Internal Audit Organization and Operations
I. Purpose of Internal Audit
The purpose of the Company’s internal audit is to provide independent and objective assurance and consulting services to enhance organizational value and improve operations. Through a systematic and disciplined approach, internal audit assists the Board of Directors and management in evaluating and enhancing the effectiveness of risk management, control, and governance processes, thereby promoting sound operations and achieving organizational objectives.
II. Audit Reporting Line and Organization
According to the Company’s organizational rules, the Audit Office reports directly to the Board of Directors. It is staffed by one Chief Internal Auditor responsible for overseeing the internal audit operations of both the Company and its subsidiaries. The appointment or dismissal of the Chief Internal Auditor must be approved by the Audit Committee and resolved by the Board of Directors.
Depending on business needs, 1 to 3 internal auditors may be assigned to carry out internal audit work. The appointment, evaluation, and performance-based compensation of audit staff are proposed by the Chief Auditor and approved by the Chairperson.
The hiring, evaluation, and compensation of internal audit staff are conducted in accordance with the Company's “Personnel Recruitment and New Employee Training Management Guidelines,” “Salary Management Regulations,” and “Performance Evaluation Guidelines.” The “Internal Auditor Appointment and Dismissal Management Regulations” are disclosed in the Company’s internal regulations.
Internal auditors must meet the qualifications set by the competent authorities, and the Chief Auditor and audit staff are required to undergo relevant mandatory training annually.
III. Execution of Audit Activities
1. Annual Audit Plan
1.1 Before the end of each year, the Audit Office formulates the audit plan for the following year based on legal requirements, risk assessments, and the instructions of the Board of Directors and supervisors. The plan is submitted to the Board for approval and serves as the basis for audit execution.
1.2 The audit plan includes audit items and the schedule for conducting audits.
1.3 The annual audit plan is submitted to the competent authority for record before the end of the previous year.
2. Audit Operations Management
2.1 Audit personnel shall conduct audits in accordance with the “Audit Office Guidelines” or “Internal Audit Implementation Rules.” The internal audit scope includes all subsidiaries.
2.2 The “Audit Office Guidelines” or “Internal Audit Implementation Rules” include:
2.2.1 Planning prior to the commencement of audit work
2.2.2 Conducting audit operations
2.2.3 Methods of communication and recommendation
2.2.4 Audit working papers and reports
2.2.5 Follow-up and correction of audit deficiencies
2.2.6 Key control or audit checkpoints
3. Self-Inspection: Department heads conduct annual self-assessments of the internal control system to evaluate its effectiveness.
4. Deficiency Follow-up and Review: The Internal Audit Office regularly and in writing follows up and reviews the findings or deficiencies identified by regulators, accountants, internal auditors, and audited units, as well as the areas for improvement listed in the Internal Control System Statement. Audited units must regularly review the identified deficiencies until the Audit Office confirms corrective actions are complete.
5. Reporting: All audit reports, self-inspection results, and deficiency follow-up reports are submitted to the supervisors for review by the end of the month following completion.
IV. Subsidiary Audit
1. Subsidiaries that are not publicly listed or do not have internal audit departments must provide quarterly management reports. The parent company's Audit Office schedules supervisory operations based on risk assessments.
2. For subsidiaries that are publicly listed or have established internal audit departments, the subsidiaries themselves execute audit activities. The parent company supervises their audit activities as follows:
2.1 Before the end of each year, subsidiaries shall submit the implementation status of the current year’s audit plan and the following year’s board-approved audit plan to the parent company for record.
2.2 Subsidiaries must report the status of deficiency and abnormality corrections to the parent company’s Audit Office on a quarterly basis. Any significant issues must be reported immediately.
2.3 Completed audit reports and self-inspection reports must be submitted to the parent company’s Audit Office for review.
Last Updated: 2024.11.13