Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries Article 10

The internal control system of a financial holding company or banking business shall incorporate the following components:1. Control Environment: The Control Environment is the basis for the design and implementation of internal control systems across a financial holding company or banking business. It encompasses the integrity and ethical values of a financial holding company or banking business, the governance oversight responsibility of its board of directors and supervisors (board of supervisors) or audit committee, organizational structure, assignment of authority and responsibility, human resources policy, performance measures, and awards and disciplines. The board of directors and management shall uphold the principle of treating customers fairly and establish ethical corporate management best practice principles and internal codes of conduct, including codes of conduct for directors and employees.2. Risk Assessment: A precondition to risk assessment is the identification of objectives, linked at different levels of the financial holding company or banking business, and the suitability of the objectives shall also be taken into consideration. The management shall consider the impact of changes in the external environment and within its own business model and possible fraud scenarios. The risk assessment results can assist the financial holding company or banking business in designing, correcting, and implementing necessary controls in a timely manner.3. Control Operations: Control operations means the actions of adopting proper policies and procedures by a financial holding company or banking business based on the risk assessment results to control risks within a tolerable range. Control operations shall be performed at all levels of a financial holding company or business, at various stages of business processes, and over the technological environment. They shall include the supervision and management of subsidiaries, appropriate segregation of duties, and measures ensuring that management and employees are not assigned conflicting responsibilities.4. Information and Communication: Information and communication refers to relevant and high-quality information that a financial holding company or banking business obtains, generates, or uses from both internal and external sources to support the continuous functioning of other components of internal control, and to ensure that information can be effectively communicated within and outside the organization. The internal control system must have mechanisms to generate information necessary for planning, implementation, and supervision and to enable timely access to information by those who need it, and the system shall maintain comprehensive internal financial, operational and compliance data. An effective internal control system shall also establish appropriate channels of communication.5. Monitoring Operations: Monitoring operations means ongoing evaluations, individual evaluations, or combination of the two undertaken by a financial holding company or banking business to ascertain whether each of the components of internal control is present and continuously functioning. Ongoing evaluations means routine evaluations built into the course of operations at different levels. Individual evaluations are evaluations conducted by different personnel such as internal auditors, supervisors (or board of supervisors) or audit committee, or the board of directors. Findings of deficiencies of the internal control system shall be communicated to management of appropriate levels, the board of directors, and supervisors (board of supervisors) or audit committee, and improvements shall be made in a timely manner.A financial holding company shall supervise its subsidiaries to ensure that their internal control systems incorporate the components prescribed in the preceding paragraph.