Internal Audit Requirements for Certain Lebanese Joint-Stock Companies

Decision Number 5 Internal Audit Committees, Units and Departments to be established in Some Joint-Stock Companies Pursuant to Law No. 161 dated 17/8/2011, on the capital markets; Pursuant to the decision of the Capital Markets Authority’s Board taken in its meeting held on August 5, 2013; The Chairman of the Capital Markets Authority / Governor of the Central Bank of Lebanon declares the following, Article 1: The provisions of the present decision shall apply to the following companies: Category 1: Joint-stock companies operating in Lebanon having negotiable shares in organized Capital Markets. Category 2: Joint-stock companies operating in Lebanon having negotiable shares in organized Capital Markets or Over the Counter Capital Markets (OTC) with a number of shareholders exceeding twenty, and total revenues ranging between LBP 30,000,000,000 and 100,000,000,000 (thirty and one hundred billion Lebanese pounds). Category 3: Joint-stock companies operating in Lebanon having negotiable shares in organized Capital Markets or Over the Counter Capital Markets (OTC) with a number of shareholders exceeding twenty, and total revenues exceeding 100,000,000,000 (one hundred billion Lebanese pounds). The provisions of the present decision shall not apply to banks, financial institutions and financial intermediaries operating in Lebanon. Article 2: All companies mentioned in article 1 hereinabove should set up a framework for internal audit that provides an independent and objective assessment of the work and activities of all the Company’s departments and units. This would enhance the effectiveness and efficiency of control and risk management to protect the rights of shareholders and stakeholders. Article 3: All companies mentioned in article 1 hereinabove should establish an Internal Audit Department that ensures proper performance of internal audit duties; it should be constituted of one or more qualified staff commensurate with the Company’s size, diversity of activities and operations. Article 4: Companies affiliated to a group of companies can have a common Internal Audit Department with the parent company. Article 5: Companies falling under the abovementioned category (2) can designate a specialized external institution to perform the internal audit duties totally or partially (outsourcing) provided that:

• The company ensures that the outsourcing institution is qualified enough to perform the outsourcing work.
• The outsourcing agreement shall explicitly state and nature of the outsourcing and confirm the company’s full responsibility in relation to the proper implementation of the provisions of the present decision.
• The Company shall inform the Capital Markets Authority of the name of the outsourcing institution that will perform the internal duties; if the Capital Markets Authority objects to the outsourcing institution, the company concerned should immediately comply with the CMA objection. Article 6: For the sake of greater objectivity, the Internal Audit Department should be independent from the party assigned to carry out operations and should not have executive duties in the Company. Article 7: The Internal Audit Department should abide by the following: 1- Set up its internal audit charter which is approved by the board of directors, guarantees its independence and specifies its full powers in audit. 2- Comprehensively audit all the Company’s operations and activities within a specified period (audit cycle) provided that such audit cycle does not exceed two years. 3- Perform audit duties based on an annual audit plan that is prepared following a comprehensive measurement of risks that the company is facing or that could arise in the future. Article 8: The Board of Directors appoints the Head of the Internal Audit Department and specifies his benefits and indemnities.. The Board of Directors will also be in charge of the Department if it is constituted of only one person. Companies that fall under category (1) should inform the Capital Markets Authority in accordance with Annex No. (1) enclosed herewith, of the name of the Head of Internal Audit Department, any subsequent change and the reasons behind such change. If the Capital Markets Authority objects to the name of the assigned Head, the companies concerned should immediately comply with the CMA objection. Article 9: The Internal Audit Department should submit regular reports, at least semi-annually, to the Board of Directors on the completed tasks of audit, assessment and follow-up led during the past semester, and the violations and /or deficiencies of the laws and regulations in force. This is recommended to address them on a pro-active basis. Article 10: All companies referred to in article 1 hereinabove should make all the reports of the Internal Audit Department available to the Financial Control Unit and its External Auditors upon request. Article 11: The provisions of the present decision shall apply to:
• All the departments, units, operations and activities of the Company including outsourced activities and operations.
• All branches and units affiliated to the Company in Lebanon and abroad.
• Subsidiaries which have a common internal audit department with the parent company.

Article 12: In compliance with the provisions of the Lebanese Code of Land Trade, especially the provisions related to auditors, companies which fall under the above mentioned categories (1) or (2) should appoint at least one external auditor, as for companies which fall under category (3), they should appoint at least two external auditors. All companies referred to in article 1 hereinabove should inform the Capital Markets Authority of the names of its external auditors; if the Capital Markets Authority objects to any of them, the companies concerned should immediately comply with the objection. All companies referred to in article 1 hereinabove should request from its external auditors to submit up an annual report to the Capital Markets Authority on the extent of compliance of the company with the provisions of the present decision. Article 13: Whoever violates the provisions of the present decision shall be subject to the administrative penalties stipulated in the laws and regulations in force, especially those stipulated in law No. 161 dated August 17, 2011, related to capital markets. Article 14: Companies subject to the present decision shall be given a maximum period of one year as of the date of publication of the same in the Official Gazette to abide by the provisions thereof. The Capital Markets Authority can, if deemed appropriate, impose a shorter deadline on the said companies. Article 15: The present decision shall enter into force upon its publication in the Official Gazette. Beirut on August 14, 2013 Chairman of the Capital Markets Authority / Governor of the Central Bank of Lebanon Riad Toufic Salameh (Signature)

Annex 1 Form of notification concerning the person in charge of the Internal Audit Department 1 Data related to the Company 2 Personal data of the appointed person 3 How to contact the appointed person 4 Position entrusted to the appointed person 5 Professional / Judicial Behavior 6 Competence and qualifications 7 Acknowledgement of the appointed person 8 Company’s Undertaking

Position  Head of the Internal Audit Department

1. Data related to the Company a- Full Name b- Registration No. in the Commercial Register c- E-mail Website d- Tel: e- Fax:

2. Personal data of the appointed person 2.1 Name Full Name Family Name First Name Father’s Name 2.2 Date of Birth Day Month Year 2.3 Place of Birth 2.4 Nationality 2.5 Register No. City or Village District Province

3. How to communicate with the appointed person 3.1 Permanent Place of Residence Address Street Name and number Area and City P.O. Box Tel / Mobile Fax and e-mail (Fax) (E-mail)

4. Position entrusted to the appointed person 4.1 Work Start Date Day Month Year 4.2 Clear and detailed description of the position’s duties and responsibilities.

5. Professional / Judicial Behavior 5.1 Has the person appointed ever: a- Been forbidden from exercising any trade, commerce or profession which requires authorization, registration or approval by virtue of the laws and regulations in force or have restrictions been imposed on such exercise?  Yes  No b- Been convicted of any crime?  Yes  No c- Been convicted of any deceit, fraud, abuse of trust or any prohibited action?  Yes  No

If yes, mention the details: 6. Competence and qualifications 6.1 Education Background of the appointed person Degree Name of University Country Graduation Year 6.2 Professional record of the appointed person: 1 2 3 Employer Type of Work Job duties Period of Service From ____ (Month / year) Until (Month / year) From ____ (Month / year) Until (Month / year) From ____ (Month / year) Until (Month / year) Reason for quitting the job Prior to signature, make sure of filling all the required data  Have all questions been answered?  Has the curriculum vitae been submitted?  Has a copy of the judicial record been enclosed?  Has a copy of the identity card been enclosed?

7. Acknowledgement of the appointed person I the undersigned, hereby acknowledge having reviewed all the information of the present application (including all enclosures and annexes). Signature: __________________________________ Date:
8. Company’s Undertaking I the undersigned, hereby undertake that the information of the present application (including all enclosures and annexes) are complete, accurate and correct and I have taken notice that the Capital Markets Authority shall be entitled to ensure the validity of the abovementioned information and object on the present designation. Name of Company’s representative Official Signature and seal Date