Implementation Rules for the Internal Audit and Internal Control System of Specialized Electronic Payment Institutions Article 8

The internal control system of a specialized electronic payment institution shall contain the following components:1. Control environment: The control environment is the basis for the design and implementation of the internal control system of a specialized electronic payment institution. The control environment encompasses the integrity and ethical values of the institution, governance oversight responsibility of its board of directors and supervisors or audit committee, organizational structure, assignment of authority and responsibility, human resources policy, performance measures and reward and discipline. The board of directors and management shall prescribe internal standards of conduct, including the adoption of code of conduct for directors and employees.2. Risk assessment: A precondition to risk assessment is the establishment of objectives, linked at different levels of a specialized electronic payment institution, and with the suitability of the objectives for the institution taken into consideration. The management shall consider the impact of possible changes in the external environment and within its own business model, and likely fraud scenarios that may occur. The risk assessment results may be used to assist the institution in designing, correcting, and implementing necessary controls in a timely manner.3. Control activities: Control activities are the actions of adopting appropriate policies and procedures by a specialized electronic payment institution based on its risk assessment results to limit relevant risks within an acceptable range. Control activities shall be performed at all levels of the institution, at various stages of business processes, and over the technology environment, and shall include supervision and management over subsidiaries, appropriate delegation of responsibilities and not assigning conflicting responsibilities to management and employees.4. Information and communication: Information and communication means that a specialized electronic payment institution gathers, generates, and uses relevant and quality information from both internal and external sources to support the ongoing functioning of other components of internal control, and ensure effective communication within the organization and between the institution and external parties. The internal control system must have mechanisms to generate information necessary for planning, implementation, and monitoring, provide information to those who need it in a timely manner, and ensure the retention of complete financial, operational and compliance information. An effective internal control system shall have effective communication channels in place.5. Monitoring activities: Monitoring activities means ongoing evaluations, separate evaluations, or some combination of the two used by a specialized electronic payment institution to ascertain whether each of the components of internal control is present and continuously functioning. Ongoing evaluations means routine evaluations built into the course of operations at different levels of the institution. Separate evaluations are evaluations of other personnel conducted by internal auditors, supervisors or audit committee, or the board of directors. Findings of deficiencies of the internal control system shall be communicated to the management of appropriate levels, the board of directors, and supervisors or audit committee, and improvements shall be made in a timely manner.The minimum requirement for directors’ code of conduct specified in Subparagraph 1 of the preceding paragraph shall incorporate that, the directors must not only take adequate actions promptly when the specialized electronic institution are found to face foreseeable material damages, but also have to notify the audit committee or independent directors or supervisors, and the board as well as instruct the said institution to report to the competent authority.