REGULATIONS
ON REQUIREMENTS FOR CONDUCTING EXTERNAL AUDIT OF LOCAL BRANCHES OF BANKS AND FOREIGN BANKS

(as amended on 10 July 2009 and 15 April 2010)

Baku – 2007

I. General provisions

1.1. These Regulations have been developed in accordance with the laws of the Republic of Azerbaijan “On the Central Bank of the Republic of Azerbaijan”, “On Banks”, “On Auditor Service”, recommendations of the Basel Committee on Banking Supervision, as well as other applicable regulatory legal acts on audit in force and establish rules on the requirements for conducting an external audit of local branches of banks and foreign banks (hereinafter - the banks).
1.2. The requirements of these Regulations shall not apply to the external audit conducted by the Central Bank of the Republic of Azerbaijan (hereinafter - the Central Bank) and on the initiative of banks.
1.3. The external audit standards required by these Regulations shall also apply to the audit of subsidiaries of banks integrating (consolidating) financial statements in accordance with International Financial Reporting Standards (hereinafter - IFRS).

2. Main definitions

2.1. The terms used in these Regulations shall have the following meanings:
2.1.1. Auditor - an audit organization or an independent auditor having a special agreement (license) in accordance with the legislation of the Republic of Azerbaijan. The terms "external auditor" and "auditor" have the same meaning in these Regulations. The term "internal auditor" is used in the relevant sections of the Regulations to distinguish between an external auditor and an internal auditor.
2.1.2. Unqualified opinion - the auditor's opinion when it is confirmed that the financial statements of a bank represent an accurate and objective opinion (or provide accurate information on all important matters) in accordance with IFRSs.
2.1.3. Qualified opinion - the auditor's opinion when it is impossible to give an unqualified opinion, but the restrictions or disagreement with the bank's administrators are not significant or sufficiently convincing to refuse to give an opinion or to give an adverse opinion.
2.1.4. Adverse opinion - the auditor’s opinion when it is impossible to give a qualified opinion to identify inaccuracies or incomplete financial statements due to the fact that the disagreement with the bank's management is significant and persuasive.
2.1.5. Disclaimer of opinion – the auditor’s statement that no opinion is being given regarding the financial statements as a result of lack of evidence due to the fact that the constraints on the auditor's work are too significant and persuasive.
2.1.6. Letter of engagement - is a written document reflecting the terms of the audit, including its purpose and scope, the auditor's obligations to the bank and the bank's obligations to the auditor.
2.1.7. International Standards on Auditing (ISA) are standards used to examine past financial information developed by the International Auditing and Assurance Standards Board (IAASB), a committee of the International Federation of Accountants (IFAC). For the purposes of these Regulations, the following documents published by the IFAC shall hereinafter be referred to as the ISA:

• Code of Ethics for professional accountants;
• International Principles on Assurance Engagements;
• International Standards on Quality Control;
• International Standards on Auditing;
• International Declarations on Auditing.

2.1.8. Independent opinion – is the ability to express an opinion free from factors that may affect professional judgment, and to be accurate, objective, and cautious.
2.1.9. Independent view - is the absence of important facts and conditions that could lead a third party with relevant information to conclude that the auditor is not credible in terms of accuracy, objectivity and professionalism.
2.1.10. Report to Management (Letter of Proposals for Management) is a written document submitted to the bank by the auditor after the audit.
2.2. Limitations on the auditor's work may arise from the bank and, in some cases, depending on the circumstances (for example, the terms of the contract do not allow the auditor to perform audit procedures that he considers necessary, the contract and the appointment term of the auditor doesn’t allow him to control the inventory counting, etc.).
Limitations may also arise when, in the auditor's opinion, the bank's accounting records are inadequate or the auditor is unable to perform the audit procedures deemed appropriate.
2.3. Disagreements with the bank's administrators may arise when they do not agree on issues such as the accounting policy chosen by the auditor, the methods of its application, or the adequacy of the financial statements.
2.4. Other terms used in these Regulations shall have the meanings in accordance with the definitions given in the legislation of the Republic of Azerbaijan "On Banks", "On Accounting", "On Auditor Services" and others.

3. Audit standards

3.1. These Regulations require the application of ISA when auditing the financial statements of banks.
3.2. IFRS shall be used as a criterion for financial reporting standards to evaluate banks' financial statements.
3.3. If the legislation of the Republic of Azerbaijan establishes other requirements than the requirements of the ISA on the audit of banks, these requirements shall be met in addition to the requirements of the ISA.
In the event of a conflict between the requirements established by the legislation of the Republic of Azerbaijan and the requirements of the ISA, the legislation of the Republic of Azerbaijan shall prevail.

4. Independence of the external auditor

4.1. The external auditor shall conduct its audit independently of the banks, their administrators and shareholders, as well as shareholders with significant stakes.
4.2. The auditor's independence shall be based on his/her independent opinion and view.
4.3. The auditor's independence shall be considered lost when the following threats have a significant effect on him and it is not possible to reduce these risks to an acceptable level:
4.3.1. A “self-interest” threat exists if the auditor holds financial interests in the audited bank or may benefit from the conflict of the interests of that bank;
4.3.2. A “self-review” threat arises when it is necessary to re-examine previous findings and considerations in order to obtain the results of an audit, or when the auditor was an administrator of a previously audited bank or an employee who might have a direct and significant impact on the audited entity;
4.3.3. An “advocacy” threat exists if the auditor is involved in promoting the client, to the point where the objectivity of the position or opinion of the audited bank is potentially compromised;
4.3.4. A “familiarity” threat exists when the auditor is too personally close to or familiar with employees, officers, or administrators of the audited bank, which leads to a conflict of interest;
4.3.5. An “intimidation” threat arises when the auditor is intimidated by management or employees of the audited bank to the point that they are deterred from acting objectively.

5. Selection and replacement of an external auditor

5.1. Banks are free to choose an external auditor. The Bank's Audit Committee shall obtain information from the potential auditor on the following:
5.1.1. availability of a special agreement (license) in force to engage in auditing services;
5.1.2. past activities of the auditor;
5.1.3. names of other auditors and experts (if any) who will participate in the audit of the bank, their education and work experience;
5.1.4. auditor’s statement, which affirms the auditor's independence and describes the details of the relationship of the auditor, their employees, their jointly managed and jointly owned entity with the bank, bank administrators, affiliates and persons acting on behalf of the bank over the past three years or any relationship intended for the future;
5.1.5. any other business information that, in the opinion of the Audit Committee, is relevant to the selection.
5.2. The selected auditor shall have knowledge of IFRSs and experience in auditing banks and other financial institutions.
5.3. A contract shall be concluded with the external auditor selected to conduct the audit and the Central Bank shall be notified by November 15 of the year covered by the audit.
5.4. In addition to the agreement signed between the bank and the auditor, the “Letter of Engagement” prepared on the basis of ISA shall be sent to the bank by the auditor and the receipt of the letter shall be approved by the bank accordingly.
5.5. In case of early termination of the external audit of the bank, the bank shall notify the Central Bank within 5 (five) business days from that date. The information shall indicate the reasons for termination of the contract.
5.6. If the external audit of the bank is carried out by the same auditor for at least 5 years without change, the Central Bank may require the involvement (rotation) of another auditor by the bank in order to ensure the objectivity and impartiality of the audit.

6. Rights and obligations of the external auditor

6.1. The external auditor of the bank shall have the following rights:
6.1.1. independently determine the audit plan and audit procedures;
6.1.2. get acquainted with all documents required for auditing the financial and economic activities of the bank and its subsidiaries, as well as materials on the results of the audit of previous years or obtain them from the bank or third parties;
6.1.3. check the availability of funds, securities, tangible and intangible assets in the bank and its subsidiaries;
6.1.4. obtain clarifications from administrators and employees in order to assess the risks associated with material misstatements in the financial statements, as well as the considerations used in the preparation of accounting opinions and application of accounting policies;
6.1.5. use the factors identified by the bank's internal auditor after determining whether the relevant requirements of ISA on internal audit have been met;
6.1.6. refuse to conduct an audit of the bank if the bank does not submit the necessary documents;
6.1.7. require the provision of the necessary working conditions for the audit;
6.1.8. make recommendations to the bank's administrators for eliminating the identified shortcomings;
6.1.9. involve an expert (an individual or legal entity with special knowledge, experience and competence in areas other than accounting and auditing) to conduct an audit with the consent of the bank;
6.1.10. exercise other rights provided by the legislation.
6.2. The external auditor of the bank shall have the following responsibilities:
6.2.1. audit the bank in accordance with the requirements of the ISA and these Regulations;
6.2.2. assess the compliance of the bank's activities with the corporate governance standards set by the Central Bank;
6.2.2.-1. assess the bank's loan portfolio and creation of credit reserves, non-performing loans, refinancing of assets, as well as the bank's operations with securities and off-balance sheet accounts; assessment of the bank's loan portfolio and creation of credit reserves, non-performing loans, refinancing of assets, as well as the bank's operations with securities and off-balance sheet accounts;
6.2.2.-2. confirm the adequacy of the bank's internal risk assessment and management methods, the determination of the fair value of assets, and the internal control systems of the financial statements;
6.2.3. prepare and submit to the bank the Auditor's report, the Management Report and other information required by these Regulations within the time limits agreed between the bank and the auditor;
6.2.4. inform the Central Bank on any significant violations, losses or illegal activities that may adversely affect the bank's ability to fulfill its obligations to the interests of depositors and creditors, as well as its liquidity position, or reduce the bank's total capital below the minimum established by applicable law.
6.2.5. fulfill other obligations stipulated by the legislation and the agreement concluded between the bank and the external auditor.

7. The Auditor’s report

7.1. The audit report shall be prepared on the basis of audit results in accordance with the requirements of the relevant legislation.
7.2. Each report prepared by the auditor in accordance with these Regulations shall contain the following key elements of the audit report:
7.2.1. the report’s name;
7.2.2. the person to whom the report is addressed;
7.2.3. the introductory part showing the audited financial statements and the responsibilities of the management of the enterprise and the auditor;
7.2.4. the part referring to the IFAC declarations and describing the work performed by the auditor (the part indicating the type of audit);
7.2.5. the part of the report stating that the reporting structure used to prepare the financial statements refers to IFRSs and containing an opinion on the financial statements.

When forming the auditor's report, the auditor shall collect sufficient audit evidences to enable him to draw conclusions. The auditor's report increases the reliability of the financial statements, creating a certain level of confidence. It is not possible to achieve absolute certainty in the course of an audit. This is due to the limitations of the considerations, testing, accounting and internal control systems, as well as the fact that the evidences in the hands of the auditor are not final, but satisfactory (substantial).

There are four types of audit reports: "unqualified", "qualified", "adverse" and "disclaimer of opinion"
7.2.6. the report’s date;
7.2.7. the auditor’s address;
7.2.8. the auditor’s signature;
7.2.9. Complete financial statements consisting of the following components: balance sheet, profit and loss statement, statement of changes in equity, cash flow statement, accounting policy and notes.
7.3. Sections on issues that are important to highlight the factors affecting the financial statements may also be included in the auditor's report. A more detailed explanation of these issues is included in the notes to the financial statements. The addition of such sections does not affect the auditor's opinion. The auditor may also make additions to the auditor's report using sections on other important matters that do not affect the financial statements.
7.4. Upon completion of the audit, the auditor may provide the bank with a "Management Report". This report contains issues that are not required to be disclosed in the annual financial statements, but are mentioned during the audit, which attracts the attention of the auditor, and relevant proposals. The report shall be sent to the bank's Management Board, the Audit Committee and the Supervisory Board. The management report may contain information about the following facts: key risks, unusual facts, suggestions for improving the internal control system, ideas for improving processes and structures, as well as alternatives for more efficient use of resources. The overall format of the Management Report may include changes to the proposals made in the previous year, the facts identified for the current year, the risks associated with them, the proposals and the parties taking relevant actions.
7.5. Banks provide the auditor with additional information to determine whether there is a material discrepancy between the financial statements and the additional information to be published together with the audited financial statements. If the bank refuses to make changes to the additional information at the request of the auditor, an audit note on the issue on which no agreement can be reached shall be published along with the additional information.

8. Obligations of banks to submit audit reports and other information to the Central Bank

8.1. Banks shall make copies of the financial statements together with copies of the “Audit Report” and the “Management Report” within the first 5 (five) months of the following year after the end of the corresponding reporting year, but not later than 3 (three) business days from the date of signing the “Auditor Report”.
8.2. If the audit covers another period, banks shall submit a copy of the audit report to the Central Bank within 3 (three) business days from the date of signing the report.
8.3. Banks shall eliminate inconsistencies identified by the external auditor in the financial statements and submit a list of all audit adjustments with explanations to the Central Bank within the first 6 (six) months of the following year after the end of the relevant reporting year.
8.4. Within 1 (one) month after receiving the “Management Report”, banks shall respond in writing to the auditor about the shortcomings and deficiencies indicated in the report and submit a copy of the response letter to the Central Bank.
8.5. The audit report submitted to the Central Bank shall be in the Azerbaijani language. The report shall be sewn up, numbered and stamped on the back of the last page indicating the total number of pages.

9. Closing provision

These Regulations shall be effective from the date of state registration.