Internal Audit System of Shanghai Pharmaceutical Group Co., Ltd.

Chapter I General Provisions

Article 1 In order to standardize the internal audit work of Shanghai Pharmaceutical Group Co., Ltd. (hereinafter referred to as "the company") and establish and improve the internal audit system, in accordance with the Company Law of People's Republic of China (PRC), the Provisions of the Audit Commission on Internal Audit, the Basic Auditing Standards of People's Republic of China (PRC), the Interim Measures for the Administration of Internal Audit of State-owned Enterprises in Shanghai, the Basic Standards for Internal Control of Enterprises and the Articles of Association and other relevant regulations.

Article 2 This system is applicable to the internal audit work of corporate units (hereinafter referred to as corporate units) such as main system companies, wholly-owned or holding subsidiaries directly or indirectly controlled by companies.

Article 3 This system refers to the internal management procedures and rules that internal audit institutions and personnel use certain procedures and methods to inspect and evaluate the authenticity, legality and efficiency of the economic activities of the company and its units, supervise, inspect and evaluate the internal control and governance procedures, put forward rectification opinions, urge improvement, help the company to continuously improve its operating efficiency, improve its management, realize the preservation and appreciation of assets, safeguard the legitimate rights and interests of owners, and implement self-discipline and self-monitoring mechanisms.

Article 4 A company unit shall formulate its own internal audit system according to the provisions of this system or with reference to this system.

Article 5 Citation criteria

(1) Accounting Law of People's Republic of China (PRC);

(2) Audit Law of People's Republic of China (PRC);

(3) People's Republic of China (PRC) Company Law;

(4) The basic auditing standards of People's Republic of China (PRC).

(five) the provisions of the National Audit Office on internal audit;

(6) Basic principles of internal audit;

(seven) professional ethics of internal auditors;

(eight) the specific standards of internal audit;

(9) Provisions of Shanghai Municipality on Internal Audit System of Enterprises;

(10) Accounting Standards for Enterprises;

(eleven) "basic norms of enterprise internal control" and related application guide;

(12) Other relevant laws and regulations.

Chapter II Internal Audit Institutions and Personnel

Article 6 The Company shall set up an independent Audit Department (hereinafter referred to as the Audit Department), which, under the leadership of the Board of Directors (Audit Committee) of the Company, shall independently carry out its work and exercise its internal supervision power in accordance with the laws and regulations of the state and local governments, overseas regions and countries, and the rules and regulations of the Company.

Article 7 By standardizing audit supervision, the Audit Department helps the company to strengthen internal control, guides all units of the company to strengthen financial management and internal control, sums up enterprise management experience with all units of the company, and puts forward opinions and suggestions for improving business management, so as to serve the optimization of management and the improvement of the company's economic benefits.

Article 8 The Audit Department shall help the company to set up an internal audit department or an internal audit institution in the internal audit business, gradually form an internal audit network between the company and the company, share internal audit resources, and improve internal audit efficiency. The management measures for the construction, management and evaluation of the company's internal audit institutions and audit teams shall be formulated by the company's audit department and implemented after the approval of the company's board of directors (audit committee).

Article 9 A company unit shall set up an independent internal audit department (hereinafter referred to as "internal audit institution") with professional internal auditors (hereinafter referred to as "internal auditors") according to the actual situation of the enterprise; Or set up internal audit institutions, equipped with full-time or part-time internal auditors, to help enterprise management strengthen internal management and achieve economic goals. An internal audit institution shall not be jointly established with the financial department. If it is jointly established with the non-financial department, the person in charge of the internal audit work and the personnel who undertake the responsibilities of the internal audit work shall be defined to ensure the independence of the internal audit work.

Article 10 Internal audit institutions shall maintain a reasonable and stable personnel structure to meet the needs of audit tasks, and qualified enterprises may be equipped with professionals in auditing, economy, management, finance and law. Eleventh internal auditors perform their duties according to law and are protected by laws and enterprise rules and regulations. No department or individual may refuse or obstruct internal auditors from performing their duties, and may not take revenge.

Article 12 Quality of internal auditors: Internal auditors should have the quality required by the Basic Standards for Internal Auditors, with correct guiding ideology, excellent professional ability, rigorous work style and high sense of responsibility.

Article 13 Internal auditors shall abide by the professional ethics of internal auditors, be loyal to their duties, be objective and fair, be honest, be modest and prudent, and keep secrets.

Fourteenth internal auditors should maintain a relatively independent position and should not have direct economic interests with the audited enterprises and objects. If an internal auditor has an interest in the audited enterprise or the audited matters, he shall withdraw.

Article 15 An internal auditor undertaking audit business shall meet the following conditions:

(a) familiar with the relevant laws, regulations and policies;

(2) Master auditing and related professional knowledge;

(3) Having certain professional experience in auditing or other related fields;

(4) Having high auditing skills, including being able to correctly use internal auditing procedures, methods and professional knowledge; Investigation, comprehensive analysis, professional judgment and written expression ability.

(V) Audit departments should pay attention to the follow-up education and training of internal auditors, constantly update their knowledge, conduct seminars and exchange experiences, and improve their professional level and business ability.

Chapter III Duties of Internal Audit Institutions and Personnel Article 16 Duties of Internal Audit Institutions and Personnel:

(1) To formulate an internal audit system, which shall be implemented after being approved by the board of directors;

(two) to formulate the annual internal audit work plan (including human resources, budget, etc.). ) and implemented after the approval of the chairman;

(3) Organizing the audit of the term of office and outgoing economic responsibility of the heads of the company's main business departments and the heads of the company's units;

(four) to organize the supervision and evaluation of the internal control system of the enterprise. Including the daily evaluation of the establishment and implementation of the daily internal control system of enterprises; When the enterprise's development strategy, organizational structure, business activities, business processes and employees in key positions undergo major adjustments or changes, it shall conduct targeted supervision and inspection on one or several aspects of internal control. Find out the key control points and weak links of internal control, and put forward suggestions and measures to establish and improve the internal control system of enterprises;

(five) to organize the audit and supervision of the budget, final accounts and completion and delivery of enterprise infrastructure projects and major technological transformation and overhaul projects;

(six) to organize audit and supervision of important economic activities such as enterprise restructuring, equity transfer, foreign investment, merger and bankruptcy, major contracts, and financial write-off of asset impairment reserves. , and ensure that the working procedures are legal and compliant;

(seven) to organize the audit and supervision of high-risk investment business such as enterprise economic guarantee, capital lending, entrusted wealth management, stocks, futures, foreign exchange and financial derivatives, so as to prevent business risks;

(eight) to organize the audit supervision and evaluation of the financial revenue and expenditure, financial budget, financial final accounts, asset quality, operating performance and other related economic activities of the enterprise and its subsidiaries;

(nine) to organize regular audits of overseas and foreign-invested enterprises and strengthen the audit supervision of overseas and foreign-invested enterprises;

(ten) to organize special audits of major business anomalies;

(eleven) organize the implementation of audit follow-up management, improve the application level of audit results.

Follow up the problems found in the audit and urge the rectification; Where accountability is involved, it shall report to the board of directors in a timely manner.

And transfer the audit situation to the discipline inspection and supervision department for handling.

(XII) Complete other matters assigned by the board of directors or the principal responsible person of the company.

(XIII) Report the implementation of the annual audit plan to the chairman and the board of directors (audit committee).

Seventeenth internal audit institutions and personnel authority:

(1) The internal audit institution has the right to know, supervise and make suggestions on the internal control process and risk control of the company;

(two) according to the needs of internal audit work, have the right to request the relevant units to submit plans, accounting statements, budgets, final accounts and relevant documents on time;

(three) to participate in important business meetings and relevant business and financial decision-making meetings, and to put forward opinions and suggestions on decision-making work; Participate in the research, formulation and revision of relevant rules and regulations of enterprises and supervise the implementation;

(4) Check the vouchers, statements, budgets and final accounts of the audited entity, check the use and management of funds and assets related to on-site investigation, consult relevant contracts, agreements, resolutions of the board of directors and other documents and minutes of meetings, and consult the annual accounting report, computer software, electronic data and other relevant materials audited by certified public accountants;

(five) to investigate the relevant matters and individuals involved in the audit and obtain relevant documents, materials and other supporting materials;

(six) have the right to report to the board of directors and the president in a timely manner on the risks or major control weaknesses found in the audit work, and implement continuous monitoring;

(seven) to make a temporary decision to stop serious violations of laws and regulations and serious losses and waste, and report to the board of directors and the president in a timely manner;

(8) Accounting vouchers, accounting books, statements and materials related to economic activities that may be transferred, concealed, tampered with or destroyed may be temporarily sealed with the authorization of the board of directors or the president;

(nine) to obstruct or hinder the audit work, provide false information, or refuse to provide relevant information, with the approval of the authorized unit of * * *, necessary temporary measures can be taken, and suggestions for investigating the responsibility of the relevant personnel are put forward;

(ten) have the right to put forward suggestions to improve management and efficiency, and correct and deal with violations of financial regulations.

(eleven) the board of directors and the president may grant the internal audit institution the necessary treatment or punishment power within the scope of management authority;

(twelve) have the right to question the relevant personnel.

(thirteen) have the right to organize or participate in the business management of external intermediaries.

(14) With the consent of the competent leaders of the enterprise, the audit department may employ external intermediaries or personnel in accordance with the procedures of the enterprise during the project implementation, and supervise the quality of their work.

(fifteen) have the right to report major problems with commonality found in the audit process within a certain scope.

Chapter IV Audit Scope and Audit Contents Article 18 Audit scope: companies, company units and cooperative projects.

Nineteenth audit content (choose different content according to different needs)

(1) The authenticity of assets, liabilities, changes in owners' equity and profits and losses;

(two) the implementation and final accounts of the financial revenue and expenditure budget;

(three) investment decisions, business decisions and their benefits;

(4) The business management activities are reasonable and effective;

(5) Budgets and final accounts of major investment projects;

(six) the establishment and implementation of various internal control systems;

(seven) the economic responsibility of managers during their term of office (resignation);

(eight) the implementation of national and local laws, regulations and company rules and regulations;

(nine) other matters that need to be audited.

Article 20 Specific Audit Business Management System The Audit Department shall formulate the following (but not limited to) specific audit system or audit process regulations according to this system, and report them to the company's board of directors (audit committee) or the president's office meeting for approval before implementation.

(a) the operating performance audit system;

(2) The outgoing audit system;

(3) Audit system for major investment projects;

(4) Internal control audit system;

(5) Special audit system.

Chapter V Audit Procedures Section 1 Planning Stage Article 21 Annual Audit Plan

At the beginning of the year, according to the relevant national regulations and the requirements of the board of directors (audit committee), the Audit Department combined with the annual business work plan of the company, the management needs of the company and its subordinate units, organizational risks and audit resources, and after fully communicating with the general managers of all departments and units of the company and the chairmen of subordinate enterprises, drew up the internal audit plan for that year, and submitted it to the chairman of the company or the board of directors (audit committee) for approval before implementation.

Article 22 An internal audit institution with a single audit plan shall determine the audit project and schedule according to the annual audit plan, and make the project audit plan and audit plan on the basis of fully understanding the basic situation of the audited unit or department, so as to make good preparations for the audit. It shall be implemented after being approved by the head of the internal audit institution. The specific steps are as follows:

(a) before the implementation of the audit project, the authorization of the chairman or president or legal representative of the audited enterprise must be obtained. Among them, the outgoing audit, business performance audit, important special audit and internal control audit of leading cadres of major companies are authorized by the chairman of the company.

(two) after accepting the audit commission, organize the investigation to understand the basic situation and relevant information of the audit matters.

(3) Compiling audit plans and procedures, determining the audit scope, key points, methods and steps, and reporting them to the authorized person and the competent leader for approval.

(4) issue a notice to be audited. Before the implementation of the audit, notify the audited enterprise in writing three working days in advance, put forward the working conditions that need to cooperate with the audit and provide relevant materials. When auditing, special audit services can be provided.

(five) after receiving the audit notice, the audited entity or department shall make all the preparations for accepting the audit. Including providing necessary working conditions for internal auditors and providing audit information.

Section 2 Audit Implementation Stage Article 23 Conduct compliance test and substantive test, including consulting materials, audit verification, obtaining evidence and preparing audit working papers.

Article 24 Audit shall be conducted by examining accounting vouchers, accounting books and statements, consulting documents and materials related to audit matters, and investigating. , in order to obtain the necessary supporting materials.

Twenty-fifth of the problems found in the audit, at any time to the relevant departments and personnel to put forward opinions and suggestions. If major problems are found, they should also report orally to the competent leaders and authorized persons of the enterprise in time or issue interim audit reports during the audit process.

Twenty-sixth after the audit site work, the major problems found will be informed to the management of the audited enterprise and the heads of relevant departments, and the relevant opinions of the management will be formed into working papers.

Section 3 Audit Completion Stage Article 27 After the audit is completed, the internal auditors shall collect and sort out the audit working papers, form audit conclusions and suggestions according to the audit evidence, issue audit reports for comments, and solicit opinions from the audited enterprises, individuals and relevant departments of the company.

Twenty-eighth audited units or departments have objections to the draft audit report, it shall submit written opinions to the audit department within ten working days from the date of receiving the draft. If the written opinions are not submitted within the time limit, it shall be deemed that there is no objection, and the internal auditors shall indicate it.

Article 29 After receiving the opinions of the audited enterprise, the audit department forms a formal internal audit report, which is submitted to the authorized person and the competent leader for review together with the opinions of the audited enterprise, and then submitted to the chairman or president of the company for signature, and is responsible for explaining the contents of the report.

Thirtieth major problems found in the audit project, the audit report can be directly submitted by the audit department to the chairman or president of the company.

Article 31 The signed audit report, audit opinion or audit decision shall be copied to the board of directors, key management personnel and relevant departments of the audited enterprise.

Article 32 The relevant departments and company units of the company may put forward corresponding treatment opinions according to the suggestions in the audit report, and implement them after examination and approval according to the examination and approval procedures stipulated in the articles of association of the audited enterprise.

Article 33 The audited entity or department shall carry out rectification according to the audit suggestions and approved handling opinions, and report the implementation of handling opinions and the adoption of audit suggestions to the audit authorizer and the audit department in writing.

Thirty-fourth audited units or departments have objections to the audit report, the person in charge of the audit project and relevant personnel shall conduct research and verification; If coordination is not possible, the audit report shall be submitted to the board of directors (audit committee) together with the opinions of the audited entity or department for coordination.

Section IV Follow-up Matters Article 35 The internal audit institution shall regularly organize follow-up audits and audit return visits according to the requirements of the company's chairman, president, leaders in charge, and legal representatives of companies and units, check the rectification of the audited enterprises, summarize the audit effect, and each company unit shall be responsible for the daily follow-up supervision of the rectification of enterprises. If it is found that the audited entity or department fails to take corrective measures, it shall report to the board of directors (audit committee).

Chapter VI Internal Audit Management Article 36 The audit department shall formulate standardized audit business processes and operate according to standards. When the audit environment changes, adjust the business norms accordingly.

Thirty-seventh internal audit institutions should establish audit quality control mechanism according to the specific circumstances of audit work and strengthen audit quality management.

Thirty-eighth after the completion of the audit project, the internal auditors shall timely sort out the working papers and other materials formed in the audit, and file, manage and use them in accordance with the requirements of relevant laws and regulations.

Thirty-ninth audit departments should pay attention to the follow-up education and training of internal auditors, and constantly improve the efficiency and quality of internal audit; Attach importance to economic information and audit information, and strengthen publicity work.

Article 40 An enterprise shall commend and reward internal auditors who have made outstanding achievements in audit work.

Chapter VII Liability for Violation of Provisions Article 41 The Audit Office will, according to the seriousness of the case, recommend the relevant enterprises to give administrative and economic penalties to enterprises and individuals who commit any of the following acts.

(a) refusing or delaying the provision of relevant documents, vouchers, accounts, materials and supporting materials.

(2) Obstructing internal auditors from exercising their functions and powers and resisting sabotage of supervision and inspection.

(3) Providing false information and concealing the truth.

(4) refusing to implement the audit decision.

(five) take revenge on internal auditors or informants.

(six) if the above acts are serious enough to constitute a crime, they shall be handed over to judicial organs for handling according to law.

Article 42 If an internal auditor commits one of the following acts, the company shall impose administrative sanctions according to the seriousness of the case.

(1) divulging secrets or abusing power for personal gain.

(2) practicing fraud or practicing favoritism.

(three) dereliction of duty, causing heavy losses to the state or unit.

(four) if the above acts are serious enough to constitute a crime, they shall be handed over to judicial organs for handling according to law.

Chapter VIII Supplementary Provisions Article 43 This system is jointly formulated by the audit department of the company and the relevant functional departments of the company, and implemented after being approved by the board of directors (audit committee) of the company.

Article 44 The Audit Department shall be responsible for the interpretation of this system. According to the actual situation of the company's operation and management, the audit department timely revised and improved it and reported it to the board of directors (audit Committee) for approval.