| Article 26 | The purpose of internal audit is to assist the board of directors and the managerial level to verify and evaluate whether the operation of internal control system works effectively and smoothly and provide appropriate suggestions for revision, which can ensure the on-going performance of effective internal control and serve as the basis of internal control system revisions. |
| Article 27 | Financial holding companies and the banking business shall set up an internal audit unit that is directly subsidiary to the board of directors, which shall perform audit business independently and honestly. The unit is required to report its audit business to the board of directors and supervisors (board of supervisors) or audit committee at a minimum period of every six months.
Financial holding companies and the banking business shall establish a chief auditor system to manage all audit business. The chief auditor shall possess sufficient leadership and ability to carry out effective audit work, and whose qualification requirements shall be equivalent to those prescribed for the responsible persons of each respective type of financial institution, with a rank equivalent to that of a vice general manager. The chief auditor is not allowed to take a job that will cause conflicts or limitations to the audit work.
The employment, dismissal, or transfer of the chief auditor shall have the consent of the majority of audit committee members as well as the consent of more than two-thirds of the board of directors and report to the competent authority for ratification.
Where the matter in the preceding paragraph did not have the consent of the majority of audit committee members, the resolution adopted by the audit committee shall be recorded in the board meeting minutes. If there is no audit committee but independent directors set up and an independent director objects to or expresses reservations about the matter, it shall be recorded in the board meeting minutes.
In the event of a change of the chief auditor, a financial holding company and banking business shall, within five days from the date of occurrence of the fact, report the reasons for and contents of the change in writing to the competent authority, and provide a copy of the notification to the chief auditor involved in the change.
The "date of occurrence of the fact" referred to in the preceding paragraph means the date of the resolution of the board of directors or any other date sufficient to confirm the appointment or dismissal of the chief auditor, whichever is earlier.
The appointment, dismissal, promotion, reward/ discipline, rotation, and performance review of personnel in the internal audit unit shall become effective after being reported by the chief auditor to chairperson of the board. However, if a matter involves personnel of other management or business units, the chief auditor shall first consult the personnel department to refer the matter to the general manager for approval, and then report to the chairperson of the board for final approval.
The Regulations in Paragraph 1 to 7 of this article shall not apply to a company who operates financial and trust business concurrently other than a banking business.
The chief auditor of a financial holding company is allowed to, if required by business, dispatch the internal auditors of a subsidiary company to conduct the internal audit task on the financial holding company or its subsidiary company. The chief auditor shall also take up the final responsibility to ensure appropriate and effective internal audit system in the financial holding company or its subsidiary company.
Financial holding companies and the banking business shall establish communication channels and mechanisms between independent directors, the audit committee, or supervisors (board of supervisors) and the internal audit unit, and the internal audit unit shall report the communication status to the board of directors on an annual basis. |
| Article 28 | When any of the following circumstances applies to a chief auditor in overseeing internal audit work, the competent authority may, having regard to the seriousness of the event, issue an official reprimand, order the chief auditor to make improvements within a specified time limit, or otherwise order the financial holding company to release the auditor general from duty.
1. Has made any improper loan extension, been involved in a material breach of the principles for giving credit or otherwise engaged in any improper transfer of funds with customers, as established by factual proof.
2. Has abused authority of office, there is evidence showing that he or she has carried out improper activities, or he or she has misused power, in an attempt to seek profits for him or herself or for a third party, or to damage the interest of its belonging financial company (including its subsidiaries) or banking business; and therefore, his or her abuse or misuse of power has thus cause losses for its belonging financial company or its subsidiary company or banking business or a third party.
3. The auditor disclose, deliver, or publicize all or part of the contents of its financial examination reports to a person not related to such job without the consent from the competent authority.
4. Has failed to notify the competent authority of any significant malpractice that due to poor internal management has occurred in the financial holding company (including its subsidiaries) or the banking business.
5. Has failed to disclose in an internal audit report any significant deficiency identified in the financial and business operations of the financial holding company (including its subsidiaries) or the banking business.
6. Has issued a fraudulent internal audit report on internal audit findings.
7. As a result of obviously insufficient staffing or staffing operations by obviously incompetent internal auditors in the financial holding company (including its subsidiaries) or banking business, has failed to identify a serious deficiency in financial and business operations.
8. Has failed to follow the instructions of the competent authority in conducting audit work or in providing relevant information.
9. Has otherwise committed any act that impairs the reputation or interests of the financial holding company (including its subsidiaries) or the banking business. |
| Article 29 | Financial holding companies the banking business shall, after having regard to its investment scale, business condition (the number of its branches and amount of business), management needs, and relevant provisions of rules and regulations, staff competent persons in an appropriate number as full-time internal auditors who shall perform their duties in a detached, independent, objective, and impartial manner. Personnel of the internal audit unit shall be deputy to each other to cover each other's absence.
An internal auditor of a financial holding company or banking business shall meet the following qualification requirements:
1. Having not less than two (2) years of experience in financial examination; or having graduated from a college or university or passed a senior civil service examination or an equivalent examination, or the examination of certified internal auditor or certified information systems auditor and having not less than two (2) years of experience in financial business; or having not less than five (5) years of experience in financial business. A person is deemed to meet such requirements if he or she has worked as a professional, such as an auditor in an accounting firm, or a computer programmer or system analyst for not less than two (2) years and has received not less than three (3) months of training in the business operations and management of a financial institution. However, the number of this type of auditor cannot exceed one-half of the total auditors.
2. Free of any record of demerit or more severe disciplinary action from employer in the last three (3) years, unless the demerit record was a result of joint and several disciplinary action on account of the violation or offense of another person, and the demerit has been offset by other merits; and
3. If a lead auditor, have no less than three (3) years of experience in auditing or financial examination, or have no less than one (1) year of experience in auditing and no less than five (5) years of experience in financial business.
The qualifications of the dedicated internal audit personnel of banks’ foreign business units must comply with the local regulations and the requirements of the local competent authority. However, if the local competent authority does not specify the qualifications for internal auditors hired locally, the foreign business unit shall hire employees in accordance with the evaluation and selection regulations passed by the board of directors, and the aforementioned regulations do not apply.
Financial holding companies and the banking business shall examine whether the internal auditors have violated the regulations in the preceding three paragraphs. If the auditor has violated the rules, the company shall order the auditor to make improvement within two (2) months and shall be transferred to other job if he or she fails to make such improvement. |
| Article 30 | The internal auditors of a financial holding company or banking business shall perform their duties in good faith, and may not do any of the following:
1. Conceal or make false or inappropriate disclosures of any of the financial holding company's or the banking business's business activities, reporting, or compliance with rules and regulations that they know to directly cause damage to any interested party.
2. Act beyond the scope of audit functions or engage in other improper activities, or externally disclose any acquired information, attempt to profit therefrom, or otherwise use the information against the interest of the financial holding company (including its subsidiaries) or banking business.
3. Cause losses to the financial holding company (including its subsidiaries) or the banking business or harm the interests of its stakeholders due to negligence.
4. Conduct audit work within one (1) year to the department where the auditor used to work at.
5. Fail to recuse himself or herself from auditing of cases or business within the scope of his or her past duties or matters in which he or she has a personal interest.
6. Directly or indirectly provide, promise, demand or accept any unreasonable gift, hospitality or other improper benefits of any form to or from employees or customers of the same financial holding company (including its subsidiaries) or the banking business.
7. Fail to audit matters that the competent authority has instructed to him or her to audit or to provide relevant information.
8. Any other violation of rules, regulations or practices prohibited by the competent authority.
Financial holding companies and the banking business shall examine at all time whether the internal auditors have violated the regulations in the preceding two paragraphs. If the auditor has violated the rules, the company shall order the auditor to make improvement within one (1) month and shall be transferred to other job if he or she fails to make such improvement. |
| Article 31 | The internal audit unit shall undertake the following tasks:
1. Plan the organization structure, size and duty of the internal audit unit. Prepare internal audit working manuals and working papers, which shall at least include assessing the various rules and operating procedures of the internal control system to determine whether adequate internal controls are already in place in the current rules and procedures, whether each department has realistically carried out the internal controls, and whether the internal controls are carried out in a reasonably effective manner, and from time to time provide recommendations for improvement.
2. Formulate annual audit plans and, based on the business risk profile of and implementation of internal audits by each subsidiary or department, determine audit plans targeted at each individual subsidiary or department
Financial holding companies and the banking business shall conduct self-inspections, and the internal audit unit shall audit the implementation of the self-inspections of the internal control system by each unit (including its subsidiary companies if it is a financial holding company). Such audit results, together with the improvement status of internal control deficiencies and irregularities identified by the internal audit unit, shall serve as the basis for the issuance of the Internal Control System Statement.
When a significant deficiency or malpractice arises within the management or business departments of a financial holding company or a banking business, the internal audit unit shall have the power to suggest penalties and shall make a full disclosure of the responsible negligent personnel in an internal audit report. |
| Article 32 | The internal audit unit of a banking business shall conduct one routine audit and one special audit annually on its operation, finance, asset custody, information departments and dedicated information security unit; at least one special audit annually on other management departments; and at least one routine audit annually on its all-business centers, foreign business units and foreign subsidiary companies. For foreign representative offices, the internal audit method may be replaced by audit documentary review, or the frequency of internal audit may be flexibly adjusted.
The contents of the routine audit or the special audit, which is performed by the internal audit unit of a banking business to its business unit, shall cover whether there are improper marketing activities when dealing with trust business, financial management, and the sale of financial products; whether the contents of the products are clearly disclosed; whether the risks are well notified; whether the contract is fair and other obligations are performed appropriately following the law or self-regulatory guidelines.
The internal auditing unit of a financial holding company shall conduct a routine audit at least annually; a special audit on its finance, risk management, and compliance with applicable acts and regulations at least semiannually; where the routine audit has covered the scope of the special audit and its audit results reveal no significant deficiency, and it expressly states such in the internal audit report, it is not required to conduct a special audit for that current half-year.
The internal audit unit shall include the execution status of the regulatory compliance system into the routine audit or special audit of the business and management units. |
| Article 33 | A domestic bank may apply to the competent authority for approval to adopt a risk-based internal auditing system. A subsidiary that was evaluated and exempted from adopting the system for implementation in accordance with Paragraph 2 of Article 34 shall provide evaluation documents. The competent authority may ask a domestic bank to apply for approval to adopt a risk-based internal auditing system in view of the bank's asset size, business risks, and other necessary conditions.
A domestic bank that applies for approval to adopt a risk-based internal auditing system must meet the following criteria:
1. The bank's most recently filed ratio of regulatory capital to risk-weighted assets meets the requirements set out in Article 5 of the Regulations Governing the Capital Adequacy and Capital Category of Banks;
2. The bank does not show insufficient loan loss provision and reserves based on the most recent financial examination and the most recent CPA-audited and certified financial statements;
3. The bank's non-performing loan ratio of the most recent quarter does not exceed 1%; and
4. The bank has an effective internal control system.
The provisions on auditing frequency in Paragraph 1 of the preceding article and Paragraph 2 of Article 34 do not apply to domestic banks that have been approved to adopt a risk-based internal auditing system. |
| Article 34 | Financial holding companies and the banking business shall formulate annual audit plans and, based on the business risk profile of and implementation of internal audits by each subsidiary, determine audit plans targeted at each individual subsidiary.
The internal audit unit of a financial holding company or a banking business, except those foreign subsidiary banks of a banking business and other business ratified by the competent authority, conduct a target audit on its subsidiaries' finance, risk management, and compliance with applicable acts and regulations at least semiannually and incorporate the audit results into its annual audit project.
Financial holding companies and the banking business shall supervise its subsidiaries to submit their board meeting minutes, CPA audit reports, examination reports issued by the financial examination agency, and other relevant materials, and, for subsidiaries having established an internal audit unit, audit plans and reports on significant deficiencies identified in internal audit reports and the status of improvements thereof; the parent company shall review such documents and monitor the implementation of improvements by each subsidiary.
The chief auditor of a financial holding company or a banking business shall periodically evaluate the efficacy of the internal control activities of a subsidiary as set forth in the preceding paragraph and, after having reported to the board of directors, send the evaluation results to the relevant subsidiary's board of directors for their reference in personnel evaluations. |
| Article 35 | Financial holding companies and the banking business shall disclose at least the following information in its internal audit report for routine audits:
1.Audit scope; summary commentary; financial status; capital adequacy; operation performance; asset quality; equity management; management of the operation of board of directors and audit committee; compliance with major acts, regulations, and rules; internal controls; interested party transactions; the control and internal management of all business tasks; employee confidentiality education; information management and information security; management of customer data confidentiality; protection measures of consumers and investors; management of sustainability information and the results of self-inspection, and the evaluation to above matters.
2. Opinions for the major illegal errors or faults in all departments, and the suggestions for punishment for employees fail to fulfill their duties.
3. The examination comments or faults listed by the financial examination agency, accountants, internal audit unit (including the internal audit unit of the parent company), and self-inspection people, and the improvement status of items that enlisted as 'need further improvement' by the internal control system statement.
The record of the results in working papers shall be preserved together with the self-inspection or internal audit reports and relevant materials for no less than five (5) years. |
| Article 36 | The internal audit report of a financial holding company or banking business shall be delivered to the supervisors (board of supervisors) or audit committee for review and unless it is otherwise provided by the competent authority, shall be submitted to the competent authority within two (2) months following completion of the audit. The audit report shall also be delivered to the independent directors if such positions are set up by the financial holding company or the banking business. |
| Article 37 | Before assuming the following post, the person shall enroll in the following trainings held by the institutes recognized by the competent authority and obtain completion certificate from them:
1. When acting as an internal auditor for the first time, the auditor shall participate in the audit training course, computer audit training course or billing audit training course for no less than sixty (60) hours. The auditor shall also pass the exam and obtain the completion certificate.
2. An internal auditor with leadership duty shall participate in the internal auditor leader train course for no less than nineteen (19) hours.
3. The chief auditor and official, deputy managers shall participate in audit manager training course for no less than twelve (12) hours.
The regulations in the preceding paragraph do not apply to the training required for locally hired internal audit personnel hired by the foreign business unit. However, where the local competent authority has other regulations, such regulations shall apply.
Internal auditors (including the official, deputy managers and chief auditor) of a financial holding company (including its subsidiary companies) or a banking business (including the parent company) each year shall attend a finance-related professional training held by a competent authority-designated institution or by the financial holding company or a subsidiary thereof. For the minimum number of training hours, the total hour shall be no less than twenty (20) for the official, deputy managers and chief auditors; no less than thirty (30) for the other internal auditors. If an auditor has obtained an international internal auditor certificate within the current year, the certificate can be transferred to the training hours.
The total hour of a finance-related professional training held by a competent authority-designated institution shall not be less than half of the training hours in the preceding paragraph.
The number of required training hours each year for an auditor stationed in a foreign country or locally hired internal audit personnel hired by the foreign business unit shall meet requirements in local regulations, and the regulations in the two preceding paragraphs do not apply. However, where requirements are not specified in the local regulations, the number of on-the-job training hours required each year for the supervisor and the personnel of the internal audit unit of the head office in Taiwan shall be adopted. The training hours can also be recognized by enrolling with a financial training institute established according to the local regulations.
A financial holding company or a banking business shall verify that its internal auditors meet the qualification requirements set forth herein. The verification documentation and records for such purpose shall be kept on file for future reference. |
| Article 38 | Financial holding companies and the banking business shall, in a prescribed format and via an Internet-based information system, file with the competent authority for recordation the information on the name and years of service of its internal auditors by the end of January annually.
When preparing the basic information of internal auditors, the financial holding company or the banking business shall verify whether these auditors have met the requirements stipulated in Paragraph 2 and Paragraph 3, Article 29 and Article 37. If the auditor fails to meet the requirements, it shall be improved within two (2) months, if not, the auditor shall be re-assigned to another job. |
| Article 39 | Financial holding companies and the banking business shall, in a prescribed format and via an Internet-based information system, file with the competent authority for recordation its next year's audit plan by the end of each fiscal year and a report on the execution of its preceding year's annual audit plan within two (2) months from the end of each fiscal year.
By the end of each accounting year, the financial holding company or the banking business shall deliver a written audit plan for the next year to the supervisors (supervisors, board of supervisors) or the audit committee for examination and compilation. If the company doesn't have an audit committee, the report shall be delivered to the independent directors for comments. The annual audit plan and changes thereof shall be approved by the board of directors.
The contents of audit plan mentioned in the preceding paragraph shall at least include: an explanation of the audit plan, annual audit points, units that will receive the audit, nature of audit (routine audit or special audit), and whether the frequency of audit comply with the regulation of the competent authority. If the audit is a special audit, then it is necessary to notify the range of audit. |
| Article 40 | Financial holding companies and the banking business shall, in a prescribed format and via an Internet-based information system, file with the competent authority for recordation their improvements of deficiencies and irregularities identified in the internal control system in preceding year within five (5) months from the end of each fiscal year. |
| Article 41 | For a banking business, officers with business or transaction approval authority shall meet any of the requirements below prior to taking office:
1. Have served as auditors in the internal audit unit and worked for over one (1) year with actual auditing affairs.
2. Have enrolled in the audit training course or computer audit training course held by a competent authority-designated institution and passed the exam and obtained the completion certificate.
3. Obtaining the qualification certificates in banking business internal control and internal audit exam held by a competent authority-designated institution. The contents of the exam shall be similar to the contents mentioned in the preceding paragraph.
For the foreign businesses of domestic banks, officers with business or transaction approval authority, they are allowed to enroll in professional audit training held by a foreign professional institute or obtain a similar certificate from a foreign institute to replace the certificate mentioned in Paragraph 1.
When acting as the manager of a local business unit, the person shall meet the conditions listed in Paragraph 1. Furthermore, if such person meets the qualifications in Subparagraph 2 or 3 of Paragraph 1, they shall participate in internal audit practices no less than four (4) times with the internal audit unit before actually assuming the post or within six (6) months after assuming the post. During these internships, such person shall inspect at least one (1) item per session, with cumulative coverage of no less than four (4) items, prepare a report on the practice, and submit it to the chief auditor for verification. The chief auditor shall issue a certificate and retain it together with the report for further reference
For the banks of a foreign bank in Taiwan, the officers with business or transaction approval authority have finished the internal audit trainings requirement by the bank, when the training is higher than the requirements listed in Paragraph 1, then they can be exempt for the regulations in this article. The officers with business or transaction approval authority referred to therein shall mean managers who report directly to the person in charge in Taiwan and possess business or transaction approval authority. |
| Article 42 | The internal audit unit shall continually conduct follow-up reviews on any examination opinions or audit deficiencies brought up by the financial examination authority, CPA and internal audit unit (including the internal audit unit of the parent company), as well as matters specified in the internal control system statement as requiring stronger improvement efforts, and submit a written report on the implementation of improvement of deficiencies to the board of directors, together with a copy to the supervisors (supervisors, the board of supervisors), and list these as an important factor in the relevant department's performance evaluations.
The major points of audit task for a financial holding company or a banking business shall be prescribed by the competent authority. |
| Article 43 | The audit business matters reported by the internal audit unit of a banking business to the board of directors and supervisors or the audit committee at least once every six months pursuant to Paragraph 1 of Article 27 shall include the performance evaluation of the dedicated units for legal compliance, risk management, and information security, as well as evaluation opinions on the bank-wide level of legal compliance, risk management, and information security.
After the end of examination conducted by the competent authority or the local competent authority at where a foreign branch is located or after receiving an examination report, the internal audit unit at a financial holding company or the head office of a banking business shall, based on the principle of materiality, promptly inform the directors (council members) and supervisors (board of supervisors), and make a report to the forthcoming board of directors' meeting. The report items shall include the content of examination communication meeting, major deficiencies found in the examination, the rating downgrade by the financial competent authority, improvement actions required by the competent authority or possible disciplinary measures to be taken. |