What are the audit requirements in Brazil?

Audit requirements in Brazil are defined by a combination of corporate law, securities regulation and sector-specific rules. Whether a company must undergo an independent audit depends primarily on its legal form, size, whether it is publicly listed, and the industry in which it operates. Foreign founders and investors frequently underestimate how broadly these obligations extend beyond listed companies. This guide covers who is required to have an independent audit in Brazil, which authorities oversee the process, what auditors must be qualified to do, and what the practical consequences of non-compliance look like.

The starting point for understanding audit requirements in Brazil is the Lei das Sociedades por Ações - Law 6,404 of 1976, Brazil';s Corporations Act. Under this statute, all publicly held companies (companhias abertas) are required to have their financial statements audited annually by an independent auditor registered with the Comissão de Valores Mobiliários (CVM), Brazil';s securities regulator. This obligation is unconditional and applies regardless of the company';s size or revenue.

Large privately held corporations (companhias fechadas de grande porte) are also subject to mandatory audit under the same law. A company qualifies as large-scale if it has total assets exceeding BRL 240 million or annual gross revenue exceeding BRL 300 million. These thresholds were introduced to bring significant private enterprises under the same transparency standards as listed companies, even though their shares are not traded on any exchange.

Beyond corporate law, sector-specific legislation extends audit obligations further. Financial institutions, insurance companies, pension funds, cooperatives and healthcare operators are each governed by their own regulatory frameworks, all of which impose independent audit requirements regardless of size. For example, the Banco Central do Brasil (BCB) requires all institutions under its supervision to submit audited financial statements as part of their ongoing licensing conditions.

In practice, founders should consider that even companies below the statutory thresholds may face contractual audit requirements - for instance, when seeking credit from development banks such as BNDES, when entering into public procurement contracts, or when attracting foreign direct investment from institutional investors who require audited accounts as a condition of their investment.

A non-obvious requirement for foreign businesses is that auditors in Brazil must be registered with the Conselho Federal de Contabilidade (CFC), the federal accounting council, and - for companies subject to CVM oversight - also with the CVM itself. Foreign audit firms cannot simply send their home-country partners to sign off on Brazilian financial statements. The engagement partner must hold a valid Brazilian CRC (Conselho Regional de Contabilidade) registration.

The CVM maintains a public register of independent auditors (Cadastro de Auditores Independentes) and issues detailed normative instructions governing audit conduct. CVM Resolution 23 and related instructions set out the independence requirements, rotation rules and quality control standards that registered auditors must follow. Auditor rotation is mandatory for publicly held companies: the same lead auditor or audit firm cannot serve the same listed client for more than five consecutive years, after which a three-year cooling-off period applies.

For companies supervised by the BCB, the Resolução CMN 3,198 framework establishes additional requirements, including the obligation to appoint an audit committee (comitê de auditoria) in larger financial institutions. This committee must include independent members and is responsible for overseeing the relationship between management and the external auditor.

A common mistake among foreign groups establishing Brazilian subsidiaries is assuming that the parent company';s global audit firm automatically satisfies local requirements. While the major international networks do have Brazilian member firms registered with the CFC and CVM, the engagement must formally be conducted by the Brazilian entity, not the foreign parent. Contracts and audit opinions signed by unregistered parties are not accepted by Brazilian regulators.

Brazil adopted International Financial Reporting Standards (IFRS) for publicly held companies and large privately held companies through the work of the Comitê de Pronunciamentos Contábeis (CPC), which translates and adapts IFRS pronouncements into Brazilian Generally Accepted Accounting Principles (BR GAAP). In practice, BR GAAP and IFRS are substantially converged for these entities, though some local adaptations remain.

Audits of Brazilian companies must be conducted in accordance with the Normas Brasileiras de Contabilidade - NBC TA standards, which are the Brazilian equivalents of the International Standards on Auditing (ISA). These standards are issued by the CFC and cover planning, risk assessment, evidence gathering, related-party transactions, going concern and the form of the auditor';s report.

The auditor';s report must be issued in Portuguese and must follow the prescribed format set out in NBC TA 700 and related standards. For publicly held companies, the report is filed with the CVM through the Sistema Empresas.NET platform and becomes part of the public record. For large privately held companies, the audited financial statements must be published in the Diário Oficial or a newspaper of wide circulation, as required by Law 6,404.

Many underestimate the documentation burden involved. Brazilian audit standards require auditors to maintain working papers for a minimum of five years. Companies must be prepared to provide auditors with access to all accounting records, board minutes, contracts, tax filings and bank statements. Delays in providing documentation are a frequent source of audit timeline overruns, particularly in companies that have not maintained organised records throughout the year.

The standard financial year in Brazil runs from 1 January to 31 December, though companies may adopt a different fiscal year with regulatory approval. For publicly held companies, the CVM requires the annual financial statements (Demonstrações Financeiras Padronizadas - DFP) to be filed within three months of the financial year-end, meaning by the end of March for calendar-year companies. The auditor';s report must accompany this filing.

In practice, audit engagements for listed companies begin well before the year-end. Interim audit procedures - sometimes called the "interim audit" - are typically conducted in the third quarter, covering internal controls, risk assessment and preliminary testing. The final fieldwork phase takes place in January and February, with the audit report issued in time for the DFP filing deadline.

For large privately held companies, the timeline is less prescriptive but the obligation to publish audited statements within a reasonable period after the year-end is embedded in Law 6,404. Boards of directors are required to approve the financial statements at the annual general meeting (Assembleia Geral Ordinária - AGO), which must be held within four months of the financial year-end. The audited statements must be available to shareholders at least one month before the AGO.

Financial institutions supervised by the BCB face their own reporting calendar, which may include semi-annual audited statements in addition to the annual audit. Insurance companies regulated by the Superintendência de Seguros Privados (SUSEP) similarly have quarterly and annual reporting obligations that require auditor involvement at various stages.

If you are establishing or acquiring a business in Brazil and need to understand how these timelines apply to your specific structure, contact us at info@vlolawfirm.com. We can help structure the setup correctly the first time.

Failure to comply with audit requirements in Brazil carries meaningful consequences at multiple levels. For publicly held companies, the CVM has broad enforcement powers under Law 6,385 of 1976, the Capital Markets Law. The CVM can impose administrative fines, suspend trading in the company';s securities, require restatement of financial statements and, in serious cases, delist the company from the exchange. Individual directors and officers can also be held personally liable for failures in financial reporting.

For large privately held companies, non-compliance with the audit obligation under Law 6,404 can expose directors to civil liability claims from shareholders and creditors. Courts have held that the failure to obtain an independent audit, where legally required, constitutes a breach of the directors'; duty of diligence. In insolvency proceedings, this can result in personal liability for company debts.

Regulated entities face sector-specific consequences. A financial institution that fails to submit audited statements to the BCB risks having its operating licence suspended or revoked. SUSEP can impose similar sanctions on insurance companies. In both cases, the reputational damage from regulatory action is typically more damaging than the financial penalties themselves.

A common mistake is treating the audit as a purely administrative exercise and engaging auditors too late in the process. When auditors identify material misstatements or internal control deficiencies, management needs time to respond, restate accounts if necessary, and implement remediation. Companies that begin the audit process only weeks before the filing deadline frequently miss it, triggering automatic regulatory notifications.

Consider a foreign technology group that establishes a Brazilian subsidiary as a Sociedade Limitada (Ltda.) - the most common private company form in Brazil. If the subsidiary';s total assets remain below BRL 240 million and annual revenue stays below BRL 300 million, there is no statutory obligation to have an independent audit under Law 6,404. However, if the parent company is listed on a foreign stock exchange and consolidates the Brazilian subsidiary into its group accounts, the parent';s auditors will typically require audited local financial statements to support the consolidation. In practice, the subsidiary ends up being audited even though Brazilian law does not technically require it.

Now consider a Brazilian fintech company that obtains a payment institution licence from the BCB. From the moment the licence is granted, the company is subject to BCB supervision and must submit audited financial statements regardless of its size. If the company later grows and lists on the B3 stock exchange, it becomes subject to CVM requirements as well, and must ensure its auditor is registered with both the CFC and the CVM. The audit committee requirement under the CMN framework may also be triggered depending on the institution';s classification.

These scenarios illustrate that the question of whether a company needs an audit in Brazil cannot be answered by looking at size alone. Legal form, regulatory status, listing status and contractual obligations all interact to determine the actual audit burden. Foreign investors who structure their Brazilian operations without accounting for these layers frequently discover the obligation only when a lender or regulator raises it.

Does a small Brazilian Ltda. always need an independent audit?

Not automatically. A Sociedade Limitada that falls below the large-company thresholds in Law 6,404 - total assets under BRL 240 million and annual revenue under BRL 300 million - is not required by corporate law to have an independent audit. However, the company';s articles of association may require one, lenders may impose it as a loan covenant, and foreign parent companies may need audited accounts for consolidation purposes. Regulated entities such as payment institutions or insurance companies must be audited regardless of size. In practice, many Ltdas. that are not technically required to be audited choose to do so for governance and financing reasons.

How long does a statutory audit typically take in Brazil, and what does it cost?

For a mid-sized company, the full audit cycle - from planning through to the signed report - typically spans four to six months, with fieldwork concentrated in the first quarter following the financial year-end. Interim procedures conducted before year-end can compress the final phase. Professional fees vary considerably depending on company size, complexity, industry and the audit firm engaged. For smaller companies, fees generally start from the low tens of thousands of BRL. For larger or more complex entities, fees can reach several hundred thousand BRL or more. State registration and filing fees are modest by comparison. Companies should budget for internal time costs as well, since preparing documentation for auditors is resource-intensive.

Can a foreign audit firm conduct the audit of a Brazilian company?

Not directly. The audit engagement must be conducted by an auditor or firm registered with the CFC, and for CVM-regulated companies, also registered with the CVM. Major international audit networks operate in Brazil through locally registered member firms, and these firms can coordinate with the global network for group audit purposes. However, the Brazilian engagement partner who signs the audit report must hold a valid Brazilian CRC registration. Foreign firms that attempt to conduct Brazilian audits without local registration expose both themselves and their clients to regulatory sanctions. Foreign groups should confirm that their global auditor';s Brazilian member firm holds the necessary registrations before the engagement begins.

Audit requirements in Brazil are layered and extend well beyond publicly listed companies. Corporate law, securities regulation, BCB supervision and sector-specific frameworks each impose independent obligations, and the interaction between them determines the actual audit burden for any given entity. Foreign investors who plan their Brazilian structures carefully - accounting for size thresholds, regulatory status and contractual requirements - avoid costly surprises later.

VLO Law Firms advises international clients on audit requirements in Brazil. We can assist with assessing your company';s audit obligations, coordinating with registered local auditors, and ensuring compliance with CVM, BCB and CFC requirements. To request a consultation, contact: info@vlolawfirm.com