Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries Article 27

Financial holding companies and the banking business shall set up an internal audit unit that is directly subsidiary to the board of directors, which shall perform audit business independently and honestly. The unit is required to report its audit business to the board of directors and supervisors (board of supervisors) or audit committee at a minimum period of every six months.Financial holding companies and the banking business shall establish a chief auditor system to manage all audit business. The chief auditor shall possess sufficient leadership and ability to carry out effective audit work, and whose qualification requirements shall be equivalent to those prescribed for the responsible persons of each respective type of financial institution, with a rank equivalent to that of a vice general manager. The chief auditor is not allowed to take a job that will cause conflicts or limitations to the audit work.The employment, dismissal, or transfer of the chief auditor shall have the consent of the majority of audit committee members as well as the consent of more than two-thirds of the board of directors and report to the competent authority for ratification.Where the matter in the preceding paragraph did not have the consent of the majority of audit committee members, the resolution adopted by the audit committee shall be recorded in the board meeting minutes. If there is no audit committee but independent directors set up and an independent director objects to or expresses reservations about the matter, it shall be recorded in the board meeting minutes.In the event of a change of the chief auditor, a financial holding company and banking business shall, within five days from the date of occurrence of the fact, report the reasons for and contents of the change in writing to the competent authority, and provide a copy of the notification to the chief auditor involved in the change.The "date of occurrence of the fact" referred to in the preceding paragraph means the date of the resolution of the board of directors or any other date sufficient to confirm the appointment or dismissal of the chief auditor, whichever is earlier.The appointment, dismissal, promotion, reward/ discipline, rotation, and performance review of personnel in the internal audit unit shall become effective after being reported by the chief auditor to chairperson of the board. However, if a matter involves personnel of other management or business units, the chief auditor shall first consult the personnel department to refer the matter to the general manager for approval, and then report to the chairperson of the board for final approval.The Regulations in Paragraph 1 to 7 of this article shall not apply to a company who operates financial and trust business concurrently other than a banking business.The chief auditor of a financial holding company is allowed to, if required by business, dispatch the internal auditors of a subsidiary company to conduct the internal audit task on the financial holding company or its subsidiary company. The chief auditor shall also take up the final responsibility to ensure appropriate and effective internal audit system in the financial holding company or its subsidiary company.Financial holding companies and the banking business shall establish communication channels and mechanisms between independent directors, the audit committee, or supervisors (board of supervisors) and the internal audit unit, and the internal audit unit shall report the communication status to the board of directors on an annual basis.