Regulations Governing the Internal Controls and Audit System for Postal Remittances and Savings Article 5

The internal control system of Chunghwa Post shall incorporate the following components:1. Control Environment: Control environment is the basis for the design and implementation of internal control systems across Chunghwa Post. It encompasses the integrity and ethical values of Chunghwa Post, governance oversight responsibility of its board of directors and supervisors, organizational structure, assignment of authority and responsibility, human resources policy, performance measures, and awards and disciplines. The board of directors and management should establish an internal code of conduct, including a code of conduct for directors and code of conduct for employees.2. Risk Assessment: A precondition to risk assessment is the identification of objectives, linked at different levels of Chunghwa Post, and the suitability of the objectives should also be taken into consideration. The management shall consider the impact of changes in the external environment and within its own business model and possible fraud scenarios. The risk assessment results can assist Chunghwa Post in designing, correcting, and implementing necessary controls in a timely manner.3. Control Operations: Control operations means the actions of adopting proper policies and procedures by Chunghwa Post based on the risk assessment results to control risks within a tolerable range. Control operations shall be performed at all levels of Chunghwa Post, at various stages of business processes, and over the technological environment, and shall include supervision and management of subsidiaries, appropriate segregation of duties and that management and employees are not assigned conflicting responsibilities.4. Information and Communication: Information and communication means relevant and quality information that Chunghwa Post obtains, generates, or uses from both internal and external sources to support the continuous functioning of other components of internal control, and to ensure that information can be effectively communicated within and outside the organization. The internal control system must have mechanisms to generate information necessary for planning, implementation, and supervision and to enable timely access to information by those who need it, and the system should maintain comprehensive internal financial, operational and compliance data. An effective internal control system shall also establish effective channels of communication.5. Monitoring Operations: Monitoring operations means ongoing evaluations, individual evaluations, or combination of the two undertaken by Chunghwa Post to ascertain whether each of the components of internal control is present and continuously functioning. Ongoing evaluations means routine evaluations built into the course of operations at different levels. Individual evaluations are evaluations conducted by different personnel such as internal auditors, supervisors or the board of directors. Findings of deficiencies of the internal control system shall be communicated to management of appropriate levels, the board of directors, and supervisors, and improvements shall be made in a timely manner.The code of conduct for directors mentioned in Subparagraph 1 of the preceding paragraph shall contain at least the rules that when a director discovers that Chunghwa Post is in danger of sustaining material loss or damage, the director should promptly take appropriate actions and immediately notify supervisors, and report to the board of directors, and supervise Chunghwa Post to report to the Ministry of Transportation and Communications (MOTC) or the Financial Supervisory Commission(FSC).