Amendment of Decision No. 5 on Internal Audit Requirements for Lebanese Capital Markets Companies

Announcement No. 13 On the Amendment of Decision no. 5 of 14/8/2013 (on Internal Audit) Pursuant to Law 161 of August 17, 2011 on Capital Markets, And pursuant to the Decision of the Capital Markets Authority’s Board, taken in its meeting of 26/1/ 2015, Please be informed of the following: First: the Decision no. 5 of 14/8/2013 (on Internal Audit) has been amended as follows:

1. Article One of said decision was cancelled and replaced with the following text: Article 1: The provisions of the present decision shall apply to the following companies: Category 1: Joint-stock companies operating in Lebanon having negotiable shares in organized Capital Markets. Category 2: Joint-stock companies operating in Lebanon having negotiable shares in organized Capital Markets or Over the Counter Capital Markets (OTC) with a number of shareholders exceeding twenty, and total revenues ranging between LBP 30,000,000,000 and 100,000,000,000 (thirty and one hundred billion Lebanese pounds). Category 3: Joint-stock companies operating in Lebanon having negotiable shares in organized Capital Markets or Over the Counter Capital Markets (OTC) with a number of shareholders exceeding twenty, and total revenues exceeding 100,000,000,000 (one hundred billion Lebanese pounds). Category 4: Companies that intend to transfer their assets in the framework of a securitization process by being the originator. The provisions of the present decision shall not apply to banks, financial institutions and financial intermediaries operating in Lebanon.
2. Article five of said decision was cancelled and replaced with the following text: Article 5: Companies falling under abovementioned categories (3) and (4) can outsource a specialized external institution to perform the Internal Audit duties totally or partially provided that:

• The company ensures that the outsourcing institution is qualified enough to perform the outsourcing work;
• The outsourcing agreement shall explicitly state the scope and nature of the outsourcing and confirm the company’s full responsibility in relation to the proper implementation of the provisions of this decision.
• The Company shall inform the Capital Markets Authority of the name of the outsourcing institution that will perform the Internal Audit duties; if the Capital

Markets Authority objects to the outsourcing institution, the company concerned should immediately comply with the CMA objection. 3. Article Twelve of said decision was cancelled and replaced with the following text: Article 12: In compliance with the provisions of the Lebanese Code of Land Trade, especially the provisions related to auditors, companies which fall under the abovementioned categories (1), (2) or (4) should appoint at least one external auditor, as for companies which fall under category (3), they should appoint at least two external auditors. All companies referred to in article 1 hereinabove should inform the Capital Markets Authority of the names of their external auditors; if the Capital Markets Authority objects to any of them, the companies concerned should immediately comply with the objection. All companies referred to in article 1 hereinabove should request from its external auditors to submit up an annual report to the Capital Markets Authority on the extent of compliance of the company with the provisions of this decision. Second: Attached is Decision no. 5 of 14/8/2013 (on Internal Audit) amended as per the above. Beirut, on January 27, 2015. CMA Chairman/ Governor of the Central Bank of Lebanon Riad Toufic Salame (signature)

Committees, Units and Departments to be Established in Some Joint-Stock Companies Decision No. 5 Related to “Internal Audit” Pursuant to Law No. 161 dated 17/8/2011, on the capital markets; Pursuant to the decision of the Capital Markets Authority’s Board taken in its meeting held on August 5, 2013; The Chairman of the Capital Markets Authority / Governor of the Central Bank of Lebanon decides the following: Article 1: The provisions of the present decision shall apply to the following companies: Category 11 : Joint-stock companies operating in Lebanon having negotiable shares in organized Capital Markets. Category 2: Joint-stock companies operating in Lebanon having negotiable shares in organized Capital Markets or Over the Counter Capital Markets (OTC) with a number of shareholders exceeding twenty, and total revenues ranging between LBP 30,000,000,000 and 100,000,000,000 (thirty and one hundred billion Lebanese pounds). Category 3: Joint-stock companies operating in Lebanon having negotiable shares in organized Capital Markets or Over the Counter Capital Markets (OTC) with a number of shareholders exceeding twenty, and total revenues exceeding 100,000,000,000 (one hundred billion Lebanese pounds). Category 4: Companies that intend to transfer their assets in the framework of a securitization process by being the originator. The provisions of the present decision shall not apply to banks, financial institutions and financial intermediaries operating in Lebanon. Article 2: All companies mentioned in article 1 hereinabove should set up a framework for internal audit that provides an independent and objective assessment of the work and activities of all the Company’s departments and units. This would enhance the effectiveness and efficiency of control and risk management to protect the rights of shareholders and stakeholders. Article 3: All companies mentioned in article 1 hereinabove should establish an Internal Audit Department that ensures proper performance of internal audit duties; it should be constituted of one or more qualified staff commensurate with the Company’s size, diversity of activities and operations.

1 This article was amended by Announcement 13 of 27/1/2015

Article 4: Companies affiliated to a group of companies can have a common Internal Audit Department with the parent company. Article 52 : Companies falling under abovementioned categories (3) and (4) can outsource a specialized external institution to perform the Internal Audit duties totally or partially provided that:

• The company ensures that the outsourcing institution is qualified enough to perform the outsourcing work;
• The outsourcing agreement shall explicitly state the scope and nature of the outsourcing and confirm the company’s full responsibility in relation to the proper implementation of the provisions of this decision.
• The Company shall inform the Capital Markets Authority of the name of the outsourcing institution that will perform the Internal Audit duties; if the Capital Markets Authority objects to the outsourcing institution, the company concerned should immediately comply with the CMA objection. Article 6: For the sake of greater objectivity, the Internal Audit Department should be independent from the party assigned to carry out operations and should not have executive duties in the Company. Article 7: The Internal Audit Department should abide by the following: 1- Set up its internal audit charter which is approved by the board of directors, guarantees its independence and specifies its full powers in audit. 2- Comprehensively audit all the Company’s operations and activities within a specified period (audit cycle) provided that such audit cycle does not exceed two years. 3- Perform audit duties based on an annual audit plan that is prepared following a comprehensive measurement of risks that the company is facing or that could arise in the future. Article 8: The Board of Directors appoints the Head of the Internal Audit Department and specifies his benefits and indemnities.. The Board of Directors will also be in charge of the Department if it is constituted of only one person. Companies that fall under category (1) should inform the Capital Markets Authority in accordance with Annex No. (1) enclosed herewith, of the name of the Head of Internal Audit Department, any subsequent change and the reasons behind such change. If the Capital Markets Authority objects to the name of the assigned Head, the companies concerned should immediately comply with the CMA objection. Article 9: The Internal Audit Department should submit regular reports, at least semi￾annually, to the Board of Directors on the completed tasks of audit, assessment and follow-up led during the past semester, and the violations and /or deficiencies of the laws and regulations in force. This is recommended to address them on a pro-active basis.

2 This article was amended by Announcement 13 of 27/1/2015

Article 10: All companies referred to in article 1 hereinabove should make all the reports of the Internal Audit Department available to the Financial Control Unit and its External Auditors upon request. Article 11: The provisions of this decision shall apply to:

• All the departments, units, operations and activities of the Company including outsourced activities and operations.
• All branches and units affiliated to the Company in Lebanon and abroad.
• Subsidiaries which have a common internal audit department with the parent company. Article 123 : In compliance with the provisions of the Lebanese Code of Land Trade, especially the provisions related to auditors, companies which fall under the abovementioned categories (1), (2) or (4) should appoint at least one external auditor, as for companies which fall under category (3), they should appoint at least two external auditors. All companies referred to in article 1 hereinabove should inform the Capital Markets Authority of the names of their external auditors; if the Capital Markets Authority objects to any of them, the companies concerned should immediately comply with the objection. All companies referred to in article 1 hereinabove should request from its external auditors to submit up an annual report to the Capital Markets Authority on the extent of compliance of the company with the provisions of this decision. Article 13: Whoever violates the provisions of the present decision shall be subject to the administrative penalties stipulated in the laws and regulations in force, especially those stipulated in law No. 161 dated August 17, 2011, related to capital markets. Article 14: Companies subject to the present decision shall be given a maximum period of one year as of the date of publication4 of the same in the Official Gazette to abide by the provisions thereof. The Capital Markets Authority can, if deemed appropriate, impose a shorter deadline on the said companies. Article 15: The present decision shall enter into force upon its publication in the Official Gazette. Beirut on August 14, 2013 Chairman of the Capital Markets Authority / Governor of the Central Bank of Lebanon Riad Toufic Salameh (Signature and seal)

3 This article was amended by Announcement 13 of 27/1/2015 4 the date of publication in this article is the date of issue 37 of the official gazette dated 22/8/2013