CIRCULAR

INTRODUCING SAMPLE REGULATIONS ON INTERNAL AUDITS FOR CORPORATE USE

Pursuant to the Law on Accounting No. 88/2015/QH13 dated November 20, 2015;

Pursuant to the Government’s Decree No. 05/2019/ND-CP dated January 22, 2019 on internal audits;

Pursuant to the Government's Decree No. 87/2017/ND-CP dated July 26, 2017, defining the functions, tasks, powers and organizational structure of the Ministry of Finance;

Upon the request of the Director of the Department of Accounting and Auditing Regulations;

The Minister of Finance hereby issues the Circular introducing sample Regulations on internal audits for corporate use.

Article 1. Scope

...

...

...

Article 2. Subjects of application

1. This Circular shall apply to enterprises prescribed in Clause 1 of Article 10 in the Government’s Decree No. 05/2019/ND-CP dated January 22, 2019 on internal audits.

2. Enterprises not specified in Clause 1 of this Article are advised to develop internal audit regulations by referring to the sample internal audit regulation annexed hereto.

Article 3. Internal audit regulations

1. Internal audit regulations of enterprises must at least include those regulations set forth in Clause 1 of Article 12 in the Government’s Decree No. 05/2019/ND-CP dated January 22, 2019 on internal audits.

2. Enterprises shall refer to these sample Internal Audit Regulations annexed to this Circular to develop their own internal audit regulations, ensuring compliance with the provisions of the Government’s Decree No. 05/2019/ND-CP dated January 22, 2019 on internal audits, current legal regulations, and compatibility with their corporate organizational and operational structure.

Article 4. Implementation

1. This Circular shall enter into force from September 1, 2020.

2. In the course of implementation of this Circular, if there is any difficulty that arises, entities, organizations and individuals should promptly inform the Ministry of Finance (Department of Accounting and Auditing Regulations) for its review and further guidance./.

...

...

...

PP. MINISTER
DEPUTY MINISTER




Do Hoang Anh Tuan

Appendix

(To the Circular No. 66/2020/TT-BTC dated July 10, 2020 of the Minister of Finance, introducing sample regulations on internal audits for corporate use)

SAMPLE REGULATIONS

APPLICABLE TO ENTERPRISES

...

...

...

REGULATIONS

ON INTERNAL AUDIT

(Enterprise’s name)

...

...

...

…, day…month…year

INTERNAL AUDIT REGULATIONS

(Enterprise’s name)

(Annexed to the Resolution/Decision No…dated (day…month…year) of Governing Board/Board of Trustees/Company’s President)

CHAPTER I

...

...

...

Article 1. Scope

These Regulations provide for objectives, scope of operation, position, duties, powers and responsibilities of the internal audit at (enterprise’s name) and its relationship with other departments, even including scope and methods of provision of information necessary for that audit. The Regulations prescribe requirements concerning independence, objectivity, fundamental principles, requirements concerning professional qualification and assurance of internal audit quality and other related matters.

Article 2. Subjects of application

These Regulations shall apply to all members of an internal audit department of (enterprise’s name) and organizations and individuals within (enterprise’s name) involved in internal audit activities within the entire enterprise, including its head office, branches, representative offices.

Article 3. Interpretation

1. Internal audit refers to the examination, evaluation and supervision of the adequacy, appropriacy and efficaciousness of an internal audit.  

2. Internal audit professional/practitioner refers to a person performing internal audit tasks within a unit.

3. Internal audit head/leader refers to a person authorized by a competent authority in accordance with laws or regulations of a unit assigned to take charge of internal audit at that unit.

4. Audit committee refers to a specialized body affiliated to the Governing Board of an enterprise under the provisions of the Law on Enterprises.

...

...

...

Article 4. Objectives of an internal audit

By means of carrying out inspection, assessment and consulting activities, the internal audit may come up with independent and objective assurance and recommendations about the followings:

a) The internal audit system of a unit (enterprise’s name) that must have been established and operated in an appropriate manner in order to prevent, detect and handle risks to which (enterprise’s name) may be exposed;

b) Governance and risk management processes of (enterprise’s name) that must ensure efficiency and high performance;

c) Operational and strategic objectives, working plans and missions that (enterprise’s name) must have been fulfilled.

Article 5. Position of internal audit

1. [Describe the position of the department of internal audit within a unit]

Example: The internal audit department is established by the Governing Board/Board of Trustees/ Company’s President. Governing Board/Board of Trustees/Company’s President directly manages the internal audit department (or through the Audit Committee or an authorized subordinate body/department (if any) by the Governing Board/Board of Trustees/Company’s President.

2. Internal audit head will present an audit report to the Governing Board/Board of Trustees/Company’s President (or through the Audit Committee or a subordinate body/department (if any) authorized by the Governing Board/Board of Trustees/Company’s President).

...

...

...

4. The internal audit head shall have the right to report and communicate directly with the Governing Board/Board of Trustees/Company’s President where necessary.

5. The internal audit head will present an audit report to the Governing Board/Board of Trustees/Company’s President (or through the Audit Committee or a subordinate body/department (if any) authorized by the Governing Board/Board of Trustees/Company’s President) on objectives, rights and responsibilities as well as performance compared to those stated in the plan of the internal audit department. The report also includes significant risks and controls, risk of fraud, governance and other matters that are necessary or are requested by the Board of Directors and Governing Board/Board of Trustees/Company’s President (or the Audit Committee or a subordinate body/department (if any) authorized by the Governing Board/Board of Trustees/Company’s President).

Article 6. Scope of internal audit

1. Internal audit provides independent and objective assurance services designed to add value and improve (enterprise’s name)’s operations. The internal audit helps (enterprise’s name) accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of governance, risk management and control processes.

2. The internal audit activity includes, but is not limited to, the testing and evaluation of the adequacy and effectiveness of governance, risk management and internal control, as well as the quality of performance, in performing assigned tasks and giving complete recommendations about improvements in order to attain the objectives and purposes of an enterprise.

3. Scope of internal audit, including:

a) Providing assurance through the testing and evaluation of the adequacy and effectiveness of governance, risk management and internal controls to help (enterprise’s name) to achieve strategic, operational, compliance and financial objectives:

i. Monitoring and evaluating governance processes.

ii. Monitoring and evaluating the effectiveness of the enterprise’s risk management processes.

...

...

...

iv. Evaluating systems set up to ensure compliance with policies, plans, procedures, legislation, financial, accounting systems and regulations that may have significant effects on the enterprise.

v. Testing and attesting the quality and reliability of economic and financial information of the financial statement and executive accounting reports before submission thereof for approval.

vi. Evaluating means of protection of assets and the existence of these assets where necessary.

vii. The report also includes significant risks and controls, risk of fraud, governance and other matters that are necessary or are requested by the Board of Directors and Governing Board/Board of Trustees/Company’s President (or the Audit Committee or a subordinate body/department (if any) authorized by the Governing Board/Board of Trustees/Company’s President).

b) Making in-depth analyses and recommendations based on data assessment and processes of the enterprise:

i. Evaluating the reliability and integrity of the management information system and means by which such information is determined, measured, sorted and reported.

ii. Analyzing activities or programs to determine whether findings and results are consistent with established goals and objectives.

iii. Assessing whether activities or programs are performed according to the plan.

iv. Assessing the effectiveness and efficiency of resources used.

...

...

...

d) Conducting pre-engagement activities: These activities are performed before the implementation of the audited department’s/unit's projects, activity plans or programs, serving the purpose of assessing the reliability of information, documents, the economy, feasibility and effectiveness of these projects, activity plans and programs; may help management gain reliable information to make decisions.

e) Conducting simultaneously engaged audit activities: These activities are performed during the ongoing implementation of the audited department's/unit's activity plans and projects, aiming to evaluate the progress and quality of the activity performance process; detect and promptly recommend measures to correct deviations, shortcomings and weaknesses arising in the process of implementing projects, programs and work plans in order to ensure the best implementation of objectives of the project or plan of the audited department/unit.

f) Conducting post-engagement activities: These activities are performed after the implementation of the audited department/unit completes their project, program, and activity plan in order to carry out the contents and objectives of the financial statement, compliance and operational audit on operations of the audited department/unit.

g) Providing the enterprise with counseling for selection and control of independent audit services to ensure the economy and efficiency.

h) Periodically reporting on the purposes, authority, responsibility and performance of the internal audit department in relation to the department's plan.

i) Inspecting and evaluating specific activities as requested by the Board of Directors and the Governing Board/Board of Trustees/Company’s President (or the Audit Committee or a subordinate body/department (if any) authorized by the Governing Board/Board of Trustees/Company’s President).

k) Depending on the subject of the audit, when planning an internal audit, it is possible to combine pre-engagement, simultaneously engaged audit and post-engagement activities.

Article 7. Core principles of internal audit

1. Independence:

...

...

...

b) Internal audit practitioners shall not be allowed to get involved in auditing activities and departments/units where they assume operational or executive responsibilities over the last 3 years.  

c) Internal audit practitioners shall not be allowed to get involved in auditing activities and departments/units where their related persons assume operational or executive responsibilities.  

2. Objectivity: Internal audit practitioners must ensure the objectivity, accuracy, integrity and impartiality during the process of performing internal audit engagements.

3. Complying with laws and assume legal liability for internal audit activities.

Article 8. Standards for professional practice of internal auditing

1. The internal audit department must comply with legal regulations on internal audit, the internal audit standards and code of ethics issued or announced by the competent regulatory authority.

2. In addition, the internal audit department must comply with the relevant policies and procedures of (enterprise’s name) regarding internal audit, even including internal audit procedures that have been approved and put to use by (enterprise’s name).

Article 9. Code of ethics for internal audit

1. Integrity: Internal audit practitioners must perform audit activities in an honest and discreet manner and with a high sense of responsibility; must observe provisions of laws and declare necessary information according to regulatory and professional requirements as to internal auditing; shall be prohibited from participating in illegal acts causing harm to (enterprise’s name)’s reputation.

...

...

...

3. Professional capabilities and discretion: Internal audit practitioners must employ their internal audit knowledge, skills and professional experience in performing internal audit engagements. They must also act in a discreet manner and in conformity with professional and technical standards currently in use.

4. Confidentiality: Internal audit practitioners must respect values and ownership of provided information and shall be banned from revealing such information without permission from competent authorities, except in case disclosure of such information falls into their assigned duties or conform to requirements laid down in laws.

5. Professional conduct: Internal audit practitioners must comply with laws and relevant regulations, and must be prevented from performing any act that may reduce their professional reputation.

6. Internal audit heads must take monitoring, assessment and management measures in order to ensure that internal audit practitioners comply with the code of ethics for internal audit.

Article 10. Competencies in performing internal audit engagements

1. Internal audit heads shall, after making a review on the scale and extent of complexity of audit activities and audit engagements, submit it to the Governing Board/Board of Directors/Company’s President (or through the Audit Committee or a subordinate body/department (if any) authorized by the Governing Board/Board of Directors/Company’s President) to seek their decision on which resources are necessary to the internal audit department. Internal audit heads shall establish the appropriate standards for recruiting internal audit practitioners.

2. Internal audit heads should have relevant education/expertise and adequate audit experience. Internal audit heads should also have in-depth knowledge about business operations and other relevant skills.

3. Internal audit heads should evaluate skills and knowledge of the internal audit department for the effective performance of process audits. Where necessary, it is possible to hire independent experts/consultants. Internal audit heads shall prepare a plan to hire independent experts/consultants which will be then submitted to the Governing Board/Board of Directors/Company’s President to seek approval (or to the Audit Committee or a body/department subordinate to the Governing Board/Board of Directors/Company’s President to consult with them on such plan before seeking approval from the Governing Board/Board of Directors/Company’s President). Internal audit heads shall be responsible for internal audit activities related to results received from these experts/consultants.

4. Internal audit heads shall be responsible for internal audit activities performed by internal audit practitioners. Internal audit heads should ensure that audit objectives outlined in an approved audit plan have been met. Internal audit heads should establish a reasonable detailed plan to complete each audit engagement (from the beginning to the issuance of an audit report) after considering the nature and complexity of that audit engagement.

...

...

...

Article 11. Authority of internal audit departments

1. Actively perform tasks specified in approved audit plans.

2. Receive resources necessary to carry out their work according to the approved plans.

3. Fully and promptly receive all the necessary information, documents and records for internal audit activities.

4. Have access to and review all professional processes and assets during the process of internal audit.

5. Meet and interview all staff members of audited units to collect their opinions about issues related to the subject matters of the internal audit.

6. Receive documents, records and meeting minutes from the Governing Board/Board of Trustees/Company’s President and other subordinate departments involved in the internal audit work.

7. Attend internal meetings in accordance with laws and (enterprise’s name)’s statutes or internal rules.

[The audited unit details a number of meetings that internal auditors can attend to ensure they can duly perform their functions and duties].

...

...

...

9. Have access to protection against refusal of collaboration of audited departments/units.

10. Have access to training in improving competencies of internal audit practitioners of internal audit departments.

11. All officers, employees and management at all levels within (enterprise’s name) shall be responsible for providing adequate and timely documentation, giving explanations, fully and promptly cooperating and assisting internal audit departments in performing their roles and responsibilities.

Article 12. Responsibilities of internal audit departments

1. Protect confidentiality of records, documents and information in accordance with regulations in force and rules (enterprise’s name).

2. Bear responsibility to the Governing Board/Board of Trustees/Company’s President for internal audit results, assessments, conclusions, recommendations and proposals included in internal audit reports.

3. Promptly monitor, facilitate and inspect the results of implementation of post-audit recommendations of subordinate and affiliated departments/units of (enterprise’s name).

4. Organize regular training sessions in order to improve and assure professional competences of internal audit practitioners.

5. Assume other responsibilities prescribed by laws and internal audit rules of (enterprise’s name).

...

...

...

1. Responsibilities:

a) Carry out internal audit plans that have already been approved;

b) Identify information that is sufficient, reliable, proper and useful to accomplish audit objectives;

c) Rely on appropriate analyses and assessments in order to give independent and unbiased audit conclusions and results;

d) Store related information in order to support audit conclusions and produce audit results;

dd) Bear responsibility for results of assigned internal audits;

e) Ensure information security in accordance with laws;

g) Incessantly improve professional competencies and adhere to professional ethics;

h) Assume other responsibilities prescribed by laws and internal audit rules of (enterprise’s name).

...

...

...

a) In the process of carrying out internal audits, exercise independent rights to give their opinions, comments, assessments and recommendations about audited matters;

b) Request audited department/units to provide materials, documents and information related to audited matters in a timely and sufficient manner;

c) Retain and reserve written opinions on audit results within the scope of their assigned tasks;

d) Exercise other rights defined under laws and internal audit rules of (enterprise’s name).

Article 14. Rights and responsibilities of internal audit heads

1. Responsibilities:

a) Manage and administer internal audit departments to ensure that they perform tasks in accordance with regulations in force;

b) Ensure that internal audit staff members have access to regular training, possess necessary qualifications and competencies to perform assigned tasks;

c) Implement measures in order to ensure independence, objectivity and truthfulness of internal audits;

...

...

...

dd) Assume responsibility for results of internal audits conducted by internal audit departments;

e) Ensure information security in accordance with laws;

g) Assume other responsibilities prescribed by laws and internal audit rules of (enterprise’s name).

2. Rights and authority:

a) Petition the Governing Board/Board of Trustees/Company’s President (or through the Audit Committee or an authorized subordinate body/department (if any) by the Governing Board/Board of Trustees/Company’s President) to issue internal audit rules and procedures as well as internal audit approaches;

b) Request staff members of other departments to be summoned to get involved in internal audit activities; request hiring of experts and consultants to set up an internal audit department and take part in internal audits where necessary provided that the independence of internal audits is ensured;

c) Attend meetings in accordance with internal rules of their units and legislative regulations;

d) In the process of carrying out internal audits, exercise independent rights to give their opinions, comments, assessments and recommendations about audited matters;

dd) Request audited department/units to provide materials, documents and information related to subject matters of the internal audit in a timely and sufficient manner;

...

...

...

g) Exercise other rights defined under laws and internal audit rules of (enterprise’s name).

Article 15. Independence and objectivity of internal audits

1. The internal audit team shall not be tampered with by any factors within an organization, including those related to audit options, scope, procedures, frequency, timing or content of the reporting, in order to allow the maintenance of the necessary independent and objective mental attitude.

2. Internal audit practitioners shall not have direct operational responsibility or authority for any activity to be audited. Accordingly, internal audit practitioners shall not perform internal controls, build procedures, install systems, prepare documentation or engage in any other activity that would impair their judgments.

3. Internal audit practitioners must ultimately express their professional objectivity with respect to the collection, assessment and communication of information about audited activities and processes.   Internal audit practitioners shall make the balanced assessment of all relevant circumstances and must not be affected or controlled by personal interests of theirs or any other person's while making their judgements.

4. Internal audit heads must be committed to and confirm to the Governing Board/Board of Trustees/ Company’s President, annually, the organizational independence of the internal audit department.

CHAPTER II

INTERNAL AUDIT ACTIVITIES

Article 16. Internal audit implementation approach

...

...

...

Article 17. Internal audit plan

1. Annually, before day…month…, the internal audit department must prepare an internal audit plan for submission to the Governing Board/Board of Trustees/Company’s President to seek their approval (or to the Audit Committee or a body/department subordinate to the Governing Board/Board of Trustees/Company’s President to consult with them on such plan before seeking approval from the Governing Board/Board of Trustees/Company’s President).

2. The internal audit plan must include audit scope, subjects of audit, audit objectives, audit subject matters, audit year, audit time, audit schedule, as well as requirements concerning the budget and resources used for the next fiscal/calendar year.

3. The internal audit plan must be developed based on the priority of the risk-based approach, taking into account the comments of the Board of Directors, the Auditing Committee (or an organ/unit subordinate to the Board of Directors/Board of Trustees/Company’s President). Internal audit heads must make a comprehensive risk assessment of operations, professional processes or units/departments to plan the internal audit. Internal audit heads must review and adjust the plan if necessary in response to changes arising from business, risks, operations, programs, systems and controls of (enterprise’s name). Any significant adjustment in the approved internal audit plan must be notified to the Board of Directors, Audit Committee (or an organ/department subordinate to the Board of Directors/Board of Trustees/Company’s President), the Governing Board/Board of Trustees/Company’s President through periodic operational reports.

4. The annual internal audit plan must be approved within ... days from the date of the internal audit head’s submission of that internal audit plan to the Governing Board/Board of Trustees/Company’s President.

5. The internal audit plan must be sent to the Board of Directors, Audit Committee (or an organ/department subordinate to the Board of Directors/Board of Trustees/Company’s President), the Governing Board/Board of Trustees/Company’s President within the duration of...days from the approval date.

Article 18. Internal audit process

Internal audit head shall design a detailed internal audit process in accordance with the operational characteristics of (enterprise’s name), and consulting with the General Director/Director before submitting that process to the Audit Committee (or an organ/department subordinate to the Governing Board/Board of Trustees/Company’s President)/Governing Board/Board of Trustees / Company’s President, to put it to use.

Article 19. Reporting of auditing and inspection of implementation of recommendations

...

...

...

a) Report on each internal audit engagement shall be prepared and submitted to the Governing Board/Board of Trustees/Company’s President (or submitted through the Audit Committee (or an organ/department subordinate to the Governing Board/Board of Trustees/Company’s President) by the internal audit team leader/head of the internal audit team or the internal audit head within a maximum of .... days after completion of the audit engagement (e.g. 10 days). Internal audit report must bear the signature of the head or leader of the internal audit team or the internal audit head.

b) An internal audit report must clarify:  Subject matters, audit scope; opinions and conclusions related to audited matters and grounds for giving such opinions and conclusions; weaknesses, unresolved issues, defaults, defects, violations and recommended correction or remedial actions against errors, defects or recommended sanctions against violations; recommended measures for rationalization and improvement of operational processes; perfection of policies on management of risks and organizational structure of (enterprise’s name) (if any).

c) Internal audit report must have opinions from leaderships of audited departments/units. In case where audited departments/units have contentious opinions on audit results, internal audit reports shall need to clarify these contentious opinions and reasons therefor.

d) Internal audit report after being completed must be sent to the Governing Board/Board of Trustees/Company’s President and cc’ed to the Audit Committee (or a subordinate body/department (if any) authorized by the Governing Board/Board of Trustees/Company’s President), General Director/Director, and audited or relevant departments/units.

2. Annual internal audit reports:

a) Not later than … days from the end date of the fiscal year, the internal audit head must send an annual internal audit report to the Governing Board/Board of Trustees/Company’s President and cc it to the Audit Committee (or a subordinate body/department (if any) authorized by the Governing Board/Board of Trustees/Company’s President), and General Director/Director.

b) An annual internal audit report must include, but not limited to, the followings:

- Proposed internal audit plan; audit work that have already been completed;

- Material defects or mistakes already discovered; measures recommended by the internal audit;

...

...

...

- Situations of implementation of measures, recommendations and proposals provided by the internal audit;

- Self-assessment of internal audit achievements already attained and developmental orientations.

c) Annual internal audit reports must carry the signature of the internal audit head.

3. Abnormal audit reports:

In case where material defects are detected or high risks may adversely affect corporate operations, the internal audit department must immediately report to the Governing Board/Board of Trustees/Company’s President and cc it to the Audit Committee (or a subordinate body/department (if any) authorized by the Governing Board/Board of Trustees/Company’s President), or General Director/Director. Abnormal audit reports made in case of any issues arising in a fiscal year must include:

a) Risks that internal audit practitioners consider and pay attention to;

b) Exposure or appearance of weaknesses in the internal control system at an enterprise or department;

c) Critical findings that need response or remedial actions to be taken by the Governing Board/Board of Trustees/Company’s President, General Director/Director;

d) An abnormal report must present problems that arise or findings together with recommendations about actions to be taken,

...

...

...

4. Inspection of implementation of internal auditor’s recommendations:

a) Examining and evaluating the time and results of the work performed by the audited department/unit according to the recommendations of the internal audit.

b) Sending a report on results of inspection of implementation of internal auditor’s recommendations towards the audited department/unit to the Governing Board/Board of Trustees/Company’s President and cc’ing it to the Audit Committee (or a subordinate body/department (if any) authorized by the Governing Board/Board of Trustees/Company’s President), or General Director/Director.

Article 20. Retention and storage of internal audit records and documents

1. Engagement records and documents must exist in written form (paper or electronic) and stored with due care so that competent organizations and individuals can have access to them and understand internal audit activities and performance results included in audit reports.

2. Internal audit reports, documents and records must be stored and deposited in accordance with regulations in force of the State and (enterprise’s name).

Article 21. Assurance and improvement of quality of internal audits

1. Internal audit departments must maintain a quality assurance and improvement program that covers all aspects of an internal audit department.

2. The program is to contain an assessment of the internal audit department's compliance with the internal audit regulations and standards; an assessment of compliance with the code of ethics of the internal auditor. The program also evaluates the effectiveness and performance of the internal audit department and identifies opportunities for improvement.

...

...

...

4. The internal audit head must send the Governing Board/Board of Trustees/Company’s President and cc it to the Audit Committee (or a subordinate body/department (if any) authorized by the Governing Board/Board of Trustees/Company’s President) a report on the program for assurance and improvement of the quality of the internal audit department, including the results of annual internal audits and external audits (if any).

CHAPTER III

RESPONSIBILITIES OF PARTIES INVOLVED IN INTERNAL AUDITS

Article 22. Responsibilities of the Governing Board/Board of Trustees/Company’s President

1. Issue internal audit rules and regulations of (enterprise’s name).

2. Approve the risk-based internal audit plan and the annual internal audit report.

3. Approve the internal audit budget and resource plan.

4. Receive information about the internal audit department's performance related to the department's plans and other matters from the internal audit head.

5. Decide to carry out the appropriate requirements of the Board of Directors and the internal audit head to determine whether there is any limitation to resources or the scope is appropriate.

...

...

...

7. Decide and approve the implementation of recommendations from the internal audit; direct departments to perform internal auditor’s recommendations; take timely actions to implement internal auditor’s recommendations and suggestions.

Article 23. Responsibilities of the Audit Committee (or the subordinate body/department authorized (if any) by the Governing Board/Board of Trustees/Company’s President)

The Audit Committee (or the subordinate body/department authorized (if any) by the Governing Board/Board of Trustees/Company’s President) shall be responsible for directly directing, governing and superintending operations of the internal audit department.

1. Conduct the review, inspection and assessment to ensure the effectiveness of internal audits; take the primary responsibility for assuring the quality of internal audit activities.

2. Ensure that the internal audit holds an appropriate position and is free from any unreasonable obstacles to internal audit activities.

3. Develop, amend, supplement and regularly complete internal audit approaches and policies before submission to the Governing Board to seek their decision.

4. Ensure the effective coordination with the independent audit.

5. Implement other responsibilities under the Law on Enterprises or operational rules and regulations of the Audit Committee (or the subordinate body/department authorized (if any) by the Governing Board/Board of Trustees/ Company’s President), and internal audit regulations of (enterprise's name).

Article 24. Responsibilities of the Control Board (if any)

...

...

...

2. Implement matters prescribed under these Regulations, specifically including: [the enterprise must elaborate on this content after receipt of unanimous opinions from the Control Board].

Article 25. Responsibilities of Director General/Director

1. Provide internal audit staff with advantages to perform their assigned tasks and direct other departments to collaborate with internal audit departments in performing tasks in accordance with internal audit rules and regulations.

2. Push departments to implement recommendations agreed upon with the internal audit department or follow directions from the Governing Board/Board of Trustees/Company’s President, and inform the internal audit department of the implementation of recommendations agreed upon with the internal audit department.

3. Ensure that internal audit department is fully informed of any change and problem arising from activities of the audited unit in order to early detect associated risks.

Article 26. Responsibilities of management of departments/units within the enterprise

1. Provide internal audit staff with advantages to perform their assigned tasks and direct other departments to collaborate with internal audit departments in performing tasks in accordance with internal audit rules and regulations.

2. Push departments to implement recommendations agreed upon with the internal audit department or follow directions from the Governing Board/Board of Trustees/Company’s President, and inform the internal audit department of the implementation of recommendations agreed upon with the internal audit department.

3. Ensure that the internal audit department is fully informed of any change and problem arising from activities of the audited department/unit in order to early determine associated risks.

...

...

...

Article 27. Responsibilities of audited departments/units

1. Provide a full amount of information, materials, documents and records necessary for internal audits after receipt of the request from the internal audit department in a true and accurate manner, and avoid hiding requested information.

2. Promptly inform the internal audit department in case of detecting any error, unsolved issue, violation, risk or loss of property or risk of loss of property.

3. Implement the recommendations agreed upon with the internal audit department or under the direction of the Governing Board/Board of Trustees/Company’s President, General Director/Director.

4. Provide all favorable conditions for the internal audit department in order to ensure they perform their tasks the most effectively.

CHAPTER IV

IMPLEMENTATION PROVISIONS

Article 28. Entry into force

These Regulations shall commence on day … month … year ...

...

...

...

1. The internal audit head shall be responsible for conducting the periodic review on these Regulations and proposing any necessary amendment, supplement or replacement.

2. Amending, supplementing and replacing these Regulations shall be subject to the decision issued by the Governing Board/Board of Trustees/Company’s President.

Article 30. Implementation

Members of the Governing Board/Board of Trustees/Company’s President (including the Audit Committee or a subordinate body/department (if any) authorized by the Governing Board/Board of Trustees/Company’s President), General Director/Director, the internal audit head, organizations and individuals within (enterprise’s name) shall be responsible for implementing these Regulations.