Regulations Governing the Implementation of Internal Control and Audit System and Business Solicitation System of Insurance Agent Companies and Insurance Broker Companies Article 5

The internal control system of banks as well as insurance agent companies and insurance broker companies with annual operating revenue of NT$500 million or more shall contain at least the following components:1. Control environment: Control environment is the basis of the design and implementation of internal control system across the company. Control environment encompasses corporate integrity and ethical value of the company, governance oversight responsibility of the board of directors (council) and supervisors (board of supervisors), or audit committee organizational structure, assignment of authority and responsibility, human resources policy, and performance measures and reward and discipline. The board of directors (council) and management shall prescribe internal standards of conduct, including the adoption of code of conduct for directors (council) and employees.2. Risk assessment: A precondition to risk assessment is the establishment of objectives, linked at different levels of the company, taking into account suitability of the objectives. Management shall consider the impact of possible changes in the external environment and within its own business model that may render internal control ineffective. The risk assessment results can assist the company in designing, correcting, and operating necessary control activities in a timely manner.3. Control activities: Control activities are actions of carrying out policies and procedures taken by the company according to risk assessment results to limit relevant risks to a sustainable level. Control activities shall be performed at all levels of the company, at various stages within business processes, and over the technology environment, and shall include supervision and management of subsidiaries.4. Information and communications: Information and the company obtains, generates, or uses communication mean the relevant and quality information from both internal and external sources to support functioning of other components of internal control, and to ensure effective communication of such information between the company and external parties. Internal control systems must have mechanisms of generating information necessary for planning, implementation, and monitoring and providing timely information to those who need it.5. Monitoring activities: Monitoring activities means ongoing evaluations, separate evaluations, or some combinations of the two used by the company to ascertain whether each component of the internal control system exists and continues to function. Ongoing evaluations means routine evaluations built into the course of operations at different levels of the company. Separate evaluations are evaluations conducted by internal auditors, supervisors (board of supervisors) or audit committee, or board of directors (council). Findings of deficiencies of the internal control system shall be communicated to the management of appropriate levels, the board of directors (council) and supervisors (board of supervisors) or audit committee, and improvements shall be made in a timely manner.The insurance agent companies and insurance broker companies with annual operating revenue less than NT$500 million shall contain at least the following components:1. Management oversight and control culture: The board of directors (council) shall have the responsibility for approving and periodically reviewing overall business strategies and major policies, and shall have the ultimate responsibility for ensuring that an adequate and effective internal control system is established and maintained; senior management shall have the responsibility for implementing business strategies and policies approved by the board of directors (council), for developing processes that identify, measure, monitor, and control risks incurred by the company, for setting appropriate internal control policies, and for monitoring their effectiveness and relevance.2. Risk recognition and assessment: An effective internal control system requires that the material risks that could adversely affect the achievement of the company goals are being identified and continually evaluated.3. Control activities and delegation of responsibilities: Control activities shall be an integral part of the daily operations. An appropriate control structure shall be set up, with internal control processes defined at every business level. An effective internal control system requires that there is appropriate delegation of responsibilities and that management and employees are not assigned conflicting responsibilities.4. Information and communication: an insurance agent company or insurance broker company shall maintain relevant and comprehensive financial and non-financial information related to operations, financial reports and regulatory compliance; such information shall be reliable, timely, and accessible in order to establish effective channels of communication.5. Monitoring activities and correction of deficiencies: An insurance agent company or insurance broker company shall monitor the overall effectiveness of its internal controls on an ongoing basis. Business units, internal auditors or other internal control personnel shall promptly report any internal control deficiencies found to the appropriate management in a timely manner, and any significant internal control deficiencies shall be reported to senior management, the board of directors (council) and supervisors (board of supervisors) with corrective actions promptly taken.Insurance agent companies, or insurance broker companies that have already established its internal control system according to paragraph 1 hereof shall stay in compliance with paragraph 1 when annual operating revenue falling below NT$500 million.