Risk Management | Corporate Governance

Risk Management

Risk Management Policies, Procedures and Organization

To address the rapidly changing business environment, mitigate the impact of potential risks on operations, and enhance the Company's resilience to risks, the Company established the Risk Management Policies and Procedures in 2020. In the same year, the Risk Management Team was formed under the Sustainable Development Committee to oversee the implementation of the risk management framework.
In October 2024, the Company revised the policy (Version 2) and obtained Board approval to transfer the Risk Management Team from the Sustainable Development Committee to the Audit Committee, which is now responsible for the Company's overall risk assessment and management.

Risk Management Operations

Risk management is a critical foundation for sustainable corporate operations, helping enhance operational stability and long-term resilience. The Company has established a structured process to systematically identify, assess, and manage risks that may affect its operations and performance, and implements corresponding management measures based on the level of risk. The scope of the Company’s risk management includes, but is not limited to, the following categories: "operational risk", "environmental and occupational health and safety risk", "information security risk", and "climate change risk".

The risk assessment process begins with an analysis based on the materiality principle of the Sustainability Report to identify material sustainability issues. Relevant departments then evaluate topics that could impact operations through a structured risk identification, analysis, assessment, and response process. The Risk Management Team consolidates the assessment results and reports them at least once a year to the Audit Committee and the Board of Directors. Upon approval, these results are incorporated into the Sustainable Development Committee’s annual objectives for continuous tracking, ensuring that risks are managed within an acceptable range.

On February 26, 2026, the Risk Management Team reported to the Board of Directors on the risk assessment results, management measures, and the implementation status of the previous year. The report covered operational, environmental and occupational health and safety, cybersecurity, and climate change risks, which are regularly monitored by the Sustainable Development Committee.

● Risk Management Policies and Strategies for ESG Issues

The Company's approach to managing environmental, social, and corporate governance (ESG) risks is outlined as follows:

Risk assessment item	Material Issue Category	Risk Management Policies or Strategies
Operational Risk	Governance Society	The Company established the regulations of the management of supply chain: To confirm the suppliers meet the needs and expectations of Chipbond and clients through the operational process management. In the selection of suppliers, the Company evaluates the suppliers in various aspects and tries to make sure the delivery date and quality meet the expectations. For the unexclusive raw materials, the Company sets up the second source to avoid natural disaster or force-majeure circumstances to break the supply chain. Continuously monitor global market trends and raw material price fluctuations, analyze their impact on material costs, and proactively engage in price negotiations while implementing appropriate procurement strategies to mitigate the effects of price volatility. Continuously Acquired IECQ-QC 080000 Hazardous Substances Process Management certificate (validity period: Nov. 11, 2023 to Nov.16, 2026). The Company also appoints the third party to verify samples from each processing, to assure meet the needs of clients and requirements of regulations. To investigate the Conflicts Minerals for suppliers of raw materials and supplies containing gold, tungsten, and tin to assure that the products of Chipbond are not against Conflicts Minerals. For impacts on raw materials caused by natural disasters, earthquakes, emerging diseases, or force majeure events, the Company takes actions as below: (1) Classify supplier risk levels according to the event impacts and make the inventory plan. (2) Investigate production/ supply to enhance the inventory and stabilize supply plan. (3) Timely feedback material reserves and supply status to relevant departments, and ensure normal raw material supply. (4) Establish a Critical Raw Materials Map for risk management, enabling immediate assessment of the impact and scope of disruptions, formulating rapid response strategies, and minimizing operational impact. (5) Develop and implement a Business Continuity Plan (BCP) to ensure the activation of emergency response mechanisms and disaster recovery capabilities when disasters or incidents occur.
Environmental andOccupational Hazard Risks	Society Environment	To comply with regulatory requirements and market demands, the company has established ISO 45001:2018 Occupational Health and Safety Management Systems and ISO 14001:2015 Environmental Management System, with annual verification to ensure their effectiveness. EHS committee holds quarterly discussions on environmental and workplace safety issues and continuously implements improvements. Monitor the working environment and security inspection periodically to reduce the possible adverse factors to the operation safety or health. Strict chemical management protocols govern the procurement, storage, use, and disposal of hazardous materials. Provide annual physical examination with colleagues for free. For employees who work for specific items shall provide them with appropriate prevention equipment and provide specific check-up items to avoid the occupational disease. Periodic occupational health and safety training, fire drills, and emergency response exercises enhance employee safety awareness and risk management preparedness.
Cyber Security Risks	Governance	The Company has established a comprehensive information security risk management organization and system based on the ISO 27001 framework. Through the formulation of risk management policies and management regulations, the trainings and promotions of information security, and regular execution of risk assessments pursuant to risk identification, the Company identify potential cyber security risks, and further set up improvement goals and draw up action plans to ensure that important systems such as company operations and accounting can operate effectively.
Climate Changes Risks	Environment	Conduct greenhouse gas (GHG) inventory in accordance with ISO 14064-1 to identify major carbon emission sources and develop energy-saving and carbon reduction initiatives to minimize GHG emissions from production processes and electricity consumption. Implement the ISO 50001 Energy Management System to enhance energy efficiency through systematic and data-driven management. Expand solar power generation facilities and increase the use of renewable energy to reduce reliance on purchased electricity.