Rwanda
Regulation determining Requirements and Other Conditions for Accreditation of External Auditors for Regulated Institutions
Regulation 44 of 2022
- Published in Official Gazette special on 17 June 2022
- Assented to on 2 June 2022
- Commenced on 17 June 2022
- [This is the version of this document from 17 June 2022.]
Chapter One
General provisions
Article One – Purpose
This regulation aims at establishing requirements and other conditions for accrediting external auditors for regulated institutions.Article 2 – Definitions
In this regulation, the following terms are defined as follows:1°Regulated institution: any institution licensed and supervised by the Supervisory Authority;2°Audit committee: the board committee that reviews the financial condition of the regulated institution, its internal controls, the performance and findings of the internal audit function and of the external auditors, and recommends an appropriate remedial action regularly;3°Related party: any natural person or legal entity that maintains with the regulated institution at least one of the following relationships;a.a person who is a member of the Board of Directors or a member of the senior management of the regulated institution;b.person who has a direct or indirect significant shareholding in the regulated institution;c.person who is a member of the Board of Directors or the management of an entity covered specified in “g” or “h”;d.spouse, family member on direct line or collateral line up to the second degree of any of the persons mentioned under “a”, “b”, or “c”;e.any entity in which any of the persons mentioned under “a”, “b”, “c”, or “d” is a member of the Board of Directors/Trustees or the management;f.any entity in which any of the persons mentioned under “a”, “b”, “c”, or “d” above holds directly or indirectly, alone or with others, at least ten percent (10%) of the shares or voting rights or can exert influence;g.any entity that a regulated institution, alone or with others, controls or on which the regulated institution exerts influence directly or indirectly;h.any entity controlled or on which influence is exerted directly or indirectly by an entity that controls a regulated institution;i.any party that controls the key financial/funding decisions of the company.4°Control: is a relationship between counterparties whereby natural persons or legal entities exercise control over the regulated institution on account of:a.holding more than fifty (50%) percent in the equity capital or voting rights;b.having the right to appoint or remove the majority of the members of the Board of Directors of a regulated institutionc.having the power to exert influence over a financial institution, pursuant to a contract entered into with that regulated institution, or to a clause in the bylaws of said regulated institution;5°Senior manager: management personnel at executive level of the regulated institution. This includes:a.the Chief Executive Officer (CEO)/Managing Director (MD);b.Senior Executives reporting to the Board or to Board Committees; andc.Senior Executives reporting to the Chief Executive Officer (CEO)/Managing Director (MD).6°Accredited external auditor: an audit firm or individual auditor authorized to audit regulated institutions;7°Tier I audit firm: any audit firm with at least two active partners with Practicing Certificates issued by the Institute of Certified Public Accountants of Rwanda (ICPAR) accredited to audit all regulated institutions;8°Tier II audit firm: any audit firm with at least a sole partner with a Practicing Certificate issued by the Institute of Certified Public Accountants of Rwanda (ICPAR) accredited to audit regulated institutions determined by the Supervisory authority;9°Tier III external Auditor: any natural person accredited to audit regulated institutions determined by the Supervisory authority.Article 3 – Categories of External auditors
External auditors are categorized as follows:1°Tier I Audit firm;2°Tier II Audit firm;3°Tier III external Auditor;The Supervisory authority, through a Directive determines regulated institutions that a Tier II audit firm and Tier II audit firm shall audit.Chapter II
Requirements and other conditions for accreditation
Article 4 – Application requirements for accreditation
In order to be accredited by the Supervisory authority as an external auditor for regulated institutions, the applicant shall submit a duly filled application form as set out in Appendix 1 of this regulation.The application form mentioned in paragraph one of this article shall be accompanied by proof of payment of a non-refundable application fee of five hundred thousand Rwandan francs (500,000 FRW) for an applicant who wishes to be accredited as Tier I audit firm, two hundred thousand Rwandan francs (200,000 FRW) for an applicant who wishes to be accredited as a Tier II audit firm.Furthermore, the application file provided in the preceding paragraph must be accompanied by the following information:1°a copy of valid Practicing Certificates issued by the Institute of Certified Public Accountants of Rwanda (ICPAR);2°criminal record certificates, detailed curriculum vitaes (CVs) including names, academic and professional qualifications and experience for Partners, Quality control Reviewers, Managers and Team leaders and the list of all staff indicating their positions;3°Physical and postal/ digital address of the local office and its branches in Rwanda together with its organizational structure. In case of an international audit firm, full details of its head office in foreign jurisdiction;4°the names of the managing partners who will directly be engaged in the audits;5°details of applicant’s experience in auditing regulated institutions, including a list of all major audit assignments conducted in the past three (3) years;6°details of any existing business relationships between the external auditor and regulated institutions;7°a copy of the external auditor’s financial statements for the past three (3) years approved by the board of directors;8°recent audit engagement letters;9°general description of the quality assurance policies and procedures adopted by the auditing firm;10°undertaking to preserve the auditor’s working papers including any audit related documents for a period of at least ten years (10) and to avail them whenever required by the Supervisory authority; and;11°any other information as may be required by the Supervisory authority.Article 5 – Assessing the applicant’s other conditions for accreditation
For the purpose of assessing the auditor’s application, the Supervisory authority shall ensure that the applicant meets the following conditions in particular:1°is not disqualified due to incompatibilities attached to its duties;2°complies with International Standards of Auditing and with other relevant regulations, directives, and decisions of the Supervisory authority;3°has experience in auditing services;4°has at least one signing partner residing in Rwanda for an international audit firm;5°proves no misconduct in the performance of its duties both with regulated institutions and other general clients;6°for an auditor who requires to be accredited as a Tier I audit firm, to have at least six (6) staff members with education and experience in accounting and audit, at least one staff who is an Information System Audit (IT expert) and at least one actuarial expert. Managers and partners on individual engagements must be chartered/certified public accountants and registered with Institute of Certified Public Accountants of Rwanda (ICPAR). Quality control reviewers, IT expert and as well actuaries shall be duly registered with their relevant professional bodies;7°has its partners and staff independent from the regulated institution;8°complies with any other ethical requirements applicable;9°has the ability to demonstrate an effective quality assurance process and is in conformity with any internal and external standards that guide its service.Article 6 – Requirements for accreditation of Tier III external auditors
The Supervisory authority through a directive, shall set specific requirements for applicants wishing to be accredited as individual external auditors.Article 7 – Annual review of the requirements and other conditions for accreditation
The external auditor shall annually submit to the Supervisory authority the following updated information for assessment and review:1°a copy of a valid practicing certificates issued by ICPAR;2°The audit firm structure and a list of all key staff and their practicing certificates issued by ICPAR;3°List of assignments for the previous year;4°any other information as may be required by the Supervisory authority.The evaluation and review shall determine whether the external auditor still meets the requirements and conditions for accreditation.The updated information shall be submitted to the Supervisory authority not later than the last working day of April of the following year.Article 8 – Granting and validity of accreditation issued to the external auditor
Upon receipt of the Application file, the Supervisory authority sends to the Applicant, within seven (7) working days, a notice of acknowledgement.The notice of acknowledgement informs the applicant that the application file submitted was found complete or deficient and outlines the deficiencies identified.The Supervisory authority shall, within one (1) month from the date of the receipt of the complete application file, decide to grant or refuse to grant the accreditation and shall thereafter notify the decision taken to the applicant in the following ways:1°where the Supervisory authority rejects to grant the accreditation, the notification for rejection and its grounds shall be provided to the applicant in the letter;2°where the Supervisory authority decides to grant the accreditation, the notification for accreditation shall be provided to the applicant in the letter and the granted accreditation shall be valid right from the date of notification;Nonetheless, the granted accreditation may be revoked or suspended by the Supervisory authority whenever deemed necessary.Article 9 – Annual accreditation fees
The accredited external auditor shall pay annual accreditation fees of two million Rwandan francs (2,000,000 FRW) for a Tier I audit firm, and four hundred thousand Rwanda francs (400,000 FRW) for a Tier II audit firm.The amount provided in paragraph one of this article shall be paid on Supervisory authority account and the proof of payment be submitted to the Supervisory authority not later than the last working day of April of the following year.Article 10 – Grounds for suspension of external auditor’s accreditation
The Supervisory authority may suspend the accreditation granted to an external auditor at any time if the latter:1°is found to be in violation of the provisions of the laws or in material breach of this regulation, which affects the effectiveness of its operations or the public trust;2°has inadequate expertise or independence, is not subject to or does not adhere to established professional standards;3°has been suspended by ICPAR or any other relevant bodyThe Supervisory authority issues a suspension letter to the external auditor and informs regulated institutions as well as ICPAR.Article 11 – Grounds for revocation of external auditor’s accreditation
The Supervisory authority may revoke the accreditation granted to an external auditor at any time if the latter:1°has obtained the accreditation through incorrect statements or fraudulent means;2°has not commenced business within twelve (12) months from the date on which an accreditation letter was submitted to them;3°has ceased operating for a period of more than 12 months unless decided by the Supervisory authority;4°no longer meets the applicable accreditation criteria;5°is found to be in serious violation of provisions of the laws or in material breach of this regulation, which the effectiveness of its operations or the public trust;6°has serious inadequate expertise or independence, is not subject to or does not adhere to established professional standards;7°is engaged in financial crimes activities including money laundering and financing of terrorism activities;8°has not corrected the grounds for suspension;9°has been revoked by ICPAR or any other relevant body.The Supervisory authority shall issue a revocation letter to the external auditor and informs regulated institutions as well as the ICPAR.Chapter III
Appointment of an accredited external auditor, duties, responsibilities and obligations
Article 12 – Obligation to appoint an accredited external auditor by regulated institution
A regulated institution must appoint an external auditor from the list of accredited external auditors published on the website of the Supervisory authority.Regulated institutions must also apply robust processes for monitoring and assessing the independence of the accredited external auditor and to ensure that the appointed external auditor has the necessary knowledge, skills, expertise, integrity and resources to conduct the audit and meet any additional regulatory requirements.In case a regulated institution doesn’t appoint an accredited external auditor, the Supervisory authority shall appoint one on behalf of the regulated institution and all expenses incurred shall be paid by the audited regulated institution.Article 13 – Duration of appointment of an accredited external auditor
The duration of appointment of an accredited external auditor in a regulated institution shall be three years (3) unless extended by the Supervisory authority upon request by the audited institution. However, the granted extension cannot exceed two (2) years.The external auditor shall not be re-appointed to the same regulated Institution before the elapse of at least three consecutive fiscal years (3) counted from the date of end of its preceding appointment.Article 14 – Duties of an accredited external auditor
The accredited external auditor shall carry out its duties in accordance with International Standards of Auditing as well as with regulatory framework and decisions put in place by the Supervisory authority.The main duties of the accredited external auditor shall be to form and provide a written objective opinion on whether:1°it has obtained all the necessary information and explanations for the audit of books of accounts and have applied International Auditing Standards (IAS);2°proper books of accounts have been kept and maintained by the regulated institution;3°the financial statements are in agreement with the books of accounts and are in conformity with applicable International Financial Reporting Standards;4°the financial statements derived from the books of accounts give a “true and fair view” of the financial status of the institution in accordance with International Financial Reporting StandardsArticle 15 – Main responsibilities of an accredited external auditor
To achieve the duties provided for in this regulation, an accredited external auditor has the following main responsibilities:1°to ensure that the audited regulated institution prepares financial statements in accordance with International Financial Reporting Standards (IFRS) and that those financial statements are supported by the regulated institution’s data systems, in accordance with the relevant laws and regulations;2°to determine that a regulated institution has used valuation practices consistent with International Financial Reporting Standards (IFRS) and that the framework, structure and processes for fair value estimation are subject to independent verification and validation;3°document and disclose any significant differences between the valuations used for financial reporting purposes and for regulatory purposes in the management letter;4°ensure that the disclosure of the financial statements of regulated institutions complies with the International Financial Reporting Standards (IFRS) and relevant provisions of laws and regulations;5°disclose violations of laws and regulations in the management letter;6°review regulatory returns and report deficiencies to the Supervisory authority;7°ensure that financial statements, including the explanatory notes, are audited in accordance with International Standards on Auditing issued by the International Auditing and Assurance Standards Board (IAASB).8°ensure care and protection of public interest, depositors, policyholders, contributors, pensioners and other clients.Article 16 – Other responsibilities of an accredited external auditor
While exercising the duties of care and protection of public interest, depositors, policyholders, contributors, pensioners and other clients, the accredited external auditor shall ensure that:1°there is an appropriate disclosure of accounting policies to enable full understanding of the financial status and risks facing the regulated institution;2°all material factors affecting the ability of the regulated institution to continue as a going concern have been evaluated;3°the institution’s processes for identifying and managing risks (on and off-balance sheet) have been assessed;4°important areas in the regulated institution such as the loan portfolio, loan loss provisioning, non-performing assets, asset valuations, trading and other securities activities, derivatives, securitizations, consolidation and the relationship with off-balance sheet vehicles, technical provisions;5°sub-life funds accounts management, ageing analysis of receivables and payables, provisioning requirements, reinsurance assets and liabilities, and internal controls over the financial reporting have been assessed, review of capital adequacy computation, related parties’ transactions, assessment of movement of loan provisions and liquidity ratios, and reported in the management letter as per regulatory requirements;6°professional skepticism has been exercised when planning and performing the audit of the institution, considering the particularities of their activities;7°the risks of material misstatement in the institution’s financial statements have been identified and assessed, taking into consideration the complexities of its activities and the effectiveness of its internal control environment.Article 17 – Obligations of an accredited external auditor to the Supervisory authority
The accredited external auditor shall promptly inform the Supervisory authority of:1°any information or occurrence relating to the affairs of the institution that, in his or her opinion, could jeopardize the interest of the institution, depositors, policyholders or any other creditors, or information that the institution is insolvent or is likely to be unable to meet its obligations;2°any criminal offence that has been or is being committed by the institution or in connection with the institution’s business;3°transactions leading to suspicion of criminal activities including money laundering and financing terrorism;4°any acts of regulated institution that breach the relevant laws or regulations;5°any significant weaknesses in the institution’s internal control which may render it vulnerable to significant risks or any exposures that may potentially jeopardize its financial viability;An accredited external auditor shall also notify the Supervisory authority within seven (7) days in the event of:1°resignation from audit assignment and the reasons thereof;2°decision not to seek re-appointment and the reasons thereof;3°qualification of its opinion on the financial statements, including reasons thereof; and;4°any disciplinary actions taken against the firm.Article 18 – Additional reports to the Supervisory authority by an accredited external auditor
In addition to the obligations provided for in article 17 of this Regulation, the external auditor is required to report promptly to the Supervisory authority any of the information concerning the following matters:1°matters of serious conflict within the decision-making bodies;2°intention of the accredited external auditor to resign or any threat of removal of the auditor from office;3°material adverse changes in current or potential risks in the institution’s business;4°serious irregularities or significant losses which may jeopardize the interests of depositors, policyholders or other creditors of the institution;5°Information that indicates a material breach of the institution’s own policies, articles of association and memorandum of association.An accredited external auditor shall not be liable for any information disclosed to the Supervisory authority following this Regulation.Article 19 – Understanding of the regulated institution’s internal control environment by an accredited external auditor
The accredited external auditor, when obtaining an understanding of institution’s internal control environment, must:1°assess whether management, with the involvement of those charged with governance, is promoting a robust control environment;2°assess whether the same or a similar control environment extends to all types of operations and offered services and encompasses all subsidiaries and branches of the group;3°assess the IT capability of facilitating the business operations;4°understand the institution’s approach to outsourcing/offshoring of business activities and functions and assess how internal control over these activities is maintained;5°Obtain an adequate understanding of the organization of key control functions within the regulated institution and its subsidiaries. At a minimum, key control functions include the internal audit, risk management, compliance and other monitoring functions; and6°Assess whether there are any material gaps in the regulated institution’s control systems and understand the level of risk tolerance defined by those charged with governance;8°Assess whether the regulated institution comply with the anti-money laundering and financing of terrorism requirements.[Please note: numbering as in original.]Article 20 – The accredited external auditor’s opinion
The accredited external auditor shall not be exonerated by disclaimer clauses in the statements they endorse if those statements contain material errors and gross misrepresentation.An external auditor shall apply audit approaches, techniques and procedures designed to obtain reasonable assurance that material misstatements arising from fraud and errors are detected. When the auditor determines that such material misstatements exist, they are required to disclose this information to the Supervisory authority.When the accredited external auditor discovers material misstatements related to the financial statements, including the use of an inappropriate accounting policy or asset valuation or a failure to disclose essential information, the auditor must request management to adjust the financial statements in order to correct the misstatement.If the management refuses to make the correction, the external auditor must inform the Supervisory authority and must issue a qualified or an adverse opinion on the financial statements. The external auditor shall issue a qualified opinion or a disclaimer of opinion if the management failed to provide the auditor with all information or explanations that the auditor requires.Chapter IV
Disclosure and reporting requirements
Article 21 – Disclosure of related parties’ transactions
The accredited external auditor shall ensure that detailed information on related parties’ transactions are disclosed in audited annual financial statements. The non-performing component shall be clearly stated in the report.The accredited external auditor shall specifically identify and report any non-performing loan or any long outstanding receivables from the related parties.The accredited external auditor must verify whether transactions between regulated institutions and their related parties have value addition for the regulated institution and are at arm’s length.Article 22 – Actuarial evaluation for insurers or pension schemes
The accredited external auditor shall review and evaluate, for the purposes of audit and supervision, an evaluation conducted by the actuary appointed by the insurer or pension scheme.The actuarial evaluation shall be related to the liabilities resulting from the policies/funds as at the end of a financial year and to any change during the financial year in the liabilities resulting from policies of the insurer or pension scheme in relation to a particular fund.The external auditor for an insurer or pension scheme must have actuarial expertise to evaluate actuarial valuations.Article 23 – Quality assurance enforcement
The Supervisory authority shall continuously monitor the quality of audit of regulated institutions. The Supervisory authority may investigate any failures and/or weaknesses of the external auditor in the conduct of audit of a regulated institution.The Supervisory authority may also where it is not satisfied with the external auditor’s report, disqualify the latter and appoint another auditor to carry out additional audit or investigation as may be deemed necessary and submit a report on the matter concerned. The regulated institution shall remunerate that external auditor for its additional duties.Chapter IV
Miscellaneous and final provisions
Article 24 – Disciplinary sanctions to an accredited external auditor
Besides the sanction of suspension or revocation of an external auditor’s accreditation, the Supervisory authority may apply the following sanctions to an accredited external auditor who fails to comply with the requirements of this regulation, relevant laws as well as professional standards:1°Warning to the audit firm;2°Warning to the engagement partner, quality assurance partner or managerThe Supervisory authority shall communicate to the Institute of Certified Public Accountants of Rwanda (ICPAR) of such misconduct.Article 25 – Obligations of the regulated institution to the accredited external auditor
A regulated institution must provide data, information and the necessary facilities to the external auditor to effectively perform his/her duties.Article 26 – Incompatibilities with the functions of the accredited external auditor
The accredited external auditor shall be deemed non-independent and, therefore, shall not be hired or kept as an external auditor of an institution if:1°anyone in the team involved in the audit is a direct or indirect shareholder of the institution or any of its subsidiaries, affiliates, or controlled;2°has shares or contributions in a regulated institution in which they intend to audit;3°he or she is an officer of the pension scheme or any related sponsoring employer;4°has a business operation with the institution or any of its subsidiaries, affiliates or controlled institution not provided in the normal course of business and under ordinary commercial terms offered to all other customers;5°the audit fee and reimbursed audit expenses in the year as of which the audit work is performed, considered in isolation or together with its related companies’ fees and reimbursements, represents an amount equal or superior to twenty-five percent (25%) of the total income of the external auditor in that year.The accredited external auditor must have a policy that guarantees independence in his/her audit services, which includes the situations which can hamper his/her independence and the internal controls he/she adopts to monitor, identify and avoid these occurrences.If the accredited external auditor also provides non-audit services to the institution, the audit committee of a regulated institution shall monitor the provision of such services to ensure that such provision does not impair the external auditor’s objectivity and independence, taking into consideration factors as the skills and experience of the external auditor, safeguards in place to mitigate any threat to objectivity and independence, and the nature of and arrangements for non-audit fees;Annual audited accounts shall include a statement disclosing whether the audit committee is satisfied that the provision of non-audit services is compatible with the auditor’s independence. This disclosure shall include an explanation as to why the non-audit services do not compromise the audit independence.Article 27 – Non-audit Services
Non-audit services may include:1°preparing accounting records and financial statements;2°tax compliance services;3°valuation services;4°internal audit services; and IT systems services;5°temporary staff assignments;6°acting for or assisting an insurance client in the resolution of a dispute or litigation;7°legal services;8°recruiting senior managers for an insurance client and;9°corporate finance and similar activities. Or;10°any other service as may be determined by the Supervisory authority.Article 28 – Supervisory authority meeting with the accredited external auditor
The Supervisory authority may organize a meeting with an external auditor to discuss the scope of the work and to exchange information on the audited regulated institution.Where necessary the Supervisory authority may invite both the audited regulated institution and the external auditor to hold tripartite meetings.The Supervisory authority shall meet with external audit firms to discuss issues of common interest relating to regulated institutions operations whenever deemed necessary.Article 29 – Status of accreditations issued under the repealed regulation
The accreditations that were issued under the repealed regulation shall continue to be valid until their respective expiration dates.Article 30 – Drafting and consideration of this regulation
This regulation was prepared, considered and approved in English.Article 31 – Repealing provision
The regulation n° 14/2017 of 23/11/2017 on accreditation requirements and other conditions for external auditors for financial institutions and any prior provisions contrary to this regulation are hereby repealed.Article 32 – Commencement
This regulation shall come into force on the date of its publication in the Official Gazette of the Republic of Rwanda.History of this document
17 June 2022 this version
Commenced
02 June 2022
Assented to