Fosun Pharma Internal Audit Management System (Revised in 2026)
Shanghai Fosun Pharmaceutical (Group) Co., Ltd.
Internal audit management system
(revised in 2026)
Chapter 1 General Provisions
Article 1 In order to standardize the internal audit work of Shanghai Fosun Pharmaceutical (Group) Co., Ltd. (hereinafter referred to as the "Company" or the "listed company"), clarify the responsibilities, authorities and basic codes of conduct of the internal audit, give full play to the role of internal audit in strengthening internal control, prevent operating risks, and achieve institutionalized and standardized management of internal audit, according to the "China This system is specially formulated based on the actual situation of the company in accordance with the provisions of the Audit Law of the People's Republic of China, the Basic Standards for Enterprise Internal Control, the China Internal Auditing Standards, and other relevant laws, administrative regulations, regulatory requirements of the place where the company's shares are listed, and the Articles of Association of Shanghai Fosun Pharma (Group) Co., Ltd. (hereinafter referred to as the "Articles of Association").
Article 2 The term “internal audit” as mentioned in this system refers to the activities in which the company’s audit department or auditors carry out independent and objective supervision, evaluation and recommendations on the effectiveness of internal control and risk management of the group (i.e. the company and its holding subsidiaries/units, the same below), the authenticity and completeness of financial information, the efficiency and effectiveness of operating activities, the responsibilities of managers, etc., in order to promote the improvement of corporate governance and the achievement of goals.
The term "auditors" as mentioned in this system refers to the personnel engaged in auditing work in the company and its affiliated companies/units, including auditors in the company's audit department and personnel in the audit department/audit positions of its holding subsidiaries/units.
Subsidiary companies/units referred to in this system refer to branches, holding subsidiaries/units and their branches.
Article 3 The term "internal control" as mentioned in this system refers to the process by which the company's board of directors, the audit committee of the board of directors (hereinafter referred to as the "Audit Committee"), senior managers and all employees provide reasonable guarantees to achieve the following goals:
(1) Comply with national laws, regulations, rules and other relevant provisions;
(2) Improve the efficiency and effectiveness of the Group’s operations;
(3) Ensure the safety and integrity of the Group’s assets;
(4) Ensure the authenticity, accuracy and completeness of information disclosed by listed companies.
Chapter 2 Internal Audit Institutions and Personnel
Article 4 The company shall establish an audit department as an internal audit institution. The Audit Department is the daily execution agency of the Audit Committee and reports its work to the Audit Committee on a regular basis. The Audit Department is responsible to the company's Board of Directors, and in accordance with relevant laws, administrative regulations, the Articles of Association and this system, it independently carries out work and exercises internal supervision rights, and performs supervision, evaluation and service functions. In the process of supervision and inspection, the Audit Department shall accept the supervision and guidance of the Audit Committee. Any major matters discovered by the internal audit shall be reported to the Audit Committee in a timely manner.
Article 5 The company's audit department may, based on the group's development plan and actual conditions, set up internal audit institutions in subordinate companies/units and dispatch audit leaders. Subordinate companies/units may also set up internal audit institutions or full-time auditors as appropriate, and accept the business guidance, supervision and inspection of the company's audit department to ensure that they carry out audit work in a standardized and effective manner.
Article 6 The company's audit department has a general manager, and the appointment, promotion, assignment, transfer, demotion, dismissal, performance appraisal, incentives, etc. of him and other auditors shall be carried out in accordance with the company's human resources related systems.
Article 7 The audit department of a company should be equipped with corresponding auditors. Auditors should have the professional knowledge and professional abilities required to engage in audit work. They should carry out continuing education and training through various channels to improve their professional competence.
Article 8 The internal audit institution shall maintain independence. Auditors are not allowed to participate in the actual operation and management activities of the audited unit as any decision-maker in order to maintain an objective and impartial stance. The internal audit institution should be free from interference and control when determining the scope of the audit, performing the audit work and reporting the audit results.
Article 9 Auditors shall not participate in work that may affect the independent and objective performance of audit duties. If they have an interest in the audited unit or audit matters, they shall recuse themselves.
Article 10 Auditors shall abide by professional ethics and conduct auditing business with professional proficiency and due professional prudence. Auditors must be honest, objective, diligent, confidential and competent; they must audit in accordance with the law, adhere to principles, seek truth from facts, be honest and dedicated, and be loyal to their duties.
Article 11 Auditors shall abide by the principle of confidentiality, and any confidential information collected during the audit work shall be kept strictly confidential.
Chapter 3 Internal Audit Responsibilities and Authority
Article 12 The responsibilities and authority of the company's audit department are granted by the board of directors, and it exercises internal supervision rights on behalf of the company. Any department or subsidiary company/unit should actively cooperate with the audit work and shall not obstruct or set up any form of obstacles.
Article 13 The company's audit department shall formulate the department's development plan, establish and improve the internal audit management system, and implement it effectively; be responsible for the selection, appointment, management, business guidance and training of the company's internal audit personnel. Its main responsibilities include:
(1) Internal audit work
Formulate and implement an annual audit plan to audit the legality, compliance, authenticity and completeness of the accounting information and operating management information of the company and its subordinate companies/units;
Inspect and evaluate the execution of various business activities of the company and its subordinate companies/units, and provide audit opinions;
Inspect and evaluate the company and its subordinate companies/units' compliance with laws, regulations, company systems and processes in various economic businesses, and provide audit opinions;
Regularly report to the Audit Committee, including but not limited to the implementation of the annual audit plan and problems discovered during internal audit work;
Submit an internal audit report to the Audit Committee after the end of each year;
If major flaws or important flaws in internal control are discovered during the audit process, they should be reported to the audit committee in a timely manner; for the general flaws in internal control discovered, urge the relevant responsible departments or subordinate companies/units to formulate rectification measures and specify the rectification time;
Regularly follow up and inspect the rectification of issues disclosed in audit reports, and supervise the implementation of rectification measures;
Assist the company's Integrity Supervision Department to establish and improve the anti-fraud mechanism, determine the key areas, key links and main contents of anti-fraud, and pay attention to and inspect possible fraud during the internal audit process;
Provide constructive reference opinions on the company’s important management systems and processes;
Complete other audit matters required by the board of directors and management.
(2) Internal control evaluation work
Organize the internal control evaluation work of the company and its subordinate companies/units, and inspect and evaluate the integrity, rationality and effectiveness of the internal control system as well as its implementation.
Article 14 In order to effectively perform internal audit duties, the company’s board of directors grants the audit department the following authority:
(1) Carry out audit work independently according to the approved annual audit plan;
(2) Have the right to participate in CEO/President office meetings, business analysis meetings and other special meetings of the company and its affiliated companies/units;
(3) Based on the needs of audit work, have the right to require the audited unit to provide or submit financial budgets, financial statements, financial analysis and various business materials on time;
(4) According to the needs of audit work, have the right to review, copy and retain relevant financial information, management systems, business processes, meeting minutes and other business information and documents deemed necessary;
(5) Interview parties and insiders related to the audit project, and require them to provide documents, information, situation descriptions, communication records and other written supporting materials;
(6) Inspect and verify the assets, liabilities and other financial status of the company and its affiliated companies/units; have the right to inspect, inventory or supervise the inventory of physical objects on the spot; inspect the business premises of the enterprise, and observe the production, operation and business processing processes of the enterprise;
(7) In the process of performing their duties, they have the right to make decisions to stop and put forward correction and handling opinions for the following behaviors of the audited unit:
Obstruction and obstruction of internal audit work and refusal to provide information;
Illegal and irregular behaviors in economic activities;
Acts that seriously violate laws and regulations, listed company and/or unit system, and cause serious losses and waste;
The act of transferring, concealing, tampering with, and destroying accounting vouchers, account books, statements, and other business information related to economic activities and audit matters;
Withholding or misappropriating company or customer funds, transferring, concealing, or misappropriating company property;
Other behaviors that violate laws and regulations and infringe on the interests of the company and customers;
Refusal to reply to the audit exchange of opinions without reason or refuse to accept the audit conclusion;
Spreading rumors, slandering and retaliating against auditors.
(8) Have the right to require the audited unit to respond in writing on time to the problems discovered during the audit and the audit suggestions put forward;
(9) Within the scope of authorization, have the right to exercise accountability recommendations for personnel with violations of laws and regulations discovered during the audit process.
Article 15 The expenses required by the company's audit department to carry out work shall be included in the company's annual budget and used after approval; if the budget is insufficient, it shall be submitted for approval according to the company's corresponding procedures.
Chapter 4 Types and Procedures of Internal Audit
Article 16 The types of internal audit include:
(1) Risk management and internal control audit: systematic audit work on the compliance of the audited unit’s business management activities, operational efficiency and effectiveness, as well as the rationality of the design and implementation effectiveness of the internal control system;
(2) Special audit: special inspection required by the company’s board of directors, audit committee and management based on operational and management needs;
(3) Outgoing audit: Audit work carried out to evaluate the operating performance and economic responsibilities of the outgoing audit object during the management period;
(4) Anti-fraud audit: Carry out anti-fraud audit for fraud that has occurred or may occur during the operation of the company or its subordinate companies/units;
(5) Internal control self-evaluation work: Carry out internal control self-evaluation work according to the compliance requirements of listed companies;
(6) Other internal audit matters.
Article 17 The internal audit procedures are as follows:
(1) The company's audit department should formulate an annual audit plan and implement it after approval by the audit committee.
(2) When the company's audit department conducts an audit in accordance with the annual audit plan, it should determine the members of the audit team and formulate an audit plan.
(3) The company's audit department shall issue a written audit notice to the audited unit three days before the implementation of the audit work. The audit notice shall be submitted to the chairman of the board and the executive director assisting in charge (if any) for approval. When carrying out special audit projects such as anti-fraud special audits, the company can be exempted from sending an audit notice and conduct the audit directly.
(4) The audit plan shall be sent as an attachment to the audit notice. The audit plan shall specify the audit purpose, scope, time, team, information table required for audit and other information. The audited unit shall cooperate with the work of the audit department to provide corresponding information and provide necessary working conditions.
(5) After the audit work is completed, the company's audit department should formulate a first draft of the audit report and an audit exchange opinion letter, and send them to the audited unit for comments.
(6) Within five working days from the date of receipt of the first draft of the audit report and the audit exchange of opinions, the audited unit shall reply to the audit exchange of opinions in writing, signed and stamped by the person in charge of the audited unit. If no reply is made within the time limit, it will be deemed to have no opinion.
(7) The audit report and audit exchange opinion letter shall be submitted to the chairman of the board of directors and the executive director assisting in charge (if any) for approval. After approval, they shall be submitted to the relevant senior managers of the company, the audited unit and other relevant personnel respectively.
(8) The audited unit should implement rectification work according to the instructions, and the company's audit department should regularly track the implementation of rectification measures and conduct necessary follow-up audits.
Article 18 The audit evidence obtained by auditors shall be sufficient, relevant and reliable. Internal audit institutions should establish a working paper system, and auditors should clearly and completely record the name, source, content, time and other information of obtaining audit evidence in working papers.
Article 19 The audit work shall adopt a systematic and standardized method, establish a secondary review of the audit work and an audit quality assessment mechanism, review and evaluate the quality of the audit work during the preparation, implementation, reporting, follow-up and other stages of the audit work to ensure the efficiency and effectiveness of the audit work.
Article 20 The company's audit department shall manage files according to the company's file management system. Various materials generated during the audit work, including audit notices, audit plans, audit exchange opinions, audit reports, audit working papers and related documents and materials should be organized, classified and archived.
Chapter 5 Accountability
Article 21 The internal audit institution shall bear the responsibility for auditing discrepancies. If auditors violate the provisions of this system, are negligent, and fail to fulfill their responsibilities of prudence and diligence, resulting in failure to discover problems that should be discovered and failure to correctly and objectively disclose business risks, they shall bear audit responsibility.
Article 22 The audited unit shall bear the responsibility for poor management. If the audited unit violates the provisions of relevant management systems, or neglects its duties and fails to fulfill its obligations of diligence, resulting in the loss of assets of the group, false financial statements, low competitiveness, chaotic internal management, weak risk control, and damage to corporate reputation, it will bear management responsibility.
Article 23 The audited unit and its relevant personnel shall not replace, reduce or exempt the audited unit from its due management responsibilities just because its business has been audited.
Article 24 For violations discovered during the audit process, the offenders shall be held accountable and punished in accordance with the company's relevant systems; if they are suspected of serious violations of laws or criminal crimes, they shall be reported to the chairman of the board and the executive director assisting in charge (if any), and if necessary, the case clues will be transferred to the company's Integrity Supervision Department for further investigation and processing.
Chapter 6 Supplementary Provisions
Article 25 Matters not covered by this system, or that conflict with relevant laws, administrative regulations, departmental rules, supervisory requirements of the place where the company's stocks are listed, and the "Articles of Association" shall be followed.
Article 26 The company’s audit department is responsible for the interpretation and revision of this system.
Article 27 This system shall take effect from the date of review and approval by the board of directors, and the same shall apply when it is revised.
Shanghai Fosun Pharmaceutical (Group) Co., Ltd.
August 25, 2026