Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries Article 33

A domestic bank may apply to the competent authority for approval to adopt a risk-based internal auditing system. A subsidiary that was evaluated and exempted from adopting the system for implementation in accordance with Paragraph 2 of Article 34 shall provide evaluation documents. The competent authority may ask a domestic bank to apply for approval to adopt a risk-based internal auditing system in view of the bank's asset size, business risks, and other necessary conditions.A domestic bank that applies for approval to adopt a risk-based internal auditing system must meet the following criteria:1. The bank's most recently filed ratio of regulatory capital to risk-weighted assets meets the requirements set out in Article 5 of the Regulations Governing the Capital Adequacy and Capital Category of Banks;2. The bank does not show insufficient loan loss provision and reserves based on the most recent financial examination and the most recent CPA-audited and certified financial statements;3. The bank's non-performing loan ratio of the most recent quarter does not exceed 1%; and4. The bank has an effective internal control system.The provisions on auditing frequency in Paragraph 1 of the preceding article and Paragraph 2 of Article 34 do not apply to domestic banks that have been approved to adopt a risk-based internal auditing system.