Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries Article 32

The internal audit unit of a banking business shall conduct one routine audit and one special audit annually on its operation, finance, asset custody, information departments and dedicated information security unit; at least one special audit annually on other management departments; and at least one routine audit annually on its all-business centers, foreign business units and foreign subsidiary companies. For foreign representative offices, the internal audit method may be replaced by audit documentary review, or the frequency of internal audit may be flexibly adjusted.The contents of the routine audit or the special audit, which is performed by the internal audit unit of a banking business to its business unit, shall cover whether there are improper marketing activities when dealing with trust business, financial management, and the sale of financial products; whether the contents of the products are clearly disclosed; whether the risks are well notified; whether the contract is fair and other obligations are performed appropriately following the law or self-regulatory guidelines.The internal auditing unit of a financial holding company shall conduct a routine audit at least annually; a special audit on its finance, risk management, and compliance with applicable acts and regulations at least semiannually; where the routine audit has covered the scope of the special audit and its audit results reveal no significant deficiency, and it expressly states such in the internal audit report, it is not required to conduct a special audit for that current half-year.The internal audit unit shall include the execution status of the regulatory compliance system into the routine audit or special audit of the business and management units.