Risk Management

In order to understand the internal and external risks that the company may face, we conduct risk identification to identify the scope of risk management. We continuously monitor potential risks and implement preventive measures based on the latest developments and regulatory requirements in internal audit. This strengthens risk management, enhances crisis response capabilities, and achieves the goal of risk control. By doing so, we aim to promote shareholder value, maintain competitiveness, and establish a foundation for sustainable business operations.

Scope of Risk Management

Risk Management Organization

The "Risk Management Team" integrates various risk management units, under the ESG Committee. The Chief Financial Officer leads the operations of the Risk Management Team, which identifies and manages risk factors according to the Risk Management Policy approved by the Board of Directors in 2020. This ensures more efficient command and control, self-assessment, and execution of the risk management organization. The 2024 operational status was reported to the 12th Board of Directors at the 2nd meeting on July 28, 2025.

Implementation

The Company has actively promoted the implementation of risk management mechanisms since 2017. From 2020, the Company has provided regular annual reports to the BOD on the operation. As of July 2023, the Company annually reports to the Audit Committee and the BOD. The Audit Office will also be responsible for submitting risk assessments as part of the annual audit plan and reporting the Company's risk management implementation to the Audit Committee and the BOD. The following shows the implementation from every year:

• The scope, organization, and structure of the risk management were established in 2017.
• The risk management organization was re-structured based on the organizational change in 2018. Each risk management unit was combined into a “Risk Management Team” that is subordinated to the ESG Committee and led by the Chief Financial Officer for identification of risk factors and risk control. This makes the command and control, self-evaluation, and operation of the risk management organization become more efficient.
• The risk detection, analysis, and identification for the risk management had been continuously implemented in 2019. In addition, the emerging risk issues, such as the information security and climate change risk, were included in the management policies for effective control. The Company offered the risk management courses about quality, products, and information security. A total of 253 people attended them with a total of 114 training hours.
• In 2020, the risk management policy of the Company has been developed and approved by the Board of Directors. The Company will continue the risk detection, analysis, and identification for the risk management to enhance the crisis response abilities to prevent and solve them and the ability to quickly recover after crises for effective risk control. Moreover, the Company offered the risk management courses about quality, information security, and climate change. A total of 83 people attended them with a total of 116 training hours.
• In 2021,  the Company offered the risk management courses about quality, information security, climate change and RBA. A total of 2,591 people attended them with a total of 3,362 training hours. Furthermore, to enforce the detection, analysis, and identification of risks within the scope of risk management to capture the internal and external risks that the Company will face in business operations, we conducted the biennial risk factor identification at the end of 2021 to achieve advance assessment, countermeasure establishment, and prevention.
• In 2022, we have conducted risk management courses related to risk identification, information security, climate change, and occupational health and safety. These courses include "Safety Risk Identification and Control," "Environmental Issues Identification," "Production Safety Management and Occupational Safety and Health Products Use and Management," "Occupational Disease Prevention and Control," "Handling of Occupational Accidents," and "Information Security." These courses aim to enhance employees' risk awareness. The total number of participants was 2,658, with a total training duration of 1,718 man-hours.
• In 2023, we have offering risk identification, information security, climate change, and occupational safety andhealth-related risk management courses, such as: "Safety Risk Identification and Control," "Environmental Issues Identification," "Production Safety Management and Occupational Safety and Health Products Use and Management," "Occupational Disease Prevention and Control," "Handling of Occupational Accidents," and "Information Security" etc., to enhance employees' risk awareness. A total of 3,784 people participated in the training, with a total of 5,841 personhours of training. Furthermore, to enforce the detection, analysis, and identification of risks within the scope of risk management to capture the internal and external risks that the Company will face in business operations, we conducted the biennial risk factor identification at the end of 2023 to achieve advance assessment, countermeasure establishment, and prevention.
• In 2024, three risk-related issues have been implemented in the company's operations. First, introduce the Task Force on Climate-related Financial Disclosures (TCFD) framework, conduct climate change risk and opportunity identification and impact analysis, and develop energy-saving and carbon-reduction strategies centered on low-carbon products and green operations to mitigate the greenhouse effect. Second, set annual information security management objectives, develop evaluation data based on their characteristics, and use data-driven indicators and standardized processes to propose improvement suggestions for non-compliance or identified risks, and track their implementation. Third, based on the latest risk identification results, monitor potential risks, develop management strategies, and implement preventive measures to strengthen risk management, enhance crisis response capabilities, and achieve the goal of risk control.

Risk Identification

• To implement the detection, analysis, and identification of risk-related issues in the risk management domain, and to grasp the internal and external risks that the Company’s operations may face, a biennial risk factor identification process will be carried out by the end of 2023 with the aim of conducting prior assessments, establishing countermeasures, and taking preventive measures.
• The Risk Management Team listed 40 risk issues for a questionnaire survey: In the first stage, 276 mid-level and above managers were asked to fill out a questionnaire on "The main risks they had faced," "The risks that had occurred in the past 12 months," and "The top five risks they might face in the next three years," to generate the top 20 risk issues. Then, the top 20 risk issues were screened by 20 senior executives participating in the group's senior management meeting to identify Coretronic' top 10 risk issues.

Risk Assessment