EXPLANATORY MEMORANDUM

1. CONTEXT OF THE PROPOSAL

The measures adopted both in Europe and elsewhere in the direct aftermath of the financial crisis have mainly focused on the urgent need to stabilise the financial system. While the role played by banks, hedge funds, rating agencies, supervisors or central banks has been questioned and analysed in depth in many instances, little or no attention had been given to the role auditors played in the crisis – or indeed the role they should have played. Given that many banks revealed huge losses from 2007 to 2009 on the positions they had held both on and off balance sheet, it is difficult for many citizens and investors to understand how auditors could give clean audit reports to their clients (in particular banks) for those periods.

It is important to note that in a crisis where €4 588.9 billion of taxpayer money was committed to support banks between October 2008 and October 2009 and where such aid accounted for 39% of EU 27 GDP in 2009[1], all components of the financial system need to be improved.

Robust audit is key to re-establishing trust and market confidence. It contributes to investor protection by providing easily accessible, cost-effective and trustworthy information about the financial statements of companies. It also potentially reduces the cost of capital for audited companies by ensuring more transparency and reliability of financial statements.

It is also important to stress that auditors are entrusted by law to conduct statutory audits of the financial statements of companies which enjoy limited liability and/or are authorised to provide services in the financial sector. This entrustment responds to the fulfilment of a societal role in offering an opinion on the truth and fairness of the financial statements of those companies.

Since 1984, EU rules have partially regulated statutory audit when a directive (Directive 1984/253/EEC) harmonized the procedures for the approval of auditors. Directive 2006/43/EC of the European Parliament and of the Council of 17 May 2006 on statutory audits of annual accounts and consolidated accounts, amending Council Directives 78/660/EEC and 83/349/EEC and repealing Council Directive 84/253/EEC (hereinafter Directive 2006/43/EC) was adopted in 2006 and considerably broadened the scope of the former Directive.

The financial crisis has highlighted weaknesses in the statutory audit especially with regard to Public-Interest Entities (PIE), entities which are of significant public interest because of their business, their size, their number of employees or their corporate status is such that they have a wide range of stakeholders. Therefore, this proposal lays down conditions for carrying out the statutory audit on the financial statements of PIEs.

2. RESULTS OF CONSULTATIONS WITH THE INTERESTED PARTIES AND IMPACT ASSESSMENTS

The Commission conducted a consultation from 13 October to 8 December 2010[2].

In all, almost 700 responses from various stakeholders; these included members of the profession, supervisors, investors, academics, companies, government authorities, professional bodies and individuals were received.

The consultation has shown both an appetite for as well as resistance to change; stakeholders who are currently well established are particularly opposed to changes. On the other hand, especially small and medium sized practitioners as well as investors concluded that the recent financial crisis highlighted serious shortcomings. A summary of public submissions received can be found on:

http://ec.europa.eu/internal_market/consultations/docs/2010/audit/summary_responses_en.pdf

In addition, a high level conference on audit held by the Commission on 10 February 2011[3] allowed for a further exchange of views.

The European Parliament adopted an own-initiative report on 13 September 2011 on this matter in reaction to the Commission's Green Paper and urges the Commission to ensure more transparency and competition in the audit market.[4] The European Economic and Social Committee (EESC) adopted a similar report on 16 June 2011.[5]

The issues were also brought to the attention of the Member States at the Financial Services Committee meeting of 16 May 2011 and at the Audit Regulatory Committee meeting of 24 June 2011.

In keeping with the principles of 'Better Regulation', the Impact Assessment identifies the various problem areas that may require regulatory action:

· There is an expectation gap between what stakeholders expect of an audit and what auditors actually do.

· Independence is neither assured nor demonstrable in a paradigm where audit has effectively become one of a plethora of commercial services. The lack of regular tendering of audit services and periodic rotation of audit firms has deprived audit of its key ethos: professional scepticism.

· Market concentration and lack of choice: The market is so polarised that rare is the occasion when the auditor of a PIE is not a 'Big Four' firm. In the majority of Member States, the Big Four audit more than 85% of large listed companies.

The impact assessment resulted in the following preferred policy options:

· The scope of statutory audit should be clarified and specified and the information that the auditor provides to users, the audited entities, audit committees and supervisors improved.

· The prohibition of the provision of non-audit services to the audited entities and even the prohibition of the provision of non-audit services in general would effectively address the need to reinforce independence and professional scepticism. Moreover, stricter rules in the procedure for the appointment of auditors and the introduction of mandatory audit firm rotation would contribute to higher quality audits.

· To facilitate an objective choice of an audit provider, contractual clauses limiting audit firm choice should be prohibited, the transparency on audit quality and on audit firms should be increased and an audit quality certification should be established.

· To increase the choice of audit providers ownership restrictions should be lifted.

· National audit supervisory authorities should be strengthened and an EU-wide cooperation within the European Securities and Markets Authority (ESMA) should be set up.

The impact assessment report for this proposal can be found on:

http://ec.europa.eu/internal_market/auditing/index_en.htm

3. LEGAL ELEMENTS OF THE PROPOSAL

3.1 Legal basis

The existing Directive 2006/43/EC is based on Article 50 TFEU. The establishment related requirements (e.g. those requirements that deal with the approval/registration of auditors) and amendments thereto remain within the purvey of the Directive[6].

Specific additional requirements that deal with the conduct of a statutory audit of PIEs are set out in this regulation, based on Article 114 TFEU.

3.2. Subsidiarity and proportionality

So far, EU rules have left a large discretion to Member States, which in turn have largely relied on self-regulation by the profession. The crisis has shown that self-regulation is not adequate when looking towards the future. Moreover, the problems highlighted in the Impact Assessment cannot be solved at a national level as important differences would emerge in the regulatory framework and this in turn would seriously undermine the single market.

Given the interconnected nature of securities markets and financial actors, audit should be conducted across the Union within a harmonised framework. It is critical that the role, independence of auditors and the market structure are dealt with at the level of the Union as PIEs in Europe often have cross-border activities. It is worth noting that legislation covering investor protection as well as financial institutions is already enacted at the level of the Union.

Moreover, a coordinated approach at the level of the Union, supplemented by international support, would also lower the risk of regulatory arbitrage.

The proposal respects the principle of proportionality and it does not go beyond what is necessary to achieve the objectives pursued.

3.3. Detailed explanation of the proposal

Articles 39 to 43 of Directive 2006/43/EC already deal with certain requirements which apply to the statutory audit of PIEs. Those requirements will no longer be comprised in the Directive, but integrated (and further developed) in this Regulation.

A Regulation is a suitable and proportionate legal instrument to ensure high quality of audits of PIEs. The direct applicability of a Regulation offers greater legal certainty. Also, the legislation would become applicable at the same date across the Union, thus avoiding problems associated with the late transpostion of legislation by Member States[7]. Furthermore, a regulation offers the highest degree of harmonisation: statutory audits would be carried out under substantially identical rules in all Member States.

3.3.1. Title I (subject matter, scope and definitions)

The Regulation applies to auditors that carry out statutory audits of PIEs and to the audited PIEs, e. g. rules on the audit committee which a PIE is required to have.

For the purpose of the Regulation the definitions that apply to the amended Directive 2006/43/EC should also apply here. As the financial sector evolves, new categories of financial institutions are created under Union law and it is thus appropriate that the definition of PIEs also encompasses investment firms, payment institutions, undertakings for collective investment in transferable securities (UCITS), electronic money institutions and alternative investment funds.

3.3.2. Title II (Conditions for carrying out statutory audit of public-interest entities)

Chapter I (Independence and avoidance of conflict of interest)

An auditor should establish adequate policies and procedures to ensure compliance with the obligations under the Regulation regarding independence, internal quality control systems and the supervision of employees.

Former auditors, key audit partners or their employees are not allowed to take up a key management position in the audited entity, to become a member of the audit committee of the audited entity, to become a non-executive member of the administrative body or to join the supervisory body of the audited entity within two years after the termination of the audit engagement.

The fees for the provision of related financial audit services to the audited entity should be limited to 10 % of the audit fees paid by that entity. Additionally, where the total fees, audit and related financial audit services, received by an auditor from a PIE reach a significant percentage of his/her/its total annual fees, appropriate safeguards should be applied.

The statutory auditor, audit firm or member of the audit firm's network will be prevented from providing certain non-audit services which are fundamentally incompatible with the independent public-interest function of audit to their audited entities in all cases, while for other non-services that are not fundamentally incompatible with the audit services, the audit committee or the competent authority will be empowered to assess, depending on the concrete circumstances, whether or not they may be provided to the audited entity.. However, related financial audit services could be provided. The Commission is empowered to adapt the lists of authorised services and of prohibited services in accordance with the conditions set out in Title VI. In addition, audit firms of significant dimension should focus their professional activity on the carrying out of statutory audit and should not be allowed to undertake non-audit services.

Before accepting or continuing an engagement, an auditor should assess all potential threats to his/her/its independence and confirm his/her independence to the audit committee.

Chapter II (Confidentiality and professional secrecy)

Auditors should not invoke professional secrecy rules to prevent the application of the provisions of this proposal.

Article 13 ensures that necessary information can be exchanged during the performance of the audit. However, such rules would not allow an auditor to cooperate with third country authorities outside the cooperation channels foreseen in Chapter XI of Directive 2006/43/EC.

Chapter III (Performance of the statutory audit)

The Regulation lays out that the auditor should take the necessary steps with a view to forming an opinion as to whether the financial statements give a true and fair view and have been prepared in accordance with the relevant financial reporting framework. It does not include the assurance on the future viability of the audited entity nor the efficiency or effectiveness with which the management or the administrative body has conducted or will conduct the affairs of the entity. However, this exclusion should neither undermine the tasks that an auditor needs to undertake in order to conduct the audit properly nor any reporting requirements.

Professional scepticism is reinforced. The auditor should always remain alert to the possibilty of a material misstatement due to error or fraud, notwithstanding the auditor's past experience with the entity.

Basic requirements for the performance of the statutory audit are established. The audit firm should designate at least a key audit partner, who should be actively involved in the carrying out of the statutory audit. Sufficient resources should be assigned as well. A client account record should be maintained and an audit file should be created. Moreover, the auditor should make sure that all the organisational requirements are properly applied.

Where an incident which has or may have serious consequences for the integrity of the statutory audit activities happens, the auditor should take appropriate measures with a view to managing the consequences of the incident and prevent any recurrence.

In the case of the audit of consolidated financial statements, where the group auditor is not in the position to document the audit work performed by third-country auditor(s), he needs to take appropriate measures including additional audit work and inform the competent authority.

An auditor/audit firm should carry out its own internal quality control review before submitting the audit report. The review should be the responsibility of an auditor who is not involved in the performance of the statutory audit to which the internal quality review relates.

Chapter IV (Audit reporting)

The content of the audit report disclosed to the public is expanded so that it explains the methodology used, especially how much of the balance sheet has been directly verified and how much has been based on system and compliance testing, the levels of materiality applied to perform the audit, the key areas of risk of material misstatements of the financial statements, whether the statutory audit was designed to detect fraud and, in the event of a qualified or adverse opinion or a disclaimer of opinion, the reasons for such a decision. It should also explain the variation in the weighting of substantive and compliance testing when compared to the previous year.

Moreover, the auditor should also prepare a longer and more detailed report for the audit committee. This report would provide more detailed information on the audit carried out, on the situation of the undertaking as such (e. g. going concern) and the findings of the audit combined with the necessary explanations. This additional report would also present (and justify) the audit work carried out to the audit committee. This longer report would be submitted to the audit committee and to the management of the audited entity, but not to the public (given that its content would include business secrets and potentially price sensitive information). However, upon request, the auditor should make this report available to the competent authority.

In most of the financial services directives, the auditor is already required to the competent authorities supervising the PIE any fact or decision concerning the PIE. This obligation is now extended to all PIEs. Moreover, competent authorities supervising credit institutions and insurance undertakings should establish a regular dialogue with the auditors.

Chapter V (Transparency reporting by statutory auditors and audit firms and record keeping)

Auditors will be required to disclose financial information, showing in particular their total turnover divided into audit fees paid by PIEs, audit fees paid by other entities and fees for other services. They should also disclose financial information at the level of the network to which they belong.

The transparency reports of auditors of PIEs should be completed by a statement on the firms' own corporate governance. Additional supplementary information on audit fees should be provided to competent authorities with a view to facilitating their supervisory tasks.

The auditor should keep certain documents and information for a period of five years.

3.3.3. Title III (The appointment of statutory auditors or audit firms by public-interest entities)

In order to reinforce the independence and capacity of the audit committee, it should be composed of non-executive members, at least one member should have experience and knowledge in auditing and another one in accounting and/or auditing.

The proposal for the appointment of the auditor to the meeting of shareholders should be based on a recommendation of the audit committee. The recommendation should always contain a justification of the decision proposed. In addition, unless it concerns the renewal of an audit engagement, the recommendation should contain at least two choices (excluding the incumbent auditor) and the audit committee should express a duly justified preference for one of them. The recommendation of the audit committee should be made after the completion of a due tendering process. In the case of credit institutions or insurance undertakings, the audit committee should submit its recommendation to the prudential supervisory authority, which should have the right to veto the choice proposed.

Contractual clauses with third parties limiting the audited entity's choice of an auditor should be prohibited.

With a view to addressing the threat of familiarity that results from the audited undertaking often appointing and re-appointing the same audit firm for decades, the regulation introduces mandatory rotation of audit firms after a maximum period of 6 years that may be, under certain exceptional circumstances, extended to 8 years. Where a public-interest entity has appointed two or more statutory auditors or audit firms, the maximum duration of the engagements will be 9 years; on an exceptional basis, such duration may be extended to 12 years. It also provides for a cooling-off period before the audit firm is able to carry out the statutory audit of the same entity again. In order to ensure a smooth transition the former auditor is required to transfer a handover file with relevant information to the incoming auditor.

The audit committee, one or more shareholders, the competent authorities and the competent authorities for the supervision of the PIEs are empowered to bring a claim before a national court for the dismissal of the auditor where there are proper grounds.

3.3.4. Title IV (Surveillance of the activities of auditors and audit firms carrying out statutory audit of public-interest entities)

Chapter I (Competent authorities)

Each Member State should designate a competent authority responsible for the supervision of auditors and audit firms auditing PIEs. These authorities should be adequately staffed and independent of auditors. The obligations of professional secrecy apply to the competent authorities employees.

The competent authorities should have all supervisory and investigative powers that are necessary to exercise their function but should not interfere with the content of an audit report..

The competent authorities should cooperate at the national level with the authority responsible for the approval and registration of statutory auditors and audit firms (Directive 2006/43/EC) and with other supervisors of PIEs e. g. the banking or the insurance supervisor.

Chapter II (Quality assurance, investigation, market monitoring, contingency planning and transparency of competent authorities)

The tasks of the competent authorities include:

· undertaking quality assurance reviews on the statutory audits carried out. These reviews should be proportionate to the scale and dimension of activity of the reviewed auditor;

· investigating with a view to detecting, correcting and preventing inadequate statutory audits of PIEs;

· monitoring the developments in the market for the provision of statutory audit services to PIEs;

· regularly monitoring the possible threats to the continuity of the operations of large audit firms, including the risks arising from high concentration and requiring large audit firms to establish contingency plans to address such threats;

· being transparent about their activities, including the publication of individual quality assurance review reports.

Chapter III (Cooperation between competent authorities and relations with the European supervisory authorities)

The regulation requires that the EU-wide cooperation between competent authorities takes place within ESMA, thus taking over the current EU-wide cooperation mechanism under the aegis of the European Group of Auditors' Oversight Bodies (EGAOB), an expert group chaired by the European Commission. ESMA is already working in the field of auditing (and accounting) regarding PIEs and the legal framework foresees the cooperation of ESMA, the European Banking Authority (EBA) and the European Insurance and Occupational Pensions Authority (EIOPA) within their joint committee in the area of auditing. ESMA is required to create a permanent internal committee which should at least be composed of the national competent authorities.

ESMA should issue guidance on several issues: e.g. on the content and presentation of the audit report and the additional report to the audit committe, on the oversight activity of the audit committee or for conducting quality assurance reviews.

A 'voluntary' pan-European audit quality certification is introduced to increase the visibility, recognition and reputation of all audit firms having capacities to conduct high quality audits of PIEs. ESMA should publish the requirements for obtaining the certificate along with any administrative and fee implications. National competent authorities should be involved in the examination of the application for the certificate. Concerning investigation and on-site inspections, competent authorities should notify the competent authority of the other Member State, if they conclude that activities contrary to the provisions of the Regulation are being or have been carried out. Moreover, a competent authority of a Member State may request that an investigation be carried out by the competent authority of another Member State in the latter's territory.

Furthermore, colleges of competent authorities may be established by ESMA upon request of one or more competent authorities in order to facilitate the exercise of certain tasks.

Chapter IV (Cooperation with third country auditors and with international organisations and bodies)

The competent authorities and ESMA may conclude cooperation agreements on the exchange of information with the competent authorities of third countries only if the information disclosed is subject to guarantees of professional secrecy and provided data protection rules are respected.

3.3.5. Title V (Supervisory measures and penalties)

In order to improve compliance with the requirements of this Regulation and following the Commission Communication of 9 December 2010 entitled 'Reinforcing sanctioning regimes in the financial sector'[8], the powers to adopt supervisory measures and the sanctioning powers of competent authorities are enhanced. Administrative pecuniary sanctions on auditors and PIEs for identified violations are envisaged. Authorities should be transparent about the sanctions and measures they apply.

3.3.6. Title VI (Reporting and transitional and final provisions)

A transitional regime is introduced regarding the entry into force of the obligation to rotate audit firms, the obligation to organise a selection procedure for the choice of audit firm and the establishment of audit firms that only provide audit services.

3.3.7. Regulatory technical standards and compliance with Article 290 TFE

In order to take account of developments in auditing and the audit market, ESMA is requested to submit regulatory technical standards to the Commission in order to specify technical requirements on the content of the handover file that the new auditor should receive and the establishment of a European quality certificate for auditors carrying out statutory audits of PIEs. The Commission is empowered to adopt these technical standards as delegated acts.

On 23 September 2009, the Commission adopted proposals for Regulations establishing EBA, EIOPA (The European Insurance and Occupational Pensions Authority (EIOPA), and ESMA (European Securities and Markets Authority)[9]. In this respect the Commission wishes to recall the Statements in relation to Articles 290 and 291 TFEU it made at the adoption of the Regulations establishing the European Supervisory Authorities according to which: "As regards the process for the adoption of regulatory standards, the Commission emphasises the unique character of the financial services sector, following from the Lamfalussy structure and explicitly recognised in Declaration 39 to the TFEU. However, the Commission has serious doubts whether the restrictions on its role when adopting delegated acts and implementing measures are in line with Articles 290 and 291 TFEU."

4. BUDGETARY IMPLICATION

The Commission's proposal has no direct or indirect impact on the European Union budget. In particular, tasks that would be entrusted to EU supervisory bodies as mentioned in the proposal would not entail additional EU funding.

2011/0359 (COD)

Proposal for a

REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

on specific requirements regarding statutory audit of public-interest entities

(Text with EEA relevance)

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 114 thereof,

Having regard to the proposal from the European Commission,

After transmission of the draft legislative act to the national Parliaments,

Having regard to the opinion of the European Economic and Social Committee[10],

After consulting the European Data Protection Supervisor[11],

Acting in accordance with the ordinary legislative procedure,

Whereas:

(1) Statutory auditors and audit firms are entrusted by law to conduct statutory audits of public-interest entities with a view to enhancing the degree of confidence of the public in the annual and consolidated financial statements of such entities. The public-interest function of statutory audit means that a broad community of people and institutions rely on the quality of a statutory auditor's work. Good audit quality contributes to the orderly functioning of markets by enhancing the integrity and efficiency of financial statements. Thereby, auditors fulfil a particularly important societal role.

(2) Union legislation requires that the financial stements, comprising annual accounts or consolidated accounts, of credit institutions, insurance undertakings, issuers of securities admitted to trading on a regulated market, payment institutions, UCITS, electronic money institutions and alternative investment funds be audited by one or more persons entitled to carry out such audits in accordance with Union law, namely: Article 1(1) of Council Directive 86/635/EEC of 8 December 1986 on the annual accounts and consolidated accounts of banks and other financial institutions[12], Article 1(1) of Council Directive 91/674/EEC of 19 December 1991 on the annual accounts and consolidated accounts of insurance undertankings[13], Article 4(4) of Directive 2004/109/EC of the European Parliament and of the Council of 15 December 2004 on the harmonisation of transparency requirements in relation to information about issuers whose securities are admitted to trading on a regulated market and amending Directive 2001/34/EC[14], Article 15(2) of Directive 2007/64/EC of the European Parliament and of the Council of 13 November 2007 on payment services in the internal market amending Directives 97/7/EC, 2002/65/EC, 2005/60/EC and 2006/48/EC and repealing Directive 97/5/EC[15], Article 73 of Directive 2009/65/EC of the European Parliament and of the Council of 13 July 2009 on the coordination of laws, regulations and administrative provisions relating to undertakings for collective investment in transferable securities (UCITS)[16], Article 3(1) of Directive 2009/110/EC of the European Parliament and of the Council of 16 September 2009 on the taking up, pursuit and prudential supervision of the business of electronic money institutions amending Directives 2005/60/EC and 2006/48EC and repealing Directive 2000/46/EC[17], and Article 22(3) of Directive 2011/61/EC of the European Parliament and of the Council of 8 June 2011 on Alternative Investment Fund Managers and amending Directives 2003/41/EC and 2009/65/EC and Regulations (EC) No 1060/2009 and (EU) No 1095/2010[18]. Moreover, Article 4(1)(1) of Directive 2004/39/EC of the European Parliament and of the Council of 21 April 2004 on markets in financial instruments amending Council Directives 85/611/EEC and 93/6/EEC and Directive 2000/12/EC of the European Parliament and of the Council and repealing Council Directive 93/22/EEC[19] also requires that the annual financial statements of investment firms be audited when the Fourth Council Directive 78/660/EEC of 25 July 1978 on the annual accounts of certain types of companies[20] or the Seventh Council Directive 83/349/EEC of 13 June 1983 on consolidated accounts[21] are not appplicable.

(3) The conditions for the approval of the persons responsible for carrying out the statutory audit as well as the minimum requirements for carrying out such statutory audit are laid down in Directive 2006/43/EC of the European Parliament and of the Council of 17 May 2006 on statutory audits of annual accounts and consolidated accounts, amending Council Directives 78/660/EEC and 83/349/EEC and repealing Council Directive 84/253/EEC[22].

(4) During the recent financial crisis, numerous banks revealed huge losses from 2007 to 2009 on the position they had held both on and off balance sheet. This raised not only the question of how auditors could give unqualified audit reports to their clients for those periods but also about the suitability and adequacy of the current legislative framework. The Commission published on 13 October 2010 a Green Paper on Audit Policy: Lessons from the Crisis[23], which launched a wide public consultation, in the general context of financial market regulatory reform, on the role and scope of audit and how the audit function could be enhanced in order to contribute to increased financial stability. It resulted from the public consultation that the rules of Directive 2006/43/EC regarding the carrying out of the statutory audit of annual and consolidated accounts of public-interest entities could be substantially improved. The European Parliament issued an own initiative report on the Green Paper on 13 September 2011. The European Economic and Social Committee also adopted a report on that Green Paper on 16 June 2011.

(5) It is important to lay down detailed rules with a view to ensuring that the statutory audits of public-interest entities are of adequate quality and are carried out by statutory auditors and audit firms subject to stringent requirements. A common regulatory approach should enhance the integrity, independence, objectivity, responsibility, transparency and reliability of statutory auditors and audit firms carrying out statutory audit of public-interest entities, contributing to the quality of statutory audit in the Union, thereby contributing to smooth functioning of the internal market, while achieving a high level of consumer and investor protection. The development of a separate act for public-interest entities should also ensure consistent harmonisation and uniform application and thus contribute to a more effective functioning of the internal market.

(6) The financial sector is evolving and new categories of financial institutions are created by Union law. The importance of new entities and activities outside the regular banking system is growing and their impact on financial stability has become greater. Therefore, it is appropriate that the definition of public-interest entity also encompasses other financial institutions and entities such as investment firms, payment institutions, undertakings for collective investments in transferable securities (UCITS), electronic money institutions and alternative investment funds.

(7) Audit of annual and consolidated financial statements is intended as a statutory safeguard for investors, lenders and business counterparties who have a stake or a business interest in public-interest entities. Hence, statutory auditors and audit firms should be completely independent when carrying out statutory audits of such entities and conflicts of interest should be avoided. In order to determine the independence of auditors and audit firms, the concept of network in which auditors and firms operate has to be taken into account.

(8) Adequate internal organisation of statutory auditors and audit firms should contribute to preventing any threats to their independence. Thus, owners or shareholders of an audit firm, as well as those managing it, should not intervene in the carrying out of a statutory audit in any way which jeopardises the independence and objectivity of the statutory auditor who carries out the statutory audit on behalf of the audit firm. Additionally, statutory auditors and audit firms should establish appropriate internal policies and procedures in relation to employees and other persons involved in the statutory audit activity within their organisations in order to ensure compliance with their statutory obligations. Those policies and procedures should in particular seek to prevent and address any threats to independence and ensure the quality, integrity and thoroughness of the statutory audit. Those policies and procedures should be proportionate in view of the scale and complexity of the business of the statutory auditor or audit firm.

(9) Auditors, audit firms and their employees should in particular refrain from carrying out the statutory audit of an entity if they have a business interest or financial interest in it and from engaging on trading in financial instruments issued, guaranteed or otherwise supported by an audited entity, other than holdings in diversified collective investment schemes. The statutory auditor or audit firm should abstain from the internal decision-making processes of the audited entity. Statutory auditors or their employees should be prevented from taking up duties in the audited entity at managerial or board level until an appropriate period has elapsed since the end of the audit engagement.

(10) The level of fees received from one audited entity and the structure of fees can also threaten the independence of a statutory auditor or audit firm. Thus, it is important to ensure that audit fees are not based on any form of contingency and that, when the audit fees from a single client are significant, a specific procedure is established to secure the quality of the audit. If the dependence on a single client is excessive, the statutory auditor or the audit firm should refrain from undertaking the statutory audit in question.

(11) The provision of services other than statutory audit to audited entities by statutory auditors, audit firms or members of their networks may compromise their independence. Therefore, it is appropriate to require the statutory auditor, the audit firm and the members of their network not to provide non-audit services to their audited entities. The provision of non-audit services by an audit firm to a company would prevent that audit firm from carrying out statutory audit of that company, thus resulting in a reduction of the audit firms available to provide statutory audit, in particular with regard to the audit of large public-interest entities where the market is concentrated. As a result, in order to secure that a minimum number of audit firms is able to provide audit services to large public-interest entities, it is appropriate to request that audit firms of significant dimension focus their professional activity on the carrying out of statutory audit and are not allowed to undertake other services unconnected to their statutory audit function such as consultancy or advisory services.

(12) With a view to avoiding conflicts of interest it is important that the statutory auditor or the audit firm, before accepting or continuing an engagement for a statutory audit of a public-interest entity, assesses whether the independence requirements are met, and in particular whether any threats to independence arise as a result of the relationship with that entity. In order to maintain this independence, it is also important that they keep records of all threats to their independence and that of their employeess and other persons involved in the statutory audit process, as well as the safeguards applied to mitigate those threats. Moreover, where the threats to their indepedence, even after having applied safeguards to mitigate those threats, are too significant, they should resign or abstain from the audit engagement. The statutory auditor or the audit firm should confirm annually to the audit committee of the audited entity their independence and discuss with such committee any threat to their independence as well as the safeguards applied to mitigate those threats.

(13) Directive 95/46 of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data[24] govern the processing of personal data carried our in the Member States in the context of this Regulation and under the supervision of the Member States competent authorities, in particular the public independent authorities designated by the Member States. Regulation (EU) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the EU institutions and bodies and on the free movement of such data[25], governs the processing of personal data carried out by ESMA within the framework of this Regulation and under the supervision of the European Data Protection Supervisor. Any exchange or transmission of information by competent authorities should be in accordance with the rules on the transfer of personal data as laid down in Directive 95/46/EC and any exchange or transmission of information by ESMA should be in accordance with the rules on the transfer of personal data as laid down in Regulation (EC) No 45/2001.

(14) It is important that statutory auditors and audit firms respect the rights to private life and data protection of of their clients. They should therefore be bound by strict rules on confidentiality and professional secrecy which, however, should not impede the proper enforcement of this Regulation or the cooperation with the group auditor during the performance of the audit of consolidated financial statements when the parent undertaking is in a third country, provided that Directive 95/46/EC is complied with. However, such rules would not allow a statutory auditor or audit firm to cooperate with third country authorities outside the cooperation channels foreseen in Chapter XI of Directive 2006/43/EC. Those confidentiality rules should also apply to any statutory auditor or audit firm which has ceased to be involved in a specific audit task.

(15) The statutory audit results in an opinion on the truth and fairness of the financial statements of the audited entities. Stakeholders, however, might to be unaware of the limitations of an audit (materiality, sampling techniques, role of the auditor in the detection of fraud and the responsibility of managers), which can lead to an expectation gap. In order to reduce such gap, it is important to provide more clarity on what the scope of the statutory audit is.

(16) Whilst the primary responsibility for delivering financial information should rest with the management of the audited entities, auditors play a role by actively challenging management from a user's perspective. In order to improve audit quality, it is therefore important that the professional scepticism exercised by auditors vis-à-vis the audited entity is reinforced. Auditors should recognise the possibility that a material misstatment due to fraud or error could exist, notwithstanding the auditor's past experience of the honesty and integrity of the audited entity's management. Securing audit quality should be the main criterion to organise the audit work and to allocate the necessary resources to the tasks. The integrity of the statutory auditor, audit firm and their staff is essential to ensure the public confidence in statutory audits and financial markets. Therefore, any incident that may have serious consequences for the integrity of the statutory audit activities should be appropriately managed. The statutory auditor or the audit firm should appropriately document the audit work.

(17) In the case of consolidated financial statements, it is important that there is a clear definition of responsibilities of the statutory auditors who audit different entities of the group. For this purpose, the group auditor should bear full responsibility for the audit report.

(18) A sound internal quality control review of the work carried out in each statutory audit engagement should be conducive to high audit quality. Therefore, the statutory auditor or the audit firm should not issue his, her or its audit report until such an internal quality control review has been completed.

(19) The results of the statutory audit should be presented to the stakeholders in the audit report. In order to increase the confidence of stakeholders in the financial statements of the audited entity, it is particularly important that the audit report is well-founded and solidly substantiated and its content expanded to include additional information specific to the audit carried out. The audit report should in particular include sufficient information on the methodology used in the audit, especially how much of the balance sheet has been directly verified and how much has been based on system and compliance testing, on the levels of materiality applied to perform the audit, on the key areas of risk of material misstatements of the annual and consolidated financial statements, on whether the statutory audit was designed to detect fraud and, in the event of a qualified or adverse opinion or a disclaimer of opinion, on the reasons for such decision.

(20) The value of statutory audit for the audited entity would be particularly enhanced if the communication between the statutory auditor or the audit firm, on the one hand, and the audit committee, on the other hand, was reinforced. Further to the regular dialogue during the carrying out of the statutory audit, it is important that the statutory auditor or the audit firm submits to the audit committee an additional and more detailed report on the results of the statutory audit. It should be possible to make such additional detailed reports available to the supervisors of public-interest entities, but not to the public.

(21) Statutory auditors or audit firms already provide supervisors of public-interest entities with information on facts or decisions which could constitute a breach of the rules governing the activities of the audited entity or the impairment of the continuous functioning of the audited entity. Supervisory tasks would also be facilitated if supervisors of credit and financial institutions were required to establish a regular dialogue with their statutory auditors and audit firms.

(22) In order to increase the confidence in and the liability of the statutory auditors and audit firms carrying out the statutory audit of public-interest entities, it is important that the transparency reporting by statutory auditors and audit firms is increased. Therefore, statutory auditors and audit firms should be required to disclose audited financial information, showing in particular their total turnover divided into audit fees paid by public-interest entities, audit fees paid by other entities and fees for other services. They should also disclose financial information at the level of the network to which they belong. The transparency reports of audit firms should be completed by a statement on corporate governance with a view to showing whether the audit firm maintains arrangements for sound corporate governance. Additional supplementary information on audit fees should be provided to competent authorities with a view to facilitating their supervisory tasks.

(23) Audit committees, or bodies performing an equivalent function within the audited entity, have a decisive role in contributing to high-quality statutory audit. It is particularly important to reinforce the independence and technical competence of the audit committee by requiring that a majority of its members is independent and that at least one member of the committee has competence in auditing and another one in auditing and/or accounting. The Commission Recommendation of 15 February 2005 on the role of non-executive or supervisory directors of listed companies and on the committees of the (supervisory) board[26] sets out how audit committees should be established and function. Considering, however, the dimension of boards in companies with reduced market capitalisation and in small and medium-sized public-interest entities, it would be appropriate that the functions assigned to the audit committee for those entities, or to a body performing equivalent functions within the audited entity, may be performed by the administrative or supervisory body as a whole. Public-interest entities which are UCITS or alternative investment funds should also be exempted from the obligation to have an audit committee. This exemption takes into account the fact that where those funds function merely for the purpose of pooling assets, the employment of an audit committee is not appropriate. UCITS and alternative investments funds, as well as their management companies, operate in a strictly defined regulatory environment and are subject to specific governance mechanisms such as controls exercised by their depositary.

(24) It is also important that the role of the audit committee in the selection of a new statutory auditor or audit firm be reinforced, for the benefit of a more informed decision of the general meeting of shareholders or members of the audited entity. Hence, when making a proposal to the general meeting, the board should explain whether it follows the recommendation of the audit committee and, if not, why. The recommendation of the audit committee should include at least two possible choices for the audit engagement and a duly justified preference for one of them, so that the general meeting can make a real choice. In order to provide a fair and proper justification in its recommendation, the audit committee should use the results of a mandatory selection procedure organised by the audited entity, under the responsibility of the audit committee. In such selection procedure, the audited entity should invite statutory auditors or audit firms, including smaller ones, to present proposals for the audit engagement. Tender documents should contain transparent and non-discriminatory selection criteria to be used for the evaluation of proposals. Considering, however, that this selection procedure could entail disproportionate costs for companies with reduced market capitalisation or small and medium-sized public-interest entities having regard to their dimension, it is appropriate to relieve such entities from this obligation.

(25) The right of the general meeting of shareholders or members of the audited entity to choose the statutory auditor or the audit firm would be of no value if the audited entity were to enter into a contract with a third party providing for a restriction of such choice. Therefore any contractual clause entered into by the audited entity with a third party regarding the appointment or restricting the choice of a particular auditor or audit firm should be considered null and void.

(26) The appointment of more than one statutory auditor or audit firm by the public-interest entities would reinforce the professional scepticism and contribute to increasing audit quality. Also, this measure combined with the presence of smaller audit firms would facilitate the development of the capacity of such firms, thus contributing to increasing the choice of statutory auditors and audit firms for public-interest entities. Therefore, the latter should be encouraged and incentivised to appoint more than one statutory auditor or audit firm to carry out the statutory audit.

(27) In order to address the familiarity threat and therefore reinforce the independence of auditors and audit firms, it is important to establish a maximum duration of the audit engagement of a statutory auditor or audit firm in a particular audited entity. An appropriate gradual rotation mechanism should also be established with regard to the most senior personnel involved in the statutory audit, including the key audit partners carrying out the statutory audit on behalf of the audit firm. It is also important to provide for an appropriate period within which such statutory auditor or audit firm may not carry out the statutory audit of the same entity. In order to ensure a smooth transition, the former auditor should transfer a handover file with relevant information to the incoming auditor.

(28) In order to protect the independence of the auditor, it is important that dismissal should be possible only where there are proper grounds and if those grounds are communicated to the authority or authorities responsible for supervision. Where there are proper grounds, but the audited entity does not act, the audit committee, the shareholders, the competent authorities responsible for the supervision of auditors and audit firms or the competent authorities responsible for the supervision of the public-interest entity should be empowered to bring a case before a national court on the dismissal of the auditor.

(29) In order to ensure a high level of investor and consumer confidence in the internal market by avoiding conflicts of interests, statutory auditors and audit firms should be subject to appropriate supervision by competent authorities which are independent from the audit profession and which have adequate capacity, expertise and resources. The national competent authorities should have the necessary powers to undertake their supervisory tasks, including the capacity to access documents, demand information from any person and carry out inspections. They should specialize in the supervision of financial markets, of compliance with financial reporting obligations or in statutory audit oversight. However, it should be possible that the supervision of the compliance with the obligations set on public-interest entities is carried out by the competent authorities responsible for the supervision of those entities. The funding of the competent authorities should be free from any possible undue influence by statutory auditors or audit firms.

(30) The quality of supervision should improve if there is effective cooperation between authorities charged with different tasks at national level. Therefore, the authorities competent to supervise compliance with the obligations on statutory audit of public-interest entities should cooperate with the authorities responsible for the approval and registration of statutory auditors and audit firms, with those supervising public-interest entities and with the Financial Intelligence Units referred to in Directive 2005/60/EC of the European Parliament and of the Council of 26 October 2006 on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing[27].

(31) External quality assurance for the statutory audit is fundamental for high quality audit. It adds credibility to published financial information and provides better protection of shareholders, investors, creditors and other interested parties. Statutory auditors and audit firms should therefore be subject to a system of quality assurance under the responsibility of the competent authorities, thus ensuring objectivity and independence from the audit profession. Quality assurance reviews should be organised in such a manner that each statutory auditor or each audit firm undertaking audits of public-interest entities is subject to a quality assurance review at least every three years. The Commission Recommendation of 6 May 2008 on external quality assurance for statutory auditors and audit firms auditing public interest entities[28] provides information on how inspections should be undertaken. Quality assurance reviews should be proportionate in view of the scale and complexity of the business of the reviewed audit firm or statutory auditor.

(32) Investigations help to detect, prevent and correct inadequate carrying out of the statutory audit of public-interest entities. Therefore, competent authorities should be empowered to undertake investigations of statutory auditors and audit firms.

(33) The market for the provision of statutory audit services to public-interest entities evolves over time. It is therefore necessary that competent authorities monitor the developments in the market, particularly as regards possible limited choice of auditor and the risks that arise from high market concentration.

(34) The demise of important audit firms may disrupt the provision of audit services in the market and could result in further structural accumulation of risk in the market. Therefore, competent authorities should, as a preventive action, request the largest audit firms in each Member State to establish contingency plans addressing a possible event threatening the continuity of operations of the concerned firm. Such plans may identify measures to prepare an orderly failure of the firm concerned.

(35) The transparency of the activities of competent authorities should contribute to increase the confidence of investors and consumers in the internal market. Therefore, competent authorities should be required to regularly report on their activities and to publish individual inspections reports.

(36) The cooperation between the competent authorities of the Member States can make an important contribution to ensuring consistently high quality in the statutory audit in the Union. Therefore, the competent authorities of the Member States should cooperate with each other, where necessary, for the purpose of carrying out their supervisory duties regarding statutory audits. They should respect the principle of home-country regulation and oversight by the Member State in which the statutory auditor or audit firm is approved and the audited entity has its registered office. The cooperation between competent authorities would be particularly enhanced if organised within the framework of the Joint Committee of European Supervisory Authorities (ESA), under the leadership of the European Securities and Markets Authority (ESMA) set up by Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities Market Authority)[29]. ESMA, with the assistance of the European Banking Authority (EBA) set up by Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority)[30] and the European Insurance and Occupational Pensions Authority (EIOPA) set up by Regulation (EU) No 1094/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Insurance and Occupational Pensions Authority)[31], should contribute to that cooperation by providing advice and guidelines to national competent authorities.

(37) The scope of cooperation between the competent authorities of Member States should include exchange of information, cooperation with regard to quality assurance assurance reviews, assistance to investigations related to the carrying out of statutory audits of public-interest entities, including in cases where the conduct under investigation does not constitute an infringment of any legislative or regulatory provision in force in the Member States concerned and contingency planning. The modalities of cooperation between the competent authorities of the Member States may include the creation of colleges of competent authorities and the delegation of tasks among themselves. The concept of network in which auditors and firms operate should be taken into account in such cooperation. Competent authorities and the European Supervisory Authorities should respect appropriate confidentiality and professional secrecy rules.

(38) Recognition of the aptitude of statutory auditors and audit firms to perform statutory audits of public-interest entities should faciliate the access of auditors and firms to other clients. Therefore, it is important to provide for a Quality Certificate of European dimension which should be developed by ESMA. National competent authorities should be involved in the examination of the applications for the certificate.

(39) The interrelation of capital markets calls for empowering national competent authorities and the European Supervisory Authorities to cooperate with supervisory authorities and bodies of third countries regarding the exchange of information or quality assurance reviews. However, where the cooperation with third country authorities is related to audit working papers or other documents held by statutory auditors or audit firms, the procedures of Directive 2006/43/EC should apply.

(40) Sustainable audit capacity and a competitive market for statutory audit services in which there is a sufficient choice of audit firms capable of carrying out statutory audits of public-interest entities are required in order to ensure a smooth functioning of capital markets. ESMA should report on the changes brought in the audit market structure by this Regulation. When carrying such analysis, ESMA should take into account the impact of the national civil liability rules for statutory auditors on the structure of the audit market. Based on such report and other appropriate evidence, the Commission should present a report on the impact of the national liability rules for statutory auditors on the audit market structure and should take the steps it considers appropriate as a result of its findings.

(41) In order to improve compliance with the requirements of this Regulation and following the Commission Communication of 9 December 2010 entitled 'Reinforcing sanctioning regimes in the financial sector'[32], the power to adopt supervisory measures and the sanctioning powers of competent authorities should be enhanced. Administrative pecuniary sanctions on statutory auditors, audit firms and public-interest entities for identified violations should be foreseen. The competent authorities should be transparent about the sanctions and measures they apply. The adoption and publication of sanctions should respect fundamental rights as laid down in the Charter of Fundamental Rights of the European Union, in particular the right to respect for private and family life (Article 7), the right to the protection of personal data (Article 8) and the right to an effective remedy and to a fair trial (Article 47).

(42) Whistleblowers can bring new information to the attention of competent authorities which assists them in detecting and sanctioning irregularities, including fraud. However, whistleblowers may be deterred from doing so for fear of retaliation, or may lack incentives to do so. Member States should therefore ensure that adequate arrangements are in place to encourage whistleblowers to alert them to possible breaches of this Regulation and to protect them from retaliation. Member States may also provide them with incentives for doing so; however, whistleblowers should only be eligible for such incentives where they bring to light new information which they are not already legally obliged to notify and where this information results in a sanction for a breach of this Regulation. Member States should also ensure that whistleblowing schemes they implement include mechanisms that provide appropriate protection of a reported person, particularly with regard the right to the protection of his personal data and procedures to ensure the right of the reported person of defence and to be heard before the adoption of a decision concerning him as well as the right to seek effective remedy before a tribunal against a decision concerning him.

(43) In order to take account of developments in auditing and the audit market, the Commission should be empowered to specify technical requirements on the content of the handover file that the new statutory auditor or audit firm should receive and on the establishment of a European quality certificate for statutory auditors and audit firms carrying out statutory audits of public-interest entities.

(44) In order to take account of the technical developments in the financial markets, in auditing and the audit profession and to specify the requirements laid down in this Regulation, the Commission should be empowered to adopt delegated acts in accordance with Article 290 of the Treaty on the Functioning of the European Union. In particular, the use of delegated acts is necessary to adapt the list of related audit services and of non-audit services as well as to set out the level of fees that ESMA could charge for delivering the European Quality Certificate to statutory auditors and audit firms. It is of particular importance that the Commission carries out appropriate consultations during its preparatory work, including at expert level. The Commission, when preparing and drawing up delegated acts, should ensure a simultaneous, timely and appropriate transmission of relevant documents to the European Parliament and to the Council.

(45) In order to ensure legal certainty and the smooth transition to the regime introduced by this Regulation, it is important to introduce a transitional regime regarding the entry into force of the obligation to rotate audit firms, the obligation to organise a selection procedure for the choice of audit firm and the conversion of audit firms into firms that only provide audit services.

(46) Since the objectives of this Regulation, namely clarifying and better defining the role of statutory audit regarding public-interest entities, improving the information that the statutory auditor or audit firm provides to the audited entity, investors and other stakeholers, improving the communication channels between auditors and supervisors of public-interest entities, preventing any conflict of interest arising from the provision of non-audit services to public-interest entities, mitigating the risk of any potential conflict of interest due to existing system of "auditee selects and pays the auditor" or to familiarity threat, facilitating the switching of statutory auditor or audit firm and the choice of an audit provider to public-interest entities, increasing the choice of audit providers to public-interest entities and improving the effectiveness, independence and consistency of the regulation and supervison of statutory auditors and audit firms providing statutory audits to public interest entities including as regards cooperation at Union level, cannot be sufficiently achieved by the Member States and can, therefore, by reason of their scale, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, this Regulatoin does not go beyond what is necessary in order to achieve those objectives.

(47) This Regulation respects the fundamental rights and observes the principles recognised in particular by the Charter of Fundamental Rights of the European Union, notably the right to respect for private and family life (Article 7), the right to the protection of personal data (Article 8), the freedom to conduct a business (Article 16), the right to an effective remedy and to a fair trial (Article 47), the presumption of innocence and right of defence (Article 48), the principles of legality and proportionality of criminal offences and penalties (Article 49), the right not to be tried or punished twice for the same offence (Article 50), and has to be applied in accordance with those rights and principles,

HAVE ADOPTED THIS REGULATION:

Title I

Subject matter, scope and definitions

Article 1

Subject matter

This Regulation lays down requirements for the carrying out statutory audit of annual and consolidated financial statements of public-interest entities, rules on the organisation and selection of statutory auditors and audit firms by public-interest entities to promote their independence and the avoidance of conflicts of interest and rules on the supervision of compliance by statutory auditors and audit firms with those requirements.

Article 2

Scope

1. This Regulation applies to the following:

(a) statutory auditors and audit firms who carry out statutory audits of public-interest entities;

(b) public-interest entities.

2. This Regulation applies without prejudice to Directive 2006/43/EC.

Article 3

Definitions

For the purposes of this Regulation, the definitions laid down in Article 2 of Directive 2006/43/EC shall apply, except for the definitions of 'audit report' and 'competent authority'.

Article 4

Large public interest entities

For the purposes of this Regulation, 'large public-interest entities' shall cover the following

(a) in relation to entities defined in point 13(a) of Article 2 of Directive 2006/43/EC, the largest 10 issuers of shares in each Member State measured by the market capitalisation on the basis of the end-year quotes and in any case all issuers of shares that had an average market capitalisation of more than EUR 1 000 000 000 on the basis of end-year quotes for the previous three calendar years;

(b) in relation to entities defined in points 13(b) to (f) of Article 2 of Directive 2006/43/EC, any entity which on their balance sheet date has a balance sheet total exceeding EUR 1 000 000 000;

(c) in relation to entities defined in points 13(g) and (h) of Article 2 of Directive 2006/43/EC, any entity which on their balance sheet date has total assets under management exceeding EUR 1 000 000 000.

Title II

Conditions for carrying out statutory audit of public-interest entities

CHAPTER I

INDEPENDENCE AND AVOIDANCE OF CONFLICTS OF INTEREST

Article 5

Independence and objectivity

A statutory auditor or audit firm shall take all necessary steps to ensure that the carrying out of a statutory audit of a public-interest entity is not affected by any existing or potential conflict of interest or business or other relationship involving the statutory auditor or audit firm carrying out the statutory audit and, where appropriate, its network, managers, auditors, employees, any other natural persons whose services are placed at the disposal or under the control of the statutory auditor or audit firm, or any person directly or indirectly linked to the statutory auditor or audit firm by control.

Article 6

Internal organisation of auditors and audit firms

1. A statutory auditor or audit firm shall comply with the following organisational requirements:

(a) an audit firm shall establish adequate policies and procedures to ensure that its owners or shareholders as well as the members of the administrative, management and supervisory bodies of the firm, or of an affiliate firm, do not intervene in the carrying out of a statutory audit in any way which jeopardises the independence and objectivity of the statutory auditor who carries out the statutory audit on behalf of the audit firm;

(b) a statutory auditor or an audit firm shall have sound administrative and accounting procedures, internal control mechanisms, effective procedures for risk assessment, and effective control and safeguard arrangements for information processing systems.

Those internal control mechanisms shall be designed to secure compliance with decisions and procedures at all levels of the audit firm or of the working structure of the statutory auditor.

A statutory auditor or an audit firm shall implement and maintain decision-making procedures and organisational structures which clearly and in a documented manner specify reporting lines and allocate functions and responsibilities;

(c) a statutory auditor or an audit firm shall establish adequate policies and procedures to ensure that his, her or its employees and any other natural persons whose services are placed at its disposal or under its control and who are directly involved in the statutory audit activities have appropriate knowledge and experience for the duties assigned;

(d) a statutory auditor or an audit firm shall establish adequate policies and procedures to ensure that outsourcing of important audit functions is not undertaken in such a way as to impair the quality of the statutory auditor’s or audit firm’s internal control and the ability of the competent authorities to supervise the statutory auditor's or audit firm's compliance with the obligations laid down in this Regulation;

(e) a statutory auditor or an audit firm shall establish appropriate and effective organisational and administrative arrangements to prevent, identify, eliminate or manage and disclose any threats to independence referred to in Article 11(2);

(f) a statutory auditor or an audit firm shall establish appropriate procedures and standards for carrying out statutory audits of public-interest entities, coaching, supervising and reviewing employees activities and organising the structure of the audit file referred to in Article 15(5);

(g) a statutory auditor or an audit firm shall establish an internal quality control system to ensure the quality of the statutory audit of public-interest entities. The quality control system shall at least cover the procedures and standards described in point (f). In the case of an audit firm, the responsibility of the internal quality control system shall be with a person that qualifies as statutory auditor;

(h) a statutory auditor or an audit firm shall use appropriate systems, resources and procedures to ensure continuity and regularity in the performance of its statutory audit activities;

(i) a statutory auditor or an audit firm shall establish a policy to preclude his, her or its involvement and that of his, her or its employees in any criminal offence or breach of the law in the conduct of their work. The statutory auditor or the audit firm shall also establish appropriate and effective organisational and administrative arrangements for dealing with and recording incidents which have or may have serious consequences for the integrity of his, her or its statutory audit activities;

(j) a statutory auditor or an audit firm shall have adequate remuneration policies providing sufficient performance incentives to secure audit quality. In particular, compensation and performance evaluation of employees shall not be contingent on the amount of revenue that the statutory auditor or the audit firm derives from the audited entity;

(k) a statutory auditor or an audit firm shall monitor and evaluate the adequacy and effectiveness of his, her or its systems, internal control and internal quality control mechanisms and arrangements established in accordance with this Regulation and take appropriate measures to address any deficiencies. A statutory auditor or an audit firm shall in particular carry out an annual evaluation of the internal quality control system referred to in point (g). A statutory auditor or an audit firm shall keep records of the findings of that evaluation and any proposed measure to modify the internal quality control system.

The policies and procedures referred to in the first subparagraph shall be documented and communicated to the employees of the statutory auditor or audit firm.

Any outsourcing of audit functions as referred to in point (d) shall not affect the liability of the statutory auditor or audit firm towards the audited entity.

2. The statutory auditor or audit firm shall take into consideration his, her or its size and complexity of activities when complying with the requirements of paragraph 1 of this Article.

The statutory auditor or audit firm shall be able to demonstrate to the competent authority referred to in Article 35(1) that such compliance is proportionate to the size and complexity of activities of the statutory auditor or audit firm.

Article 7

Independence from the audited entity

1. A statutory auditor or an audit firm and any holder of voting rights in an audit firm shall be independent of the audited entity and shall not be involved in the decision-taking of the audited entity.

2. A statutory auditor, an audit firm, their key audit partners, their employees as well as any other natural person whose services are placed at the disposal or under the control of such auditor or firm and who is directly involved in statutory audit activities, and persons closely associated with them within the meaning of Article 1(2) of Commission Directive 2004/72/EC[33] shall not buy or sell or engage in any transaction in any financial instrument issued, guaranteed, or otherwise supported by any audited entity within their area of statutory audit activities other than holdings in diversified collective investment schemes, including managed funds such as pension funds or life insurance.

3. Persons or firms referred to in paragraph 2 shall not participate in or otherwise influence the determination of a statutory audit of any particular audited entity if they:

(a) own financial instruments of the audited entity, other than holdings in diversified collective investment schemes;

(b) own financial instruments of any entity related to an audited entity, the ownership of which may cause or may be generally perceived as causing a conflict of interest, other than holdings in diversified collective investment schemes;

(c) have had a recent employment, business or other relationship with the audited entity that may cause or may be generally perceived as causing a conflict of interest.

4. Persons or firms referred to in paragraph 2 shall not solicit or accept money, gifts or favours from anyone with whom the statutory audit or audit firm has a contractual relationship.

5. National measures on professional ethics enacted pursuant to Article 21(1) of Directive 2006/43/EC which are not compatible with paragraphs 2, 3 and 4 shall not apply.

Article 8

Employment by public-interest entities of former statutory auditors or of employees of statutory auditors or audit firms

1 A statutory auditor or a key audit partner who carries out a statutory audit of a public-interest entity on behalf of an audit firm shall not, before a period of at least two years has elapsed since he or she resigned as a statutory auditor or key audit partner from the audit engagement, take up any of the following duties:

(a) take up a key management position in the audited entity;

(b) become a member of the audit committee of the audited entity or, where such committee does not exist, of the body performing equivalent functions to an audit committee;

(c) become a non-executive member of the administrative body or a member of the supervisory body of the audited entity.

2. Employees of a statutory auditor or an audit firm carrying out a statutory audit of a public-interest entity as well as any other natural person whose services are placed at the disposal or under the control of such auditor or firm shall not, when such employees or other natural persons are personally approved as statutory auditors, before a period of at least one year has elapsed since he or she was directly involved in the statutory audit activities, take up any of the duties referred to in points (a), b) and (c) of paragraph 1.

Article 9

Audit fees

1. Fees for the provision of statutory audits to public-interest entities shall not be contingent fees.

For the purposes of the first subparagraph, contingent fees means fees for audit engagements calculated on a predetermined basis relating to the outcome or result of a transaction or the result of the work performed. Fees shall not be regarded as being contingent if a court or a competent authority has established them.

2. When the statutory auditor or audit firm provides to the audited entity related financial audit services, as referred to in Article 10(2), the fees for such services shall be limited to no more than 10 % of the fees paid by the audited entity for the statutory audit.

3. When the total fees received from a public-interest entity subject to the statutory audit represent either more than 20 % or, for two consecutive years, more than 15 % of the of the total annual fees received by the statutory auditor or audit firm carrying out the statutory audit, such auditor or firm shall disclose to the audit committee the fact that the total of such fees represents more than 20 % or 15 %, as appropriate, of the total fees received by the firm and the discussions referred to in Article 11(4)(d) shall be undertaken. The audit committee shall consider whether the audit engagement shall be subject to a quality control review by another statutory auditor or audit firm prior to the issuance of the audit report.

When the total fees received from a public-interest entity subject to the statutory audit represent, for two consecutive years, 15 % or more of the total annual fees received by the statutory auditor or audit firm carrying out the statutory audit, the auditor or firm shall inform the competent authority referred to in Article 35(1) of such situation. The competent authority referred to in Article 35(1) shall decide on the basis of objective grounds provided by the statutory auditor or the audit firm whether the statutory auditor or audit firm of such entity may continue to carry out the statutory for an additional period which in any case shall not be longer than two years.

Where the audited entity is exempted from the obligation to have an audit committee, the audited entity shall decide which body or organ of the entity shall engage with the statutory auditor or audit firm for the purposes of the obligations set out in this paragraph.

Article 10

Prohibition of the provision of non-audit services

1. A statutory auditor or an audit firm carrying out statutory audit of public-interest entities may provide to the audited entity, to its parent undertaking and to its controlled undertakings statutory audit services and related financial audit services.

Where the statutory auditor belongs to a network, a member of such network may provide to the audited entity, to its parent undertaking and to its controlled undertakings within the Union statutory audit services or related financial audit services.

2. For the purposes of this Article, related financial audit services shall mean:

(a) the audit or review of interim financial statements;

(b) providing assurance on corporate governance statements;

(c) providing assurance on corporate social responsibility matters;

(d) providing assurance on or attestation of regulatory reporting to regulators of financial institutions beyond the scope of the statutory audit and designed to assist regulators in fulfilling their role, such as on capital requirements or specific solvency rations determining how likely an undertaking will be to continue meeting its debt obligations;

(e) providing certification on compliance with tax requirements where such attestation is required by national law;

(f) any other statutory duty related to audit work imposed by Union legislation to the statutory auditor or audit firm.

3. A statutory auditor or an audit firm carrying out statutory audit of public-interest entities shall not directly or indirectly provide to the audited entity, to its parent undertaking and to its controlled undertakings non-audit services.

Where the statutory auditor belongs to a network, no member of such network shall provide to the audited entity, to its parent undertaking and to its controlled undertakings within the Union any non-audit services.

For the purposes of this Article, non-audit services shall mean:

(a) services entailing conflict of interest in all cases:

(i) expert services unrelated to the audit, tax consultancy, general management and other advisory services;

(ii) bookkeeping and preparing accounting records and financial statements;

(iii) designing and implementing internal control or risk management procedure related to the preparation and/or control of financing information included in the financial statements and advice on risk;

(iv) valuation services, providing fairness opinions or contribution-in-kind reports;

(v) actuarial and legal services, including the resolution of litigation;

(vi) designing and implementing financial information technology systems for public-interest entities as referred to in Article 2(13)(b) to (j) of Directive 2006/43/EC;

(vii) participating in the audit client's internal audit and the provision of services related to the internal audit function;

(viii) broker or dealer, investment adviser, or investment banking services.

(b) services which may entail conflict of interest:

(i) human resources services, including recruiting senior management;

(ii) providing comfort letters for investors in the context of the issuance of an undertaking's securities;

(iii) designing and implementing financial information technology systems for public-interest entities as referred to in Article 2(13)(a) of Directive 2006/43/EC;

(iv) due diligence services to the vendor or the buy side on potential mergers and acquisitions and providing assurance on the audited entity to other parties at a financial or corporate transaction.

By derogation from the first and second subparagraphs, the services mentioned in point (b)(iii) and (iv) may be provided by the statutory auditor or the audit firm, subject to prior approval by the competent authority referred to in Article 35(1).

By derogation from the first and second subparagraphs, the services mentioned in point (b)(i) and (ii) may be provided by the statutory auditor or the audit firm, subject to prior approval by the audit committee as referred to in Article 31 of this Regulation.

4. When a member of the network to which the statutory auditor or the audit firm carrying out statutory audit of a public-interest entity belongs provides non-audit services to an undertaking incorporated in a third country controlled by the audited public-interest entity, the statutory auditor or the audit firm concerned shall assess whether his, her or its independence would be compromised by such provision of services by the member of the network.

If his, her or its independence is affected, the statutory auditor or the audit firm shall apply safeguards in order to mitigate the threats caused by such provision of services in a third country. The statutory auditor or the audit firm may continue to carry out the statutory audit of the public-interest entity only if he, she or it can justify, in accordance with Article 11, that such provision of services does not affect his, her or its professional judgement and the audit report.

Being involved in the decision-taking of the audited entity and the provision of the services referred to in points (ii) and (iii) of paragraph 3(a) shall be considered as affecting such independence in all cases.

The provision of the services referred to in points (i) and (iv) to (viii) of paragraph 3(a) shall be presumed to affect such independence.

The statutory auditor or the audit firm may consult the competent authority for an opinion on this issue.

5. Where an audit firm generates more than one third of its annual audit revenues from large public-interest entities and belongs to a network whose members have combined annual audit revenues which exceed EUR 1 500 million within the European Union, it shall comply with the following conditions:

(a) it shall not directly or indirectly provide to any public interest entity non-audit services;

(b) it shall not belong to a network which provides non-audit services within the Union;

(c) any entity which provides the services listed in paragraph 3 shall not directly or indirectly hold more than 5 % of the capital or of the voting rights in the audit firm;

(d) the entities which provide the services listed in paragraph 3shall not directly or indirectly hold together more than 10 % of the capital or of the voting rights in the audit firm;

(e) such audit firm shall not directly or indirectly hold more than 5 % of the capital or of the voting rights in any entity which provides the services listed in paragraph 3.

6. The Commission shall be empowered to adopt delegated acts in accordance with Article 68 for the purpose of adapting the list of related financial audit services referred to in paragraph 2 and the list of non-audit services referred to in paragraph 3 of this Article. When using such powers, the Commission shall take into account developments in auditing and the audit profession.

Article 11

Preparation for the statutory audit and assessment of threats to independence

1. Before accepting or continuing an engagement for a statutory audit of a public-interest entity, a statutory auditor or audit firm shall assess and document the following:

– whether he, she or it complies with the internal organisation requirements of Article 6;

– whether he, she or it complies with the requirements of Articles 7, 9 and 10;

– whether he, she or it has the competent employees, time and resources to carry out the audit in an appropriate manner;

– whether, in the case of an audit firm, the key audit partner is approved as statutory auditor in the Member State requiring the statutory audit;

– whether the conditions of Article 33 are complied with;

– without prejudice to Directive 2005/60//EC, the integrity of the public-interest entity.

2. The statutory auditor or audit firm shall also assess whether there are threats to his, her or its independence.

The statutory auditor or audit firm shall not carry out a statutory audit if there is any direct or indirect financial, business, employment or other relationship between the statutory auditor, audit firm, or network and the audited entity from which an objective, reasonable and informed third party would conclude that the statutory auditor's or audit firm's independence is compromised.

If the statutory auditor's or audit firm's independence is affected by threats of self-review or self-interest, the statutory auditor or audit firm shall not carry out the statutory audit.

If the statutory auditor's or audit firm's independence is affected by threats of advocacy, familiarity or trust or intimidation, the statutory auditor or audit firm shall apply safeguards in order to mitigate those threats. If the significance of the threats compared to the safeguards applied is such that his, her or its independence is compromised, the statutory auditor or audit firm shall not carry out the statutory audit.

3. A statutory auditor or audit firm shall keep records of the assessments referred to in paragraphs 1 and 2 and shall document in the audit working papers all significant threats to his, her or its independence as well as the safeguards applied to mitigate those threats.

4 A statutory auditor or audit firm shall:

(a) confirm annually in writing to the audit committee his, her or its independence from the audited entity;

(b) confirm annually in writing to the audit comittee the names of the audit partners, senior manager and manager of the core team conducting the statutory audit, certifying that there are no conflicts of interest;

(c) request permission from the audit committee to provide the non-audit services referred to in Article 10(3)(b)(i) and (ii) to the audited entity;

(d) request permission from the competent authority referred to in Article 35(1) to provide the non-audit services referred to in Article 10(3)(b)(iii) and (iv) to the audited entity;

(e) discuss with the audit committee the threats to their independence and the safeguards applied to mitigate those threats, as documented by them pursuant to paragraph 3.

Where the audited entity is exempted from the obligation to have an audit committee, the audited entity shall decide which body or organ of the entity shall perform the functions assigned to the audit committee in this paragraph.

CHAPTER II

CONFIDENTIALITY AND PROFESSIONAL SECRECY

Article 12

Confidentiality and professional secrecy

Statutory auditors or audit firms, including those who have ceased to be engaged in a particular audit assignment and former statutory auditors or audit firms, shall not invoke the rules on confidentiality and professional secrecy referred to in Article 23(1) of Directive 2006/43/EC to prevent the application of the provisions of this Regulation.

Article 13

Disclosure to third-country auditors and to third country authorities

1. Where a statutory auditor or an audit firm carries out statutory audit of a public-interest entity which is part of a group of undertakings whose parent undertaking is situated in a third country, the confidentiality and professional secrecy rules referred to in Article 23(1) of Directive 2006/43/EC shall not impede the transfer by the statutory auditor or audit firm of relevant documentation of the audit work performed to the group auditor situated in a third country if such documentation is exclusively necessary for the preparation of the audit of consolidated financial statements of the parent undertaking.

The transfer of information to the group auditor situated in a third country shall comply with Chapter IV of Directive 95/46/EC and the applicable national rules on personal data protection.

2. A statutory auditor or audit firm that carries out statutory audit of a public-interest entity which has issued securities in a third country or which forms part of a group issuing statutory consolidated financial statements in a third country may only transfer the audit working papers or other documents related to the audit of that entity that he, she or it holds to the competent authorities in the relevant third countries under the conditions set out in Article 47 of Directive 2006/43/EC.

CHAPTER III

PERFORMANCE OF THE STATUTORY AUDIT

Article 14

Scope of the statutory audit

1. When carrying out the statutory audit of a public-interest entity, the statutory auditor or audit firm shall take the necessary steps with a view to forming an opinion as to whether the annual or consolidated financial statements of the public-interest entity give a true and fair view in accordance with the relevant financial reporting framework and, where appropriate, whether such annual or consolidated financial statements comply with statutory requirements as referred to in Article 22.

Such steps shall include at least the requirements set out in Articles 15 to 20.

The opinion of the statutory auditor or audit firm shall be expressed in accordance with Articles 21 to 25.

2. Without prejudice to the reporting requirements as referred to in Articles 22 and 23, the scope of statutory audit shall not include the assurance on the future viability of the audited entity nor the efficiency or effectiveness with which the management or administrative body has conducted or will conduct the affairs of the entity.

Article 15

Professional scepticism

When carrying out the statutory audit of a public-interest entity, the statutory auditor or audit firm shall maintain professional scepticism throughout the audit, recognizing the possibility that a material misstatement due to facts or behaviour indicating irregularities, including fraud or error could exist, notwithstanding the auditor's or firm's past experience of the honesty and integrity of the audited entity's management and of the persons charged with its governance.

The statutory auditor or the audit firm shall maintain professional scepticism in particular when reviewing management estimates relating to fair values and the impairment of goodwill and other intangible and future cash flow relevant to the consideration of the going concern.

For the purposes of this Article, 'professional scepticism' means an attitude that includes a questioning mind, being alert to conditions which may indicate possible misstatement due to error or fraud and a critical assessment of audit evidence.

Article 16

Organisation of the work

1. When the statutory audit of a public-interest entity is carried out by an audit firm, that audit firm shall designate at least one key audit partner. The audit firm shall provide the designated audit partner(s) with sufficient ressources to carry out his, her or their duties appropriately.

Securing audit quality, independence and competence shall be the main criteria for the audit firm to select the key audit partner(s) to be designated.

The designated audit partner(s) shall be actively involved in the carrying out of the statutory audit.

2. When the statutory audit of a public-interest entity is carried out by a statutory auditor, he or she shall devote sufficient time to the engagement and shall assign sufficient ressources among his or her employees to carry our his or her duties appropriately.

3. The statutory auditor or the audit firm shall keep records of the cases in which their employees do not respect this Regulation. They shall also keep records of any consequence thereof, including the measures taken towards those employees and the measures taken to modify the internal quality control system. The statutory auditor or the audit firm shall prepare an annual report with an overview of any such measures taken and communicate it to the employees.

When the statutory auditor or the audit firm ask external experts for advice, he, she or it shall document the request made and advice received.

4. A statutory auditor or an audit firm shall maintain a client account record. Such record shall include the following data for each audit client:

(a) the name, the address and the place of business;

(b) in the case of an audit firm, the key audit partner(s);

(c) the fees charged for the statutory audit and the fees charged for other services in any financial year.

5. A statutory auditor or an audit firm shall create an audit file for each statutory audit carried out. The audit file shall contain at least the following data and documents, either in paper form or in electronic form:

(a) the contract between the statutory auditor or the audit firm and the audited entity, and any amendments thereto;

(b) the correspondence with the audited entity related to the statutory audit;

(c) an audit plan setting out the probable scope and method of the statutory audit;

(d) a description of the nature and the extent of the auditing activities carried out;

(e) the starting and ending dates of the phases of audit procedures set out in the audit plan;

(f) the principal findings of the audit procedures carried out;

(g) the conclusions drawn from the findings referred to under point (f);

(h) the opinion of the statutory auditor or the key audit partner as evidenced by the drafts of the reports referred to in Articles 22 and 23;

(i) the data recorded pursuant to Article 11(3), Article 16(3), Articles 17 and 18 and 19(6);

(j) other relevant data and documents that are of importance in support of the reports referred to in Articles 22 and 23 and for monitoring compliance with this Regulation and other applicable legal requirements.

The audit file shall be closed no later than two months after the date of signature of the audit report referred to in Article 22.

6. The statutory auditor or the audit firm shall keep records of any complaints about the performance of the statutory audits.

Article 17

Market integrity

1. Where an incident which has or may have serious consequences for the integrity of the statutory audit activities of a statutory auditor or an audit firm occurs, the statutory auditor or the audit firm shall:

(a) keep record of the incident;

(b) take appropriate measures with a view to managing the consequences of the incident and prevent any recurrence;

(c) inform the competent authority referred to in Article 35(1) of the incident.

The record referred in point (a) of the first subparagraph shall include the facts and circumstances of the incident, information about the person or persons involved and details of the measures that have been taken pursuant to point (b) of that subparagraph.

2. Without prejudice to Directive 2005/60/EC, when a statutory auditor or an audit firm carrying out the statutory audit of a public-interest entity suspects or has reasonable grounds to suspect that facts or behaviour indicating irregularities, including fraud with regard to the financial statements of the audited entity is being or has been committed or attempted, he, she or it shall inform the audited entity and invite it to investigate the matter and take appropriate measures to deal with such irregularities and to prevent any recurrence of such irregularities in the future.

Where the audited entity does not investigate the matter or does not take any measures, or where the statutory auditor or audit firm believes that the measures taken by the audited entity are not adequate to deal with such irregularities, the statutory auditor or audit firm shall inform the competent authorities supervising public-interest entities of such irregularities.

The disclosure in good faith to the competent authorities, by the statutory auditor or audit firm, of any fact referred to in the first subparagraph shall not constitute a breach of any contractual or legal restriction on disclosure of information and shall not involve such persons in liability of any kind.

Article 18

Audit of consolidated financial statements

1 In the case of a statutory audit of the consolidated financial statements of a group of undertakings where the parent undertaking is a public-interest entity, the group auditor shall:

(a) bear the full responsibility for the audit report referred to in Article 22 and the additional report to the audit committee referred