Internal Audit

The Company implements internal auditing with the purpose of assisting the Board of Directors and management in examining and reviewing deficiencies in the internal control system, as well as evaluating the effectiveness and efficiency of operations. Timely recommendations for improvement are provided to ensure the continuous and effective implementation of the internal control system, serving as a basis for reviewing and amending the internal control framework.

To implement internal auditing, the Company has established an Audit Office directly under the Board of Directors, as shown in the Company’s organizational chart. The office is staffed with one full-time Chief Audit Executive and at least one internal auditor (the number of auditors may be adjusted based on practical needs but will not be fewer than one). Internal auditors are expected to exercise due professional care, uphold independence and impartiality, and maintain objectivity when performing internal audit tasks.

Appointment, dismissal, and compensation of internal auditors:
(1) These are handled in accordance with the Company’s relevant personnel and compensation policies applicable to general employees, subject to approval by the Chairman of the Board.
(2) The appointment and dismissal of the Chief Audit Executive must be approved by the Audit Committee and resolved by the Board of Directors. Furthermore, the reasons and details of such changes shall be reported to the Financial Supervisory Commission through the Market Observation Post System (MOPS) within two days from the effective date.

Performance evaluation of internal audit personnel: This is conducted in accordance with the “Internal Audit Performance Evaluation Regulations,” which have been reviewed and approved by the Audit Committee and submitted to the Board of Directors for final approval.

1. Audit Scope: The scope of the Company’s internal audit covers all operational activities. The mandatory annual audit items include the following:

 ● Acquisition or disposal of assets
 ● Derivatives trading (monthly)
 ● Lending of funds to others (quarterly)
 ● Management of endorsements and guarantees (quarterly)
 ● Management of related-party transactions
 ● Supervision and management of subsidiaries
 ● Management of Board of Directors meeting procedures
 ● Information security inspections
 ● Sales and collection cycle
 ● Procurement and payment cycle
 ● Operations of the Remuneration Committee
 ● Management of insider trading prevention
 ● Compliance with International Financial Reporting Standards (IFRS)
 ● Accounting judgment processes, accounting policies, and changes in estimates

In addition, based on risk assessment results, instructions from the Board of Directors, or regulatory requirements relating to internal controls, the Audit Office may include other risk items within the scope of audits.

2. Audit Targets: The audit covers all units, branches, and subsidiaries of the Company.

3. Audit Operations: By the end of each year, the Audit Office formulates the audit plan for the following year based on risk assessment results and Board instructions, which is then submitted to the Board for approval and implementation. Audit operations are classified as follows:

(1) Annual planned audits: Conducted in accordance with the annual audit plan approved by the Board of Directors.
(2) Special project audits: Conducted in accordance with instructions from the Board of Directors or management, or as required by specific projects or business needs.
(3) Self-assessment: The Audit Office requires all internal departments and subsidiaries to periodically perform self-assessments of the implementation of their internal control systems. Each unit and subsidiary must evaluate its internal controls over business operations, document the results in assessment reports, and submit them to the Audit Office. The Audit Office then regularly reviews the self-assessment results to confirm their effectiveness.

4. Audit Reports:

(1) In accordance with the annual audit plan, the Audit Office examines and evaluates the implementation of the internal control system and prepares audit reports, which are submitted monthly to the President and Chairman of the Board for review. Audit reports are expected to be concise, objective, constructive, and timely. Audit findings and deficiencies in internal controls must be truthfully disclosed in the reports. Pursuant to the “Regulations Governing Establishment of Internal Control Systems by Public Companies,” completed reports shall be submitted to the members of the Audit Committee by the end of the month following completion.
(2) Audit findings must be followed up, and periodic follow-up reports shall be prepared to ensure that the relevant units have taken appropriate corrective actions in a timely manner until full remediation is achieved.
(3) The Chief Audit Executive shall attend Board meetings and report on the implementation and results of internal audit operations.