Committees, audit and reports: how governance works

An illustration, not a real case. In March, the cost engineer on a BRL 120 million development notices that the concrete and steel bill has run over budget. In April, it runs over again. She flags it at the site meeting, someone promises to look into it, and work goes on. The issue reaches someone with authority only in late June, when the quarterly trial balance closes. By then, the overrun is four months old.

The quarter was not picked at random. Since 2004, Brazil's Real Estate Development Law has required developers who ring-fence a project under the patrimônio de afetação regime to report to the buyers' representative committee (Article 31-D). They owe, "at least every three months", a progress statement signed by licensed professionals, plus trial balances for each calendar quarter. The Corporations Law and the Civil Code set the same rhythm for the fiscal council.

The quarter is the floor the law demands. An overrun does not wait for the quarter. Committee governance is the organized answer to what happens between one trial balance and the next. It does not replace the bodies the law requires: it prepares the decisions they will review and shortens the distance between deviation and correction. Below, we lay out the mechanism, run the numbers on stated assumptions and show where it does not pay off.

The law sets the floor and holds whoever sits at the table to account

In a corporation, the fiscal council has three to five members and may sit permanently or only in the years shareholders ask for it. In a limited liability company, the articles may create a fiscal council of three or more members. Real estate development adds an outward-looking body. A committee of at least three buyers, elected within six months of registration, reviews trial balances and oversees purchasing on cost-plus builds.

The provision that weighs most on design is Article 160 of the Corporations Law. It extends directors' duties "to the members of any bodies created by the bylaws with technical functions or intended to advise the officers". In plain terms, anyone who sits on a bylaw committee answers, where applicable, like a director. The practical consequence is a filter. A committee is only worth creating if it has real work to do and people willing to stand behind what they decide.

A committee with a mandate decides; a meeting without rules just talks

A committee has a written mandate that separates what it decides from what it merely recommends. It has authority limits, a quorum, a schedule, an agenda circulated in advance and minutes. Without these, a meeting produces opinion, and opinion cannot be audited.

The most detailed benchmark is in CVM Resolution 23/2021, on the statutory audit committee of listed companies. The committee must be provided for in the bylaws, report directly to the board and meet "at least every two months", before each release of accounting information. It needs its own charter, a coordinator, a channel for complaints, including anonymous ones, and a budget to hire independent experts.

A privately held project is bound by none of this, yet the list works as a maturity test. A committee without a charter has no limits. One without a budget depends on the people it should oversee. One without a reporting channel hears only what travels up the hierarchy.

Minutes are the most underrated piece. The Civil Code asks directors for "the care and diligence that every active and honest man usually employs in managing his own affairs". Well-kept minutes are the proof of that diligence: they show what was known, when it was known and what was decided on that basis.

110

Each committee answers a different question

Committees trip over each other when they are formed around vague themes, and they work when each has its own question and the data to answer it. A highly complex development is well served by five fronts:

• Executive Committee, weekly: is the project on schedule, and what is blocking the next milestone? It reads the timeline, critical fronts and open issues between contractors.
• Finance Committee, monthly: does cash support the plan? It reads budget against actuals, cash projections and the project's ring-fenced account.
• Compliance and Integrity Committee: are permits, contracts and third parties in order? It reads expiry dates, permit conditions and the whistleblower channel.
• Curatorial Committee: does whoever joins preserve the project's positioning? It rules on members, operators and associated brands, against written criteria.
• Investment Committee: is this spend above the authority limit justified? It weighs alternatives and the effect on projected returns.

The simulator alongside this article starts from that choice: how many committees and how many meetings a year. The resulting calendar sizes people and hours; the risk and transparency scores it shows are illustrative, a yardstick for partners' conversations rather than a measurement.

An audit is worth something because the auditor cannot be a party

An independent audit is mandatory for listed companies and, under Law No. 11,638/2007, for large companies of any legal form. A large company is one, "or a group of companies under common control", with total assets above BRL 240 million or gross annual revenue above BRL 300 million in the prior year. For anyone who sets up one special purpose company per project, this is the decisive detail: several small entities under the same controller can add up to a large one.

An audit opinion is only as good as the independence of whoever signs it, and in the capital markets the CVM protects it with objective rules. The auditor may not provide consulting that compromises objectivity, such as business valuation or tax planning. Nor may the same auditor serve the same client for more than five consecutive years, with a three-year cooling-off period. The term stretches to ten years when there is a permanent statutory audit committee and the auditor is a firm, with mandatory rotation of the engagement team.

Transparency is not seeing everything all the time. It is seeing what matters in time to decide, with a number that will survive the audit.

A note on collaboration. Valida Auditoria, part of the same group as InnovaSphere, audits group companies and third parties under the motto "Validamos a realidade, não a narrativa" (we validate reality, not the narrative). By the logic of this section, corporate proximity is exactly the kind of tie a committee should examine before any engagement, inside or outside the group.

Integrity has become a sentencing criterion, not a slogan

Brazil's Clean Company Act requires authorities, when setting penalties, to weigh the existence of internal integrity, audit and whistleblowing mechanisms. Decree 11,129/2022 spells out how such a program is assessed: commitment from senior management, "including the boards", risk management, complete accounting records, reporting channels, third-party due diligence and continuous monitoring. The company's size is taken into account.

For a real estate project, the list reads almost like a script. The decree calls for procedures against fraud in every interaction with the public sector, explicitly including obtaining licenses, permits and certificates, which is daily life for anyone permitting a building site. When something goes wrong, an integrity committee with a calendar, minutes and independence weighs far more than an ethics code in a drawer.

A real-time dashboard matters only if the number survives the audit

A live dashboard helps only if it shows the number the auditor will find later. The ring-fenced regime provides the basis. The same Article 31-D requires a bank account opened specifically for the project's funds and complete bookkeeping "even if exempted by tax legislation". When the BI Platform reads directly from that segregated ledger, the finance committee's dashboard and the quarterly trial balance tell the same story.

The other side is access. These dashboards carry personal data on buyers and members. The LGPD, Brazil's data protection law, requires security measures against unauthorized access "from the design phase of the product or service through to its execution". Each committee sees only the slice it needs, with a trail of who looked at what.

Automatic alerts close the loop: the meeting turns to the decision rather than the discovery. The alert would have fired in March, when the engineer in our opening scene spotted the overrun, and the issue would have been on April's finance agenda.

A worked example: the cost of finding out late

The example is hypothetical, built on our own assumptions rather than market data. A BRL 120 million build suffers an unplanned overrun of 0.5% of budget per month, which stops only when someone with authority decides to correct it. Figures are simple sums, with no interest or inflation adjustment. Across scenarios, only the time to decision changes.

Read the table modestly. In the base case, a single intercepted overrun covers the annual cost more than four times over. Under stress, with a heavier structure, a smaller overrun and a slower alert, one overrun is not enough. The value depends on how many overruns the structure catches and how early. Catching early is not recovering everything, either: part of the spend may be irreversible.

When it does not pay off

The full structure costs people, time and liability. It tends not to pay for itself in three situations:

• A small project where the decision-maker and the doer share a desk. With no off-plan buyers and a single partner on site every day, the legal bodies, up-to-date books and a well-minuted monthly meeting may be enough.
• A committee with no real authority. When every relevant decision goes back to the controlling shareholder, the committee becomes ceremony. Since the law extends directors' duties to members of bylaw bodies, the structure adds liability without adding power.
• Data that does not reconcile. A real-time dashboard on top of late bookkeeping or a non-segregated account creates an illusion of control. Before BI and a committee calendar, fix the books and the segregation of funds.

Checklist for structuring your project's governance

1. Map the mandatory bodies that apply, with your corporate counsel.
2. Calculate with your accountants whether the group under common control exceeds BRL 240 million in assets or BRL 300 million in revenue.
3. Draft each committee's charter (mandate, authority, quorum, schedule, coordinator) and have the partners approve it.
4. Define the authority matrix for spending and contracts, and check the limits with the finance and investment committees.
5. Standardize agendas, document circulation deadlines and the minutes template with the governance secretariat.
6. Verify independence restrictions and rotation rules before hiring the auditor, with the board and the auditor itself.
7. Configure access profiles, audit trail and alerts on the BI Platform, with the data protection officer checking LGPD compliance.

Frequently asked questions

Does a committee need to be written into the bylaws or articles of association?

For a listed company's statutory audit committee, yes, because the CVM requires it. For the others, the law imposes no single form. Writing mandate and authority into the corporate documents or a partner-approved charter reduces disputes over who decides what.

Can a limited liability company have a fiscal council?

Yes. Article 1,066 of the Civil Code lets the articles create a fiscal council of three or more members, with a duty to examine the books and cash at least every quarter. Minority partners holding a fifth of the capital elect one member separately.

Is my project's special purpose company required to have an independent audit?

Only if it is listed or if, together with the companies under common control, it exceeds the size thresholds of the 2007 law. Otherwise it is voluntary, although lenders often require one by contract.

Does the buyers' representative committee replace internal committees?

No. The representative committee speaks for buyers and oversees from outside. The law makes clear that appointing an inspector does not shift to the committee any responsibility for build quality or delivery dates (Article 31-C). It stays with the developer, and internal committees are how it is exercised with method.

How often should committees meet?

The law sets floors: quarterly reporting to the buyers' committee, quarterly review by the fiscal council and a bimonthly meeting of the statutory audit committee. Above that, frequency follows risk: fronts that change every week call for a weekly rhythm.

Legal basis

• Law 4,591/1964 (real estate development): arts. 31-C, 31-D (IV, V, VI and VIII), 50, as worded by Law 14,382/2022, and 61.
• Law 6,404/1976 (corporations): arts. 160, 161 and 163, VI.
• Law 10,406/2002 (Civil Code): arts. 1,011, 1,066 and 1,069.
• Law 11,638/2007: art. 3 and sole paragraph (large companies).
• CVM Resolution 23/2021: arts. 23, 31, 31-A and 31-B.
• Law 12,846/2013: art. 7, VIII. Decree 11,129/2022: art. 57.
• Law 13,709/2018 (LGPD): art. 46, § 2.