Regulations Governing Implementation of Internal Control and Auditing System of Insurance Enterprises Article 4
The internal control system of an insurance enterprise shall incorporate at least the following components:1. Control environment: The control environment is the basis for the design and implementation of the internal control system of an insurance enterprise. The control environment encompasses the integrity and ethical values of the insurance enterprise, governance oversight responsibility of its board of directors and supervisors or audit committee, organizational structure, assignment of authority and responsibility, human resources policy, performance measures and awards and discipline. The board of directors and management shall establish internal code of conduct, including the code of conduct for directors and code of conduct for employees.2. Risk assessment: A precondition to risk assessment is the establishment of objectives, linked at different levels of an insurance enterprise, and the suitability of the objectives should also be taken into consideration. The management should consider the impact of changes in the external environment and its own business model, and possible fraud scenarios that may occur. The risk assessment results can assist the insurance enterprise in designing, correcting, and implementing necessary controls in a timely manner.3. Control operations: Control operations are means the actions of adopting proper policies and procedures by an insurance enterprise based on its risk assessment results to control risks within a tolerable range. Control operations shall be performed at all levels of the insurance enterprise, at various stages of business processes, and over the technology environment, and shall include supervision and management over subsidiaries.4. Information and communication: Information and communication means relevant and quality information that an insurance enterprise obtains, generates, and uses from both internal and external sources to support the continuous functioning of other components of internal control, and to ensure that information can be effectively communicated within and outside the organization. The internal control system must have mechanisms to generate information necessary for planning, implementation, and monitoring, and to enable timely access to information by those who need it.5. Monitoring operations: Monitoring operations means ongoing evaluations, individual evaluations, or some combination of the two used by an insurance enterprise to ascertain whether each of the components of internal control is present and continuously functioning. Ongoing evaluations means routine evaluations built into the course of operations at different levels. Individual evaluations are evaluations conducted by different personnel such as internal auditors, supervisors or audit committee, or the board of directors. Findings of deficiencies of the internal control system shall be communicated to the management of appropriate levels, the board of directors, and supervisors or audit committee, and improvements shall be made in a timely manner.
中文原文 保險業內部控制及稽核制度實施辦法第4條
保險業之內部控制制度，至少應包括下列組成要素：
一、控制環境：係保險業設計及執行內部控制制度之基礎。
控制環境包括保險業之誠信與道德價值、董（理）事會及監察人（監事）或審計委員會治理監督責任、組織結構、權責分派、人力資源政策、績效衡量及獎懲等。
董（理）事會與管理階層應建立內部行為準則，包括訂定董（理）事行為準則、員工行為準則等事項。
二、風險評估：風險評估之先決條件為確立各項目標，並與保險業不同層級單位相連結，同時需考慮保險業目標之適合性。
管理階層應考量保險業外部環境與商業模式改變之影響，以及可能發生之舞弊情事。
其評估結果，可協助保險業及時設計、修正及執行必要之控制作業。
三、控制作業：係指保險業依據風險評估結果，採用適當政策與程序之行動，將風險控制在可承受範圍之內。
控制作業之執行應包括保險業所有層級、業務流程內之各個階段、所有科技環境等範圍及對子公司之監督與管理。
四、資訊與溝通：係指保險業蒐集、產生及使用來自內部與外部之攸關、具品質之資訊，以支持內部控制其他組成要素之持續運作，並確保資訊在保險業內部與外部之間皆能進行有效溝通。
內部控制制度須具備產生規劃、執行、監督等所需資訊及提供資訊需求者適時取得資訊之機制。
五、監督作業：係指保險業進行持續性評估、個別評估或兩者併行，以確定內部控制制度之各組成要素是否已經存在及持續運作。
持續性評估係指不同層級營運過程中之例行評估；個別評估係由內部稽核人員、監察人（監事）或審計委員會、董（理）事會等其他人員進行評估。
對於所發現之內部控制制度缺失，應向適當層級之管理階層、董（理）事會及監察人（監事）或審計委員會溝通，並及時改善。
一、控制環境：係保險業設計及執行內部控制制度之基礎。
控制環境包括保險業之誠信與道德價值、董（理）事會及監察人（監事）或審計委員會治理監督責任、組織結構、權責分派、人力資源政策、績效衡量及獎懲等。
董（理）事會與管理階層應建立內部行為準則，包括訂定董（理）事行為準則、員工行為準則等事項。
二、風險評估：風險評估之先決條件為確立各項目標，並與保險業不同層級單位相連結，同時需考慮保險業目標之適合性。
管理階層應考量保險業外部環境與商業模式改變之影響，以及可能發生之舞弊情事。
其評估結果，可協助保險業及時設計、修正及執行必要之控制作業。
三、控制作業：係指保險業依據風險評估結果，採用適當政策與程序之行動，將風險控制在可承受範圍之內。
控制作業之執行應包括保險業所有層級、業務流程內之各個階段、所有科技環境等範圍及對子公司之監督與管理。
四、資訊與溝通：係指保險業蒐集、產生及使用來自內部與外部之攸關、具品質之資訊，以支持內部控制其他組成要素之持續運作，並確保資訊在保險業內部與外部之間皆能進行有效溝通。
內部控制制度須具備產生規劃、執行、監督等所需資訊及提供資訊需求者適時取得資訊之機制。
五、監督作業：係指保險業進行持續性評估、個別評估或兩者併行，以確定內部控制制度之各組成要素是否已經存在及持續運作。
持續性評估係指不同層級營運過程中之例行評估；個別評估係由內部稽核人員、監察人（監事）或審計委員會、董（理）事會等其他人員進行評估。
對於所發現之內部控制制度缺失，應向適當層級之管理階層、董（理）事會及監察人（監事）或審計委員會溝通，並及時改善。