophic risk are included.

Issuance of reports for entities and funds of the securities market Art. 32.- External auditors of entities and funds of the securities market must issue with reference to December 31 of each fiscal year, the opinion on the financial statements as of December 31 of each fiscal year, considering the requirements and content established in the ISA, in the applicable legal and regulatory framework, and must comply, as a minimum, with the following obligations:
a) Point out or indicate, in their report, any limitations or qualifications they have had; b) Issue an opinion on the reasonableness of the financial statements of the supervised entities or funds, and verify that these financial statements are presented in accordance with the provisions issued by the applicable current regulations; c) Verify compliance with accounting manuals and systems, regarding their application and the financial information presented in them; d) Include information on compliance with current stock exchange legislation and regulations; and e) Opinion on the sufficiency and effectiveness of internal control systems, in accordance with article 35 of these Standards;

Final report of the audit on AFPs and the pension funds they administer Art. 33.- External auditors of the AFPs and the Funds they administer must issue with reference to December 31 of each fiscal year, the opinion on the financial statements, considering the requirements and content established in the ISA, in the applicable legal and regulatory framework, and must include, as a minimum, the following:
a) Express statement that they have had access to the necessary information to issue their opinion; b) Opinion on the sufficiency and effectiveness of the internal control systems of the AFPs and the Pension Funds they administer, in accordance with article 35 of these Standards; c) Report on compliance with internal prudential control policies that allow them to adequately manage their financial, regulatory, and operational risks, which have been approved by the respective boards of directors; and d) Report on compliance with the investment policies that the AFP has designed for that year, considering compliance with investment limits and the prohibition of investments in related companies.

Final report of the audit on institutions of the Public Pension System Art. 34.- External auditors must issue their final report in accordance with the ISA, in the applicable legal and regulatory framework. This report must contain, as a minimum, the following:
a) Transmittal letter addressed to the highest organizational authority; b) Background of the audited institution; c) Audit objectives; d) Scope of the audit; e) Summary of audit results; f) Independent opinion of the auditors on the financial statements; g) Comparative financial statements with the previous year; h) Notes to the financial statements; i) Opinion on the sufficiency and effectiveness of the audited entity's internal control systems, referred to in article 35 of these Standards; j) Report on compliance with laws and regulations applicable to the institution; and k) Report on the follow-up to recommendations made in previous audits.

On the internal control system
Art. 35.- External auditors will issue reports on the results of the evaluations of the internal control structure, as results of the visits made to the audited entities to which they provide external auditing services and with the frequency that the External Auditor determines in the plan, of which a copy must be submitted to the Superintendence within ten business days following the date of issuance; as a minimum, it is required that the external auditor perform two evaluations per year.

NRP-18
EXTERNAL AUDITING
Approval: 03/27/2019
Effective: 05/02/2019

The reports on the internal control structure must contain, as a minimum: internal control observations and recommendations in accounting, administrative, and legal aspects, including appraisals on information and communication technology. The referred reports must be final, after having analyzed the entity's defenses.

Additionally, the External Auditor must issue an annual opinion, before the General Shareholders' Meeting or Superior Management Body, on the sufficiency and effectiveness of the internal control systems, submitting to the Superintendence within the same deadline indicated in the first paragraph of this article, in what is applicable, they must consider, in addition to what is established in the applicable laws, the following:
a) Evaluation of the compliance and effectiveness of the internal control system; b) Evaluation of the entity's information systems; c) Evaluation of the security mechanisms of the audited entity's contingency plans, to face risk situations that imply loss of information or damage to the equipment and computer systems used; d) Evaluation of the policies and procedures for the identification and administration of risks, in accordance with the provisions established by the Central Bank through its Standards Committee; and e) Evaluation of the degree of compliance with the observations formulated by the Superintendence and the internal audit unit and previous external audits.

On compliance with the Special Law for the Prevention of Money Laundering (2) Art. 36.- External auditors must specify in their reports an opinion on compliance with what is established in the Special Law for the Prevention, Control, and Sanction of Money Laundering, Terrorism Financing, and Financing of the Proliferation of Weapons of Mass Destruction, as well as the management in the prevention of ML/TF/WMDP risks. Likewise, they must inform the Board of Directors, Senior Management, and Compliance Officer in a timely manner about any matter that is known to them in relation to ML/TF/WMDP risks. (1) (2)

On the sufficiency of the impairment reserves for risk assets Art. 37.- The report presented by the external auditor on risk credit assets for all entities that perform credit operations must contain the following:
a) The percentage scope of the risk asset portfolio analyzed and the explanation of the selection factors for the evaluated sample; b) List of the sample of reclassified credits; c) List of the sample of refinanced credits examined, indicating their credit risk classification; d) List of the examined sample of related credits; and

NRP-18
EXTERNAL AUDITING
Approval: 03/27/2019
Effective: 05/02/2019

e) List of the total of the examined credits and their amounts.

Report to the Superintendence on irregularities Art. 38.- When external auditors, in the development of the audit, identify or come to know of illegal acts or fraud, regulatory violations, irregularities, errors, or facts that based on their professional judgment could put at risk the liquidity, stability, or solvency of the audited entity or cause significant non-compliance with obligations with third parties, they must inform the Superintendence at the moment they have knowledge of such circumstances in order to achieve the necessary collaboration of the supervisory entity.

Likewise, the external auditor will inform the Superintendence if during the development of the audit, they have indications or certainty that they will have limitations in the scope of the examination or that they will issue a qualified opinion.

CHAPTER VI
OTHER PROVISIONS AND EFFECTIVENESS

Other considerations
Art. 39.- The financial statements of all entities that are members of a financial conglomerate, as well as the consolidated financial statements, must be audited by the same external auditor, except for those members of the conglomerate located abroad, which must be audited by associated firms or correspondents of the holding company's auditors, and if not possible, by internationally recognized auditing firms.

Sanctions
Art. 40.- Non-compliance with the provisions contained in these Standards will be sanctioned in accordance with what is established in the Law on Supervision and Regulation of the Financial System.

Repeals
Art. 41.- These Standards repeal the following:
a) "Standards for External Audits of Banks and Insurance Companies" (NPB2-05), approved in session CD-61/99 on August 26, 1999, by the Board of Directors of the Superintendence of the Financial System, whose Organic Law was repealed by Legislative Decree number 592 containing the Law on Supervision and Regulation of the Financial System, published in Official Diary number 23, Volume 390, on February 2, 2011; and b) "Standard of Minimum Audit Requirements and Other Obligations of External Auditors of Entities or Funds Supervised, Monitored, and Inspected by the Superintendence of Securities" (RCTG-08/2008) approved in session CD 21/2008 on

NRP-18
EXTERNAL AUDITING
Approval: 03/27/2019
Effective: 05/02/2019

June 3, 2008, by the Board of Directors of the Superintendence of Securities, whose Organic Law was repealed by Legislative Decree number 592 containing the Law on Supervision and Regulation of the Financial System, published in Official Diary number 23, Volume 390, on February 2, 2011.

Transitory Provisions
Art. 42.- These Standards will be mandatory for the provision of external auditing services of Pension Fund Administrating Institutions and for Previsional Institutions of the Public Pension System, from the repeal by the President of the Republic of their respective Regulations for the Provision of External Auditing Services.

Pending Procedures
Art. 43.- Procedures, audits, processes, and administrative appeals that were in process on the date of entry into force of these Standards will continue to be carried out according to the Standards with which they were initiated, including the 2019 fiscal year audits.

Unforeseen Aspects
Art. 44.- Aspects not provided for in the regulatory matter in these Standards will be resolved by the Central Bank through its Standards Committee.

Effectiveness
Art. 45.- These Standards will enter into force as of May 2, 2019.

MODIFICATIONS:
(1) Modifications in considerations VI, VIII, X, and in articles 2, 3, 5, 12, 13, 15, 17, 18, 19, 26, 29, and 36, approved by the Standards Committee of the Central Reserve Bank of El Salvador, in Session No. CN-08/2025, on September 30, 2025, with effect from October 15, 2025. (2) Incorporation of consideration XV and modifications in articles 1, 3, and 36, approved by the Standards Committee of the Central Reserve Bank of El Salvador, in Session No. CN-05/2026, on June 30, 2026, with effect from July 15, 2026.