Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries Article 43

The audit business matters reported by the internal audit unit of a banking business to the board of directors and supervisors or the audit committee at least once every six months pursuant to Paragraph 1 of Article 27 shall include the performance evaluation of the dedicated units for legal compliance, risk management, and information security, as well as evaluation opinions on the bank-wide level of legal compliance, risk management, and information security.After the end of examination conducted by the competent authority or the local competent authority at where a foreign branch is located or after receiving an examination report, the internal audit unit at a financial holding company or the head office of a banking business shall, based on the principle of materiality, promptly inform the directors (council members) and supervisors (board of supervisors), and make a report to the forthcoming board of directors' meeting. The report items shall include the content of examination communication meeting, major deficiencies found in the examination, the rating downgrade by the financial competent authority, improvement actions required by the competent authority or possible disciplinary measures to be taken.