Update of Circular CSSF 19/717

Circulaire CSSF 24/852 Update of Circular CSSF 19/717

CIRCULAIRE CSSF 24/852 2/11 Circular CSSF 24/852 Update of Circular CSSF 19/717 To all entities subject to public supervision of the audit profession by the CSSF Luxembourg, January 31, 2024

Dear Sirs, Madams,

This circular amends Circular CSSF 19/717 and more particularly its paragraph 8 and its Annexes by incorporating the modifications made by CSSF Regulation No. 24-02 of January 26, 2024 relating

1. to the adoption of audit standards in the field of statutory audit within the framework of the Law of July 23, 2016 on the audit profession;
2. to the adoption of standards relating to ethics and internal quality control respectively to quality management within the framework of the Law of July 23, 2016 on the audit profession.

Paragraph 8 and the Annexes of Circular CSSF 19/717 are amended in accordance with the attached annexes. This circular repeals and replaces Circular CSSF 22/794 of January 26, 2022.

Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX General Manager

Annex Paragraph 8 and Annexes of Circular CSSF 19/717

CIRCULAIRE CSSF 24/852 3/11 Annex: Paragraph 8 and Annexes of Circular CSSF 19/717 8. Audit standards and other standards (article 36, paragraph 3, letters d) and e)) The CSSF assumes the responsibility:

• for the adoption of audit standards in the field of statutory audit for matters not covered by audit standards as adopted by the European Commission;
• for the adoption of standards relating to ethics and standards relating to internal quality control of approved audit firms;

Pending the adoption by the European Commission of international audit standards by means of a Community Regulation1, and to maintain continuity of the regulatory framework applicable to statutory audit activity in Luxembourg, the CSSF has adopted by means of RCSSF normes, the parts "Introduction", "Objective", "Definitions" and "Requirements", of international audit standards as established by the International Auditing and Assurance Standards Board (IAASB) in their clarified version and published in the "Handbook of International Quality Control, Auditing, Review, Other Assurance, and Related Services Pronouncements – 2022 Edition" of the International Federation of Accountants (IFAC).

These standards have been supplemented by the provisions introduced by the EU directive and regulation and by the provisions applicable to entities subject to the provisions of Commission Delegated Regulation (EU) 2019/815 on the "European Single Electronic Format" (ESEF) in order to have a regulatory framework bringing together all rules applicable in Luxembourg.

In the same perspective, the CSSF has adopted by this same RCSSF normes:

• the international quality management standards as established by the International Auditing and Assurance Standard Board (IAASB) in their versions published in the "Handbook of International Quality Control, Auditing, Review, Other Assurance, and Related Services Pronouncements - 2022 Edition" of the International Federation of Accountants (IFAC), as well as the Luxembourg annex to this standard relating to the retention of working papers of approved auditors; and
• the code of ethics of the audit profession which corresponds to the code of ethics issued by the International Ethics Standards Board of Accountants (IESBA) in its version published in the "Handbook of the International Code of Ethics for Professional Accountants – 2023 Edition" of the International Federation of Accountants (IFAC).

In the same way as the international audit standards, these standards have been supplemented by the provisions of the EU directive and regulation in order to have a regulatory framework reproducing all rules applicable in Luxembourg.

The CSSF has adopted concomitantly with the RCSSF normes:

• the parts "Application and Other explanatory material" of the international audit standards referred to in Chapter 1 of RCSSF normes and of international quality management standards referred to in Chapter 2 of this same regulation which provide clarifications and/or additional explanations to these standards;
• the "Appendix" to the international audit standards referred to in Chapter 1 of RCSSF normes which provide examples and illustrations essential for compliance with these standards. These "Application and Other explanatory material" and "Appendix" have also been supplemented by the provisions introduced by the EU directive and regulation and these supplements are presented in Annex 1 of this circular.

Annex 2 presents additional information concerning the Luxembourg standard relating to the involvement of the approved auditor in financial statements in ESEF (European Single Electronic Format)

1 A Community Regulation is directly applicable in national law. No transposition is required.

CIRCULAIRE CSSF 24/852 4/11 It is therefore incumbent upon approved auditors and approved audit firms to take into account these application modalities and other explanatory information as well as the annexes for statutory audit missions.

CIRCULAIRE CSSF 24/852 5/11 ANNEXE 1: Luxembourg Supplements to the "Application and Other Explanatory Material" and "Appendix" parts of audit standards in the field of statutory audit pursuant to article 33, paragraph 2, of the Law of July 23, 2016 on the audit profession.

1. LUXEMBOURG SUPPLEMENT TO INTERNATIONAL STANDARD ON AUDITING 220 (REVISED) QUALITY CONTROL FOR AN AUDIT OF FINANCIAL STATEMENTS Application and Other Explanatory Material Documentation A120-1. In documenting the significant threats to the firm’s independence and any mitigating safeguards, the auditor refers to the documentation required by ISQM12.

2. LUXEMBOURG SUPPLEMENT TO INTERNATIONAL STANDARD ON AUDITING 240 THE AUDITOR’S RESPONSIBILITIES RELATING TO FRAUD IN AN AUDIT OF FINANCIAL STATEMENTS Application and Other Explanatory Material Communications to Management and with Those Charged With Governance Communications with Those Charged With Governance A63-1. For statutory audits of financial statements of public-interest entities, ISA 260 (Revised)3 requires the auditor to communicate in the additional report to the audit committee any significant matters involving actual or suspected non-compliance with laws and regulations, including from fraud or suspected fraud, which were identified in the course of the audit. [AR/Article 11.2(k)] Communications to Authorities of Public-Interest Entities (Ref: Para. 43R-1) A65-1. The disclosure in good faith to the authorities responsible for investigating such irregularities, by the auditor, of any irregularities referred to in paragraph 43R-1 shall not constitute a breach of any contractual or legal restriction on disclosure of information in accordance with the Audit Regulation. [AR/Article 7]

3. LUXEMBOURG SUPPLEMENT TO INTERNATIONAL STANDARD ON AUDITING 250 (REVISED) CONSIDERATION OF LAWS AND REGULATIONS IN AN AUDIT OF FINANCIAL STATEMENTS Application and Other Explanatory Material Communicating and reporting Identified or Suspected Non-Compliance Communicating Identified or Suspected Non-Compliance with Those Charged with Governance A25-1. For statutory audits of financial statements of public-interest entities, ISA 260 (Revised)2 requires the auditor to communicate in the additional report to the audit committee any significant matters involving actual or suspected non-compliance with laws and regulations or article of association, including from fraud or suspected fraud, which were identified in the course of the audit. [AR/Article 11.2.(k)] Reporting of Identified or Suspected Non-Compliance to an Appropriate Authority outside the entity A33-1. The disclosure in good faith to the authorities responsible for investigating such irregularities, by the auditor, of any irregularities referred to in paragraph 29R-2 shall not constitute a breach of any contractual or legal restriction on disclosure of information in accordance with the Audit Regulation. [AR/Article 7]

2 ISQM1. Paragraph 58D-1 (b) (ii) 3 ISA 260 (Revised), “Communication with Those Charged with Governance”, paragraph 16R-1(k).

CIRCULAIRE CSSF 24/852 6/11 4. LUXEMBOURG SUPPLEMENT TO INTERNATIONAL STANDARD ON AUDITING 330 THE AUDITOR’S RESPONSES TO ASSESSED RISKS Application and Other Explanatory Material Valuation Methods (Ref: Para. 19R-1) A51-1. For audits of financial statements of public interest entities, the Luxembourg supplement to ISA 260 (Revised)4 requires the auditor to communicate in the additional report to the audit committee the auditor’s assessment of the valuation methods applied to the various items in the annual or consolidated financial statements including any impact of changes of such methods.

5. LUXEMBOURG SUPPLEMENT TO INTERNATIONAL STANDARD ON AUDITING 600 SPECIAL CONSIDERATIONS—AUDITS OF GROUP FINANCIAL STATEMENTS (INCLUDING THE WORK OF COMPONENT AUDITORS) (effective for audits of financial statements for periods beginning before December 15, 2023) Appendix Appendix 5 Required and Additional Matters Included in the Group Engagement Team’s Letter of Instruction Matters required by this ISA to be communicated to the component auditor are shown in italicized text. Matters that are relevant to the planning of the work of the component auditor: • The ethical requirements that are relevant to the group audit and, in particular, the independence requirements, for example, where the group auditor is prohibited by law or regulation from using internal auditors to provide direct assistance, it is relevant for the group auditor to consider whether the prohibition also extends to component auditors and, if so, to address this in the communication to the component auditors.5 [...]

6. LUXEMBOURG SUPPLEMENT TO INTERNATIONAL STANDARD ON AUDITING 610 (REVISED 2013) – USING THE WORK OF INTERNAL AUDITORS (effective for audits of financial statements for periods beginning on or after December 15, 2023) Application and Other Explanatory Material Determining Whether, in Which Areas and to What Extent Internal Auditors Can Be Used to Provide Direct Assistance Determining Whether Internal Auditors Can Be Used to Provide Direct Assistance for Purposes of the Audit (Ref: Para. 5, 26–28) A31. In jurisdictions where the external auditor is prohibited by law or regulation from using internal auditors to provide direct assistance, it is relevant in the circumstances of a group audit, for the

4 ISA 260 (Revised), Communication with Those Charged With Governance, paragraph 16R-1(l). 5 ISA 610 (Revised June 2013), Using the Work of Internal Auditors, paragraph A31. The use of internal auditors to provide direct assistance is prohibited in a statutory audit of financial statements conducted in accordance with ISAs. For a group audit this prohibition extends to the work of any component auditor which is relied upon by the group auditor, including for overseas components – see the Luxembourg supplement to ISA 610 (Revised June 2013), paragraph 5-1.

CIRCULAIRE CSSF 24/852 7/11 group auditor to consider whether the prohibition also extends to component auditors and, if so, to address this in the communication to the component auditors.6

7. LUXEMBOURG SUPPLEMENT TO INTERNATIONAL STANDARD ON AUDITING 620 USING THE WORK OF AN AUDITOR’S EXPERT Appendix (Ref: Para. A25) Considerations for Agreement between the Auditor and an Auditor’s External Expert […] • The auditor’s external expert’s consent to the auditor’s intended use of that expert’s report, including any reference to it, or disclosure of it, to others, for example reference to it in the basis for a modified opinion in the auditor’s report, if necessary, or disclosure of it to management or an audit committee7.

8. LUXEMBOURG SUPPLEMENT TO INTERNATIONAL STANDARD ON AUDITING 700 (REVISED) FORMING AN OPINION AND REPORTING ON FINANCIAL STATEMENTS Application and Other Explanatory Material Auditor’s Responsibilities for the Audit of the Financial Statements (Ref: Para. 37-40) A52-1. ISA 700 paragraph 40R-1 requires the auditor to provide a declaration in their audit report that they have not breached non-audit services requirements. Where those requirements have been breached, but where the auditor believes that an ‘objective, reasonable and informed third party’ would not conclude that the auditor’s independence had been compromised (perhaps because the breach was minor in nature), then the auditor should issue the auditor’s report, disclosing within it: (i) the nature of the breach; (ii) confirming the auditor’s assessment that their independence had not been compromised; and (iii) stating what had been done to address any risks arising impacting on the independence of the auditor. Before the auditor’s report is signed, this should be discussed and agreed with the audit committee of the entity concerned. Auditor’s Report Prescribed by Law or Regulation (Ref: Para. 50) A65-1. Auditor’s reports prepared in compliance with the requirements of this Luxembourg supplement to ISA 700 (Revised) shall comply with ISA 700 (Revised) “Forming an Opinion and Reporting on Financial Statements” issued by the IAASB, including the minimum elements of an auditor’s report required by paragraph 50(a)-(o) of ISA 700 (Revised). Therefore, it does not preclude the auditor from being able to assert compliance with International Standards on Auditing issued by the IAASB. Auditor’s Report for Audits Conducted in Accordance with Both Auditing Standards of a Specific Jurisdiction and International Standards on Auditing (Ref: Para. 51) A72-1. The requirements of the Luxembourg supplement to ISAs do not conflict with the requirements in ISAs. An audit conducted in accordance with ISAs and their Luxembourg supplements does not therefore preclude the auditor from being able to assert compliance with International Standards on Auditing issued by the IAASB.

6 ISA 610 (Revised June 2013), Using the Work of Internal Auditors, paragraph A31. The use of internal auditors to provide direct assistance is prohibited in a statutory audit of financial statements conducted in accordance with ISAs. For a group audit this prohibition extends to the work of any component auditor which is relied upon by the group auditor, including for overseas components – see the Luxembourg supplement to ISA 610 (Revised June 2013), paragraph 5-1. 7 Auditors of public-interest entities are required by paragraph 16R-1(c) of the supplement to ISA 260 (Revised) to communicate matters relating to the use of the work of the auditor’s external expert in the additional report to the audit committee.

CIRCULAIRE CSSF 24/852 8/11 9. LUXEMBOURG SUPPLEMENT TO INTERNATIONAL STANDARD ON AUDITING 701 COMMUNICATING KEY AUDIT MATTERS IN THE INDEPENDENT AUDITOR’S REPORT Application and Other Explanatory Material Definitions Key Audit Matters A8-1. In Luxembourg, those matters of the current period that were of most significance in the statutory audits of the financial statements of public-interest entities include the most significant assessed risks of material misstatement (whether or not due to fraud) identified by the auditor. [AR/Article 10.2(c)] Communicating Key Audit Matters Communicating Key Audit Matters for Group and Parent Company Financial Statements (Ref: Para 13.) A33-1. An auditor’s report for a group may include the auditor’s report with respect to both the group and the parent company financial statements. This is typically the case where both sets of financial statements are presented in accordance with IFRSs as adopted in the EU. However, where the financial statements of the group and the parent company are presented in accordance with different financial reporting frameworks, the financial statements might be presented separately within the Annual Report and in such circumstances separate auditor’s reports in respect of the group and the parent company financial statements might be provided within the Annual Report. A33-2. Most of the key audit matters communicated in the audit of the parent company would likely also be key audit matters relating to risks of material misstatement in the audit of the group financial statements, subject to any differences in quantitative materiality considerations that may apply in those audits. However, there may be key audit matters that only arise in relation to the audit of the parent company financial statements (such as risks relating to investments in subsidiaries that could, for example, have implications for distributable reserves). A33-3. An understanding of such key audit matters may be of interest to readers of auditor’s reports. Readers may find such key audit matters to be of particular interest when their implications are relevant in the context of the parent company’s reported distributable reserves. However, readers of the auditor’s report(s) on the group and parent company financial statements will be assisted by avoiding unnecessary duplication or disaggregation of key audit matters arising from these audits in such report(s). Application where there is a single auditor’s report A33-4. Where the auditor’s reports on both the group and parent company financial statements are combined within a single report, it may be appropriate for any relevant key audit matters and other information required by ISA 701 that are unique to the parent company audit to be separately identified but integrated within the disclosures in that report of corresponding matters arising from the audit of the group financial statements. Application where the auditor reports separately on the group and parent company financial statements A33-5. Where the auditor provides separate auditor’s reports on the group and parent company financial statements, it may also be appropriate for any relevant key audit matters and other information required by ISA 701 that are unique to the parent company audit to be separately identified but integrated within the disclosures within the group auditor’s report of corresponding matters arising from the group audit. Except where such matters are required by law or regulation to be included in the auditor’s report, the parent company auditor’s report, the auditor could make reference in the other matter paragraph that refers to the separate auditor’s report on the group financial statements to the fact that the key

CIRCULAIRE CSSF 24/852 9/11 audit matters that relate to the parent company audit have been included in the group auditor’s report, rather than repeating the information.

10. LUXEMBOURG SUPPLEMENT TO INTERNATIONAL STANDARD ON AUDITING 720 (REVISED) THE AUDITOR’S RESPONSIBILITIES RELATING TO OTHER INFORMATION Application and Other Explanatory Material Reading and Considering the Other Information Identifying whether the other information has been prepared in accordance with the applicable reporting framework (Ref: Para. 14D-1) A36-1. As explained in paragraph 12(b), a misstatement of the other information also exists when the other information has not been prepared in accordance with the applicable legal and regulatory requirements. A36-2. In considering whether the other information has been prepared in accordance with the applicable legal and regulatory requirements, the auditor identifies whether information that is required by law or regulation to be included in the other information has been omitted. This includes situations where the required information is presented separately from the other information without appropriate cross reference. A36-3. If the auditor concludes that the other information has not been prepared in accordance with the applicable legal or regulatory requirements, the auditor determines whether non-compliance with the applicable legal or regulatory requirement has a material effect on the financial statements.8 A36-4. For statutory audits of financial statements of public-interest entities, the auditor considers whether to communicate any non-compliance with the applicable legal and regulatory requirement in the additional report to the audit committee.9

8 ISA250 (Revised), “Consideration of Laws and Regulations in an Audit of Financial Statements.” 9 ISA 260 (Revised), “Communication with Those Charged with Governance”, paragraph 16R-1(k).

CIRCULAIRE CSSF 24/852 10/11 ANNEXE 2: Additional information regarding the Luxembourg guidelines on the auditors’ involvement on financial statements in European Single Electronic Format (ESEF)

1. “Relevant statutory requirements” The relevant statutory requirements are set out in the Question 2.2 of the Commission Interpretative Communication on the preparation, audit and publication of the financial statements included in the annual financial reports drawn up in accordance with Commission Delegated Regulation (EU) 2019/815 on the European Single Electronic Format (ESEF) (Communication 2020/C379/01).

In order to provide an audit opinion on whether the financial statements comply with the ‘relevant statutory requirements’ laid down therein, statutory auditors shall check the compliance of the issuers’ financial statements with the provisions of the ESEF Delegated Regulation that are applicable to the financial statements. The ‘relevant statutory requirements’ are the following: i) All the financial statements that are included in the annual financial report shall be prepared in a valid XHTML format; ii) For all consolidated financial statements that are drawn up in accordance with IFRS as endorsed by the EU or with IFRS as adopted by the IASB;10

• The disclosures specified in Annex II of the ESEF Delegated Regulation shall be marked-up, where those disclosures are present in those consolidated financial statements;
• All mark-ups, including the voluntary mark-ups of disclosures other than those specified in Annex II of the ESEF Delegated Regulation, shall meet the following requirements: o the XBRL mark-up language shall be used; o the elements of the core taxonomy specified in Annex VI of the ESEF Delegated Regulation with the closest accounting meaning shall be used, unless an extension taxonomy element is created in compliance with Annex IV of the ESEF Delegated Regulation; o the mark-ups shall comply with the common rules on mark-ups.11 iii) For financial statements other than the IFRS consolidated financial statements.12
• All mark-ups included by the issuer on a voluntary basis or in compliance with national law shall meet the following requirements: o the XBRL mark-up language shall be used; o a specific taxonomy provided by the Member State in which the issuer is incorporated shall be used; o the mark-ups shall comply with the common rules on mark-ups.13

2. Risks attached to the marked-up information Risks attached to the marked-up information may encompass, for example, the following areas: Completeness

• Not all figures disclosed in the primary financial statements14 of the IFRS consolidated financial statements are marked-up;
• Not all the disclosures in the IFRS consolidated financial statements, are marked-up as specified in Annex II of the ESEF De

CIRCULAIRE CSSF 24/852 11/11 [End of Document]

---

[RegAlert note: the English text above is a translation of the first 24,000 characters of a 25,626-character original (94% of the document). The remainder was not translated. The complete original-language text is stored with this document.]