Regulations Governing Establishment of Internal Control Systems by Public Companies Article 13
A public company's internal audit unit shall formulate annual audit plans based on the results of the risk assessment, including matters to be audited monthly, and shall faithfully implement the annual audit plans, so as to assess its internal control systems, and prepare audit reports, annexing working papers and relevant materials.A public company shall include at least the following as audit items in its annual audit plan for each year:1. Matters relating to compliance with applicable laws, regulations, and bylaws.2. The control activities for major financial or business activities, such as for acquiring or disposing of assets, engaging in derivatives transactions, extending loans to others, granting endorsements or guarantees for others, and management of related party transactions.3. Supervision and management of subsidiaries.4. Management of operation of board meetings.5. Management of preparation process of financial statements, including management of application of International Financial Reporting Standards, procedures for professional accounting judgments, and processes for making changes in accounting policies and estimates.6. Inspection of information and communications security.7. Major operating cycles such as the sale and receipt cycle and purchase and payment cycle.The annual audit plan of a public company that has established an audit committee shall also include the management of audit committee meeting operations.Each annual audit plan of a company whose stock is exchange-listed or traded over-the-counter shall also include management of the operations of the remuneration committee.Each annual audit plan of a company whose stock is exchange-listed or traded over the counter shall include the management of sustainability information.A public company's annual audit plan, and any amendments thereto, shall be passed by the board of directors.Where a public company has established independent director position(s), when it submits the annual audit plan to the board of directors for deliberation under the preceding paragraph, the board of directors shall take into full consideration each independent director's opinions, and shall include their opinions in the board meeting minutes.The audit report referred to in paragraph 1, the working papers, and relevant information referred to therein shall be preserved for no less than 5 years.
中文原文 公開發行公司建立內部控制制度處理準則第13條
公開發行公司內部稽核單位應依風險評估結果擬訂年度稽核計畫，包括每月應稽核之項目，年度稽核計畫並應確實執行，據以評估公司之內部控制制度，並檢附工作底稿及相關資料等作成稽核報告。
公開發行公司至少應將下列事項列為每年年度稽核計畫之稽核項目：
一、法令規章遵循事項。
二、取得或處分資產、從事衍生性商品交易、資金貸與他人、為他人背書或提供保證之管理及關係人交易之管理等重大財務業務行為之控制作業。
三、對子公司之監督與管理。
四、董事會議事運作之管理。
五、財務報表編製流程之管理，包括適用國際財務報導準則之管理、會計專業判斷程序、會計政策與估計值變動之流程等。
六、資通安全檢查。
七、銷售及收款循環、採購及付款循環等重要營運循環。
公開發行公司設置審計委員會者，其年度稽核計畫，應包括審計委員會議事運作之管理。
股票已上市或在證券商營業處所買賣之公司之每年年度稽核計畫，尚應包括薪資報酬委員會運作之管理。
股票已上市或在證券商營業處所上櫃買賣之公司之每年年度稽核計畫，應包括永續資訊之管理。
公開發行公司年度稽核計畫應經董事會通過；修正時，亦同。
公開發行公司已設立獨立董事者，依前項規定將年度稽核計畫提報董事會討論時，應充分考量各獨立董事之意見，並將其意見列入董事會紀錄。
第一項之稽核報告、工作底稿及相關資料應至少保存五年。
公開發行公司至少應將下列事項列為每年年度稽核計畫之稽核項目：
一、法令規章遵循事項。
二、取得或處分資產、從事衍生性商品交易、資金貸與他人、為他人背書或提供保證之管理及關係人交易之管理等重大財務業務行為之控制作業。
三、對子公司之監督與管理。
四、董事會議事運作之管理。
五、財務報表編製流程之管理，包括適用國際財務報導準則之管理、會計專業判斷程序、會計政策與估計值變動之流程等。
六、資通安全檢查。
七、銷售及收款循環、採購及付款循環等重要營運循環。
公開發行公司設置審計委員會者，其年度稽核計畫，應包括審計委員會議事運作之管理。
股票已上市或在證券商營業處所買賣之公司之每年年度稽核計畫，尚應包括薪資報酬委員會運作之管理。
股票已上市或在證券商營業處所上櫃買賣之公司之每年年度稽核計畫，應包括永續資訊之管理。
公開發行公司年度稽核計畫應經董事會通過；修正時，亦同。
公開發行公司已設立獨立董事者，依前項規定將年度稽核計畫提報董事會討論時，應充分考量各獨立董事之意見，並將其意見列入董事會紀錄。
第一項之稽核報告、工作底稿及相關資料應至少保存五年。