Regulations Governing Implementation of Internal Control and Auditing System of Insurance Enterprises Article 7

For the purpose of maintaining effective operation of its internal control system to achieve the objectives of internal control set out in Article 2 herein, an insurance enterprise shall establish such three defense lines for internal control, including a self-inspection system, a regulatory compliance system and risk management mechanism and an internal audit system.To implement the regulations in the foregoing paragraph, the insurance enterprise shall adopt the following measures:1. Internal audit system: an audit unit shall be set up to take charge of auditing each unit and periodically evaluating the performance of self-inspection conducted by each business unit.2. Regulatory compliance system: The chief compliance officer examines duly whether business personnel comply with relevant laws and regulations in conducting business in accordance with the compliance plan developed by the head office.3. Self-inspection system: Members of business, financial and information units check on each other the actual implementation of internal controls under the supervision of managerial personnel or personnel at comparable position or higher as assigned by each unit to discover deficiencies early and take corrective actions in a timely manner.4. CPA auditor system: When a certified public accountant (CPA) engaged by an insurance enterprise conducts annual audit of the enterprise, the CPA should also examine the effectiveness of its internal control system and express opinions on the accuracy of financial information the enterprise files with the competent authority and the status of implementation of internal control system and regulatory compliance system.5. Risk management mechanism: Establish independent and effective risk management mechanism to assess and monitor the overall risk bearing capacity and current status of risks already incurred, and to determine their compliance with the risk response strategies and risk management procedures.The execution procedures for the three defense lines for the internal control system of an insurance enterprise have been collectively established by the Life Insurance Association of the Republic of China and the Non-Life Insurance Association of the Republic of China and have been filed with the competent authority for record.