1. Operation of Internal Audit

Aside from conducting annual audits mandated by governmental regulations, the audit staff evaluates operational risks and develops the annual audit plan for the coming year with details listed. The plan is implemented upon the approval of the Audit Committee and the Board. After the audit, the audit unit discusses deficiencies and unusual occurrences with the audited unit, which is required to propose improvement measures and monitored until the shortcomings are addressed.

The audit report, once completed, is forwarded to independent Board members for review prior to the end of the subsequent month. Quarterly progress reports on improvements made are presented to the Audit Committee and the Board for review. Major violations or potential damages to the Company are reported immediately to the President of each Business, the Audit Committee and the Board.

2. 2025 Implementation

FENC conducted 52 audit projects in 2025 and identified minor internal control risks. The majority of the improvement projects have been completed. As of the end of December 2025, deficiencies identified in 2 audit projects remained outstanding with improvement measures in progress.

3. 2025 Priority Tasks

• Internal Control Self-Evaluation
  A total of 56 subsidiaries on the consolidated statement self-evaluate the internal control practice through an electronic management platform to optimize the flow, efficiency, consistency and transparency of the internal audit operation at all FENC units and subsidiaries. Once reviewed by the audit units, results, deficiencies identified and improvement progress are presented to the Board and Presidents as the basis for evaluating the effectiveness of the internal control system and issuing the Internal Control System Statement. The outcome is also disclosed in the FENC Annual Report and on the Market Observation Post System as a means of showing FENC’s resolve to implement effective internal control.
• Auditing With Digital Tools
  Implementing digital internal audit is an ongoing task for the audit unit. Specific approaches include optimizing the data platform and introducing dashboard analytics to strengthen risk warning mechanisms and maximize the benefits of corporate governance. Key projects include:

1. Increasing the level of audit automation: Internal and external information are integrated through data concatenation technologies to provide continuous monitoring of complex transaction cycles, and repetitive tasks are replaced with process automation, releasing audit capacity for in-depth analysis on high-risk cases and improving operational accuracy and efficiency.
2. Establishing a monitoring system for critical risks: A data-driven monitoring system has been established to target operating assets and the Investment Business, two major risk areas. The system generates structured asset operation data using advanced analytics and flag anomalies in real time through visualized indicators. Another capability is the systematic integration of financial supervisory information from subsidiaries to track operational health over the long term. Monitoring indicators across multiple dimensions enables the management to promptly identify and assess potential risks and issue early warning for asset preservation and governance purposes.
3. Optimizing the audit control platform: The audit operation management system has undergone a complete upgrade to improve transparency when providing updates of audit projects while ensuring information security and clear division of responsibilities. Systematic tracking is built in to accelerate, monitor and ensure internal audit improvement with effectiveness.

4.Subsidiary Supervision

FENC conducts regular reviews over subsidiary operations and management, examining documents such as the financial report, inventory status and credit recovery. When anomalies are detected, the subsidiary is notified in the form of a work report to facilitate immediate adjustments and improvements.

5.Training for Audit Personnel

Each year, the audit staff undergo internal audit training held by organizations certified by the Financial Supervisory Commission and complete the hours in accordance with regulatory requirements. They are also required to attend training and seminars from internal and external sources such as consulting firms or academic institutions. In addition, staff take part in the annual meeting of the Institute of Internal Auditors-Chinese Taiwan to polish their professional skills and knowledge of risk control. Before the end of each January, the Company files the names of internal auditors and the training they have received on the Market Observation Post System.
 

Internal Audit Organization and Internal Control Approaches