Corporate Governance

INTERNAL AUDIT ORGANIZATION

Audit Room

Internal Audit Operations

1. Purpose of internal audit:
   The purpose of the company's internal audit is to assist the board of directors and managers to check and review the deficiencies of the internal control system and measure the effectiveness and efficiency of operations, and to provide timely improvement suggestions to ensure the continuous and effective implementation of the internal control system and to review and correct it. The basis of the internal control system.
2. Audit scope:
   The scope of execution of the Company's internal audit work includes inspecting and reviewing the effectiveness of the design and implementation of the internal control systems of various units and subsidiaries within the Company.
3. Audit objects:
   The company's audit objects include the business that each unit within the company is responsible for and all the business of subsidiaries that do not have full-time internal auditors. If the subsidiary has a full-time internal auditor, review the audit report submitted by it and track the improvement of deficiencies in its internal control system and abnormal matters.
4. Audit procedures:
   1. Before the end of each year, the company's audit office formulates an audit plan for the next year based on the risk assessment results and the instructions of the board of directors, and submits it to the board of directors for approval before implementation.
   2. The company’s audit office performs audit operations:
      1. Routine audit operations:
         Carry out various audit operations in accordance with the annual audit plan approved by the board of directors.
      2. Irregular internal audit:
         Carry out specific audit projects according to the instructions of the company's board of directors and management or the needs of projects and business.
      3. Self-inspection operations:
         Supervise all units and subsidiaries within the company to conduct self-inspections on the internal control system at least once a year, and review the self-inspection reports of each unit and subsidiaries.
   3. Submission and reporting of the company’s audit report:
      1. In addition to fully communicating with the inspected units on the results of annual audit projects, internal auditors also truthfully disclose the deficiencies and abnormalities in the internal control system discovered during the inspection in the audit report.
      2. After the audit report and follow-up report are reviewed, they will be delivered to each independent director for review at the end of the next month after the audit project is completed.
      3. When internal auditors are performing their work, if they discover major violations or the company is in danger of being seriously damaged, they should immediately prepare a report and notify the independent directors.
   4. The company tracks the implementation of improvement of deficiencies:
      The audit office will prepare follow-up reports on deficiencies and abnormalities in the internal control system discovered during the inspection at least quarterly until improvements are made to ensure that relevant units have taken appropriate improvement measures in a timely manner.
   5. Our company's external reporting operations:
      The audit office uses the Internet information system to handle various reporting and record-keeping operations in accordance with the deadlines and formats stipulated in the "Principles for Establishing Internal Control Systems for Publicly Offered Companies".

Internal Control System Self-inspection Operations

1. The company should pay attention to compliance with relevant laws and regulations and conduct self-assessment of operating procedures and methods based on risk assessment results, which should at least include the following items:
   1. Determine the control operations that should be tested.
   2. Identify the operating units that should be included in the self-assessment.
   3. Evaluate the effectiveness of various control operation designs.
2. When a company self-assesses its internal control system, it should first urge its internal units and subsidiaries to conduct self-assessments at least once a year, and then have the internal audit unit review the self-assessment reports of each unit and subsidiaries and share the findings of the audit unit. The improvement of internal control deficiencies and abnormal events will be used as the main basis for the board of directors and the general manager to evaluate the effectiveness of the overall internal control system and issue a statement on the internal control system.
3. The company should self-assess the effectiveness of the design and implementation of the internal control system every year, prepare an internal control system statement in the prescribed format, submit a resolution to the board of directors within three months after the end of the fiscal year, and make an announcement on the website designated by the Financial Supervisory Commission. , and published in the company's annual report and public prospectus.