A pubic company shall specify in its internal control systems the penalties for violations of these Regulations or its internal control system rules by managers and relevant personnel.
A public company shall from time to time check whether there is any violation of the provisions of Article 11, paragraph 1, concerning "qualified" and "full-time," or any of the circumstances set out in Article 16, paragraph 2, by its internal auditors; and shall, upon discovery of any violation, adjust the position of such auditor within 1 month from the date of discovery.
When reporting basic information of internal auditors pursuant to Article 18, a public company shall check whether or not the internal auditors have met the requirements under Article 17, paragraph 1. If not, the auditor shall take corrective measures within 1 month; otherwise, the public company shall promptly adjust the auditor's position.

Under any of the following circumstances, the FSC may order a public company to make improvements within a prescribed time limit, or, where necessary, to retain CPAs to conduct a special audit of its internal control system and submit an audit report to the FSC for recordation:
1. Failure to set out its internal control system in writing.
2. Failure to appoint an appropriate number of qualified personnel as full-time internal auditors.
3. Failure to file a report within a prescribed time limit or fail to faithfully execute its annual audit plan.
4. Failure to file a report on the implementation of its annual audit plan within the prescribed time limit.
5. Failure to file a report on the correction of any defect or irregularity of the internal control systems discovered in an audit.
6. Failure to conduct self-assessment of its internal control systems as required or to prepare an Internal Control System Statement.
7. Serious instance of failure to correct a defect of the internal control system in accordance with the internal control recommendations issued by the CPAs.
8. Serious instance of false external financial reporting or violation of a law, regulation, or bylaw.
9. Any material malpractice or suspicion of malpractice.
10. Other condition where the FSC deems a special audit to be necessary.

A public company is advised to adopt appropriate risk management policies and procedures, and establish effective risk management mechanisms, to assess and monitor its risk-bearing capacity, and the current status of risk already incurred, and to determine its compliance with the risk response strategies and risk management procedures.

If a public company has established an audit committee, the provisions of Article 4, paragraph 1, Article 6, paragraph 1, subparagraphs 1 and 5, Article 15, paragraphs 1 and 2, Article 16, paragraph 1, and Article 39, paragraph 1, subparagraph 1 of these Regulations that govern supervisors shall apply mutatis mutandis to the audit committee.

The FSC shall separately prescribe the formats under these Regulations.

These Regulations shall come into force from 1 January 2015.
The amendments to these Regulations shall be enforced from the date of issuance, with the exception of the articles amended on 15 December 2022, which shall come into force from 1 January 2023, and Article 8, paragraph 4 and Article 13, paragraph 5 amended on 22 April 2024, which shall come into force from 1 January 2025.