Internal audit organization structure

1. CTBC Holding has established an internal audit unit directly under the Board of Directors. In addition, it has designated a Chief Auditor to manage all audit-related business in a detached, independent, and impartial manner. Under the system, all audit business is reported to the Board of Directors and the Audit Committee at least once every six months.
2. The Chief Auditor and auditors are charged with supervising and executing the audit business of CTBC Holding and its subsidiaries.
3. According to CTBC Holding’s Internal Audit Procedure, the appointment, dismissal, promotion, reward/discipline, rotation, and performance review of personnel in the internal audit unit shall become effective upon being reported by the Chief Auditor to the Chairman of the Board.

Internal audit function

1. The internal audit unit conducts routine business audits of CTBC Holding at least once every year. It also completes target audits of the Company and its subsidiaries’ finances, risk management, and compliance with applicable acts and regulations at least once every six months. All internal audit reports are delivered to the Audit Committee for review and, to the competent authority in accordance with applicable regulatory requirements.
2. The unit’s reports on its routine business audits of CTBC Holding disclose the following information at a minimum:
   1. Audit scope; summary commentary; financial status; capital adequacy; operation performance; asset quality; management of shares; management of the operation of the Board of Directors and Audit Committee; compliance with major acts, rules, and regulations; internal controls; interested party transactions; control and internal management of all business tasks; protection and management of customers’ data; information management; management of customer data confidentiality; protective measures for consumers and investors and the results of self-inspection; and the evaluation of above matters.
   2. Opinions on any major legal errors or faults in all departments, and suggestions of disciplinary action for employees who fail to fulfill their duties.
   3. Feedback provided or faults identified by the financial examination agency, accountants, the internal audit unit, or department self-assessments, and the progress status of items determined by the internal control statement as requiring further improvement.
3. The internal audit unit conducts constant follow-up reviews for all examination opinions and audit deficiencies presented by the financial examination authority, CPA, or internal audit unit, and for matters specified in the internal control system statement as requiring enhanced improvement efforts. Furthermore, a written report detailing the implementation of measures to improve deficiencies is submitted to the Board of Directors, with a copy also provided to the Audit Committee. These reports serve as crucial considerations in the performance evaluation of each department.
4. The internal audit unit periodically reviews the documents submitted by CTBC Holding’s subsidiaries, such as board meeting minutes, CPA audit reports, and examination reports issued by financial examination agencies. For subsidiaries with their own internal audit units, the CTBC Holding unit also reviews their audit plans and reports on significant deficiencies identified in internal audit reports and the status of improvements thereof. The unit also monitors the implementation of improvements by each subsidiary.
5. The Chief Auditor of CTBC Holding is, if deem necessary, permitted to dispatch the internal auditors of any subsidiary to conduct an internal audit of CTBC Holding or a subsidiary, and to evaluate the efficacy of the internal audit activities of a subsidiary annually. After having reported to the Board of Directors, the Chief Auditor may also send the evaluation results to the relevant subsidiary’s own Board of Directors for its reference in personnel evaluations.
6. The internal audit unit is also charged with ensuring that all of CTBC’s internal departments and subsidiaries carry out self-inspections, and with reviewing self-inspection reports regarding the internal control system. Such self-inspection, together with the reports on the correction of any deficiencies or irregularities discovered in the internal control system by the internal audit unit, serve as a basis for the Board of Directors, President, Chief Auditor, and Chief Compliance Officer to evaluate the overall efficacy of the internal control system and to issue internal control system statements.
7. Other important audit activities include:
   1. Participating in drafting CTBC Holding policies and procedures and assessing the effectiveness of the internal control system.
   2. Proposing changes to audit-related regulations.
   3. Participating in domestic and international audit-related business seminars in order to gain industry-leading auditing knowledge and techniques for further development and application.
   4. Continuing to improve audit programs, workflows, and skills, as well as actively developing computer-assisted audit tools to enhance the effectiveness of auditing work.
   5. Continuing to strengthen individual auditors' skills based on the classification of respective audit functions and issuing assignments in accordance with individuals' specializations.

Reporting and communication of the Chief Auditor with the Board of Directors, Audit Committee, and independent directors

The Chief Auditor of CTBC Holding reports to the Company’s independent directors, Audit Committee, and Board of Directors as follows, in accordance with the law and internal audit procedures:

1. Attending meetings and reporting to the Audit Committee and the Board of Directors. (According to the Regulations Governing Establishment of Internal Control Systems by Public Companies)
2. Holding panel discussions every six months with independent directors and general directors regarding internal control system deficiencies, with a record of the discussions submitted to the Board of Directors. (According to the Corporate Governance Best Practice Principles for Financial Holding Companies)
3. Reporting every six months to the independent directors, Audit Committee, and Board of Directors on the recommendations or deficiencies discovered by financial examination authorities, accountants, internal audit units, and self-inspections of other internal units as well as on the corrective actions listed in the internal control statement. The Chief Auditor also reports other significant matters, if any, on a case-by-case basis. (According to the Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries)
4. Following up on the requirements and suggestions of the independent directors, Audit Committee, and Board of Directors to internal audit within the specific time frame.

• Internal Control Statement 2025
  PDF
• Internal Control Statement 2024
  PDF
• Internal Control Statement 2023
  PDF
• Internal Control Statement 2022
  PDF
• Internal Control Statement 2021
  PDF
• Internal Control Statement 2020
  PDF
• Internal Control Statement 2019
  PDF
• Internal Control Statement 2018
  PDF
• Internal Control Statement 2017
  PDF
• Internal Control Statement 2016
  PDF
• Internal Control Statement 2015
  PDF
• Internal Control Statement 2014
  PDF
• Internal Control Statement 2013
  PDF
• Internal Control Statement 2012
  PDF
• Internal Control Statement 2011
  PDF