The National Monetary Council (CMN) issued new rules for internal audit activities at financial institutions and other institutions authorized to operate by the Central Bank of Brazil (Bacen). Issued last June 29, Resolution No. 4,588/17 shall be implemented by the institutions indicated in the resolution by December 31, 2017.

The new rules are not applicable to (i) administrators of consortia and payment institutions, which shall comply with specific regulations issued by the Bacen; and (ii) credit cooperatives classified within Segment 5 (S5), as defined in the applicable regulations, which are members of two or three tier systems.

The institutions subject to the resolution must implement and maintain internal audit activities compatible with their nature, size, complexity, structure, risk profile, and business model. The activity must also have the necessary conditions to allow an independent, autonomous, and impartial assessment of the quality and effectiveness of the institution's internal control, risk management, and corporate governance systems and processes.

According to the resolution, the internal audit must be performed by a specific unit of the institution, or an institution that is part of the same financial conglomerate, directly subordinated to the board of directors (or the board of executive officers of the institution, if it does not have a board of directors). As an alternative, and provided that the institution is not required to create an auditing committee under applicable regulations, the internal audit activity may be performed by an independent auditor duly registered (under applicable regulations) to provide independent auditing services to financial institutions and other institutions authorized to operate by the Bacen, provided that such auditor is not responsible for auditing the institution's financial statements or any other activity with a potential conflict of interest.

The resolution also provides for exceptions for credit cooperatives, securities brokerage firms, foreign exchange brokerage companies, securities distributing companies, micro and small business lending companies, lending, financing, and investment companies, leasing companies, real estate lending companies, savings and loan associations, and mortgage companies, in which the internal audit activity may be carried out (i) with the audit of the class entity or central body with which the institution is affiliated ; or (ii) with the audit of the class entity of other institutions authorized to operate by the Bacen, through a previously approved agreement between the entity to which the institution is affiliated and the entity providing the service.

The scope of the internal audit activity should consider all the functions of the institution, including outsourced ones and, in the case of a leading prudential conglomerate institution, should also consider the functions of the institutions that compose the conglomerate.

Those responsible for the internal audit activity of the institutions should prepare and maintain specific rules for the internal audit activity, approved by the board of directors (or by the board of executive officers of the institution, if it does not have a board of directors) and by the auditing committee, when formed. The rules should provide for at least: (i) the purpose and scope of the internal audit activity; (ii) the position of the internal audit unit in the structure of the institution, if any; (iii) the essential characteristics of the internal audit activity; (iv) the duties, prohibitions, and compensation policy applicable to members of the audit team; (v) the definition of the obligation, form, and organizational components to which the internal auditors must communicate the results of the performance of their duties; (vi) the duties and responsibilities of the head of the internal audit activity; (vii) the requirement to comply with recognized internal audit standards; and (viii) procedures for coordinating the internal audit activity with the independent audit.

The institutions subject to the resolution shall maintain at the disposal of the Bacen (i) the current rules of the internal audit activity; and (ii) the documents prepared for the planning and execution of the internal audit activity, as specified in the resolution, for at least five years.