Tasly internal audit system

Tasly Pharmaceutical Group Co., Ltd.

internal audit system

Chapter 1 General Provisions

Article 1 In order to standardize the internal audit work of Tasly Pharmaceutical Group Co., Ltd. (hereinafter referred to as "Tasly", "the Company" or the "Company"), comply with relevant laws and regulations, thoroughly implement major central decision-making arrangements, national policies and measures, and state-owned assets supervision requirements, implement Tasly strategic planning, comply with Tasly rules and regulations, and continuously standardize This system is formulated in accordance with laws and regulations such as the Audit Law of the People's Republic of China, the Regulations of the National Audit Office on Internal Audit Work, the Implementation Opinions on Deepening the Internal Audit Supervision of Central Enterprises, and the China Internal Auditing Standards to conduct business operations, prevent and reduce business risks, improve operating efficiency and effects, and achieve high-quality development.

Article 2 This system applies to all Tasly centers, departments, offices and holding subsidiaries.

Article 3 Internal audit refers to the independent and objective supervision, evaluation and recommendation activities within Tasly. By using systematic and standardized methods, it reviews and evaluates the central government’s major decision-making and deployment, national policies and measures, implementation of state-owned assets supervision requirements, strategy execution, compliance with laws and regulations, economic activities, risk management, internal control, financial revenue and expenditure, corporate culture, etc., summarizes management practices, reveals problems and risks, puts forward suggestions for improvement, supervises the implementation of rectifications, and promotes the implementation of strategies, standardized operations, improvement of governance, achievement of goals and healthy development of Tasly units at all levels.

Article 4 The purpose of Tasly's internal audit is to safeguard strategies, prevent risks and create value. Units at all levels should consciously cooperate with internal audit institutions to carry out audit work in accordance with relevant laws, regulations and this system.

Article 5 Internal audit work should follow the following principles:

(1) Uphold the party’s overall leadership. Strictly follow the spirit of the central government's instructions on audit work, adhere to and improve the system and mechanism of the party's leadership in audit work, build a centralized, unified, comprehensive, authoritative and efficient audit supervision system, and play a supervisory role in achieving high-quality development.

(2) Adhere to auditing in accordance with laws and regulations, and be objective and fair. Always perform audit supervision responsibilities based on national laws and superior unit systems. Adhere to principles, perform duties diligently, investigate the truth, tell the truth, and report the truth. Implement the important requirements of “three distinctions” and conduct audit evaluations objectively and prudently.

(3) Adhere to reform and innovation. Keep pace with the times and promote innovation in audit concepts, ideas, methods, systems and mechanisms. Persist in identifying problems from a reform perspective and promote solutions to problems with reform ideas. Adhere to the unity of revealing problems and promoting problem solving, and promote the integrated advancement of reforms.

(4) Adhere to the system concept. Strengthen the overall management role of Tasly headquarters, based on the audit work, strengthen the Tasly party organization's overall coordination, overall promotion, and supervision of the implementation of the audit work, strengthen the forward-looking, holistic and collaborative nature of the audit work, continue to enhance political awareness, and plan and carry out audit work around the "biggest country".

Chapter 2 Institutions and Personnel

Article 6 Tasly shall set up an internal audit institution.

Article 7 The Tasly party organization and the board of directors (or the principal person in charge) shall directly lead the internal audit work. The chairman of the board (or the principal person in charge) shall be specifically in charge of the internal audit work and shall be the first person responsible for the internal audit work.

(1) The responsibilities of the party organization in internal audit work include:

1. Improve and improve the system and working mechanism for party organizations to lead internal audit work.

2. Carry out top-level design, overall coordination and supervision of the implementation of major internal audit work, and regularly listen to internal audit work reports, including but not limited to:

(1) Review the establishment of the internal audit agency, the basic internal audit system, and the audit work plan;

(2) Review the annual audit plan and review important audit reports;

(3) Study the major problems discovered in the audit and their rectification plans and rectification implementation status;

(4) Listen to reports on audit team building, audit quality control, and transfer of clues to violations of laws, disciplines, and laws, etc.

3. Study or review other important matters of internal audit.

(2) The responsibilities of the board of directors in terms of internal audit work include but are not limited to:

1. Determine the establishment of the internal audit organization and its person in charge.

2. Review and approve the basic internal audit system, audit work plan, annual audit plan, important audit reports, annual audit work report, as well as major problems discovered in the audit and their rectification plans and rectification implementation status.

3. Listen to the audit team building, audit quality control, and reports on major asset losses and major risk matters discovered by the audit.

4. Study or review other important matters of internal audit.

Article 8 Tasly shall set up an audit committee under the board of directors in accordance with relevant regulatory requirements and in light of its own actual conditions. The responsibilities of the Audit Committee include but are not limited to:

(1) Supervise and evaluate internal audit work, and be responsible for the coordination between internal audit and external audit.

(2) Manage other important matters of internal audit.

Article 9 Internal audit institutions shall accept the guidance, supervision, inspection and evaluation of national audit agencies, state-owned assets supervision and administration agencies and other departments in accordance with the law, and submit internal audit work plans, work summaries, audit reports, rectification status, and clues to major asset losses, important events, major risks, major violations of laws, disciplines, and laws discovered during the audit in accordance with relevant regulations and requirements.

Article 10 Internal audit institutions shall equip appropriate internal audit personnel based on their own development strategies, business scale and work needs.

Article 11 Internal audit institutions should strengthen the construction of the audit team and create an internal audit team that is politically strong, has both ability and political integrity, is professionally proficient, has a pragmatic style, is courageous to take responsibility, and is honest and honest.

Article 12 Internal auditors shall have professional skills and business knowledge suitable for the audit work they are engaged in.

Article 13 Tasly shall strictly enforce the recruitment standards for internal auditors, support and encourage internal audit institutions to establish an audit training system, continue to carry out follow-up vocational education through various channels, improve the professional competence and professional level of internal auditors, and carry out job rotation exchanges within and outside the audit institution to promote the career development of internal auditors.

Article 14 The internal audit institution shall maintain its independence and shall not participate in work that may affect its independent and objective performance of audit duties, and shall not interfere or interfere with the normal operation and management activities of the audited unit.

Article 15 Internal auditors shall strictly abide by the auditing professional ethics, adhere to principles, fulfill their duties, be independent and objective, be honest and honest, and conduct internal audit work with due professional prudence. They shall not abuse their power, engage in malpractice for personal gain, or neglect their duties.

Article 16 If internal auditors have an interest in the audited unit or audit matters during the audit work, they shall report to the person in charge of the internal audit work of the unit and the person in charge of the audit project, and actively recuse themselves in accordance with relevant regulations.

Article 17 Internal auditors shall abide by laws and regulations related to confidentiality and Tasly's rules and regulations related to confidentiality, properly keep and transmit relevant paper and electronic materials obtained during audit work, and shall keep state secrets, business secrets, work secrets, personal privacy and personal information they learn during their work confidential, and shall not disclose or illegally provide it to others.

Article 18 Tasly shall strengthen the incentive and restraint mechanism based on the actual internal audit work.

(1) Implement the responsibility system for signature and endorsement of audit work results, and clarify that the person in charge of the audit project and relevant auditors bear corresponding audit responsibilities for the audit conclusions and audit procedures.

(2) Research and formulate audit quality evaluation standards for the unit, and promote the linkage of auditor performance evaluation results with salary fulfillment, career promotion, job exchanges, etc.

(3) Explore the establishment of an internal audit assessment system that is differentiated from other business departments. The business departments at the same level as the audited objects will not participate in the internal audit institutions and

performance evaluation of its responsible persons.

Article 19 The internal audit institution may, based on work needs, deploy professionals from the company’s functional departments to assist in the internal audit work, and relevant departments and personnel shall cooperate.

Article 20 Internal audit institutions shall strengthen supervision of auditors' compliance with laws and performance of duties, and urge auditors to perform their duties in accordance with the law. Internal audit institutions and auditors shall be subject to supervision in accordance with laws and regulations.

Article 21 Internal audit institutions, on the premise of meeting confidentiality requirements, may purchase audit services from the public based on work needs and shall be responsible for the audit results adopted.

Article 22 Tasly shall ensure the funds required by the internal audit institution to perform its internal audit duties.

Chapter 3 Audit Responsibilities

Article 23 The internal audit institution shall be responsible for and report its work to the party organization and board of directors (or principal person in charge) of the unit. The audit responsibilities of the internal audit institution mainly include:

(1) Promote the establishment and improvement of the unit's internal audit system, and formulate audit work plans and annual audit plans.

(2) Carry out activities such as audit supervision, evaluation and suggestions, and submit relevant audit reports and other materials to internal and external supervision agencies in accordance with regulations.

(3) Promote the establishment and improvement of a long-term mechanism for audit rectification of the unit, and supervise and inspect the implementation of rectification of problems discovered in the audit.

(4) Promote the establishment and improvement of the mechanism for utilizing audit results.

(5) Strengthen the construction of the audit team and establish and improve work incentive mechanisms, differentiated assessment mechanisms and talent training mechanisms.

(6) Promote and carry out the construction and application of internal audit informatization.

(7) Coordinate the internal audit work of the unit and manage the internal audit work of affiliated units.

(8) Other responsibilities assigned by laws, regulations and the unit.

Article 24 The internal audit institution shall carry out internal audit work in accordance with relevant laws and regulations, the provisions of this system and relevant management requirements, focusing on the central government's major decisions and arrangements, national policies and measures and state-owned assets supervision requirements, Tasly's development strategy, and the unit's work priorities and management priorities. The audit content mainly includes:

(1) Compliance with relevant laws and regulations at home and abroad.

(2) Implementation of major central government decisions and arrangements, national policies and measures, state-owned assets supervision requirements, etc.

(3) Implementation of internal rules and regulations, strategic planning, major decisions, annual business plans, performance contracts, etc.

(4) The authenticity and completeness of financial revenue and expenditure and other management information, the effectiveness of financial control, etc.

(5) Investment and merger and acquisition project status.

(6) Internal control and risk management.

(7) Enterprise economic management and efficiency.

(8) Performance of natural resource asset management and ecological environment protection responsibilities.

(9) Network security and information management.

(10) Overseas institutions, overseas assets and overseas economic activities.

(11) Corporate culture construction and publicity.

(12) The performance of economic responsibilities by leading cadres and the construction of party style and clean government.

(13) Rectification of problems found in the audit.

(14) Other matters that should be paid attention to.

Article 25 Based on the actual situation of Tasly's operation and management, the internal audit institution may conduct a comprehensive audit or special audit of the unit and its affiliated units.

Article 26 The internal audit institution may organize and coordinate various functional lines of the unit to carry out joint audits, cross-audits, etc. based on work needs and in compliance with laws, regulations and relevant regulatory requirements.

Article 27 The internal audit institution shall establish an audit quality control system, determine audit standards, etc., and implement quality control on the internal audit business.

Chapter 4 Audit Authority

Article 28 Internal audit institutions and personnel shall independently carry out audit work in accordance with relevant laws and regulations, the provisions of this system and management requirements. The scope of the audit shall not be restricted or restricted as long as it is legal and compliant. No unit or individual within Tasly may refuse, hinder or interfere with the internal audit work, and may not attack, retaliate or frame internal audit institutions and personnel.

Article 29 Internal audit institutions and personnel have the following authority when performing audit duties:

(1) Require the audited unit to submit business and management information related to strategic planning, major decisions, internal control, risk management, financial revenue and expenditure, etc., including electronic data and relevant documents.

(2) Examine the financial and accounting information of the audited unit, as well as business and management information on financial revenue and expenditure, economic activities, internal control, risk management, etc., and examine the safety, reliability, economy, etc. of relevant computer systems, equipment and facilities.

(3) On-site supervision and inventory, inspection of physical assets, cash and important documents of the audited unit, and inspection of relevant operating procedures and workplaces, etc.

(4) Investigate and inquire about audit matters from the audited unit and relevant units and individuals within Tasly, and obtain relevant supporting materials.

(5) Participate in relevant meetings of the unit and hold meetings related to audit matters.

(6) Participate in the study and formulation of relevant rules and regulations, and make suggestions for the formulation of internal audit rules and regulations.

(7) Propose opinions on correcting and dealing with violations of laws and regulations, losses and waste, and suggestions for improving management and performance.

Article 30 The internal audit institution shall promptly report ongoing serious violations of laws and regulations, serious losses and waste to the principal person in charge of the unit where the internal audit institution is located, and may make a temporary stop decision with his consent.

Article 31 The internal audit institution may stop the transfer, concealment, tampering, and destruction of financial and accounting information related to audit matters, as well as business and management information related to financial revenue and expenditures, and economic activities, and the transfer, concealment, or intentional damage of relevant assets during the audit work; when necessary, it may temporarily seal it with the approval of the principal person in charge of the unit where the internal audit institution is located. The internal audit institution may designate the audited unit to be responsible for the safekeeping of sealed materials and assets, and the audited unit shall not damage or transfer them without authorization.

Article 32 The internal audit institution should establish a complaint and reporting mechanism to investigate and handle complaints and reports. The specific complaint and reporting email address is: [email protected]

Article 33 Clues received from complaints and reports and problems discovered during internal audit work should be classified and handled in accordance with the relevant provisions of the "Working Measures for the "Big Supervision" System of Tasly Pharmaceutical Group Co., Ltd."

Article 34 For audited units and individuals that strictly abide by laws and regulations, have significant economic benefits, and make outstanding contributions, the internal audit institution may make commendation recommendations to the party organization, board of directors (or main person in charge) of the relevant unit.

Article 35 When necessary, internal audit institutions and personnel shall carry out work in accordance with laws, regulations and other authorities granted by the unit.

Chapter 5 Rights and Obligations of the Audited Unit

Article 36 The audited unit shall actively support and cooperate with internal audit institutions and personnel to carry out audit work in accordance with relevant laws and regulations, the provisions of this system and management requirements, truthfully reflect relevant situations, comprehensively, promptly, truly and accurately provide all kinds of materials, data, information and relevant certificates required for audit, open relevant business, management and other computer information systems and data sharing platforms, and shall not refuse, delay, lie, forge or conceal for any reason.

Article 37 The audited unit and its person in charge are responsible for the timeliness, authenticity and completeness of the information they provide. When the internal audit institution analyzes the various materials and information obtained and needs to verify the relevant situation with the audited unit, the audited unit shall cooperate.

Article 38 The audited unit shall provide necessary working conditions for the development of internal audit work.

Article 39 For the problems discovered in the audit, the audited unit shall bear the main responsibility for rectification and implementation. The principal person in charge of the audited unit shall be the first person responsible for audit rectification. He shall strictly implement the audit opinions or suggestions, take practical and effective measures to complete the rectification within the prescribed time limit, and report the rectification results in writing to the relevant internal audit agency on time. The party organization of the audited unit should strengthen the leadership of the rectification work, promptly study the opinions on handling major issues, make arrangements and put forward requirements for audit rectification.

The board of directors of the audited entity or other institutions with corresponding powers should strengthen the management and guidance of audit rectification work, and include major issues identified in the audit and the implementation of rectifications into the scope of review. The relevant business functional departments of the audited unit are responsible for the supervision and management of the rectification of problems found in the subordinate units in their fields of competence discovered by the audit. They should supervise the implementation of rectifications and further systematically strengthen daily management and control.

Article 40 If the audited unit has objections to the audit report and audit conclusions, it may submit a review application to the audit report issuing agency.

Chapter 6 Audit Procedures

Article 41 The internal audit institution shall prepare an audit project plan on an annual basis and perform relevant approval and filing procedures in accordance with regulations. Due to actual work needs, the annual audit project plan may be adjusted. If substantial adjustments occur, they must be reported to the original approval agency for approval.

Article 42 The internal audit institution shall form an audit team by project based on the approved annual audit project plan, and deliver an audit notice to the audited unit before entering the site for implementation; under special circumstances, with the approval of the principal person in charge of the unit, the internal audit institution may directly carry out the audit with the audit notice.

Article 43 During the audit work, the audit team shall carry out audit work through standardized audit procedures in accordance with relevant regulations, prepare audit reports, and control the quality of the audit work during the implementation of the audit project. The internal audit organization should manage the quality control activities of the audit team.

Article 44 Before issuing an audit report, the opinions of the audited unit shall be solicited in writing.

After receiving the draft audit report for comments, the audited unit shall provide written feedback within the specified time limit. It shall not refuse to respond or accept the audit conclusions that are compliant, reasonable, and realistic and put forward in accordance with laws and regulations for any reason; those who do not provide feedback within the time limit will be deemed to have no objection. The internal audit institution should carefully study the written opinions of the audited unit and make necessary modifications to the audit report.

Article 45 The internal audit institution shall deliver the approved audit report to the audited unit and submit rectification requirements to the audited unit.

Article 46 After the audit work is completed, the internal audit institution shall promptly organize the audit materials and complete the archiving in accordance with the system regulations.

Article 47 For the problems found in the audit of the institution, the internal audit institution shall be responsible for supervision and inspection, study and improve audit rectification standards, implement account cancellation management, organize and carry out audit rectification follow-up inspections, urge the audited unit to comprehensively and systematically implement audit opinions or suggestions, and evaluate the rectification situation of the audited unit.

Chapter 7 Application of Audit Results

Article 48 In accordance with relevant laws and regulations and the provisions of this system, a sound audit results reporting mechanism shall be established and combined with actual conditions, and relevant audit results and rectification implementation status shall be reported in an appropriate manner. When reporting audit results, state secrets, business secrets, work secrets, personal privacy and personal information must be kept confidential, and relevant laws, regulations and Tasly regulations must be observed.

Article 49 Internal audit results and rectification situations should be fully utilized, including but not limited to:

(1) Serve the business decision-making and management of leaders of Tasly units at all levels.

(2) Promote Tasly units at all levels to improve strategic planning and business plans.

(3) Supervise Tasly units at all levels to optimize systems and processes and strengthen internal control and risk management.

(4) Promote practical management experience and promote relevant Tasly units to improve their operation and management levels.

(5) Summarize and publicize typical cases, and promote leading cadres and employees at all levels to implement the regulations on professional integrity and compliance with laws and regulations.

(6) Accountability and handling of violations of domestic and foreign laws and regulations and Tasly's relevant regulations.

(7) Promote relevant Tasly units to increase revenue and reduce expenditure and maintain and increase the value of state-owned assets.

(8) As an important basis for the assessment and evaluation of strategic execution and performance contract execution of Tasly units at all levels.

(9) As an important basis for the assessment, appointment, removal, reward and punishment of leading cadres.

Article 50: For problems discovered in the audit, the relevant business functional departments of the unit where the internal audit institution is located shall, on the basis of supervising and managing the implementation of rectifications by the relevant audited units, conduct timely analysis and research on typical, common, and tendentious problems in the field of competence, formulate and improve relevant systems, methods, processes, etc., and establish and improve internal control measures.

Article 51 The internal audit institution shall strengthen collaboration with all agencies and departments involved in the “big supervision” system, and establish working mechanisms such as information sharing, result sharing, joint implementation of important matters, and joint implementation of problem rectification and accountability.

Article 52 The internal audit institution shall effectively utilize the internal supervision and inspection capabilities and results of the audited unit during the audit. Problems discovered and corrected during the internal supervisory inspection of the audited unit will no longer be reflected in the audit report.

Chapter 8 Rewards and Accountability

Article 53 Tasly units at all levels may give appropriate commendations to internal audit institutions, audit teams and internal auditors who have performed their audit duties conscientiously in audit work, dared to adhere to principles, discovered major audit clues or revealed major risks, recovered or avoided major economic losses, put forward important management suggestions, and made outstanding achievements.

Article 54 If internal audit institutions and personnel fail to perform their audit duties as required, violate professional ethics, abuse their power, practice favoritism, neglect their duties, leak secrets, make false reports or conceal reports, causing significant losses or serious impacts, Tasly will be held accountable in accordance with relevant regulations. If a crime is constituted, they will be transferred to relevant state agencies for criminal liability in accordance with the law. Specific situations include but are not limited to:

(1) Major matters should be included in the audit plan but not included.

(2) Major issues should have been discovered but were not discovered, investigation and handling were inadequate, or audit procedures were not in place, resulting in serious consequences.

(3) After discovering major problems, delaying investigation, perfunctoryly not pursuing them, concealing them, or providing false audit reports.

(4) Leaking or illegally providing known state secrets, business secrets, work secrets, personal privacy and personal information to others.

Article 55 If the audited unit or personnel fails to provide information, refuses to provide information, delays in providing information, provides false information, refuses to cooperate with internal auditors in conducting inspections, obstructs audit work, or directly or instructs others to attack, retaliate, or frame internal auditors during the audit process, the internal audit agency may make suggestions for handling, and the audited unit or its superior unit’s party organization, board of directors (or main person in charge) will order corrections, and be held accountable in accordance with relevant regulations.

Article 56 If an audited unit or individual refuses to make rectifications, shirks rectification, makes perfunctory rectifications, makes false rectifications, or fails to effectively carry out audit rectification work as required, causing economic losses and serious consequences, the party organization or board of directors (or the main person in charge) of the audited unit or its superior unit shall order corrections and hold them accountable in accordance with relevant regulations.

Article 57 If internal auditors are attacked, retaliated, or framed for performing their duties, the party organization and board of directors (or the main person in charge) of the relevant unit shall take protective measures in a timely manner, and hold the relevant responsible personnel accountable in accordance with relevant regulations.

Chapter 9 Supplementary Provisions

Article 58 If there are other provisions or requirements in laws, regulations, regulatory provisions, company articles of association, etc., such provisions or requirements shall prevail. The economic responsibility audit of leading cadres of Tasly units at all levels shall be carried out in accordance with relevant laws and regulations, this system and other relevant systems.

Article 59 This system is a company-level system.

Article 60 The Tasly Audit Department is responsible for interpreting this system.

Article 61 This system shall come into effect upon approval by the board of directors.