Regulations Governing Establishment of Internal Control Systems by Public Companies Article 31
CPAs retained to conduct special audits of internal control systems of a public company shall conduct such procedures in four stages:1. Planning:A. Obtain written records of the audited company's board of directors' and managers' control objectives and internal control system policies and procedures, and other necessary information.B. Formulate an audit plan. The following factors at least shall be taken into consideration: the characteristics of the industry to which the enterprise belongs, information obtained when undertaking work under other engagements with the audited company, the condition of the audited company and recent changes in it, evidence available to the CPAs, the nature of specific internal control system procedures and the importance of such procedures to the overall internal control systems, preliminary assessment of the effectiveness of the overall internal control systems, differences among various operating locations, degree of centralization, transactions executed and the control environment, and the materiality/significance level and control risk in connection with the internal control system that are acceptable to the CPAs.2. Gaining an understanding of the internal control system: CPAs may use means such as inquiry, inspection, and observation to gain an understanding of the internal control system of the audited company, by which to assess the effectiveness of the internal control system.3. Assessing the effectiveness of the design of the internal control system:A. When assessing the effectiveness of the design of the audited company's internal control system, CPAs shall collect evidence regarding the effectiveness of the design. Methods for collecting such evidence include inquiry, inspection, and observation.B. When assessing the effectiveness of the design of the internal control system, CPAs shall focus on whether the overall internal control system achieves a given goal rather than whether any given specific operation of the internal control system is inappropriate.C. When engaged only to evaluate the effectiveness of the design of the internal control system, CPAs shall conduct necessary control tests based on actual needs.4. Testing and assessing the operating effectiveness of the internal control system:A. CPAs shall conduct control tests to collect evidence regarding the operation of the internal control system to provide a basis for assessing the operating effectiveness of the internal control system.B. Methods for conducting control tests by CPAs include inquiry, inspection, observation, and re-testing. Control tests shall be conducted until sufficient and appropriate evidence has been collected. Evidence collected by the audited company during self-assessment of the internal control system shall not be substituted directly for evidence to be collected by the CPAs.C. Whether the evidence collected by CPAs is sufficient and appropriate is affected by the following factors: the nature of the audited company's internal control procedures, the importance of the internal control procedures to attainment of the control objectives, the probability of violation of control procedures by the audited company, the nature and extent of control tests already conducted by the audited company, and the CPAs' preliminary assessment of the effectiveness of the control procedures. CPAs shall also execute necessary procedures and collect necessary evidence regarding subsequent events during the post audit period.
中文原文 公開發行公司建立內部控制制度處理準則第31條
會計師執行公司內部控制制度專案審查程序應分為下列四個階段：
一、規劃：
（一）取得受查公司董事會及經理人之控制目標、內部控制制度政策與程序之書面紀錄及其他必要之資訊。
（二）規劃審查計畫。
至少應考量下列因素：企業所屬產業特性、承接該受查公司其他案件時所得之資訊、受查公司之狀況及近來之變動、會計師可取得之證據、特定內部控制制度程序之性質及該程序對整體內部控制制度之重要性、對整體內部控制制度有效性之初步判斷、不同營運場所之差異、集權之程度、執行之交易及控制環境及會計師可接受與內部控制制度有關之重大性水準與控制風險。
二、取得對內部控制制度之瞭解：會計師得以查詢、檢查及觀察等方法，取得對受查公司內部控制制度之瞭解，以作為評估內部控制制度是否有效之基礎。
三、評估內部控制制度設計之有效性：
（一）會計師評估受查公司內部控制制度設計之有效性時，應蒐集設計是否有效之證據；其蒐集之方法，包括查詢、檢查及觀察。
（二）會計師評估內部控制制度設計之有效性時，應著重於內部控制制度整體是否能達成某一目標，而不是某一特定內部控制制度作業是否失當。
（三）會計師如僅受託審查內部控制制度設計之有效性，應視實際情況需要執行必要之控制測試。
四、測試及評估內部控制制度執行之有效性：
（一）會計師應執行控制測試，以蒐集與內部控制制度執行有關之證據，據以評估內部控制制度執行之有效性。
（二）會計師執行控制測試之方法，包括查詢、檢查、觀察及重新執行測試。
執行控制測試應至證據足夠、適切為止。
受查公司自行評估內部控制制度時所蒐集之證據，不得直接代替會計師應蒐集之證據。
（三）會計師蒐集之證據是否足夠、適切，受下列因素影響：受查公司控制程序之性質、該控制程序對達成控制目標之重要性、受查公司不遵循控制程序之可能性、受查公司已執行控制測試之性質與程度及會計師對控制程序有效性之初步判斷。
會計師並應就審查之期後期間執行必要之程序，取得對期後事項應有之證據。
一、規劃：
（一）取得受查公司董事會及經理人之控制目標、內部控制制度政策與程序之書面紀錄及其他必要之資訊。
（二）規劃審查計畫。
至少應考量下列因素：企業所屬產業特性、承接該受查公司其他案件時所得之資訊、受查公司之狀況及近來之變動、會計師可取得之證據、特定內部控制制度程序之性質及該程序對整體內部控制制度之重要性、對整體內部控制制度有效性之初步判斷、不同營運場所之差異、集權之程度、執行之交易及控制環境及會計師可接受與內部控制制度有關之重大性水準與控制風險。
二、取得對內部控制制度之瞭解：會計師得以查詢、檢查及觀察等方法，取得對受查公司內部控制制度之瞭解，以作為評估內部控制制度是否有效之基礎。
三、評估內部控制制度設計之有效性：
（一）會計師評估受查公司內部控制制度設計之有效性時，應蒐集設計是否有效之證據；其蒐集之方法，包括查詢、檢查及觀察。
（二）會計師評估內部控制制度設計之有效性時，應著重於內部控制制度整體是否能達成某一目標，而不是某一特定內部控制制度作業是否失當。
（三）會計師如僅受託審查內部控制制度設計之有效性，應視實際情況需要執行必要之控制測試。
四、測試及評估內部控制制度執行之有效性：
（一）會計師應執行控制測試，以蒐集與內部控制制度執行有關之證據，據以評估內部控制制度執行之有效性。
（二）會計師執行控制測試之方法，包括查詢、檢查、觀察及重新執行測試。
執行控制測試應至證據足夠、適切為止。
受查公司自行評估內部控制制度時所蒐集之證據，不得直接代替會計師應蒐集之證據。
（三）會計師蒐集之證據是否足夠、適切，受下列因素影響：受查公司控制程序之性質、該控制程序對達成控制目標之重要性、受查公司不遵循控制程序之可能性、受查公司已執行控制測試之性質與程度及會計師對控制程序有效性之初步判斷。
會計師並應就審查之期後期間執行必要之程序，取得對期後事項應有之證據。