Decree 0849 of 2026: new guidelines for the statutory auditor’s opinion on PTEE programmes
Decree 0849 of 28 July 2026 adds a new section to Decree 1081 of 2015 on Transparency and Business Ethics Programmes (PTEE) and adopts the Minimum Guidelines that inspection, supervision and control authorities must observe when determining the content of these programmes for the entities they supervise.
Within this new framework, the decree expressly sets out responsibilities relating to internal audit and the statutory audit function (revisoría fiscal). In particular, it provides that the statutory auditor, where one exists, must assess the Transparency and Business Ethics Programme and issue an opinion on it, so that the organisation can pursue a process of continuous improvement.
This provision should be taken into account both by statutory auditors and by companies subject to these programmes, particularly with regard to the preparation, evaluation and documentation of the elements that will be subject to assessment.
The new framework for PTEE programmes
Decree 0849 regulates coordination between the Transparency Secretariat of the Office of the President and the inspection, supervision and control authorities in determining the Minimum Guidelines that PTEE programmes must include.
These guidelines seek to standardise the actions, policies, methods, procedures and mechanisms for the prevention, control, evaluation and continuous improvement of these instruments.
The decree distinguishes between the Minimum Guidelines and the specific content of each PTEE. The former constitute the framework that authorities must observe when setting their requirements. It is then for each authority, within its remit, to issue or amend the administrative acts determining the content that its supervised entities must adopt.
For this reason, the mere adoption of the Minimum Guidelines does not allow a supervised entity to evidence compliance with the PTEE provisions if the competent authority has not yet determined the content applicable to it.
What does the decree provide regarding the statutory auditor?
The decree expressly incorporates the statutory auditor’s involvement into the PTEE framework.
It provides that, where there is a statutory auditor, he or she must assess the Transparency and Business Ethics Programme and issue an opinion on it. The stated purpose is that such opinions enable the organisation to pursue a process of continuous improvement.
The technical annex develops this function within the roles and responsibilities component and provides that, as regards the statutory audit, the statutory auditor’s reports must assess the PTEE in order to issue the corresponding opinions. Likewise, the inspection, supervision or control authority must determine, according to the characteristics of the regulated sector, industry or market, the responsibilities of internal control and the statutory audit.
The regulation therefore includes the assessment of the PTEE among the matters to be considered in the statutory audit of the organisations to which it applies.
Difference between internal audit and statutory audit
The decree also distinguishes between the roles of internal audit and statutory audit.
In organisations with an internal control system separate from the statutory audit, the two roles may be divided. In any event, the technical annex provides that both are responsible for carrying out an independent evaluation of compliance with the PTEE.
For internal audit, the Programme must form part of the annual plans evaluating the organisation’s various processes, in order to verify its compliance and effectiveness in combating corruption from a preventive approach.
For the statutory audit, the decree provides for the assessment of the PTEE in the auditor’s reports and the issuance of opinions on it.
What does the new PTEE framework cover?
The Minimum Guidelines adopted by the decree include various components that authorities must consider when determining the content of PTEE programmes.
These include:
- Scope of the programme.
- Context of the organisation.
- Risk management mechanisms.
- Anti-bribery and anti-corruption measures.
- Management of conflicts of interest.
- Public procurement.
- Lobbying.
- Political campaign financing.
- Due diligence.
- Integrity measures.
- Transparency in business management.
- Mechanisms for handling corruption reports.
- Roles and responsibilities.
- Communication and training.
- Audit and continuous improvement.
The PTEE structure is based on an assessment of the risks to which each organisation is exposed and includes mechanisms for managing the risks of corruption, bribery and transnational bribery. Depending on the characteristics of the sector, authorities may also include the risks of fraud, money laundering, terrorist financing and financing of the proliferation of weapons of mass destruction.
What should companies and statutory auditors bear in mind?
Decree 0849 of 2026 should be considered by organisations subject to PTEE programmes and by the professionals responsible for their statutory audit.
For companies, the main point is to monitor the administrative acts issued or amended by the relevant inspection, supervision or control authority, as that authority will determine the specific content applicable to its supervised entities.
For statutory auditors, the new framework must be borne in mind when assessing the PTEE and issuing the corresponding opinion, in line with the responsibilities established by the competent authority for the relevant sector, industry or regulated market.
The decree also provides that inspection, supervision and control authorities must adjust their PTEE content regimes within the deadlines set out in the decree. For the first version of the Minimum Guidelines, they have three months from the issuance of the decree to review their legal frameworks and, where adjustments are required, up to nine months from its issuance to make them.
Accordingly, the practical implementation of the new requirements will depend on the administrative acts adopted by each authority within its remit.
