Risk Management | Corporate Governance

Risk Management

Risk Management Policies, Procedures and Organization

To address the rapidly changing business environment, mitigate the impact of potential risks on operations, and enhance the Company's resilience to risks, the Company established the Risk Management Policies and Procedures in 2020. In the same year, the Risk Management Team was formed under the Sustainable Development Committee to oversee the implementation of the risk management framework.
In October 2024, the Company revised the policy (Version 2) and obtained Board approval to transfer the Risk Management Team from the Sustainable Development Committee to the Audit Committee, which is now responsible for the Company's overall risk assessment and management.

Risk Management Scope

The scope of the Company's risk assessment primarily focuses on Chipbond Technology, evaluating segments with actual operational activities within the consolidated financial report. This assessment covers the six operational sites in Hsinchu and Kaohsiung, Taiwan.

The Company adopts a systematic risk management process to identify, assess, and manage risks that may affect its operations and performance. Appropriate management measures are implemented according to the level of risk to ensure effective risk control. The scope of the Company's risk management includes, but is not limited to, the following categories: Operational Risks, Environmental, Safety and Health Risks, Cyber Security Risks, and Climate Change Risks.

Risk Management Operations

The Company conducts risk assessments on issues that may affect its operations through the processes of risk identification, analysis, evaluation, and response, with each relevant department responsible for assessing risks within its area of responsibility. The results are consolidated and coordinated by the Risk Management Team. Risk assessment results and management plans are reported to the Board of Directors at least once annually. Upon approval, they are incorporated into the tracking of annual ESG objectives.

On February 26, 2026, the Risk Management Team reported the risk assessment results, management plans, and the implementation status of the previous year's actions to the Board of Directors.

The Company's approach to managing environmental, social, and corporate governance (ESG) risks is outlined as follows:

Risk assessment item	Material Issue Category	Risk Management Policies or Strategies
Operational Risk	Governance Society	A Supplier Management Policy has been established to ensure that suppliers meet the requirements and expectations of both Chipbond and its customers through standardized management processes. Secondary suppliers have been qualified for critical non-exclusive raw materials to mitigate supply chain disruption risks arising from natural disasters or force majeure events. International market developments and raw material price trends are closely monitored to assess their impact on material costs. The Company proactively conducts price negotiations and adopts appropriate procurement strategies to mitigate the impact of price fluctuations. The Company continuously maintains IECQ QC 080000 Hazardous Substance Process Management (HSPM) System certification. In addition, samples from each manufacturing process are tested annually by independent third-party laboratories to verify compliance with customer requirements and applicable regulations. Conflict minerals investigations are conducted for suppliers of raw materials containing gold, tungsten, and tin to ensure that Chipbond's products are conflict-free. The Company has established Business Continuity Management (BCM) guidelines to ensure the activation of continuous operation mechanisms and disaster recovery capabilities in the event of disasters or incidents.
Environmental and Safety and Health Risks	Society Environment	The Company has established ISO 45001 Occupational Health and Safety Management System and ISO 14001 Environmental Management System, and undergoes annual certification audits to ensure their effectiveness. The Environment, Safety and Health (ESH) Management Committee convenes quarterly to discuss environmental, safety, and health-related issues and continuously improve identified areas of concern. Workplace environmental monitoring and safety inspections are conducted regularly to reduce factors that may pose occupational safety or health hazards. Safety management requirements and clear operating procedures have been established for the entire lifecycle of chemicals, including procurement, storage, use, and disposal. Free annual health examinations are provided to employees. In addition to appropriate personal protective equipment, employees engaged in special operations receive supplementary health screening items as part of their annual health examinations to prevent occupational diseases. Occupational safety and health training, fire drills, and emergency response exercises are conducted regularly to enhance employees' safety awareness and risk management capabilities.
Information Security Risks	Governance	The Company has established a comprehensive information security risk management framework and system in accordance with the ISO 27001 standard. Through the development of management policies, information security training and awareness programs, and regular information security risk assessments to identify potential risks, the Company establishes improvement objectives and action plans to ensure the effective operation of critical information systems.
Climate Change Risks	Environment	Through ISO 14064-1 greenhouse gas inventories, the Company identifies carbon emission hotspots and develops energy-saving and carbon reduction initiatives to reduce greenhouse gas emissions generated by manufacturing processes and electricity consumption. The Company implements the ISO 50001 Energy Management System to optimize and improve energy efficiency through systematic and visualized management. Solar power generation facilities have been installed to increase the use of renewable energy and reduce dependence on purchased electricity. Business Continuity Plan (BCP) response guidelines have been established to activate continuous operation mechanisms during emergencies and minimize operational disruptions.