Regulations Governing Implementation of Internal Control and Auditing System of Insurance Enterprises Article 35

An insurance enterprise shall set out in its internal control system penalties for violations of these Regulations or its internal control rules by management and relevant personnel.Where an insurance enterprise has a significant fraudulent event occurred as a result of poor internal management, unsatisfactory internal controls, inadequate implementation of the internal audit system and regulatory compliance system, or concealment of the results of improvement actions taken for any deficiency specified by a financial examination agency in an examination opinion requiring review and follow-up, or the audit findings of the internal audit unit (including the internal audit unit of parent financial holding company), the personnel involved shall be held responsible for dereliction of duties.An insurance enterprise should commend its internal auditors who identify any significant malpractice or negligence and thereby avert material loss to the enterprise.When a significant deficiency or malpractice event arises within the management or business unit of an insurance enterprise, the internal audit unit shall have the power to suggest penalties and shall make a full disclosure of the responsible negligent personnel in an internal audit report.