1. Policy Formulation

Our risk management policy aims to establish a comprehensive governance framework encompassing ESG-related risks. Under the supervision of the Board of Directors, execution by the Risk Management Task Force, and cooperation across departments, we implement robust procedures for risk identification, assessment, response, and oversight to enhance operational resilience and corporate governance effectiveness.

2. Scope of Risk Management

Our risk management framework covers three major ESG dimensions and their subcategories:

• E (Environmental Risks)

  • Climate Change: e.g., water or power shortages caused by extreme weather

  • Energy Risks: e.g., limited resources impacting operations

• S (Social Risks)

  • Financial Risks: e.g., changes in interest rates, exchange rates, or tax policies

  • Capital Risks: e.g., accounts receivable, investments, and mergers & acquisitions

  • Operational Risks: including information security, human resources, supplier/customer management, occupational safety, and intellectual property

• G (Governance Risks)

  • Regulatory Compliance Risks

  • Ethical Risks: including fraud, corruption, and unfair competition

3. Organizational Structure

• Board of Directors
  The highest risk management authority, responsible for understanding operational risks and ensuring the effectiveness of the risk management mechanism.

• Audit Committee
  Supervises the implementation of risk management and assists the Board in reviewing related policies.

• Risk Management Task Force
  Reporting to the General Manager, responsible for policy formulation, implementation monitoring, and regular reporting to the Board.

• All Departments
  Proactively identify and report risks, ensuring that internal control mechanisms are effectively implemented within each unit.

• Internal Audit Unit
  Reporting to the Board, responsible for internal control audits and improvement recommendations to ensure effective execution of the risk management system.

4. Operational Implementation

The risk management process includes five major steps:

1. Risk Identification: Define potential risk items across environmental, social, and governance aspects.

2. Risk Analysis: Analyze the probability and impact level of each risk to calculate a risk score.

3. Risk Evaluation: Prioritize risks and determine key issues for reporting to the Risk Management Task Force.

4. Risk Response: Develop and execute appropriate response strategies.

5. Risk Monitoring and Review: Regularly review process effectiveness and response outcomes, and incorporate results into performance evaluations.