Regulations Governing Establishment of Internal Control Systems by Public Companies Article 6
A public company's internal control systems shall comprise the following constituent elements:1. Control environment: Control environment is the basis of the design and implementation of internal control system across the company. Control environment encompasses the integrity and values of the company, governance oversight responsibility of the board of directors and supervisors, organizational structure, assignment of authority and responsibility, human resources policy, and performance measures and reward and discipline. The board of directors and management shall prescribe internal standards of conduct, including the adoption of a code of conduct for directors and a code of conduct for employees.2. Risk assessment: A precondition to risk assessment is the establishment of objectives, linked at different levels of the company, and with the suitability of the objects for the company taken into consideration. Management shall consider the impact of possible changes in the external environment and within its own business model that may render internal control ineffective.. The risk assessment results can assist the company in designing, correcting, and operating necessary control activities in a timely manner.3. Control activities: Control activities are the actions of carrying out policies and procedures taken by the company on the basis of risk assessment results to limit relevant risks to a sustainable level. Control activities shall be performed at all levels of the company, at various stages within business processes, and over the technology environment, and shall include supervision and management of subsidiaries.4. Information and communications: Information and communication means the relevant and quality information that the company obtains, generates, or uses from both internal and external sources to support the functioning of other components of internal control, and the capability of effective communication between the company and external parties. Internal control systems must have mechanisms for generating information necessary for planning, implementation, and monitoring and providing timely information to those who need it.5. Monitoring activities: Monitoring activities means ongoing evaluations, separate evaluations, or some combination of the two used by the company to ascertain whether each of the components of internal control is present and functioning. Ongoing evaluations means routine evaluations built into the course of operations at different levels of the company. Separate evaluations are evaluations conducted by different personnel such as internal auditors, supervisors, or the board of directors. Findings of deficiencies of the internal control system shall be communicated to the management at appropriate levels, the board of directors, and the supervisors, and improvements shall be made in a timely manner.A public company designing and operating its internal control systems or carrying out self-assessment, or a certified public accountant (CPA) retained to conduct a special audit of the company's internal control systems, shall fully consider the constituent elements enumerated in the preceding paragraph, and, in addition to the criteria prescribed by the Financial Supervisory Commission (FSC), shall add additional items as dictated by actual needs.
中文原文 公開發行公司建立內部控制制度處理準則第6條
公開發行公司之內部控制制度應包括下列組成要素：
一、控制環境：係公司設計及執行內部控制制度之基礎。
控制環境包括公司之誠信與道德價值、董事會及監察人治理監督責任、組織結構、權責分派、人力資源政策、績效衡量及獎懲等。
董事會與經理人應建立內部行為準則，包括訂定董事行為準則、員工行為準則等事項。
二、風險評估：風險評估之先決條件為確立各項目標，並與公司不同層級單位相連結，同時需考慮公司目標之適合性。
管理階層應考量公司外部環境與商業模式改變之影響，以及可能發生之舞弊情事。
其評估結果，可協助公司及時設計、修正及執行必要之控制作業。
三、控制作業：係指公司依據風險評估結果，採用適當政策與程序之行動，將風險控制在可承受範圍之內。
控制作業之執行應包括公司所有層級、業務流程內之各個階段、所有科技環境等範圍及對子公司之監督與管理。
四、資訊與溝通：係指公司蒐集、產生及使用來自內部與外部之攸關、具品質之資訊，以支持內部控制其他組成要素之持續運作，並確保資訊在公司內部，及公司與外部之間皆能進行有效溝通。
內部控制制度須具備產生規劃、執行、監督等所需資訊及提供資訊需求者適時取得資訊之機制。
五、監督作業：係指公司進行持續性評估、個別評估或兩者併行，以確定內部控制制度之各組成要素是否已經存在及持續運作。
持續性評估係指不同層級營運過程中之例行評估；個別評估係由內部稽核人員、監察人或董事會等其他人員進行評估。
對於所發現之內部控制制度缺失，應向適當層級之管理階層、董事會及監察人溝通，並及時改善。
公開發行公司於設計及執行，或自行評估，或會計師受託專案審查公司內部控制制度時，應綜合考量前項所列各組成要素，其判斷項目除金融監督管理委員會（以下簡稱本會）所定者外，依實際需要得自行增列必要之項目。
一、控制環境：係公司設計及執行內部控制制度之基礎。
控制環境包括公司之誠信與道德價值、董事會及監察人治理監督責任、組織結構、權責分派、人力資源政策、績效衡量及獎懲等。
董事會與經理人應建立內部行為準則，包括訂定董事行為準則、員工行為準則等事項。
二、風險評估：風險評估之先決條件為確立各項目標，並與公司不同層級單位相連結，同時需考慮公司目標之適合性。
管理階層應考量公司外部環境與商業模式改變之影響，以及可能發生之舞弊情事。
其評估結果，可協助公司及時設計、修正及執行必要之控制作業。
三、控制作業：係指公司依據風險評估結果，採用適當政策與程序之行動，將風險控制在可承受範圍之內。
控制作業之執行應包括公司所有層級、業務流程內之各個階段、所有科技環境等範圍及對子公司之監督與管理。
四、資訊與溝通：係指公司蒐集、產生及使用來自內部與外部之攸關、具品質之資訊，以支持內部控制其他組成要素之持續運作，並確保資訊在公司內部，及公司與外部之間皆能進行有效溝通。
內部控制制度須具備產生規劃、執行、監督等所需資訊及提供資訊需求者適時取得資訊之機制。
五、監督作業：係指公司進行持續性評估、個別評估或兩者併行，以確定內部控制制度之各組成要素是否已經存在及持續運作。
持續性評估係指不同層級營運過程中之例行評估；個別評估係由內部稽核人員、監察人或董事會等其他人員進行評估。
對於所發現之內部控制制度缺失，應向適當層級之管理階層、董事會及監察人溝通，並及時改善。
公開發行公司於設計及執行，或自行評估，或會計師受託專案審查公司內部控制制度時，應綜合考量前項所列各組成要素，其判斷項目除金融監督管理委員會（以下簡稱本會）所定者外，依實際需要得自行增列必要之項目。