亿帆医药: 内部审计制度（2025年8月修订）

Core Viewpoint - The internal audit system of Yifan Pharmaceutical Co., Ltd. aims to enhance and standardize internal audit work, improve management quality, and protect investors' rights through compliance with relevant laws and regulations [1]. Group 1: General Principles - The internal audit is defined as an independent and objective activity that evaluates the appropriateness and effectiveness of business activities, internal controls, and risk management [1]. - The board of directors is responsible for establishing and implementing internal control systems, ensuring the accuracy and completeness of related disclosures [1]. Group 2: Internal Audit Organization and Personnel - An audit committee is established under the board of directors to lead the audit supervision work, consisting of at least three directors, with a majority being independent directors [2]. - The audit department operates independently under the audit committee and is responsible for supervising business activities, risk management, and financial information [2][3]. - The audit department must maintain independence and cannot be under the leadership of the finance department [3]. Group 3: Responsibilities and Authority of Internal Audit - The audit committee guides and supervises the establishment and implementation of the internal audit system and reviews the annual audit work plan [4]. - The audit department is responsible for evaluating the effectiveness of internal controls and auditing financial data for legality, compliance, and accuracy [4][5]. - The internal audit institution has the authority to request necessary documents and participate in significant meetings related to financial activities [5]. Group 4: Audit Work Procedures - Audit personnel must follow established procedures and standards to conduct audits, ensuring the collection of sufficient and relevant evidence [6][7]. - Audit reports must be reviewed and approved by the audit department manager and the audit director before being delivered to the audited unit [8]. Group 5: Audit Reporting - The audit department must issue audit reports detailing the scope, basis, and procedures of the audit, along with significant findings [15]. - The audit committee must report on the effectiveness of internal controls based on the internal audit reports and related materials [11]. Group 6: Audit Information Disclosure - The internal audit institution is responsible for the organization and implementation of internal control evaluations, which must be reported to the board of directors [17]. - Any significant deficiencies in internal controls identified by external auditors must be disclosed by the board of directors [17]. Group 7: Audit Archives Management - After completing an audit project, the audit team must organize and archive audit work papers according to relevant regulations [18]. - Internal auditors are required to maintain confidentiality regarding sensitive information obtained during audits [18]. Group 8: Rewards and Penalties - The company establishes mechanisms to supervise and evaluate the performance of internal auditors, holding them accountable for violations of the audit system [20].