Regulations Governing Establishment of Internal Control Systems by Public Companies Article 22

When conducting self-assessments of its internal control systems, a public company shall first see that all internal departments and subsidiaries conduct self-assessments at least once each year, have its internal audit departments review the self-inspection reports prepared by all departments and subsidiaries, and submit the self-assessment reports, together with the reports on the correction of defects and irregularities of internal control systems discovered by its internal audit departments, to serve as the primary basis for the board of directors and general manager to evaluate the overall efficacy of all internal control systems and to produce Internal Control System Statements.The self-assessments under the preceding paragraph shall be recorded in working papers that shall be preserved, together with the self-assessment reports and relevant materials, for no less than 5 years.