These Regulations are adopted pursuant to Article 42, paragraph 3, of the Trust Enterprise Act (the "Act").

The purposes of the internal control system of a trust enterprise are to promote its sound operations, to ensure the reliability and integrity of accounting information, to enhance the efficiency of operations, and to ensure compliance with laws, regulations, and management policies, for the purpose of achieving expected goals.
The purposes of the internal audit system of a trust enterprise are to investigate and assess whether the internal control system is effectively operating, to measure the efficiency of business operations, and to provide timely recommendations for improvement, for the purposes of ensuring the sustained operation of the internal control system and assisting the board of directors and management in the effective discharge of their duties.

The internal control system of a trust company shall cover its internal functions and such procedures and rules as necessary for all business activities, including setting out various organizational charters or corporate bylaws, and various procedural manuals based on internal check-and-balance principles.
The organizational charters or corporate bylaws under the preceding paragraph shall at least include rules for segregation of duties among the board of directors, chairperson, and management, and rules for delegation of responsibilities to departments at all levels.
The Trust Association shall provide a template for the procedural manuals under paragraph 1, with the content broken down by business flow, accounting flow, computer operations guidelines, personnel administration system, and others. All trust companies shall refer to the template when creating their own procedural manuals and shall make regular revisions to adapt to any changes in statutory and regulatory requirements, lines of business, and procedural flows.

A trust company shall map out the organization, staffing, and functions for internal audits and prepare internal audit manuals that shall include at least the following content:
1.Organization and staffing of the internal unit.
2.Types, methodologies, and procedures of audit work.
3.Rules and procedural flows for all aspects of the internal control system and rules for the assessment of the effectiveness of its operation.
4.Methods for improvement measures taken by audited units in response to audit opinions.
5.Specifics of audit items, times, procedures (methods), the authorizing provisions of laws, regulations, and bylaws, and worksheets and working papers to be used.

A trust company shall set up an audit unit reporting directly to the board of directors and establish the position of auditor general who shall oversee audit affairs in a spirit of independence and impartiality. The audit unit shall report to the board of directors and the supervisors on a regular basis.
The auditor general shall meet the requirements set out in the Regulations Governing Required Qualifications for Responsible Persons and Required Trust Expertise or Experience for Operating and Managerial Personnel of Trust Enterprises promulgated under the Act; this position shall be equivalent in rank to that of an assistant general manager, and the auditor general may not concurrently serve in another position that might conflict with or otherwise impede audit work.
The auditor general and audit unit of the trust company shall be responsible jointly and severally for any major malpractice arising from poor internal management, inadequate operation of the internal audit system, or concealment of audit results by the audit unit.

A trust company shall prepare an internal audit report after completing audit work. The content of the report shall at least include the scope of the audited sample, and the asset quality, business performance, management of computer operations, compliance with major business operations-related laws and regulations, and status of operation of internal controls, of the business units.
The trust company shall create basic self-audit formats, formulated based on the procedural manuals set out in Article 3, and provide them to all units for their implementation of self-audit work and preparation of self-audit reports.
The trust company shall keep internal audit reports, self-audit reports, and the corresponding working papers on file for reference for not less than five years.

A trust company shall realistically establish an internal control system. The general manager shall join the auditor general in carefully assessing the operational status of the internal control system, and shall issue a statement after conducting a self-assessment of compliance with applicable laws and regulations and the principles of sound operations, and submit the same to the Ministry of Finance (MOF) for recordation at the end of each business year, together with the business reports and the financial reports required by Article 39 of the Act.
When carrying out internal audits, an audit unit shall assess the internal control system and its operational status and make records.
Paragraph 1 does not apply to a trust company which is taken over by the competent authority pursuant to laws.

A trust company shall, according to its business volume and number of business units, staff competent auditors in an appropriate number; the staffed auditors shall include computer auditors.

The audit unit of a trust company shall conduct a routine audit and a special audit at least annually on the company's business units, information units, and financial custody units, and a special audit at least annually on other management units.

An auditor of a trust company shall meet any one of the following qualification requirements:
1.Have graduated from a junior college, college, or university or passed a senior civil service examination or an examination equivalent to a senior civil service examination, or have not less than six years of experience in financial operations or not less than two years of experience in financial examination.
2.A person is deemed as meeting such a requirement if he or she has worked full-time as an accountant, or as a programmer or system analyst in a computer software company, and has received not less than three months of training in financial operations and administration, and if the aforesaid training session and the full-time employment in total reach three years, provided that the number of auditors meeting the qualification requirement in this way may not exceed one-third of the total number of auditors.
An auditor shall be free of any record of a demerit or more severe penalty in the past three years. This restriction shall not apply, however, where the demerit record was a result of joint and several disciplinary action due to a violation or offense of a colleague, and where the demerit has been offset by other merits.
An auditor serving as lead auditor shall have not less than two years of experience in auditing or financial examination, or have not less than one year of experience in auditing plus not less than five years of experience in financial examination.

A trust company shall adopt a self-audit training program to give appropriate training to personnel performing self-audits, and the audit unit shall regularly assess the performance of self-audits.
Newly assigned auditors in an audit unit of a trust company shall attend audit-related training sessions held by the Trust Association or by a professional training institute recognized thereby and pass an examination for that purpose and obtain a certificate of completion. Auditors other than department chiefs and deputy department chiefs shall also annually attend the following training held by either of the above-mentioned institutions:
1.Auditors shall attend professional training related to trust or banking operations held by either of the above-mentioned institutions for not less than 30 hours every year.
2.Lead auditors shall attend professional training related to trust or banking operations held by either of the above-mentioned institutions for not less than 18 hours every year.

Positions at the junior manager level or higher in a trust company's business unit shall be assigned in priority to persons with work experience in an audit unit; if a person to be assigned to such a position has no audit experience and has never attended any auditor's training, he or she shall, within one year after being assigned to that position and for not less than 60 hours, attend auditor-related training sessions held by the Trust Association or by a professional training institute recognized thereby and obtain a certificate of completion.

A trust company shall have its audit and information units participate when formulating any procedural and managerial guidelines. The same shall apply when any amendment is made thereto.

The audit unit of a trust company shall on a regular basis submit a written report to the board of directors and supervisors for review and deliberation, and keep records of, any opinions issued or problems identified by the financial supervisory agency, financial examination institution, Trust Association, certified public accountant, supervisors, individual company unit conducting a self-audit, and the audit unit itself, as well as on the status of related corrective measures.

When appointing an auditor, a trust company shall submit to the MOF for recordation the information on his or her qualifications and experience and training records (format per attachment). It shall also compile and submit to the MOF at the end of every year a name list of its internal auditors with their qualifications and experience and their training records.

Attachment
[insert full company name] Auditors Name List

Filing date:

Name Title Birth Date Merit/Demerit (specifying date and whether a joint disciplinary action) Highest Education Level Achieved Hire Date Date Assigned to Current Position Qualifications Training Information (Training Institution and Period) Remarks
National ID No. Title Period






Department supervisor: Completed by: Contact telephone:

The MOF may at any time order a trust company to adjust the duties of any auditors not meeting the qualification requirements set out herein or otherwise unqualified for their position.

Where a major deficiency arises within a trust company as a result of unsatisfactory implementation of internal audits, or where a trust company fails to make improvement upon an official reprimand by the MOF, the MOF may impose a sanction under Article 44 of the Act or otherwise impose restrictions on the company's establishment of new branch units, addition of new business lines, or applications for other matters.

The auditor general or any auditor in a trust company may directly submit a report to the MOF if any of his or her recommendations for improvement regarding the internal control system is not accepted by management, where the company or any trustor or beneficiary might incur a material loss as a result, or otherwise if he or she identifies any violation of a law or regulation.

Except as otherwise provided in another law or regulation, the provisions of these Regulations shall apply to a bank concurrently engaged in trust business.

These Regulations shall enter in to force from the date of promulgation.