Internal Audit Charter

1. Purpose and mandate

Internal Audit is the third line of the group's control structure. The divisions and the functions that run the business are the first line. Risk, Compliance and the other oversight functions are the second. Internal Audit stands apart from both and reports on both. Its purpose is to give the Board an opinion that has not passed through management.

The mandate covers the whole group: the six divisions, the 28 jurisdictions of domicile or registration, the 36 offices, the funds and vehicles the group manages or sponsors, and every activity that a group entity has outsourced. Nothing is outside scope. Where a subsidiary board or a supervisor requires a local audit function, it is provided by the group function under this charter.

Internal Audit does not design controls, run processes or make management decisions. It may advise on the design of a control before it is built, and it records that advice so that its later opinion on the control is not compromised. An auditor who has worked in a business area does not audit that area for two years afterwards.

2. Independence and reporting lines

The Group Head of Internal Audit reports functionally to the Audit Committee of the Board, chaired by Cormac Delacroix-Nwosu, and administratively to the Chief Executive for matters of budget, premises and personnel administration. The Audit Committee appoints and removes the Group Head, sets remuneration on the advice of the Remuneration Committee and approves the annual plan and budget.

The Group Head has direct and private access to the chair of the Audit Committee and to the Chair of the Board at any time, without notice to management. The Audit Committee meets the Group Head without executives present at least twice a year. No executive may restrict the scope of an audit, delay its report or edit its findings.

Remuneration of Internal Audit staff is set independently of the results of the businesses they audit. Variable pay for auditors is based on the quality and timeliness of audit work as assessed by the Audit Committee, never on the financial performance of a division. The Remuneration policy records this exception.

3. Authority and access

Internal Audit has unrestricted access to every record, system, premises and person in the group, at any time, without prior notice and without stating the reason. Access includes the minutes and papers of every committee, the personal dealing records held under the Personal Account Dealing policy, and the case files of the whistleblowing channel where the Designated Independent Director permits.

Where a service is outsourced, the contract must give Internal Audit the same access rights over the supplier as it holds over the group, and the Third-Party Risk and Outsourcing policy makes that clause mandatory. A supplier who refuses access is reported to the Audit Committee, and the contract is not renewed.

Auditors hold information they obtain in confidence and use it only for the audit in hand. They do not remove client data from the systems in which it is held except as the Data Protection and Privacy policy permits. Where an audit uncovers evidence of fraud or misconduct, the Group Head informs the General Counsel and Group Head of Compliance and the chair of the Audit Committee the same day.

4. Planning and standards

The audit universe is a register of every auditable unit in the group: each entity, division, function, important business service, material supplier and significant model. As at 30 June 2026 the universe holds 74 units. Each is rated for inherent risk and control confidence, and the rating decides how often it is audited: annually for the highest risk, and never less than every four years for any unit.

The annual plan is built from the universe, from the risk appetite statement, from the results of previous audits and from the concerns of the Board, the Audit Committee and the supervisors of the licensed entities. The plan is approved by the Audit Committee before the year begins and revised at mid-year. A fifth of the year's capacity is held back for work the plan did not foresee.

Internal Audit works to a written methodology approved by the Audit Committee. Every audit has a scope memorandum, a documented work programme, evidence for every finding, and a supervisory review before a report is issued. The function is staffed by nine people based in George Town, London and Singapore, and it engages specialist co-source support for actuarial, technology and model reviews under the Third-Party Risk and Outsourcing policy.

5. Reporting and follow-up

Every audit ends in a written report to the accountable executive, with a copy to the Audit Committee. Findings are graded high, medium or low by the harm they could cause, and each carries a management action, an owner and a date. Management may disagree with a finding; the disagreement is recorded in the report and the Audit Committee decides.

Actions are tracked to closure in the group action tracker. Internal Audit verifies closure by testing, not by management assertion. A high-rated action open past its date is reported to the Audit Committee by name at its next meeting. As at 30 June 2026 there were 31 open actions across the group, of which two were rated high and none was past its date.

Once a year the Group Head gives the Board a written opinion on the adequacy and effectiveness of the group's governance, risk management and controls. The opinion draws on the year's audits, the state of open actions, the results of scenario testing under the Operational Resilience policy and the findings of the supervisors of the licensed entities.

6. Quality and review of the charter

The function maintains an internal quality programme: every report is reviewed by a second auditor, and a sample of completed audits is re-performed each year by a person who did not take part. An external assessment of the function is commissioned by the Audit Committee every five years. The first was completed in 2025 and its recommendations were closed by June 2026.

This charter is reviewed by the Audit Committee every two years, or sooner if the structure of the group changes. Any change is approved by the Board. The Group Head confirms to the Audit Committee each year that the function has operated in conformity with the charter, and reports any impairment of independence, actual or perceived, that arose during the year.