An enterprise shall carry out internal audits to assist the board of directors and management in inspecting and reviewing deficiencies in the internal control system as well as measuring effectiveness and efficiency of operations, and shall make timely recommendations for improvements to ensure the sustained operating effectiveness of the system and to provide a basis for review and correction.

An enterprise shall establish an internal audit unit in a direct reporting line to the board of directors, and, except as otherwise provided by the FSC, shall appoint qualified persons in an appropriate number as full-time internal auditors according to its business size, business condition, management needs, and the provisions of other applicable laws and regulations.
An enterprise shall report any appointment or dismissal of the chief internal auditor for passage by the board of directors; where it has established the position of independent director, if an independent director has an objection or reservation, the objection or reservation shall be recorded in the minutes of the meeting of the board of directors.
Where an enterprise has established an audit committee in accordance with the Securities and Exchange Act, any appointment or dismissal of the chief internal auditor shall be subject to the consent of one-half or more of the entire membership of the audit committee and be submitted to the board of directors for a resolution, in which case the provisions of paragraphs 4 and 5 of Article 4 shall apply mutatis mutandis.
An enterprise shall report any appointment or dismissal of the chief internal auditor, specifying the reason for such a change of position and providing a copy of the minutes of the board of directors meeting to the FSC for recordation within five days from the date of passage by the board of directors.

The qualified full-time internal auditors referred to in paragraph 1 shall meet the qualifications and conditions prescribed in the "Regulations Governing Responsible Persons and Associated Persons of Securities Investment Trust Enterprises" or the "Regulations Governing Responsible Persons and Associated Persons of Securities Investment Consulting Enterprises."

An enterprise shall include at least the following items in its implementation rules for internal audits:
1. Inspection of the system of internal controls to measure the effectiveness of, and compliance with, the established policies and procedures, and their effects on operational activities.
2. A detailed listing of audit items, times, procedures, and methods.

An enterprise's internal audit unit shall prepare an annual audit plan based on the results of the risk assessment.
The annual audit plan under the preceding paragraph shall at least include as items to be audited monthly the controls over operation, creation, and redemption of funds, securities lending or borrowing, accounting, and operation of assets under discretionary investment agreements; the internal audit unit shall scrupulously implement the annual audit plan, so as to inspect its internal control system and prepare audit reports annexed with working papers and relevant materials.
An enterprise shall include as audit items in its annual audit plan for each year the control activities for major financial or business activities, such as for acquiring or disposing of assets, and management over "Know Your Customer," prevention of short-term trading, anti-money laundering, and information on interested companies, management over trade reporting by individuals, management of operation of board meetings, as well as inspection of information and communications security.
An enterprise shall have its annual audit plan, and any amendments thereto, passed by the board of directors.
Where an enterprise has established the position of independent director, when it submits its annual audit plan for deliberation by the board of directors pursuant to the preceding paragraph, the board of directors shall take into full consideration each independent director's opinion; when an independent director has an objection or reservation, the objection or reservation shall be recorded in the minutes of the meeting of the board of directors.
The audit reports, working papers, and relevant materials referred to under paragraph 2 shall be preserved for no less than five years.

The internal auditors of an enterprise shall factually disclose in audit reports any deficiencies and irregularities of the internal control system identified in inspection and, after having presented the reports, shall follow up on the matters and prepare follow-up reports on a regular basis to ensure that the relevant departments have taken appropriate corrective actions in a timely manner.
The enterprise shall include any identified deficiencies and irregularities of the internal control system and the correction thereof, as referred to in the preceding paragraph, as major items of performance evaluation for each department.
The correction of deficiencies and irregularities of internal control system referred to in paragraph 1 shall include all deficiencies identified by the FSC or SITCA in the course of examination, those identified in the course of internal audit operations, those listed in the Statement on Internal Control, and those identified in the course of self-inspection or by CPAs in special audits.

After having presented the audit and follow-up reports, an enterprise shall submit the same for review by each and all supervisors by the end of the month next following the completion of the audit items.
An enterprise's internal auditors identifying any material violation or any likelihood of material loss to the enterprise shall promptly prepare and present a report and notify each and all supervisors.
Where an enterprise has established the position of independent director, when an action is taken under the two preceding paragraphs, a copy of the submission or notice shall be provided simultaneously to the independent director(s).

The internal auditors of an enterprise shall be detached, independent, objective, and impartial, in scrupulously performing their duties, and report their audit operations to each and all supervisors on a regular basis; in addition, the chief internal auditor shall attend a board of directors meeting to present a report.
The internal auditors shall perform their duties in good faith and shall not do any of the following:
1. Conceal or make false or inappropriate disclosure of any of the enterprise's business activities, financial reporting, or compliance with applicable laws and regulations that they know have caused direct damage to a beneficial owner, customer, or interested party.
2. Cause damage to the rights or interest of the enterprise or any beneficial owner, customer, or interested party through improper intent or neglect of duty.
3. Fail to audit the matter instructed by the FSC or provide relevant information.
4. Any other activity in violation of any law or regulation or otherwise prohibited by the FSC.

The internal auditors of an enterprise shall pursue continuing training as well as attend internal audit training held by institutions recognized by the FSC, so as to improve their auditing quality and competence.
The internal audit training referred to in the preceding paragraph shall include various professional courses, computerized auditing, and basic legal knowledge.
The number of hours required for the continuing training under paragraph 1 shall be as publicly announced by the FSC.

An enterprise shall file with the SITCA, in the format required by the FSC, the names, ages, educational background, work experience, years of service, and professional training of its internal auditors by the end of January each year.

An enterprise shall, in the format required by the FSC, file with the SITCA its next fiscal year's annual audit plan by the end of each fiscal year and a report on the implementation of its previous fiscal year's annual audit plan within two months from the end of each fiscal year; additionally, it shall report to the SITCA the status of corrections of any irregularities identified during the previous fiscal year's internal auditing within five months from the end of each fiscal year.
After the SITCA has reviewed the matters reported under the preceding paragraph, it shall compile information on all irregularities and send it to the FSC.

The purpose of self-inspection by an enterprise of its internal control system is to implement a self-monitoring mechanism and adapt to changes in the environment in a timely manner, so as to adjust the design of the internal control system and enhance the internal audit department's inspection quality and efficiency. The inspection scope shall include the design and operation of all aspects of the internal control system.
Before carrying out the inspection referred to in the preceding paragraph, an enterprise shall set out in its internal control system the procedures and methods for self-inspection operations.
An enterprise shall, based on the results of the risk assessment, determine the procedures and methods for self-inspection operations referred to in the preceding paragraph, which shall at least include the following:
1. Determining which controls should be tested.
2. Determining the business units to include in the self-inspection.
3. Evaluating the design effectiveness of controls.
4. Evaluating the operating effectiveness of controls.

When conducting self-inspections of its internal control system, an enterprise shall, except as otherwise required by the FSC, first arrange for self-inspections by all internal departments and subsidiaries on an at least annual basis, have its internal audit unit review each unit's self-inspection report, and submit the self-inspection reports, together with the reports on the correction of deficiencies and irregularities of the internal control system identified by the audit unit, as a primary basis for the board of directors and general manager to evaluate the overall effectiveness of the enterprise's internal control system and to produce a Statement on Internal Control.
The self-inspections under the preceding paragraph shall be recorded in working papers that shall be preserved, together with the self-inspection reports and relevant materials, for no less than five years.

An enterprise's findings in its self-inspection of the internal control system shall classify the system as either "effective internal control system" or "materially deficient internal control system" based on whether or not the system provides reasonable assurance regarding the following:
1. That the board of directors and the general manager know the degree to which the objective of effectiveness and efficiency of operations has been achieved.
2. That financial reporting is reliable.
3. That applicable acts and regulations have been complied with.

An enterprise shall conduct annual self-inspection of the design and operating effectiveness of its internal control system, and prepare a Statement on Internal Control in the format required by the FSC, and submit it to the FSC for recordation within three months from the end of each fiscal year.
Where an enterprise has established an audit committee in accordance with the Securities and Exchange Act, the design and operating effectiveness of the internal control system as referred to in the preceding paragraph shall be subject to the consent of one-half or more of the entire membership of the audit committee, and the provisions of paragraphs 4 and 5 of Article 4 shall apply mutatis mutandis.
The Statement on Internal Control referred to in paragraph 1, and any amendments to the Statement, shall first be passed by the board of directors.
The Statement on Internal Control referred to in paragraph 1 shall be publicly announced and reported through a website designated by the FSC; it is not necessary to further submit the written materials to the FSC for recordation.
The Statement on Internal Control referred to in paragraph 1 shall be included in the enterprise's prospectus or private placement memoranda.

Articles 25 through 36 of the Regulations Governing Establishment of Internal Control Systems by Public Companies shall apply mutatis mutandis where a CPA is engaged by an enterprise to conduct a special audit of its internal control system.

The FSC may, after considering the size and business nature of an enterprise, order it to establish a unit in a direct reporting line to the board of directors or to the general manager, to be charged with the planning, management and execution of a compliance system.
The board of directors shall designate a member of the senior management as the chief compliance officer, to be responsible for overseeing compliance matters and submitting a report to the board of directors and to each and all supervisors at least semi-annually.
The information on the compliance officer described in the preceding paragraph shall be filed with the FSC for recordation, specifying the reason for the designation and annexing the minutes of the board of directors meeting, within five days from the date of passage by the board of directors.

A unit responsible for legal and regulatory compliance shall carry out the following activities:
1. Establish clear and adequate systems of advocacy of laws and regulations, consultation, coordination, and communication.
2. Ensure that procedural and managerial bylaws are updated in a timely manner in response to applicable laws and regulations, so that operations are in compliance with all laws and regulations.
3. Formulate the content of and procedures for assessing compliance with laws and regulations and monitor the periodic self-assessment of the implementation thereof by each unit.
4. Administer adequate and proper legal training on laws and regulations to personnel of each unit.
5. Carry out such other activities as may be required by the FSC.
Self-assessment of compliance with laws and regulations shall be performed no less frequently than annually, with the results delivered to the compliance unit for future reference. The head of a unit shall designate a person responsible for performing self-assessment within that unit.
Working papers and materials in connection with the self-assessment under the preceding paragraph shall be preserved for no less than five years.

An internal audit unit shall incorporate the implementation status of the compliance system into its audit of the business and management units.