1. Legal basis

These Directions are set forth in accordance with Paragraph 2, Article 26 of the Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries to enhance the effectiveness of banks’ internal audits.

2. Assessment method and frequency

(1)     Assessment will be conducted mainly through onsite inspection and by reviewing the internal audit reports submitted by banks through the designated reporting system.

(2)     The assessment will be conducted once every two years in principle.

(3)     An internal audit assessment board is set up by the competent authority to review and adjust the standard and the consistency of scoring the bank’s performance across assessment items.

3. Assessment items

(1)  Internal audit organization and system

A.  Manpower allocation and professionalism

Manpower of internal audit unit and personnel qualifications and training.

B.   Independence

                            i.  Independence of internal audit unit system.

                         ii.  Operation of the internal audit unit.

C.  Internal reporting mechanism

The delivery and comprehensiveness of internal audit reports.

(2)  The performance of internal audit

A.  Scope and depth of internal audit

                            i.  Internal audit approach and procedure.

                         ii.  The frequency and the execution of internal audit conducted.

B.  The comprehensiveness of internal audit results

i. The content of internal audit reports and appropriateness of audit trail saved.

ii. The execution degree of internal audit work performed on the tasks required by the competent authority.

                        iii.  The execution of self-inspection.

(3)   Internal audit management

A.  The supervision of overseas branches and subsidiaries

                     i.  The supervision and management of overseas branch’s internal audit.

                   ii.  The management of overseas branch’s outsourced internal audit operation.

                 iii.  The supervision and management of overseas subsidiary bank’s internal audit.

                   iv.  The supervision and management of subsidiary’s internal audit.

B.  The follow-up of findings uncovered

  i.    The internal audit unit’s follow-up of findings uncovered by financial examination authorities.

  ii.  The internal audit unit’s evaluation of the other business units’ performance.

             iii.  The filing of internal audit information.

C.  The reporting mechanism

The reporting of suspected fraud or significant contingent events and the subsequent actions taken.

D. Quality assessment (applicable to banks that adopt risk-based approach internal audit system)

The establishment and implementation of internal audit quality evaluation mechanism.

(4) The degree of the internal audit’s contribution to financial examinations conducted by the competent authority.

The internal audit unit provides information and plays an active communication role in the competent authority’s examination on behalf of the bank.

(5)  Other items

Opinions on internal control system offered by the internal audit unit are adopted.

(6)  Significant and subsequent events

In the event there are major incidents not included in the aforementioned assessment items or occurring after the competent authority has conducted a financial examination that may affect the effectiveness of internal audit system, scores would be deducted while assessing the internal audit unit in view of the severity of such major incidents.

4. Scoring criteria

Each assessment item is assigned a different score based on its materiality. The scoring is done by adding (deducting) 0.5 ~ 3 points to the base score of the item in view of internal audit unit’s performance.

5. The handling of assessment results

(1)   The competent authority would host an internal audit forum for banks to publicize the assessment results.

(2)   The competent authority would timely commend banks that perform well in the internal audit function assessment or have outstanding performance in internal audit.

The competent authority would also require banks to reward meritorious internal audit unit personnel.

(3)   The competent authority will meet with a bank’s chairman and require the chairman to oversee the remedial actions and evaluate the capability of the bank’s chief auditor if the bank performs poorly in the internal audit function assessment and doesn’t correct fully examination deficiencies uncovered by the competent authority’s financial examination.

(4)   The assessment results would be used as reference in competent authority’s decision to adjust examination frequency and financial supervision.