REGULATION OF THE INTERNAL AUDIT DEPARTMENT Chapter I GENERAL PROVISIONS Article 1 Purpose The purpose of this regulation is to serve the function of internal control for the company s activities with the main objective of ensuring reliable financial reports, compliance with regulations, efficient operations and maintaining the company s assets. Article 2 Definition 1. Internal Audit shall be the activity of providing independent and objective assurance and consultation, with the purpose of adding value and improving the company s operations, through a systematic approach, by evaluating and improving the effectiveness of risk management, control and corporate governance process. 2. Internal Audit Department shall be a work unit at the company which performs the Internal Audit function. 3. Work related to Internal Audit (hereinafter referred to as audit ) shall be performed based on the President Director s instruction and it must be free from the interest of parties other than the Internal Audit Department in determining the scope of audit, audit implementation and reporting the audit results. 4. Person-in-charge of the auditee is the head of the department, however, if the Director-in-charge of the department holds position as the head of department, the responsibility may be delegated to one of manager in the department. 5. Routine audit shall be audit undertaken periodically in accordance with the stipulated audit planning. 6. Special audit shall be audit undertaken based on the President Director s instruction and or in accordance with the needs. Article 3 Structure and Position of the Internal Audit Department 1. The Internal Audit Department shall be chaired by the head of Internal Audit. 2. The head of Internal Audit shall be appointed and dismissed by the President Director upon the Board of Commissioners approval. 1
3. The President Director may dismiss the head of Internal Audit, after obtaining the Board of Commissioners approval, if the head of Internal Audit does not meet the requirements for acting as auditor of the Internal Audit Department as provided for in this regulation and or fails or is unable to perform his/her duties. 4. The Head of Internal Audit shall be responsible to the President Director. 5. In order to perform supervisory task of the operational activities of the Internal Audit Department, President Director may delegates the responsibility by appointing a Director through President Director/CEO decree. 6. Auditors in the Internal Audit Department shall be directly responsible to the head of Internal Audit. Article 4 Authorities of the Internal Audit Department The Internal Audit Department shall have authorities related to its duties as outlined below: 1. The Internal Audit Department shall have the authority to access all relevant information on the company related to its duties and functions. 2. The Internal Audit Department shall be entitled to directly communicate with the Board of Directors, the Board of Commissioners and/or the Audit Committee as well as members of the Board of Directors, the Board of Commissioners and/or the Audit Committee and manage its activities directly with the parties mentioned above. 3. The Internal Audit Department shall be entitled to hold periodic and incidental meetings with the Board of Directors, the Board of Commissioners, and/or the Audit Committee. 4. The Internal Audit Department shall be entitled to determine the method and approach of audit to be undertaken. 5. The Internal Audit Department shall be entitled to attend, examine, verify and raise questions to the related party in the company, either in the group or business partner of the company if necessary with regard to the activity of the Internal Audit Department. 2 Article 5 Duties and Responsibilities of the Internal Audit Department The Internal Audit Department shall perform the duties and responsibilities related to audit as outlined below: 1. Preparing and implementing the plan for annual Internal Audit.
2. Testing and evaluating the implementation of internal control and risk management system in accordance with the Company s policies. 3. Undertaking audit and assessment of efficiency and effectiveness in the field of finance, accounting, operation, human resources, marketing, information technology and other activities. 4. Providing advice for improvement and objective information on the audited activities at all levels of related management. 5. Preparing report on the audit results and submitting such report to the Director-in- Charge, President Director, Board of Commissioners, and if deemed necessary, send copy to the Auditor of the Parent Company. 6. Observing, analyzing and reporting the implementation of follow up for improvement suggested to the Director-in-Charge of the Internal Audit Department. 7. Cooperating with the Audit Committee. Article 6 Responsibility of the Related Department 1. Person who receives request of information and or documents from the Internal Audit Department with regard to the activity of the Internal Audit Department is not allowed to refuse or giving incorrect answers. Article 7 Code of Conduct 1. The Internal Auditor shall have trustworthy integrity hence his/her judgment can be relied on, the Internal Auditor shall: a) Performing duties honestly, carefully and responsibly. b) Complying with and making disclosure in accordance with applicable laws and regulations. c) Not being involved in any activities which violate laws, or not being involved in any actions which may damage the professional reputation of the Internal Auditor or the company. d) Respecting and making contribution towards the Company s objective. 2. An Internal Auditor shall demonstrate a high level of professional objectivity in collecting, evaluating and communicating information on the activities being undertaken. An Internal Auditor must make balanced judgment of all conditions and 3
may not be influenced by personal interest or the interest of other parties in making judgment, including the following: a) Not supporting or not being involved in any activities which may cause biased judgment, including all activities resulting in a conflict of interest with the Company. b) Not being allowed to receive anything which may influence his/her professional judgment. c) Disclosing all material facts known, which may result in a misleading report if they are not disclosed. 3. An Internal Auditor shall respect the value and proprietary right to information and shall not make any unauthorized disclosure of information unless he/she is required to do so by law or professional obligation, including the following: a) Exercising care in using or safeguarding information obtained in relation to his/her work. b) Not being allowed to use information for personal interest which may violate laws and be harmful to the Company. 4. An Internal Auditor shall apply the knowledge, expertise and experience required in performing his/her duties. a) Undertaking activities only if he/she possesses the knowledge, expertise and experience required. b) Undertaking internal audit activities in accordance with applicable guidelines. c) Continuously improving his/her ability, effectiveness and quality of work. 4 Article 8 Confidentiality and Limitations 1. An Internal Auditor shall respect the value of and proprietary right to information and all information provided by the company in confidence. 2. An Internal Auditor shall be prohibited from disclosing part or all of the information obtained in performing his/her duties to an external party or internal party having no interest in the information or audit results without prior written approval of the President Director, unless upon request of a competent institution based on applicable Laws. 3. These provisions concerning confidentiality shall remain applicable although the personnel concerned in the Internal Audit Department no longer works for the company.
Article 9 Requirements for Internal Auditor 1. An Internal Auditor shall have professional, independent, honest, and objective integrity and conduct in performing his/her duties. 2. An Internal Auditor shall have knowledge and experience of technical audit and other disciplines which are relevant to the area of his/her duties. 3. An Internal Auditor shall have knowledge of laws and regulations in the capital market sector as well as other relevant laws and regulations. 4. An Internal Auditor shall have the ability to interact and communicate effectively both verbally as well as in writing. 5. An Internal Auditor shall be obligated to comply with the professional standards issued by the Internal Audit association. 6. An Internal Auditor shall be obligated to comply with the Internal Audit s code of conduct. 7. An Internal Auditor shall be obligated to keep confidential the Company s information and/or data related to the performance of duties and responsibilities of Internal Audit unless required based on laws and regulations or judicial stipulation/decision. 8. An Internal Auditor shall understand the principles of good corporate governance and risk management. 9. An Internal Auditor shall be prepared to continuously improve his/her professional knowledge, expertise and capability. 10. An Internal Auditor shall not be allowed to perform concurrent duty and hold concurrent position as auditor and implementer of the company s operations either in a public company or the subsidiary thereof. Article 10 Auditor-in in-charge 1. The auditor-in-charge shall be the head of Internal Audit or an audit officer appointed by the head of Internal Audit. 2. The auditor-in-charge shall appoint an audit officer from the Internal Audit Department, however, if necessary, may appoint a temporary audit officer from another division upon the approval of the Director-in-Charge. 5
3. The auditor-in-charge shall be responsible for preparing the audit implementation plan. 4. The auditor-in-charge shall perform supervisory task on the audit activities. Article 11 Audit Officer 1. An audit officer shall be personnel appointed by the auditor-in-charge to undertake audit. 2. An audit officer must possess the knowledge, ability and other expertise required for performing his/her duties. 3. An audit officer must continuously receive sufficient knowledge and expertise in relation to his/her work through various training, courses and seminars held either by an internal or external party. Article 12 Scope of Audit The scope of the audit undertaken shall be as follows: 1. Control audit at the corporate level including the basic components of control consisting of the control environment, risk determination and the follow up thereon, control activity, information and communication as well as monitoring. 2. Audit at the level of the company s work (business) process having influence on fair presentation of financial reports. 3. Audit of financial reports book closing undertaken on the company s book closing process in order to provide sufficient assurance of constraints on the presentation of financial reports. 4. Control audit of the implementation of information technology in supporting the company s operations. 5. Operational audit undertaken as control at the Departmental level in order to continuously improve the effectiveness and efficiency of operational working activities. Article 13 Audit Method 1. Audit shall be undertaken through stages including preparation, initial understanding, audit implementation and reporting of audit results. 6
2. Audit activities shall be aimed at making contribution to the improvement of risk management, company control and governance by using systematic methods through approach involving various disciplines. Article 14 Relationship with Other Parties 1. The Internal Audit Department must be able to provide information and communicate with interested external parties (external auditor, auditor of the parent company, consultant, audit organization, etc.) in order to provide assurance that the audit is undertaken in an adequate and effective manner. 2. The Internal Audit Department shall develop relationship and undertake periodic and incidental coordination with the Board of Directors, the Board of Commissioners, the Audit Committee, the Auditor of the Parent Company or a Public Accountant with the purpose of undertaking effective and efficient audit. Article 15 Document Retention 1. Audit documents such as assignment letters, working papers, minutes, audit reports and other documents related to audit shall constitute confidential documents and may not be known to uninterested parties without the permission of the head of Internal Audit. 2. The Internal Audit Department shall be obligated to retain and maintain the audit documents as intended in paragraph 1 above for not less than 10 years. 3. The auditor-in-charge must supervise the use of audit documents by parties outside the Internal Audit Department. 4. The use of audit documents for the interest of an external party must be approved by the President Director. Chapter II AUDIT PLAN Article 16 Annual Plan 1. The Internal Audit Department shall be obligated to prepare an annual plan based on the management s consideration, risk approach which consider the evaluation result and risk management of the Company for further submission to the President Director for approval. 7
2. An annual plan shall include basic policies of audit, standard procedures, auditee and the person-in-charge, audit schedule, audit type, scope of audit, auditor, and other matters considered necessary. 3. The Internal Audit Department shall submit the annual plan to the person-in-charge of the department which is going to be audited and the Auditor of the Parent Company. 4. The Internal Audit Department, if considered necessary, may submit the change in annual plan with the approval of the President Director. 5. In the event of change in annual plan, the head of Internal Audit must provide information to the party which is going to be audited and the Auditor of the Parent Company. Chapter III IMPLEMENTATION OF AUDIT Article 17 Audit Policies and Standard Operating Procedures 1. The implementation of audit shall be conducted based on the Standard Procedures of each audit type. 2. The audit on J-SOX shall refer to the Standard Operationg Procedures of J-SOX Audit. 3. The operational and special audit shall refer to the Standard Operating Procedures of Operational Audit. Article 18 Identification of Risk and Control Objective 1. The Head of Internal Audit shall perform regular identification of risks arising in the Company s main business process. 2. The Head of Internal Audit shall compose the control objectives and activities in relation to the risks in paragraph 1. Article 19 Progress Reports 1. The Internal Audit Department shall provide progress reports to the President Director on the undertaken audit activities. 2. The report intended in paragraph 2 above must also include audit objectives, scope of audit, role and responsibility as well as performance of the audit which was conducted, disclosure of significant risks identified in audit implementation, the company s management issues and other matters considered necessary by the management. 8
Article 20 Drawing Conclusions 1. The auditor shall be obligated to ensure that audit evidence and information obtained from audit activities are sufficient for drawing conclusions. 2. The auditor shall compile audit findings and shall create recommendation design based on the audit activities completed. 3. The auditor shall draw conclusions from the results of the audit undertaken. 9 Article 21 Consolidation Meeting on the Audit Report 1. The auditor-in-charge shall hold a reporting meeting with the audited party following the completion of audit activities for discussing audit results and notifying recommendation design. 2. A reporting meeting shall be attended by the person-in-charge of the audited party and if considered necessary, it may also be attended by staff related to the audited matters. 3. The Consolidation Meeting on the Audit Report shall at least include the following matters: 1. Submission of information resulting from audit activities on the facts of audit findings supported by sufficient evidence for response or confirmation by the audited party. 2. Submission of recommendation of weaknesses identified by the auditor for immediate follow-up by the audited party. 3. The auditor-in-charge shall be obligated to take into account responses from the audited party for consideration in preparing recommendations. 4. An audit officer shall be obligated to set forth the matters discussed in a reporting meeting on the minutes of meeting containing the minutes of audit. Article 22 Special Audit 1. The Internal Audit Department is authorized to undertake special audit based on the President Director s instruction. 2. Special audit may be undertaken at any time without prior notice to the party which is going to be audited.
3. Other procedures for special audit shall refer to the procedures for routine audit and if considered necessary, adjustment may be made in accordance with the prevailing situation and conditions. Chapter IV AUDIT REPORT Article 23 Audit Report 1. The Internal Audit Department shall make audit report based on the results of audit activities undertaken. 2. The audit report must set out the following matters: a) Scope of audit. b) Audit type. c) Facts on audit findings. d) Conclusion of audit. e) Improvement recommendation after the audit. f) Comments from the auditee. Article 24 Submission of the Audit Report The Internal Audit Department shall submit the audit report to the President Director and submit copy of the report to the related parties, namely as follows: 1. A commissioner serving as chairperson of the Audit Committee 2. Internal Audit Department (filing) 3. The audited party s person-in-charge 4. The Auditor of the Parent Company 5. Other parties with the approval of the President Director Chapter V ACTION ON AUDIT RESULTS Article 25 Recommendation of the Audit 1. The Head of Internal Audit shall submit the recommendation of action on audit results to the President Director for further submission to the meeting attended by the Board of Directors. 10
2. If the Board of Directors instructs an action in relation to the recommendation submitted by the Internal Audit Department, the Director-in-Charge must convey the instruction to the person-in-charge of the audited party. 3. The person-in-charge of the party receiving an instruction in paragraph 2 above must immediately implement the instruction and subsequently, prepare a report on the result of implementation of follow up for further submission to the head of Internal Audit. 4. Upon request of the Board of Directors, the Head of Internal Audit shall submit progress report of improvement activities conducted by the related Department. Chapter VI STIPULATION, AMENDMENT AND REVOCATION OF REGULATION Article 26 The amendment and/or revocation of this regulation shall be stipulated by the Board of Directors Meeting with the approval of the Board of Commissioners. Chapter VII DATE OF APPLICATION OF REGULATION Article 27 (1) This regulation shall be applicable as from the date of stipulation. (2) With the coming into effect of this regulation, the preceding regulations Regulations of the Internal Audit Department dated January 13, 2009 is declared no longer applicable. (3) This regulation of the Internal Audit Department shall be subject to periodic review. Stipulated in : Bekasi On : July 22, 2016 11