Tonghe Pharmaceutical: Internal Audit System (October 2025)
Jiangxi Tonghe Pharmaceutical Co., Ltd.
internal audit system
Chapter 1 General Provisions
Article 1 In order to further standardize the internal audit work of Jiangxi Tonghe Pharmaceutical Co., Ltd. (hereinafter referred to as the "Company"), improve the quality of internal audit work, and protect the legitimate rights and interests of investors, this system is formulated in accordance with the "Audit Law" and other relevant laws, regulations, rules, normative documents and the "Articles of Association of Jiangxi Tonghe Pharmaceutical Co., Ltd." (hereinafter referred to as the "Articles of Association").
Article 2 The term "internal audit" as mentioned in this system refers to an evaluation activity carried out by a company's internal institutions or personnel on the effectiveness of its internal control and risk management, the authenticity and completeness of financial information, and the efficiency and effectiveness of its operating activities.
Article 3 The term "internal control" as used in this system refers to the process by which the company's board of directors, senior managers and other relevant personnel provide reasonable guarantees for achieving the following goals:
(1) Comply with national laws, regulations, rules and other relevant provisions;
(2) Improve the efficiency and effectiveness of the company’s operations;
(3) Ensure the safety of the company’s assets;
(4) Ensure that the company’s information disclosure is true, accurate, complete and fair.
Article 4 A company shall, in accordance with the provisions of relevant national laws, regulations, rules and normative documents, and in combination with the industry and production and operation characteristics of the company, establish and improve an internal audit system to prevent and control company risks and enhance the reliability of company information disclosure.
Article 5 The company’s board of directors shall be responsible for the establishment, improvement and effective implementation of the internal control system. Important internal control systems shall be reviewed and approved by the board of directors.
The company's board of directors and all its members shall ensure that the information disclosed regarding internal control is true, accurate and complete.
Chapter 2 General Provisions
Article 6 The company shall establish an audit committee under the board of directors and formulate the rules of procedure of the audit committee. The members of the audit committee shall be composed of no less than three directors, of whom the majority shall be independent directors, and at least one independent director shall be an accounting professional and serve as the convener.
Article 7 The company shall establish an internal audit department to inspect and supervise the authenticity and completeness of the company's financial information, the establishment and implementation of the internal control system, etc. The internal audit department is responsible to the board of directors and reports to the audit committee. The internal audit department shall accept the supervision and guidance of the audit committee during the inspection and supervision of the company's business activities, risk management, internal control, financial information, etc.
Article 8 A company shall allocate full-time personnel to engage in internal audit work based on its size, production and operation characteristics and relevant regulations, and there shall be no less than one full-time person.
Article 9 The head of the internal audit department must be full-time, nominated by the audit committee, and appointed and removed by the board of directors. The company should disclose the academic qualifications, professional titles, work experience, relationship with the actual controller, etc. of the person in charge of the internal audit department, and report it to the stock exchange for filing.
Article 10 The internal audit department shall maintain its independence and shall not be placed under the leadership of the financial department, or work together with the financial department.
Article 11 All internal agencies or functional departments of the company, holding subsidiaries and joint-stock companies with significant influence shall cooperate with the internal audit department in performing their duties in accordance with the law and shall not hinder the work of the internal audit department.
Chapter 3 Responsibilities and Authority
Article 12 The audit committee shall perform the following main responsibilities when guiding and supervising the work of the internal audit department:
(1) Guide and supervise the establishment and implementation of the internal audit system;
(2) Review the company’s annual internal audit work plan;
(3) Supervise the implementation of the company’s internal audit plan;
(4) Guide the effective operation of the internal audit institution. The company's internal audit institution shall report its work to the audit committee. Various audit reports submitted by the internal audit institution to the management, rectification plans for audit issues, and rectification status shall be submitted to the audit committee at the same time;
(5) Conduct inspections on the following matters at least once every six months, issue inspection reports and submit them to the Audit Committee:
The implementation of major events such as the use of funds raised by the company, provision of guarantees, related transactions, securities investments and derivatives transactions and other high-risk investments, provision of financial assistance, purchase or sale of assets, external investments, etc.;
The company’s large capital transactions and capital transactions with directors, senior managers, controlling shareholders, actual controllers and their related parties;
(6) Report to the board of directors the progress and quality of internal audit work and major problems discovered;
(7) Coordinate the relationship between the internal audit department and external audit units such as accounting firms and national audit institutions.
If the inspection specified in Item (5) of this Article finds that the company has violated laws, regulations, irregularities in operations, etc., the audit committee shall report to the exchange in a timely manner.
The audit committee shall issue written evaluation opinions on the effectiveness of the company's internal controls based on the internal audit report and relevant materials submitted by the internal audit institution, and report to the board of directors.
If the board of directors or the audit committee believes that there are major deficiencies or major risks in the company's internal control, or if the sponsor, independent financial consultant, or accounting firm points out that there are major deficiencies in the effectiveness of the company's internal control, the board of directors shall report to the exchange in a timely manner and disclose it. The company shall disclose in the announcement any major deficiencies or major risks in internal control, the consequences that have occurred or may result, and the measures that have been taken or planned to be taken.
Article 13 The internal audit department shall perform the following main responsibilities:
(1) Inspect and evaluate the integrity, rationality and effectiveness of the internal control systems of the company’s internal institutions, holding subsidiaries and joint-stock companies with significant influence;
(2) Audit the accounting data and other relevant economic data of the company's internal institutions, holding subsidiaries, and joint-stock companies with significant influence, as well as the legality, compliance, authenticity and completeness of the reflected financial revenues and expenditures and related economic activities, including financial reports, performance forecasts, performance bulletins, voluntary disclosure of predictive financial information, etc.;
(3) Assist in establishing and improving the anti-fraud mechanism, determine the key areas, key links and main contents of anti-fraud, and pay attention to and inspect possible fraud during the internal audit process. If any major issues or clues related to the company are discovered, they should immediately report directly to the audit committee;
(4) Report to the board of directors or audit committee at least once every quarter, including the implementation of the internal audit plan and problems discovered during the internal audit work.
(5) Actively cooperate with the Audit Committee in communicating with accounting firms, national audit institutions and other external audit units, and provide necessary support and collaboration.
Article 14 The internal audit department shall submit the internal audit work plan for the next year to the Audit Committee within two months before the end of each fiscal year, and submit the annual internal audit work report to the Audit Committee within two months after the end of each fiscal year.
The internal audit department should make the audit of important external investments, purchase and sale of assets, external guarantees, related transactions, use of raised funds, information disclosure and other matters a necessary part of the annual work plan.
Article 15 The internal audit department shall carry out audit work based on business links, and evaluate the rationality of the design and implementation effectiveness of internal controls related to financial reporting and information disclosure matters based on the actual situation.
Article 16 Internal audit should usually cover all business links related to financial reporting and information disclosure matters in the company's operating activities, including: sales and collections, procurement and payment, inventory management, fixed asset management, fund management, investment and financing management, human resources management, information system management and the company's information disclosure affairs management, etc.
The internal audit department can adjust the above business links according to the company's industry and production and operation characteristics.
Article 17 The audit evidence obtained by internal auditors shall be sufficient, relevant and reliable. Internal auditors should clearly and completely record the name, source, content, time and other information of obtaining audit evidence in working papers.
Article 18 Internal auditors shall prepare and review audit working papers in accordance with relevant regulations during audit work, and after the completion of the audit project, promptly classify and archive the audit working papers. The internal audit department shall establish a confidentiality system for working papers, establish a corresponding archives management system in accordance with relevant laws and regulations, and clarify the retention time of internal audit work reports, working papers and related materials in accordance with relevant archives management regulations.
Article 19 The internal audit department may exercise the following powers during audit work:
(1) Based on the needs of internal audit work, the auditee may be required to submit plans, budgets, final accounts, statements and relevant documents and materials on time, and convene or participate in meetings related to audit matters to understand relevant situations.
(2) Review accounting vouchers, accounts, and final accounts, inspect company funds and properties, test financial accounting information systems and accounting software, and review relevant documents and materials, etc.
(3) Investigate the relevant matters involved in the audit and obtain supporting materials from relevant departments or individuals.
(4) For departments or individuals that obstruct or impede audit work, or refuse to provide relevant information, with the approval of the Audit Committee, necessary temporary emergency measures such as sealing relevant information may be taken, and suggestions for holding relevant personnel accountable shall be made.
(5) For ongoing serious violations of national laws, regulations and company rules and regulations and harm to the company's interests, with the approval of the audit committee, the company has the right to make a temporary stop decision and put forward opinions on corrective actions and suggestions for improvement.
(6) If internal auditors find deficiencies in the company's rules and regulations and corporate management, they should make reasonable suggestions to the company's management to improve management and improve efficiency.
(7) Propose commendations and rewards to departments and individuals that strictly abide by and maintain financial laws and regulations.
(8) Report relevant situations to the Audit Committee.
Article 20 The company should provide necessary conditions for internal audit work to ensure that internal audit department personnel can grasp various information in a timely manner and perform their duties independently, objectively and impartially. When the tasks are overloaded or the audit force is insufficient during the audit, the internal audit department may, with the consent of the board of directors, entrust a social audit agency to conduct the audit.
Chapter 4 Specific Implementation
Article 21 The internal audit department shall implement appropriate review procedures in accordance with relevant regulations, evaluate the effectiveness of the company's internal controls, and submit an internal control self-evaluation report to the audit committee at least once a year.
The evaluation report shall state the purpose, scope, review conclusions and suggestions for improving internal control.
Article 22 The scope of internal control review and evaluation shall include the establishment and implementation of internal control systems related to financial reporting and information disclosure matters.
The internal audit department shall focus on inspection and evaluation of the integrity, rationality and effectiveness of the internal control system related to external investment, purchase and sale of assets, external guarantees, related transactions, use of raised funds, information disclosure and other matters.
Article 23: For internal control deficiencies discovered during the review process, the internal audit department shall urge the relevant responsible departments to formulate rectification measures and rectification time, conduct follow-up reviews of internal control, and supervise the implementation of rectification measures.
The head of the internal audit department should arrange follow-up reviews of internal controls in a timely manner and incorporate them into the annual internal audit work plan.
Article 24 If the internal audit department discovers major deficiencies or major risks in internal control during the review process, it shall report to the audit committee in a timely manner.
If the audit committee believes that there are major deficiencies or major risks in the company's internal control, the board of directors shall promptly report to the stock exchange and disclose it. The company shall disclose in the announcement any major deficiencies or major risks in internal control, the consequences that have occurred or may result, and the measures that have been taken or planned to be taken.
Article 25 The internal audit department shall conduct timely audits after the occurrence of important external investment matters. When auditing external investment matters, you should focus on the following:
(1) Whether the review and approval procedures for foreign investment are carried out in accordance with relevant regulations;
(2) Whether the contract was concluded in accordance with the approved content and whether the contract was performed normally;
(3) Whether to assign special personnel or establish a special agency to study and evaluate the feasibility, investment risks and investment returns of major investment projects, and track and supervise the progress of major investment projects;
(4) For matters involving entrusted financial management, pay attention to whether the company has delegated the authority to approve entrusted financial management to individual directors or operating management of the company, whether the trustee's integrity record, operating conditions and financial status are good, and whether a dedicated person has been assigned to track and supervise the progress of entrusted financial management;
(5) For matters involving securities investment and risk investment, pay attention to whether the company has established a special internal control system, whether the investment scale affects the company's normal operations, whether the source of funds is its own funds, whether the investment risk exceeds the company's tolerable range, whether there are circumstances that prohibit securities investment, risk investment, etc. stipulated in relevant business rules, and whether the sponsor has issued an opinion (if applicable).
Article 26 The internal audit department shall conduct timely audits after important asset purchases and sales occur. When auditing the purchase and sale of assets, you should focus on the following:
(1) Whether the purchase and sale of assets are subject to approval procedures in accordance with relevant regulations;
(2) Whether the contract was concluded in accordance with the approved content and whether the contract was performed normally;
(3) Whether the operating conditions of the purchased assets are consistent with expectations;
(4) Whether there are guarantees, mortgages, pledges and other restrictions on transfer of the purchased assets, and whether they involve litigation, arbitration and other major disputes.
Article 27 The internal audit department shall conduct timely audits after the occurrence of important external guarantee matters. When auditing external guarantee matters, focus should be placed on the following:
(1) Whether the approval procedures for external guarantees are carried out in accordance with relevant regulations;
(2) Whether the guarantee risk exceeds the company's bearable range, and whether the guaranteed party's integrity record, operating conditions and financial status are good;
(3) Whether the secured party provides a counter-guarantee and whether the counter-guarantee is enforceable;
(4) Whether the sponsor has expressed an opinion (if applicable);
(5) Whether a special person is assigned to continuously pay attention to the operating status and financial status of the guaranteed party.
Article 28 The internal audit department shall promptly conduct audits after the occurrence of important related party transactions. When auditing related party transactions, you should focus on the following:
(1) Whether the list of related parties has been determined and updated in a timely manner;
(2) Whether related transactions have been reviewed and approved in accordance with relevant regulations, and whether related shareholders or directors have abstained from voting when reviewing related transactions;
(3) Whether the special meeting of independent directors has been reviewed in advance and whether the sponsor has issued an opinion (if applicable);
(4) Whether a written agreement has been signed for related-party transactions, and whether the rights, obligations and legal responsibilities of both parties to the transaction are clear;
(5) Whether there are guarantees, mortgages, pledges and other transfer restrictions on the subject matter of the transaction, and whether it involves litigation, arbitration and other major disputes;
(6) Whether the integrity record, operating conditions and financial status of the counterparty are good;
(7) Whether the pricing of related-party transactions is fair, whether the subject matter of the transaction has been audited or evaluated in accordance with relevant regulations, and whether the related-party transactions harm the interests of the company.
Article 29 The internal audit department shall inspect the storage, management and use of raised funds at least once every quarter, and report the inspection results to the audit committee in a timely manner. When checking the use of raised funds, you should focus on the following:
(1) Whether the raised funds are deposited in a special account decided by the board of directors for centralized management, and whether the company has signed a three-party supervision agreement with the commercial bank and sponsor institution where the raised funds are deposited;
(2) Whether the raised funds are used in accordance with the raised funds investment plan promised in the issuance application documents, whether the investment progress of the raised funds projects is in line with the planned progress, and whether the investment returns are consistent with expectations;
(3) Whether the raised funds are used for pledges, entrusted loans or other investments that change the purpose of the raised funds in a disguised manner, and whether the raised funds have been occupied or misappropriated;
(4) When matters such as using raised funds to replace self-raised funds that have been invested in raised funds projects in advance, using idle raised funds to temporarily supplement working capital, changing the use of raised funds, etc., whether the approval procedures and information disclosure obligations are performed in accordance with relevant regulations, and whether the sponsor issues an opinion in accordance with relevant regulations (if applicable).
Article 30 The internal audit department shall audit the performance report before it is disclosed to the public. When auditing performance reports, you should focus on the following:
(1) Whether it complies with the Accounting Standards for Business Enterprises and related regulations;
(2) Whether the accounting policies and accounting estimates are reasonable and whether they have changed;
(3) Whether there are any major abnormal events;
(4) Whether the going concern assumption is met;
(5) Whether there are major deficiencies or major risks in the internal control related to financial reporting.
Article 31 When reviewing and evaluating the establishment and implementation of the information disclosure management system, the internal audit department shall focus on the following contents:
(1) Whether the company has formulated information disclosure management systems and related systems in accordance with relevant regulations, including information disclosure management and reporting systems for internal agencies, holding subsidiaries, and joint-stock companies with significant influence;
(2) Whether the scope and content of major information are clearly defined, as well as the process for the transmission, review and disclosure of major information;
(3) Whether confidentiality measures have been formulated for undisclosed major information, and the scope and confidentiality responsibilities of insiders of inside information have been clarified;
(4) Whether the rights and obligations of the company and its directors, senior managers, shareholders, actual controllers and other relevant information disclosure obligors in information disclosure matters are clearly stipulated;
(5) If the company, controlling shareholders and actual controllers have public commitments, whether the company has designated a dedicated person to track the performance and disclosure of the commitments;
(6) Whether the information disclosure management system and related systems are effectively implemented.
Chapter 5 Information Disclosure
Article 32 The audit committee shall issue an annual internal control self-evaluation report on the establishment and implementation of the internal control system related to financial reporting and information disclosure based on the evaluation report and relevant materials issued by the internal audit department. The internal control self-evaluation report should at least include the following contents:
(1) Statement by the board of directors on the authenticity of the internal control report;
(2) The overall situation of internal control evaluation work;
(3) The basis, scope, procedures and methods of internal control evaluation;
(4) Internal control deficiencies and their identification;
(5) Rectification of internal control deficiencies in the previous year;
(6) Corrective measures to be taken to address internal control deficiencies this year;
(7) Conclusion on the effectiveness of internal control.
The company's board of directors should formulate a resolution on the internal control self-evaluation report while reviewing the annual report. The internal control evaluation report shall be submitted to the board of directors for review after being approved by more than half of all members of the audit committee. The sponsor institution or independent financial consultant (if any) shall verify the internal control evaluation report and issue verification opinions.
Article 33 If an accounting firm issues a non-standard audit report on the effectiveness of the company's internal control or points out that there are major deficiencies in the company's internal control over non-financial reporting, the company's board of directors shall make a special explanation of the matters involved. The special explanation shall at least include the following:
(1) Basic information on the matters involved;
(2) The degree of impact of the matter on the effectiveness of the company’s internal control;
(3) The opinions of the company’s board of directors and the audit committee on the matter and the materials on which they are based;
(4) Specific measures to eliminate the matter and its impact.
Article 34 The internal control self-evaluation report and the accounting firm's internal control audit report (if any) shall be disclosed on the designated website at the same time as the annual report is disclosed.
Chapter 6 Supervision System
Article 35 The company regards the completeness and effective implementation of the internal control system as one of the important indicators for the performance evaluation of the company's departments (including branches) and holding subsidiaries.
The company has established an accountability mechanism to investigate and deal with relevant responsible persons who violate the internal control system and affect the implementation of the internal control system.
Chapter 7 Supplementary Provisions
Article 36 This system will take effect on the date it is reviewed and approved by the company's board of directors.
Article 37 The Board of Directors is responsible for the interpretation and modification of this system.
Article 38 If matters are not covered in this system or are inconsistent with relevant laws and regulations, the relevant provisions of regulatory agencies, and the company's articles of association, the relevant laws, regulations, relevant regulations of regulatory agencies, and the company's articles of association shall be followed.
Jiangxi Tonghe Pharmaceutical Co., Ltd.
October 2025