Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries Article 14

Financial holding companies and the banking business shall establish a self-inspection system, wherein the management shall designate the units executing the legal compliance system, risk management system, information security system, or units possessing the second-line functions to supervise the formulation of the contents and procedures for self-inspections and to review the execution of self-inspections by each unit.Each business, finance, asset safekeeping, and information technology unit, as well as foreign business units of a banking business, shall conduct a general self-inspection at least once every six months and a special self-inspection at least once every month. However, for a month in which a general self-inspection has been conducted, a general business audit has been conducted by the internal audit unit (including the internal audit unit of the parent company), a full-scope examination has been conducted by financial examination authorities, or a self-assessment on legal compliance matters has been performed, the special self-inspection for that month may be waived. If a banking business that has been approved by the competent authority to adopt a risk-based internal audit system, the banking business may determine the frequency, focus, and scope of general and special self-inspections based on the results of risk assessments and implement them after obtaining approval from the board of directors.A financial holding company shall conduct a self-inspection of its internal control system at least once every year and supervise its subsidiaries in conducting the self-inspection matters of the internal control system specified in the preceding paragraph.For the self-inspection affairs mentioned in the preceding two paragraphs, the head of the unit shall assign a person of another duty to conduct the audit and be kept secret.The results of self-inspections mentioned in Paragraph 2 and 3 shall be made as working papers and shall be preserved together with the self-inspection or internal audit reports and relevant materials for no less than five (5) years.A financial holding company or banking business shall track the improvement status of the deficiencies identified during the self-inspections of each unit.