Important Statement
Internal control is a process implemented by the company's board of directors, audit committee, management, and all employees aimed at achieving control objectives. Under the supervision of the governance layer, it is the board's responsibility to design, implement, maintain effective internal controls, evaluate their effectiveness, and disclose the internal control evaluation report truthfully. The audit committee supervises the establishment and implementation of internal controls by the board. The management is responsible for organizing and leading the daily operations of internal controls. The board, audit committee, directors, and senior management ensure that the report contains no false records, misleading statements, or significant omissions, and bear individual and joint responsibility for the truthfulness, accuracy, and completeness of the report's content. The goal of establishing and implementing internal controls is to reasonably ensure the legality and compliance of business management, asset security, the authenticity and completeness of financial reporting and related information, improve operational efficiency and effectiveness, and promote the company's strategic development. Due to inherent limitations in internal controls, they can only provide reasonable assurance of achieving these objectives. Additionally, changes in circumstances may render internal controls inappropriate or reduce adherence to control policies or procedures, making it risky to infer future effectiveness based on evaluation results.
Internal Control Evaluation Procedures and Methods
The internal control evaluation work is led by the board of directors and its audit committee, forming an evaluation team primarily led by the audit department with participation from multiple departments to evaluate major risk areas and units included in the evaluation scope.
Evaluation Procedures:
- Establish an evaluation team and develop an evaluation plan;
- Conduct on-site inspections;
- The evaluation team studies and identifies internal control deficiencies;
- Discuss and review rectification plans;
- Submit for board approval according to prescribed authority and procedures.
Evaluation Methods:
The evaluation team employs various methods, including individual interviews, surveys, thematic discussions, walkthrough tests, statistical sampling, and comparative analysis, to widely collect evidence of the design and effective operation of internal controls, identifying design and operational deficiencies.
Scope of Internal Control Evaluation
The company determines the major units, businesses, and high-risk areas included in the evaluation scope based on a risk-oriented principle. The major units included in the evaluation scope are the company and all its wholly-owned subsidiaries. The total assets of the consolidated units included account for 100% of the total assets in the company's consolidated financial statements, and the total operating revenue accounts for 100% of the total operating revenue in the consolidated financial statements. The major businesses included in the evaluation scope are: funds, procurement, costs, sales, operations, investments, related transactions, external guarantees, and information disclosure. The matters included in the evaluation scope encompass: corporate governance, organizational structure, development strategy, corporate culture, information disclosure, information systems, internal audits at the company level; human resources, financial reporting, third-party payment business management, fund management, asset management, cost and expense management, guarantee business, related transactions at the business level. The high-risk areas of focus primarily include internal controls over related transactions, external guarantees, external investments, the effectiveness of authorization and approval processes, internal controls over financial reporting, and internal controls over information disclosure. The units, businesses, matters, and high-risk areas included in the evaluation scope cover the main aspects of the company's management and operations, with no significant omissions.