Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries Article 35

Financial holding companies and the banking business shall disclose at least the following information in its internal audit report for routine audits:1.Audit scope; summary commentary; financial status; capital adequacy; operation performance; asset quality; equity management; management of the operation of board of directors and audit committee; compliance with major acts, regulations, and rules; internal controls; interested party transactions; the control and internal management of all business tasks; employee confidentiality education; information management and information security; management of customer data confidentiality; protection measures of consumers and investors; management of sustainability information and the results of self-inspection, and the evaluation to above matters.2. Opinions for the major illegal errors or faults in all departments, and the suggestions for punishment for employees fail to fulfill their duties.3. The examination comments or faults listed by the financial examination agency, accountants, internal audit unit (including the internal audit unit of the parent company), and self-inspection people, and the improvement status of items that enlisted as 'need further improvement' by the internal control system statement.The record of the results in working papers shall be preserved together with the self-inspection or internal audit reports and relevant materials for no less than five (5) years.