Regulations Governing the Establishment of Internal Control Systems by Service Enterprises in Securities and Futures Markets Article 22

When conducting self-assessments of its internal control system, a service enterprise shall, except as otherwise required by the competent authority, first arrange for self-assessments by all internal departments and subsidiaries on an at least annual basis, have its internal audit unit review each unit's self-assessment report, and submit the self-assessment reports, together with the reports on the correction of deficiencies and irregularities of the internal control system identified by the audit unit, as a primary basis for the board of directors and general manager to evaluate the overall effectiveness of the enterprise's internal control system and to produce a Statement on Internal Control.The self-assessment s under the preceding paragraph shall be recorded in working papers that shall be retained, together with the self-assessment reports and relevant materials, for no less than 5 years.