Guanhao Biotech: Internal Audit System (March 2026)
Guanhao Biotechnology Co., Ltd.
internal audit system
Chapter 1 General Provisions
Article 1 In order to further standardize the internal audit work of Guanhao Biotechnology Co., Ltd. (hereinafter referred to as the "Company"), clarify the responsibilities of internal audit institutions and personnel, give full play to the role of internal audit in strengthening internal control, improving business management, improving economic benefits, etc., and promote the healthy, stable and sustainable development of the company, in accordance with the "Company Law" and "Audit Law" This system is formulated based on the actual conditions of the company, including the "China Internal Audit Standards", "Listed Company Governance Guidelines", "Shenzhen Stock Exchange Self-Regulatory Guidelines for Listed Companies No. 2 - Standardized Operations of GEM Listed Companies" and other relevant laws and regulations, normative documents, and the "Articles of Association".
Article 2 The term "internal audit" as mentioned in this system refers to an evaluation activity carried out by a company's internal audit institution or personnel on the effectiveness of the company's internal control and risk management, the authenticity and completeness of financial information, and the efficiency and effectiveness of business activities.
Article 3 The term "internal control" as mentioned in this system refers to the process implemented by the company's board of directors, audit committee, senior managers and all employees to achieve control objectives.
The goal of internal control is to reasonably ensure that the company's operations and management are legal and compliant, asset safety, financial reports and related information are true and complete, improve operating efficiency and effectiveness, and promote the company's development strategy.
Article 4 The internal audit work of the company's holding subsidiaries and joint-stock companies that have a significant impact on the company shall be carried out with reference to this system.
Chapter 2 Internal Audit Institutions and Personnel
Article 5 An audit committee shall be established under the company's board of directors to review the company's financial information and its disclosure, supervise and evaluate internal and external audit work and internal control.
The company has established an internal audit department to inspect and supervise the authenticity and completeness of the company's financial information, the establishment and implementation of the internal control system, etc. The internal audit department should maintain its independence and be equipped with full-time auditors. It should not be placed under the leadership of the financial department, nor should it work together with the financial department.
The Internal Audit Department independently carries out audit work under the guidance of the Audit Committee, is responsible to the Board of Directors, and reports its work to the Audit Committee. The Audit Committee participates in the evaluation of the person in charge of internal audit.
Article 6 Internal auditors should have good professional ethics and professional knowledge in accounting and audit management, be familiar with the company's business activities and internal control procedures, and maintain due professional prudence during the audit process.
When internal auditors handle audit matters and have an interest in the audited objects or audit matters, they should take the initiative to apply for recusal; they are not allowed to abuse their authority, engage in malpractice for personal gain, neglect their duties, or leak known secrets.
Article 7 The company shall provide necessary conditions for the normal development of internal audit work, and the funds required by the internal audit department to perform its duties shall be guaranteed and included in the company's budget.
The company's internal agencies, holding subsidiaries and joint-stock companies with significant influence shall cooperate with the Internal Audit Department in performing their duties in accordance with the law and shall not hinder the work of the Internal Audit Department. The auditee shall provide relevant information to the auditors in a timely manner as required, and shall not refuse, obstruct, destroy or retaliate.
Chapter 3 Main responsibilities and authorities of internal audit
Article 8 The audit committee shall perform the following main responsibilities when guiding and supervising the work of the internal audit department:
(1) Guide and supervise the establishment and implementation of the internal audit system;
(2) Review the company’s annual internal audit work plan;
(3) Supervise the implementation of the company’s internal audit plan;
(4) Guide the effective operation of the internal audit department;
(5) Report to the board of directors the progress and quality of internal audit work and major problems discovered;
(6) Coordinate the relationship between the internal audit department and external audit units such as accounting firms and national audit institutions.
Article 9 The internal audit department shall perform the following main responsibilities:
(1) Inspect and evaluate the integrity, rationality and effectiveness of the internal control systems of the company’s internal institutions, holding subsidiaries and joint-stock companies with significant influence;
(2) Audit the accounting data and other relevant economic data of the company's internal institutions, holding subsidiaries and joint-stock companies with significant influence, as well as the legality, compliance, authenticity, completeness and efficiency of the reflected financial revenues and expenditures and related economic activities;
(3) Assist in establishing and improving the anti-fraud mechanism, determine the key areas, key links and main contents of anti-fraud, and reasonably pay attention to and inspect possible fraud during the internal audit process. If any major issues or clues related to the company are discovered, they should immediately report directly to the audit committee;
(4) Report to the board of directors or audit committee at least once every quarter, including but not limited to the implementation of the internal audit plan and the problems discovered during the internal audit work and their rectification;
(5) Actively cooperate with the Audit Committee in communicating with accounting firms, national audit institutions and other external audit units, and provide necessary support and collaboration.
Article 10 Internal audit should usually cover all business aspects related to financial reporting in the company's operating activities, including but not limited to: sales and collections, procurement and payment, inventory management, fixed assets management, fund management, investment and financing management, human resources management, information system management, etc.
Article 11 The audit evidence obtained by internal auditors shall be sufficient, relevant and reliable. Internal auditors should clearly and completely record the name, source, content, time and other information of obtaining audit evidence in working papers; they should prepare and review audit working papers in accordance with relevant regulations, and after the completion of the audit project, promptly classify and archive audit working papers.
Article 12 The internal audit department shall establish a working paper system and a file management system. The management of audit files shall be implemented with reference to the company's file management, confidentiality management and other measures. Review of audit files must go through approval procedures. Internal audit work reports, working papers and related materials shall be kept for no less than 10 years.
Article 13 The Internal Audit Department shall submit the internal audit work report of the previous year, the internal control evaluation report of the previous year, and the audit work plan of this year to the Audit Committee after the end of each fiscal year. If the internal audit department discovers major deficiencies or major risks in internal control during the audit process, it shall promptly report to the board of directors or the audit committee.
Article 14 The Internal Audit Department may exercise the following powers during the audit process:
(1) Convene meetings related to audit matters, and participate in or attend meetings on the company’s production operations and financial management related to internal audit;
(2) Check accounting vouchers, accounting books, accounting statements, and information and assets related to financial revenue and expenditure;
(3) Examine the computer system operated and managed by the auditee and the relevant electronic information reflected therein;
(4) Investigate relevant units and individuals on issues related to audit matters and request written materials;
(5) For ongoing serious violations of financial disciplines, serious losses and waste, a temporary stop decision may be made with the consent of the leader in charge. If the stop is ineffective, it is recommended that the relevant departments take compulsory measures to stop;
(6) Put forward opinions on correcting and handling violations of financial disciplines and suggestions on improving management and improving efficiency;
(7) Accounting vouchers, accounting books, accounting statements and other information related to financial revenue and expenditure that may be transferred, concealed, tampered with or destroyed shall have the right to temporarily seal up with the approval of the leader in charge and the general manager;
(8) Report relevant situations to the Audit Committee of the Board of Directors.
Article 15 If the auditee or party concerned conceals facts or provides false certification, causing the audit results to be inconsistent with the facts, the company shall hold the person in charge of the auditee or party responsible responsible.
Chapter 4 Audit Procedures
Article 16 The working procedures before audit include:
(1) Determine the audit objects in accordance with the approved annual audit plan;
(2) Prepare an audit project plan and formulate a specific audit plan;
(3) Determine the list of audit leaders and auditors;
(4) Issue an "Audit Notice" and notify the auditee;
(5) The auditee shall prepare relevant materials according to the audit notice and provide necessary working conditions.
Article 17 The audit notice shall be delivered to the auditee three working days before the audit is carried out. For special business that requires surprise audit, the audit notice may be delivered when the audit is carried out.
Article 18 During the audit process, audit records must be kept, relevant audit evidence collected, and audit working papers prepared.
Article 19 Before issuing an audit report, the internal auditors shall exchange audit opinions with the person in charge of the auditee. The auditee shall provide written feedback and rectification plan within 5 working days from the date of receipt of the audit report (draft exchange of opinions). If the auditee fails to submit the feedback within the time limit, it shall be deemed that there is no objection; if the auditee has objections to the audit report and cannot coordinate, the internal audit department shall submit the audit report and the opinions of the auditee to the Audit Committee for coordination and processing.
Article 20 After soliciting the opinions of the auditee on the audit results, the internal auditors shall compile the relevant evidence to form a formal written audit report and report it to the audit committee and company management, and urge the relevant responsible departments to implement rectifications.
Article 21 The auditee shall make rectifications within a time limit based on the audit communication results, implement rectification measures item by item, and submit the implementation status to the Internal Audit Department, which may review the rectification situation or conduct follow-up audits in a timely manner.
Article 22 After the audit project is completed, the auditors shall promptly organize and archive the audit materials for the project. The audit report and audit opinion are internal (confidential) information of the company. No unit or individual may leak or publish the information without the consent of the company's general manager or company leader.
Article 23 The Internal Audit Department shall carry out audit work based on business links, implement appropriate review procedures in accordance with relevant regulations, evaluate the effectiveness of the company's internal controls, and submit an internal control evaluation report to the Audit Committee at least once a year. The evaluation report shall state the purpose, scope, review conclusions and suggestions for improving internal control.
Article 24: For internal control deficiencies discovered during the review process, the Internal Audit Department shall urge the relevant responsible departments to formulate rectification measures and rectification time, conduct follow-up reviews of internal controls, and supervise the implementation of rectification measures. The person in charge of the internal audit department shall promptly arrange the follow-up review of internal controls and incorporate it into the annual internal audit work plan. If the Internal Audit Department discovers major deficiencies or major risks in internal control during the review process, it shall promptly report to the Audit Committee.
Article 25 The Audit Committee shall supervise the Internal Audit Department to inspect the following matters at least once every six months, issue an inspection report and submit it to the Audit Committee:
(1) The implementation of major events such as the use of funds raised by the company, provision of guarantees, related transactions, high-risk investments such as securities investments and derivatives transactions, provision of financial assistance, purchase or sale of assets, external investments, etc.;
(2) The company's large capital transactions and capital transactions with directors, senior managers, controlling shareholders, actual controllers and their related parties.
Article 26 The Internal Audit Department shall conduct timely audits after the occurrence of important external investment matters. When auditing external investment matters, you should focus on the following:
(1) Whether the review and approval procedures for foreign investment are carried out in accordance with relevant regulations;
(2) Whether the contract was concluded in accordance with the approved content and whether the contract was performed normally;
(3) Whether to assign special personnel or establish a special agency to study and evaluate the feasibility, investment risks and investment returns of major investment projects, and track and supervise the progress of major investment projects;
(4) For matters involving entrusted financial management, pay attention to whether the company has granted the approval authority for entrusted financial management to individual directors or operating management of the company, whether the trustee's integrity record, operating conditions and financial status are good, and whether a dedicated person has been assigned to track and supervise the progress of entrusted financial management;
(5) For securities investment matters, pay attention to whether the company has established a special internal control system for securities investment behavior, whether the investment scale affects the company's normal operations, whether the source of funds is its own funds, whether the investment risk exceeds the company's tolerable range, whether other people's accounts are used or funds are provided to others for securities investment, and whether independent directors and sponsors (including sponsor institutions and sponsor representatives, the same below) express opinions (if applicable).
Article 27 The Internal Audit Department shall conduct timely audits after important asset purchases and sales occur. When auditing the purchase and sale of assets, you should focus on the following:
(1) Whether the purchase and sale of assets are subject to approval procedures in accordance with relevant regulations;
(2) Whether the contract was concluded in accordance with the approved content and whether the contract was performed normally;
(3) Whether the operating conditions of the purchased assets are consistent with expectations;
(4) Whether there are guarantees, mortgages, pledges and other restrictions on transfer of the purchased assets, and whether they involve litigation, arbitration and other major disputes.
Article 28 The Internal Audit Department shall conduct timely audits after the occurrence of important external guarantee matters. When auditing external guarantee matters, focus should be placed on the following:
(1) Whether the approval procedures for external guarantees are carried out in accordance with relevant regulations;
(2) Whether the guarantee risk exceeds the company's bearable range, and whether the guaranteed party's integrity record, operating conditions and financial status are good;
(3) Whether the secured party provides a counter-guarantee and whether the counter-guarantee is enforceable;
(4) Whether independent directors and sponsors express opinions (if applicable);
(5) Whether a special person is assigned to continuously pay attention to the operating status and financial status of the guaranteed party.
Article 29 The internal audit department shall promptly conduct audits after the occurrence of important related party transactions. When auditing related party transactions, you should focus on the following:
(1) Whether the list of related parties has been determined and updated in a timely manner;
(2) Whether related transactions have been reviewed and approved in accordance with relevant regulations, and whether related shareholders or directors have abstained from voting when reviewing related transactions;
(3) Whether the independent directors have recognized and expressed independent opinions in advance, and whether the sponsor has expressed opinions (if applicable);
(4) Whether a written agreement has been signed for related-party transactions, and whether the rights, obligations and legal responsibilities of both parties to the transaction are clear;
(5) Whether there are guarantees, mortgages, pledges and other transfer restrictions on the subject matter of the transaction, and whether it involves litigation, arbitration and other major disputes;
(6) Whether the counterparty’s integrity record, operating conditions and financial status are good;
(7) Whether the pricing of related-party transactions is fair, whether the subject matter of the transaction has been audited or evaluated in accordance with relevant regulations, and whether the related-party transactions will encroach on the interests of the listed company.
Article 30: When the company has raised funds that have not been fully used, the internal audit department shall conduct an audit on the storage and use of raised funds at least every six months, and express opinions on the authenticity and compliance of the use of raised funds. When auditing the use of raised funds, focus should be placed on the following:
(1) Whether the raised funds are deposited in a special account decided by the board of directors for centralized management, and whether the company has signed a three-party supervision agreement with the commercial bank and sponsor where the raised funds are deposited;
(2) Whether the raised funds are used in accordance with the raised funds investment plan promised in the issuance application documents, whether the investment progress of the raised funds projects is in line with the planned progress, and whether the investment returns are consistent with expectations;
(3) Whether the raised funds are used for pledges, entrusted loans or other investments that change the purpose of the raised funds in a disguised manner, and whether the raised funds have been occupied or misappropriated;
(4) When matters such as using raised funds to replace self-owned funds that have been invested in raised funds projects, using idle raised funds to temporarily supplement working capital, changing the investment direction of raised funds, etc., whether the approval procedures and information disclosure obligations are performed in accordance with relevant regulations, and whether independent directors and sponsors express opinions in accordance with relevant regulations.
Chapter 5 Information Disclosure
Article 31 The internal audit department is responsible for the specific organization and implementation of the company's internal control evaluation. The company issues an annual internal control evaluation report based on the evaluation report and relevant information issued by the Internal Audit Department and reviewed by the Audit Committee. The internal control evaluation report should at least include the following contents:
(1) Statement by the board of directors on the authenticity of the internal control report;
(2) The overall situation of internal control evaluation work;
(3) The basis, scope, procedures and methods of internal control evaluation;
(4) Defects in internal control and their identification;
(5) Rectification of internal control deficiencies in the previous year;
(6) Corrective measures to be taken to address internal control deficiencies this year;
(7) Conclusion on the effectiveness of internal control.
The company's board of directors shall formulate a resolution on the internal control evaluation report while reviewing the annual report. The internal control evaluation report shall be submitted to the board of directors for review after being approved by more than half of all members of the audit committee.
Article 32 The company shall hire an accounting firm to audit the effectiveness of its internal controls every year. When the company discloses its annual report, it also discloses the company's internal control evaluation report approved by the board of directors and the internal control audit report issued by the accounting firm.
Article 33 If an accounting firm issues a non-standard unqualified audit report on the effectiveness of the company's internal control, the company's board of directors shall make a special explanation of the matters involved in the audit conclusion, which shall at least include:
(1) Basic information on the matters involved in the audit conclusion;
(2) The degree of impact of the matter on the effectiveness of the company’s internal control;
(3) The opinions of the company’s board of directors and the audit committee on the matter and the materials on which they are based;
(4) Specific measures to eliminate the matter and its impact.
Article 34 The company shall disclose the internal control evaluation report and the internal control audit report issued by the accounting firm on the designated website at the same time as the annual report is disclosed, unless otherwise provided by laws and regulations.
Chapter 6 Rewards and Punishments
Article 35 If the internal audit department has outstanding achievements and internal auditors have made outstanding contributions, the company may commend or reward them.
Article 36 If the auditee violates the provisions of this system and commits any of the following acts, the Internal Audit Department shall order it to make corrections within a time limit; if it refuses to make corrections, the Internal Audit Department may report it to the general manager of the company for handling in accordance with relevant regulations:
(1) Refusing to provide or delaying the provision of documents, information and supporting materials related to audit matters, or providing false information or obstructing inspections;
(2) Ongoing behavior that seriously violates financial disciplines, infringes upon the economic interests of the unit, and causes serious waste and large losses;
(3) Refusal to make corrections without justifiable reasons;
(4) Retaliation against internal auditors or whistleblowers.
Article 37 If an internal auditor violates this system and commits one of the following acts, the company will impose sanctions according to the severity of the case. Those who cause losses to the company shall be liable for compensation. If a crime is constituted, criminal liability shall be pursued in accordance with the law:
(1) Abusing power, engaging in fraud, engaging in malpractice for personal gain, and seeking personal gain;
(2) Neglecting duties, leaking company secrets and the business secrets of the auditee, causing economic losses to the company or the auditee.
Chapter 7 Supplementary Provisions
Article 38 Matters not covered by this system shall be implemented in accordance with relevant national laws and regulations, normative documents and the relevant provisions of the Articles of Association.
Article 39 This system shall take effect from the date of review and approval by the company's board of directors.