Regulations Governing the Establishment of Internal Control Systems by Service Enterprises in Securities and Futures Markets Article 7
A service enterprise's internal control system shall consist of the following components:1. Control environment: The control environment is the basis of the design and implementation of the internal control system across the service enterprise. The control environment encompasses the integrity and ethical values of the enterprise, governance oversight responsibility of the board of directors and supervisors, organizational structure, assignment of authority and responsibility, human resources policy, and performance measures and reward and discipline. The board of directors and management shall prescribe internal standards of conduct, including the adoption of codes of conduct for directors and employees.2. Risk assessment: A precondition to risk assessment is the establishment of objectives, linked at different levels of the service enterprise, and with the suitability of the objects for the enterprise taken into consideration. Management shall consider the impact of possible changes in the external environment and within its own business model that may render internal control ineffective, and possible fraud scenarios. The risk assessment results can assist the enterprise in designing, correcting, and implementing necessary controls in a timely manner.3. Control activities: Control activities are the actions of carrying out policies and procedures taken by the service enterprise on the basis of risk assessment results to limit relevant risks to a sustainable level. Control activities shall be performed at all levels of the enterprise, at various stages within business processes, and over the technology environment, and shall include supervision and management over subsidiaries.4. Information and communication: Information and communication means the relevant and quality information that the service enterprise obtains, generates, or uses from both internal and external sources to support the functioning of other components of internal control, and the capability of effective communication between the enterprise and external parties. The Internal control system must have mechanisms to generate information necessary for planning, implementation, and monitoring and to provide information to those who need it in a timely manner.5. Monitoring activities: Monitoring activities means ongoing evaluations, separate evaluations, or some combination of the two used by the service enterprise to ascertain whether each of the components of internal control is present and functioning. Ongoing evaluations means routine evaluations built into the course of operations at different levels of the enterprise. Separate evaluations are evaluations conducted by different personnel such as internal auditors, supervisors, or the board of directors. Findings of deficiencies of the internal control system shall be communicated to the management of appropriate levels, the board of directors, and supervisors, and improvements shall be made in a timely manner.A service enterprise designing and implementing, or carrying out self-assessment of, its internal control system, or a certified public accountant (CPA) engaged to conduct a special audit of the enterprise's internal control system, shall fully consider the components enumerated in the preceding paragraph, and, in addition to the criteria prescribed by the competent authority, may add additional items as dictated by actual needs.The code of conduct for directors under paragraph 1, subparagraph 1 shall, at the least, specify that when a director discovers that the enterprise is likely to be materially harmed, the director shall handle the matter as quickly as possible, and immediately notify the audit committee, independent director members of the audit committee, or the supervisors, and report to the board of directors, and shall see to it that the service enterprise reports to the competent authority.
中文原文 證券暨期貨市場各服務事業建立內部控制制度處理準則第7條
各服務事業之內部控制制度應包括下列組成要素：
一、控制環境：係各服務事業設計及執行內部控制制度之基礎。
控制環境包括事業之誠信與道德價值、董事會及監察人治理監督責任、組織結構、權責分派、人力資源政策、績效衡量及獎懲等。
董事會與經理人應建立內部行為準則，包括訂定董事行為準則、員工行為準則等事項。
二、風險評估：風險評估之先決條件為確立各項目標，並與各服務事業不同層級單位相連結，同時需考慮事業目標之適合性。
管理階層應考量事業外部環境與商業模式改變之影響，以及可能發生之舞弊情事。
其評估結果，可協助事業及時設計、修正及執行必要之控制作業。
三、控制作業：係指各服務事業依據風險評估結果，採用適當政策與程序之行動，將風險控制在可承受範圍之內。
控制作業之執行應包括事業所有層級、業務流程內之各個階段、所有科技環境等範圍及對子公司之監督與管理。
四、資訊與溝通：係指各服務事業蒐集、產生及使用來自內部與外部之攸關、具品質之資訊，以支持內部控制其他組成要素之持續運作，並確保資訊在事業內部，及事業與外部之間皆能進行有效溝通。
內部控制制度須具備產生規劃、執行、監督等所需資訊及提供資訊需求者適時取得資訊之機制。
五、監督作業：係指各服務事業進行持續性評估、個別評估或兩者併行，以確定內部控制制度之各組成要素是否已經存在及持續運作。
持續性評估係指不同層級營運過程中之例行評估；個別評估係由內部稽核人員、監察人或董事會等其他人員進行評估。
對於所發現之內部控制制度缺失，應向適當層級之管理階層、董事會及監察人溝通，並及時改善。
各服務事業於設計及執行，或自行評估，或會計師受託專案審查公司內部控制制度時，應綜合考量前項所列各組成要素，其判斷項目除主管機關所定者外，依實際需要得自行增列必要之項目。
第一項第一款之董事行為準則至少應包括董事發現本事業有受重大損害之虞時，應儘速妥適處理，立即通知審計委員會或審計委員會之獨立董事成員或監察人並提報董事會，且應督導所屬服務事業通報主管機關。
一、控制環境：係各服務事業設計及執行內部控制制度之基礎。
控制環境包括事業之誠信與道德價值、董事會及監察人治理監督責任、組織結構、權責分派、人力資源政策、績效衡量及獎懲等。
董事會與經理人應建立內部行為準則，包括訂定董事行為準則、員工行為準則等事項。
二、風險評估：風險評估之先決條件為確立各項目標，並與各服務事業不同層級單位相連結，同時需考慮事業目標之適合性。
管理階層應考量事業外部環境與商業模式改變之影響，以及可能發生之舞弊情事。
其評估結果，可協助事業及時設計、修正及執行必要之控制作業。
三、控制作業：係指各服務事業依據風險評估結果，採用適當政策與程序之行動，將風險控制在可承受範圍之內。
控制作業之執行應包括事業所有層級、業務流程內之各個階段、所有科技環境等範圍及對子公司之監督與管理。
四、資訊與溝通：係指各服務事業蒐集、產生及使用來自內部與外部之攸關、具品質之資訊，以支持內部控制其他組成要素之持續運作，並確保資訊在事業內部，及事業與外部之間皆能進行有效溝通。
內部控制制度須具備產生規劃、執行、監督等所需資訊及提供資訊需求者適時取得資訊之機制。
五、監督作業：係指各服務事業進行持續性評估、個別評估或兩者併行，以確定內部控制制度之各組成要素是否已經存在及持續運作。
持續性評估係指不同層級營運過程中之例行評估；個別評估係由內部稽核人員、監察人或董事會等其他人員進行評估。
對於所發現之內部控制制度缺失，應向適當層級之管理階層、董事會及監察人溝通，並及時改善。
各服務事業於設計及執行，或自行評估，或會計師受託專案審查公司內部控制制度時，應綜合考量前項所列各組成要素，其判斷項目除主管機關所定者外，依實際需要得自行增列必要之項目。
第一項第一款之董事行為準則至少應包括董事發現本事業有受重大損害之虞時，應儘速妥適處理，立即通知審計委員會或審計委員會之獨立董事成員或監察人並提報董事會，且應督導所屬服務事業通報主管機關。