Regulations Governing the Establishment of Internal Control Systems by Service Enterprises in Securities and Futures Markets Article 12

A service enterprise shall establish an internal audit unit in a direct reporting line to the board of directors and, except as otherwise provided by the competent authority, shall appoint, according to its business size, business condition, management needs, and the provisions of other applicable laws and regulations, qualified persons in an appropriate number as full-time internal auditors and have deputies in place for the internal auditors; the deputies are required to carry out audit work in accordance with these Regulations.A service enterprise shall establish a chief internal auditor to oversee audit affairs, and who shall possess leadership ability and the ability to effectively oversee audit work. Any appointment or dismissal of the chief internal auditor shall be passed by the board of directors; where it has established the position of independent director, if an independent director has an objection or reservation, the objection or reservation shall be recorded in the minutes of the meeting of the board of directors.Where a service enterprise has established an audit committee in accordance with the Securities and Exchange Act, any appointment or dismissal of the chief internal auditor shall be subject to the consent of one-half or more of the entire membership of the audit committee and be submitted to the board of directors for a resolution, in which case the provisions of paragraphs 4 and 5 of Article 5 shall apply mutatis mutandis.Except as otherwise required by provisions governing securities or futures enterprises, a service enterprise shall report any appointment or dismissal of the chief internal auditor, specifying the reason for such a change of position and providing a copy of the minutes of the board of directors meeting, to the competent authority for recordation within 5 days from the date of passage by the board of directors.The appointment, dismissal, promotion, reward/discipline, rotation, and performance review of any personnel in the internal audit unit shall become effective after being reported by the chief auditor to the board of directors and ratified by the board. However, if a matter involves personnel of other management or business units, the chief auditor shall first request the personnel department to refer the matter to the general manager for consent, and it shall then be reported to the chairperson for ratification.The requirements for the qualified full-time internal auditors referred to in paragraph 1 shall be as prescribed separately by the competent authority.