Guizhou Sanli Pharmaceutical Co., Ltd. Internal Audit System
internal audit system
(November 2025)
Chapter 1 General Provisions
Article 1 In order to standardize the internal audit work of Guizhou Sanli Pharmaceutical Co., Ltd. (hereinafter referred to as the "Company"), improve the quality of internal audit work, and protect the legitimate rights and interests of investors, this system is formulated in accordance with the provisions of the Audit Law of the People's Republic of China, the Provisions of the Audit Office on Internal Audit Work and other laws, regulations, rules, the Shanghai Stock Exchange Stock Listing Rules, the Shanghai Stock Exchange Self-Discipline Supervision Guidelines for Listed Companies No. 1 - Standardized Operations, and the Articles of Association of Guizhou Sanli Co., Ltd. (hereinafter referred to as the "Articles of Association") and in combination with the actual situation of the company.
Article 2 The internal audit work mentioned in this system refers to an evaluation activity carried out by the company's internal audit institutions or personnel on the effectiveness of the company's internal control and risk management, the authenticity and completeness of financial information, and the efficiency and effectiveness of operating activities.
Article 3 The company’s internal audit follows the principles of “independence, objectivity, impartiality and confidentiality”.
Article 4 The company’s board of directors shall be responsible for the establishment, improvement and effective implementation of the internal control system. Important internal control systems shall be reviewed and approved by the board of directors. The company's board of directors and all its members guarantee that the information disclosed regarding internal control is true, accurate and complete.
Article 5 All departments and subsidiaries of the company shall cooperate with the internal audit institution in performing its duties in accordance with the law, provide necessary working conditions, and shall not hinder the work of the internal audit institution.
Chapter 2 Internal Audit Institutions and Auditors
Article 6 An audit committee shall be established under the company's board of directors to be responsible for guiding and supervising the company's internal audit work. The work responsibilities, procedures, requirements, etc. of the Audit Committee are implemented in accordance with the Company's "Working Rules of the Audit Committee of the Board of Directors".
Article 7 The company shall establish an audit and compliance department to supervise and inspect the company’s business activities, risk management, internal control, financial information and other matters. The Audit and Compliance Department is responsible to the Board of Directors and reports to the Audit Committee.
The Audit and Compliance Department shall accept the supervision and guidance of the Audit Committee during the supervision and inspection of the company's business activities, risk management, internal control, and financial information. If the internal audit institution discovers relevant major issues or clues, it shall immediately report them to the audit committee.
Page 1 of 8
Internal audit system reports directly.
Article 8 The Audit Compliance Department shall allocate full-time auditors with necessary professional knowledge, corresponding business capabilities, and good professional ethics to engage in internal audit work. The Audit and Compliance Department shall maintain its independence and shall not be placed under the leadership of the Finance Department or co-located with the Finance Department.
Article 9 The Audit Compliance Department shall have a person in charge who shall be fully responsible for the daily audit management of the Audit Compliance Department. The person in charge of the audit and compliance department shall be a full-time person.
Article 10 Auditors shall maintain independence when conducting internal audit work, adhere to the principles of objectivity, fairness, seeking truth from facts, integrity and confidentiality, and shall not abuse their power, engage in malpractice for personal gain, neglect their duties, or participate in work that may affect the independent and objective performance of audit duties. Internal auditors shall withdraw from handling audit matters if they have an interest in the audited unit or the audit matters.
Chapter 3 Responsibilities and Authority of the Internal Audit Department
Article 11 Responsibilities of the Audit and Compliance Department:
(1) Revise and improve the internal audit system;
(2) Formulate annual internal audit work plan;
(3) Inspect and evaluate the integrity, rationality and effectiveness of the internal control systems of the company’s internal institutions, holding subsidiaries and joint-stock companies that have a significant impact on the company;
(4) Report the internal audit status to the company, the board of directors and the audit committee of the board of directors;
(5) For the company’s internal control deficiencies and problems existing in its implementation, urge the relevant responsible departments to formulate rectification measures and rectification time, conduct follow-up reviews of internal control, and supervise the implementation of rectification measures. If major flaws or major risks in internal control are discovered, they should be reported to the audit committee in a timely manner;
(6) Guide and coordinate the implementation of audit recommendations;
(7) Report to the Audit Committee at least once every quarter, including but not limited to the implementation of the internal audit plan and problems discovered during the internal audit work;
(8) Submit an internal audit report to the Audit Committee after the end of each year;
(9) Responsible for the coordination and management of the company’s audit intermediaries;
(10) Complete other audit matters assigned by the company.
Article 12 The Audit and Compliance Department shall carry out audit work based on business links, and evaluate the rationality of the design and implementation effectiveness of internal controls related to financial reporting and information disclosure matters based on the actual situation.
Page 2 of 8
Internal audit system Internal audit should cover all business aspects related to financial reporting and information disclosure in the company's operating activities, including but not limited to: audit of system implementation, audit of contract implementation, audit of procurement supply chain behavior, audit of production process control, audit of revenue, expenses, assets, and audit of information disclosure.
The Audit and Compliance Department can adjust the above business links according to the actual situation of the company or the situation of the project.
Article 13 The audit evidence obtained by internal auditors shall be sufficient, relevant and reliable. The company's internal auditors should clearly and completely record the name, source, content, time and other information of obtaining audit evidence in their working papers.
Article 14 Internal auditors shall maintain a rigorous work attitude, and when the information provided by the department being audited is true and complete, they shall objectively reflect the problems discovered and report to the board of directors in a timely manner. If the reported situation is untrue, the company shall be responsible for the audit. If the internal audit department fails to truthfully provide all the information required for the audit, which affects the judgment of the internal auditors, the relevant personnel will be held accountable.
Article 15 Internal audit work authority:
(1) According to the needs of internal audit work, require the audited unit (department) to submit production, operation, financial revenue and expenditure plans, accounting statements and other relevant documents and materials on time;
(2) Review relevant statements, vouchers, account books, budgets, final accounts, contracts, agreements, etc., and inspect the information, documents and on-site inspection materials related to the production, operation and financial activities of the audited unit;
(3) Check relevant computer systems and their electronic data and information;
(4) Participate in relevant meetings and convene meetings related to audit matters according to the needs of internal audit work;
(5) Participate in the research and formulation of relevant rules and regulations, propose internal audit rules and regulations, and issue them for implementation after approval by the company's corresponding authority with the authority to approve them;
(6) Investigate issues related to audit matters from relevant units and individuals and obtain supporting materials;
(7) Make a temporary stop decision for ongoing serious violations of laws and regulations, serious losses and waste;
(8) Make suggestions for the company to improve its operation and management and increase economic benefits.
Chapter 4 Internal Audit Procedures
Article 16 The Audit and Compliance Department shall formulate a specific annual audit work plan based on the actual situation of the company, and submit it to the Board of Directors and the Audit Committee for approval before implementation. For projects that have been included in the annual audit work plan, the Audit and Compliance Department will independently arrange and carry out audit work. Other audit work will be carried out in accordance with the authorization of the company's board of directors, audit committee and other authorized departments.
Article 17 Audits generally take the form of advance notification, and the internal audit notice shall be delivered in writing three days before the audit is carried out. After receiving the internal audit notice, the auditee should carefully make preparations in accordance with the requirements of the internal audit notice, and handle special cases in accordance with the requirements of the relevant authorized departments.
Page 3 of 8
internal audit system
Article 18 Internal audit work shall be carried out in strict accordance with the prescribed audit procedures:
(1) Before implementing internal audit, an internal audit plan should be formulated and an internal audit notice should be issued to the auditee;
(2) Internal auditors conduct careful and detailed investigations and inquiries into the relevant information of the audited objects, obtain valid certification materials, and make detailed records;
(3) Further implement the evidence collection for the problems discovered during the audit, ensure that the facts are clear and correct, and prepare internal audit working papers and internal audit reports based on the reviewed internal audit records;
(4) The internal audit report should solicit the opinions of the audited objects and submit it together with the feedback from the audited objects to the audit committee of the board of directors and other relevant departments;
(5) If the auditee has objections to the audit decision, he or she may submit a written opinion to the Audit Committee within seven days from the date of receiving the decision. The Audit Committee will handle the complaint within fifteen days according to its authority. Failure to provide an opinion within the time limit will be deemed to have no objection;
(6) The Audit and Compliance Department should conduct follow-up audits of audit matters, inspect and supervise the implementation and rectification of audit opinions, and achieve closed-loop management of the entire audit project.
Article 19 The Audit Compliance Department shall organize and archive the audit files after the audit project is completed in accordance with the requirements of the company's Archives Management System.
Chapter 5 Specific Implementation of Internal Audit
Article 20 The Audit and Compliance Department shall implement appropriate review procedures in accordance with relevant regulations, evaluate the effectiveness of the company's internal controls, and submit an internal control evaluation report to the Audit Committee at least once a year. The evaluation report shall state the purpose, scope, review conclusions and suggestions for improving internal control.
Article 21 The Audit Committee of the Board of Directors shall supervise the internal audit department to conduct inspections of the following matters (if any) at least once every six months. If any major defects or major risks are found in internal control, it shall promptly report to the Board of Directors:
(1) The implementation of major events such as the use of funds raised by the company, provision of guarantees, related transactions, securities investment and financial management, provision of financial assistance, purchase or sale of assets, external investment, etc.;
(2) The company’s large capital transactions and capital transactions with directors, senior managers, controlling shareholders, actual controllers and their related parties.
Article 22 The scope of internal control review and evaluation shall include the establishment and implementation of internal controls related to financial reporting and information disclosure matters. The Audit and Compliance Department shall ensure the integrity and reasonableness of the internal control system related to large non-operating capital transactions, external investment, purchase and sale of assets, external guarantees, related transactions, use of raised funds, information disclosure matters, etc.
Page 4 of 8
The effectiveness of the internal audit system and its implementation is the focus of inspection and evaluation.
Article 23: For internal control deficiencies discovered during the review process, the Audit and Compliance Department shall urge the relevant responsible departments to formulate rectification measures and rectification time, conduct follow-up reviews, and supervise the implementation of rectification measures. The head of the audit and compliance department should arrange follow-up reviews and incorporate them into the annual internal audit work plan.
Article 24 The Audit and Compliance Department shall conduct timely audits after the occurrence of important external investment matters. When auditing external investment matters, you should focus on the following:
(1) Whether the review and approval procedures for foreign investment are carried out in accordance with relevant regulations;
(2) Whether the contract was concluded in accordance with the approved content and whether the contract was performed normally;
(3) If entrusted financial management matters are involved, whether the risk level and investment direction of the entrusted financial management products are in line with the annual review plan, whether there is any inter-temporal behavior, and whether there is a dedicated person to track the progress of the entrusted financial management;
(4) When securities investment matters are involved, attention should be paid to whether the company has established a special internal control system for securities investment behavior, whether the scale of investment affects the company's normal operations, whether the source of funds is its own funds, whether the investment risk exceeds the company's bearable range, and whether it uses other people's accounts or provides funds to others for securities investment.
Article 25 The Audit and Compliance Department shall conduct timely audits after the occurrence of major asset purchases and sales. When auditing the purchase and sale of assets, you should focus on the following:
(1) Whether the purchase and sale of assets are subject to approval procedures in accordance with relevant regulations;
(2) Whether the contract was concluded in accordance with the approved content and whether the contract was performed normally;
(3) Whether the price of the purchased assets is fair;
(4) Whether there are guarantees, mortgages, pledges and other transfer restrictions on the purchased assets, and whether they involve litigation, arbitration and other major disputes.
Article 26 The Audit and Compliance Department shall conduct timely audits after the occurrence of important related party transactions. When auditing related party transactions, you should focus on the following:
(1) Whether the list of related parties has been determined and updated in a timely manner;
(2) Whether related transactions have been reviewed and approved in accordance with relevant regulations, and whether related shareholders or directors have abstained from voting when reviewing related transactions;
(3) Whether it has performed the review procedures or expressed opinions in accordance with relevant rules;
(4) Whether the contract was concluded in accordance with the approved content and whether the contract was performed normally;
(5) Whether there are guarantees, mortgages, pledges and other transfer restrictions on the subject matter of the transaction, and whether it involves litigation, arbitration and other major disputes;
(6) Whether the pricing of related-party transactions is fair, whether the subject matter of the transaction has been audited or evaluated in accordance with relevant regulations, and whether the related-party transactions
Page 5 of 8
Whether the internal audit system will infringe on the company's interests.
Article 27 The Audit and Compliance Department shall conduct an audit on the storage and use of raised funds at least once every six months, express opinions on the authenticity and compliance of the use of raised funds, and report the inspection results to the Audit Committee in a timely manner. When auditing the use of raised funds, focus on the following:
(1) Whether the raised funds are deposited in a special raised fund account for centralized management, and whether the company has signed a three-party supervision agreement with the commercial bank and sponsor where the raised funds are deposited;
(2) Whether the raised funds are used in accordance with the raised funds investment plan promised in the issuance application documents;
(3) Whether the raised funds are used for pledges, entrusted loans or other investments that change the purpose of the raised funds in a disguised manner, and whether the raised funds have been occupied or misappropriated;
(4) When matters such as using raised funds to replace self-owned funds that have been invested in raised funds projects in advance, using idle raised funds to temporarily supplement working capital, changing the investment direction of raised funds, using idle raised funds for financial management, etc., whether the approval procedures and information disclosure obligations are performed in accordance with relevant regulations.
If any irregularities or major risks are discovered in the company's management of raised funds, it shall be reported to the board of directors in a timely manner. The board of directors shall report to the regulatory authorities in a timely manner after receiving the report and do a good job in information disclosure.
Article 28 When reviewing and evaluating the establishment and implementation of the information disclosure management system, the Audit and Compliance Department will focus on the following:
(1) Whether the company has formulated an information disclosure management system and related systems in accordance with relevant regulations;
(2) Whether the scope and content of material information are clearly defined, as well as the process for the transmission, review and disclosure of material information;
(3) Whether confidentiality measures have been formulated for undisclosed major information, and the scope and confidentiality responsibilities of insiders of inside information have been clarified;
(4) Whether the rights and obligations of the company and its directors, senior managers, shareholders, actual controllers and other relevant information disclosure obligors in information disclosure matters are clearly stipulated;
(5) If the company, controlling shareholders and actual controllers have public commitments, the performance of the commitments;
(6) Whether the information disclosure management system and related systems are effectively implemented.
Chapter 6 Information Disclosure
Article 29 The specific organization and implementation of the company's internal control evaluation shall be the responsibility of the Audit and Compliance Department. The company shall issue an annual internal control evaluation report on the establishment and implementation of the internal control system related to financial reporting and information disclosure based on the evaluation report and relevant information issued by the internal audit institution and reviewed by the audit committee. The company's board of directors should formulate a resolution on the internal control self-evaluation report while reviewing the annual report.
Page 6 of 8
internal audit system
Article 30 When a company hires an accounting firm to conduct annual audits, it shall also require the accounting firm to issue an internal control audit report on the effectiveness of the company's internal controls related to financial reporting every year. Except as otherwise provided by the stock exchange. If an accounting firm issues a non-standard audit report on the effectiveness of the company's internal control, or points out that there are major deficiencies in the company's internal control over non-financial reporting, the company's board of directors shall make a special explanation of the matters involved, and the special explanation shall at least include the following:
(1) Basic information on the matters involved;
(2) The degree of impact of the matter on the effectiveness of the company’s internal control;
(3) The opinion of the company’s board of directors on this matter;
(4) Specific measures to eliminate the matter and its impact.
Article 31 If an accounting firm issues an audit report with an unqualified opinion on the effectiveness of the company's internal control, the company's board of directors shall make a special explanation of the matters involved in the assurance conclusion. The special explanation shall at least include the following:
(1) Basic information on the matters involved in the assurance conclusion;
(2) The degree of impact of the matter on the effectiveness of the company’s internal control;
(3) The opinion of the company’s board of directors on this matter;
(4) Specific measures to eliminate the matter and its impact.
Article 32 A company shall disclose an internal control self-evaluation report and an internal control audit report issued by an accounting firm while disclosing its annual report.
Chapter 7 Supervision, Management, Accountability and Punishment
Article 33: Establish an incentive and restraint mechanism for the audit and compliance department to supervise and evaluate the work of internal auditors. The chairman and vice chairman of the board of directors are responsible for evaluating the work performance of the audit and compliance department.
Article 34 Internal auditors who conscientiously perform their duties, are loyal to their duties, adhere to principles, and make outstanding achievements will be rewarded according to the company's highest performance appraisal; internal auditors who abuse their power, practice favoritism, neglect their duties, or leak secrets will be dealt with by the company in accordance with relevant regulations; if a crime is constituted, they will be transferred to the judicial authorities for criminal responsibility.
Article 35 If relevant personnel of the audited department (unit) fail to cooperate with relevant audits, refuse audits, or fail to provide information, provide false information, or fail to implement internal audit opinions in a timely manner, they refuse to implement the audit conclusions and will be ordered by the company to make corrections and the relevant responsible persons will be dealt with.
Article 36 If internal auditors are threatened, retaliated or framed for performing their duties, the company shall promptly take protective measures and deal with the relevant responsible personnel; if they are suspected of committing a crime, they shall be transferred to the judicial authorities for investigation of criminal liability in accordance with the law.
Page 7 of 8
internal audit system
Chapter 8 Supplementary Provisions
Article 37 This system applies to the company and its subsidiaries included in the consolidated statements.
Article 38 The Audit and Compliance Department is responsible for the interpretation and revision of this system.
Article 39 This system will take effect from the date of review and approval by the company's board of directors.
Page 8 of 8