Search Result

Article Content

 
Charpter I The Internal Control System
1     These Rules are promulgated by the Securities and Futures Commission ("this Commission") of Ministry of Finance to cause a Public Company to establish the internal control system and execute such system exactly based on the purposes to strengthen the operation of the company, to develop the national economy and to safeguard investments.
2     These Rules shall apply to all of the public companies except for the securities, futures, banking and insurance enterprises which shall be governed by other rules if there are different rules promulgated by the government authority in charge of the enterprise concerned.
3     The internal control system under these Rules means the management procedure which is designed by the management level of a Public Company, and executed by the board of directors, management level and other staffs to reasonably ensure the achievement of the following aims:
  1. The effect and the efficiency of the business operation.
  2. The reliability of financial reports.
  3. The compliance relevant laws and regulations.
    The aim of effect and efficiency of business operation stated in the above Paragraph includes the aims of profit, achievement and protection of asset security.
4     The internal control may be divided into the following three groups according to the aims of internal control system designed by the management level of public company:
  1. The internal control with regard to the effect and efficiency of business operation.
  2. The internal control with regard to the reliability of the financial reports.
  3. The internal control with regard to the compliance of relevant laws and regulations.
    Certain control operation may achieve more than one aim and, therefore, may be subjected to more than one group of internal control.
5     The internal control includes the following elements:
  1. Control environment - The control environment means synthetic elements which create the culture of organization and affect the control consciousness of employees. The control environment is the basis for other elements. The elements which affect the control environment include the integrity, value and ability of employees; the management philosophy and style of management level; the way to hire, train and organize the employees and arrangement of the work; the oversight and direction of the board of directors and supervisors.
  2. Evaluation of risk - The evaluation of risk means the procedure which company clarifies the inside and outside reasons on why the aims cannot be achieved, and evaluate the degree and possibility of the impact. The result of the evaluation can be used to help the company to design the necessary control operation.
  3. Control operation - The control operation means the policy and procedure which help the management level to assure that the instructions have been executed, which include the approval, document inspection, adjustment, double check, periodical count of the products, check of the records, the arrangement of the work, the protection of the asset security, and the comparison with the plan, budget and previous achievement, etc.
  4. Information and communication - The information means the object, which the information system recognizes, evaluates, handles and reports, including financial and non-financial information with regard to the aims of business operation, financial report or compliance of laws and regulations. The communication means to inform the information to relevant personnel, including the communication inside or outside the company. The internal control must produce the information necessary for plan and supervision, and enable the information inquirers to obtain the information timely.
  5. Supervision - The supervision means the procedure to evaluate the quality of internal control, including to evaluate whether the control environment is good or not, the evaluation of risk is timely and exact or not, the control operation is proper and exact or not, the information and communication system is good or not, etc. The supervision can be divided into consistent supervision and individual evaluation. The former means the routine supervision in the business operation, the latter means the evaluation by other personnel including the internal auditor or management level.
    A Public Company shall consider the above listed elements while designing the internal control system, and shall add additonal items according to their real need if the items to be evaluated (Attachment 1) cannot cover the important elements which have not been covered.
6     The effective internal control system means the board of directors and management level can reasonably assure the following events:
  1. The board of directors and management level realize the effect of business operation and the degree of the achievement of efficiency.
  2. The financial reports are reliable.
  3. The relevant laws/regulations have been complied.
    The gross defect of the internal control system means the achievement of any group of elements listed in Article 5 cannot be reasonably assured.
7     The companies applying for initial public offering shall, within three months after the approval, promulgate the internal control system in writing, including the rules governing the implementation of the internal audit, and report to the next board of directors meeting. The same procedure shall be applied to the amendment of such system.
8     The internal control system promulgated by a Public Company may be divided by the types of trade circle according to the characteristics of enterprises ( to use the manufacturing industry as example) and shall include at least the following control operation for the trade circle:
  1. The sale and receipt circle: This circle includes the acquisition of customer orders, the management for the offer of credit, the transportation of goods, the issuance of invoices, the recording of income and account receivable, the issuance of bills, the execution and recording of cash income, etc.
  2. The purchase and payment circle: This circle includes the purchase of goods, materials, assets and labors; to handle the purchase listing, to receive the goods, to examine the quality, to fill the examination report or to handle the returned goods, to record the debts of the suppliers, to approve the payment, to execute and record the cash payment, etc.
  3. The production circle: This circle includes to make the production plans, to issue the list of materials for production, to store the materials, to produce, to calculate the costs for storage and production, to calculate the cost for sale of goods, etc.
  4. The labor and wage circle: This circle includes the employment, vacations, overtime, dismissal, training, retirement, the decision of the rate for the wage, the calculation of working time, the calculation of the gross amount of wage, the calculation of the tax for the wage and the amount withheld by the employers, the establishment of wage record, the compiling and delivery of the checks for wage.
  5. The loan circle: This circle includes the delegation of power, the execution, and the recording with regard to the financing, including the rights of shareholders, the dealing of stock-related affairs and loans from banks, guarantees, the acceptance of checks, the lease, the issuance of corporate bonds, etc.
  6. The fixed asset circle: This circle includes the addition, disposition, maintenance, safeguard and recording of fixed assets.
  7. The investment circle: This circle includes the investment decision, trading, safekeeping and recording of securities, real estate, derivatives and other long term and short term investments, and supervision of the internal control of the invested companies of which 50% or greater of its stocks are held directly or indirectly by the public company.
    If the abovesaid company engages in the research and development of products, they can, pursuant to their need, add the research and development circle, including the control operation for the basic research, the design of products, the research of technology, the making and testing of products, the research/development information, and the recording and storage of information and documents.
9     The internal control system of a public company includes not only the control operation for every type of trade circle, but also the management for the usage of chop, the management of the usage of checks, the management of budget, the management of property, the endorsement and guarantees, the promise for debts, the management for miscellaneous items, the delegation of work and the proxy system, the amount loaned to the others and information management.
10     A public company which uses the computerized information system shall, in addition to dividing clearly the information department and users' department, include at least the following control operations in their internal control systems:
  1. The function and division of work of the information operation department.
  2. The control of system development and programming changes.
  3. The control for the compiling system.
  4. The control for the saving and reading of program and information.
  5. The control for the input and output of information.
  6. The control for the management of data.
  7. The safety control for the files and equipment.
  8. The control for the purchase, usage, and maintenance of hardware and system software.
  9. The control for the system recovery project and testing procedure.
11     A company applying for initial public offering shall, within six months from the date of approval, designate the certified public accountants to do the special examination for the effectiveness of the internal control system and provide the examination report to this Commission(Attachment 2).
    If there are gross defect in the internal control system found in the examined result stated in the above Paragraph, the company shall provide the examining report to this Commission after the improvement.
    The company shall apply with this Commission to extend the deadline with reasons while the period necessary for improvement is beyond the period stipulated in the above Paragraph.
12     A Public Company shall execute exactly the internal control system, and review from time to time or evaluate by itself according to these Rules to cope with the internal or external change of the company and assure the consistent effectiveness of the design and execution of such system.
13     A Public Company which wants to apply for trading their stocks in centralized securities exchange market ("Listing") or over-the-counter market ("OTC") shall evaluate its internal control system by itself and if there are some defects improve as soon as possible.
    The above said company shall prepare the internal control statement (Attachment 3) while it applies for trading their stocks in the Stock Exchange or OTC market. Except for the stocks which shall be reported before trading, it shall appoint certified public accountant to do special audit, and submit the audit report with application documents to Taiwan Stock Exchange Corporation or ROC Over-The-Counter Securities Exchange for examination.
    The internal control statement and audit report prepared by certified public accountant (Attachment 4) shall be published in the prospectus for the Listing or OTC Listing of securities.
Charpter II The Internal Auditing Operation
14     The goal of internal audit stated in Article 5 is to examine and evaluate the defect of internal control, to estimate the efficiency of business operation and to provide timely suggestion for improvement to assure the system can be implemented consistently and effectively, and help the board of directors and management level to perform their responsibilities exactly.
15     The rules governing the internal audit for a Public Company shall include at least the following items:
  1. To examine and evaluate the internal control system to estimate the effectiveness and the degree of compliance with existing policy and procedure, and the impact to individual business activities.
  2. To establish the items, time, procedure (method) of audit.
16     The internal auditor of a Public Company shall be independent and implement his work exactly with the objective and fair attitude.
17     The internal auditor of a Public Company shall attend the seminars on internal auditing held by the institutes recommended by this Commission, the professional institution or the company itself to enhance the quality and ability of the audit.
18     A Public Company shall establish an internal audit unit directly supervised by a general manager or above personnel, and appoint competent persons and proper number of persons to be the full-time internal auditors, in view of the scope, operational condition, management needs of the company and of the relevant laws and regulations. If the full-time internal auditor appointed by the company is obviously insufficient or incompetent, this Commission may specifically supervise and guide improvements.
19     A Public Company shall submit the information regarding the names, ages, educational background, work experience, seniority and training of internal auditor to this Commission for its record before the end of every January (the form as attached list 1).
20     The appointment and dismissal of the chief internal auditor in a Public Company shall be agreed by a majority of the board of directors and shall be reported to this Commission with the reasons for the substitution, together with the minutes for the meeting of board of directors before the tenth day of next month.
21     The internal audit unit of a Public Company shall prepare an annual audit plan to examine and evaluate the internal control system of the company, including the control for the operation of budget, finance, and business, and attach the working draft and relevant information as auditing report for review.
    The Working draft and relevant information referred to in the proceeding paragraph shall be stored for at least two years; the auditing report shall be stored at least three years.
22     The auditing report made by the internal auditors of a public company shall disclose any discovered defect and abnormal situation of internal control. The discovery and suggestion stated in such report shall be monitored and the monitoring report shall be made periodically to assure the relevant departments have taken the appropriate improvement timely.
23     After the auditing report and monitoring report prepared by the internal audit department of a Public Company have been presented, they shall be submitted to the supervisors as soon as possible.
24     A listed company and OTC company shall submit to this Commission the annual audit plan for the next year before the end of every December, and the implementation status of the annual audit plan for the last year before the end of every February. (The format as attachment 2)
25     A listed company and OTC company shall report the status of improvements on defect and abnormal situation of internal control discovered through the internal audit of last year to this Commission. (The format as attachment 3).
26     A listed company and OTC company shall, in addition to submitting the auditing report and monitoring report to the supervisors according to Article 23, report to the supervisor as soon as possible regarding the annual audit plan, the implementation status, and the status of improvements on the defect and abnormal situation of internal control.
Charpter III The Self-Evaluation Operation
27     The purpose of self-evaluation stated in Article 12 is to assist the board of directors and management level of a public company to realize the effectiveness of the internal control system in order to perform their responsibilities. The scope of evaluation shall include all of the design and implementation of internal control system listed in Article 4.
28     A Public Company shall first urge every internal department to periodically review their internal control system by itself while it is evaluating its internal control system; in addition, the effect thereof shall be audited by the audit department as the basis for evaluating the effect of the whole internal control system for the company.
    The abovesaid self-evaluation shall be prepared as working draft and be kept at least 5 years together with the relevant documents.
29     A Public Company shall promulgate the procedure (method) for evaluation and submit such procedure to the board of directors while they evaluate the internal control system by itself. The same procedure shall be applied to the amendment of such procedure.
30     A public company shall consider the elements and the items to be evaluated stated in Article 5 while it evaluates the internal control system by itself. The result of evaluation will be divided into effective internal control system or the grossly defective internal control system.
31     The board of directors and management level of listed and OTC companies shall review yearly the examining result made by every department and the audit report made by the audit department, and prepare and submit the internal control statement to this Commission before the end of next April.
    The internal control statement shall be published in the annual report and prospectus according to the rules.
Charpter IV Evaluation
32     If any of the following events occurs to a public company, this Commission may order the company's appointed certified public accountant to review the internal control system of the company, and submit the review report to this Commission.
  1. The company does not prepare the written internal control system in accordance with regulations.
  2. The company does not appoint competent and sufficient persons to be the full time internal auditors.
  3. The company does not timely submit or implement exactly the annual audit plan.
  4. The company does not timely report the implementation status of the annual audit plan.
  5. The company does not timely report the status of improvements on the defect and abnormal situation of internal control system discovered during the audit.
  6. The company does not evaluate the internal control system by itself according to the rules, or does not prepare the internal control statement to be published in the annual report or prospectus.
  7. The company does not improve the defect of internal control according to the suggestion of certified public accountant and the situation is very serious.
  8. The company does not operate well, prepares false financial report or violates the laws and regulations seriously.
  9. The company materially misconducts or has been suspected of misconduct.
  10. Other situation which this Commission deems necessary to appoint special review.
33     If a Public Company did not operate pursuant to these Rules, or pursuant to "Keypoints for the Review of Internal Control System of Public Companies by Certified Public Accountants", the certified public accountant provides no reserved opinion, reserved opinion, negative opinion, or is unable to express the opinion, or the company did not improve the defect, in addition to being supervised by special project, the abovesaid situation shall be used as reference to whether this Commission will approve a Public Company to offer and issue securities.