Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries Article 31

The internal audit unit shall undertake the following tasks:1. Plan the organization structure, size and duty of the internal audit unit. Prepare internal audit working manuals and working papers, which shall at least include assessing the various rules and operating procedures of the internal control system to determine whether adequate internal controls are already in place in the current rules and procedures, whether each department has realistically carried out the internal controls, and whether the internal controls are carried out in a reasonably effective manner, and from time to time provide recommendations for improvement.2. Formulate annual audit plans and, based on the business risk profile of and implementation of internal audits by each subsidiary or department, determine audit plans targeted at each individual subsidiary or departmentFinancial holding companies and the banking business shall conduct self-inspections, and the internal audit unit shall audit the implementation of the self-inspections of the internal control system by each unit (including its subsidiary companies if it is a financial holding company). Such audit results, together with the improvement status of internal control deficiencies and irregularities identified by the internal audit unit, shall serve as the basis for the issuance of the Internal Control System Statement.When a significant deficiency or malpractice arises within the management or business departments of a financial holding company or a banking business, the internal audit unit shall have the power to suggest penalties and shall make a full disclosure of the responsible negligent personnel in an internal audit report.