Internal audit organization

The Company’s Internal Audit Office reports directly to the Board of Directors.

• One Chief Internal Auditor is appointed, whose appointment and removal are subject to the approval of the Audit Committee and the resolution of the Board of Directors. One Deputy Internal Auditor is also assigned.
• Based on the Company’s scale, business conditions, management needs, and relevant regulations, an appropriate number of full-time internal auditors are appointed.
• In accordance with Article 3, Paragraph 4 of the Company’s Corporate Governance Best Practice Principles, the appointment, performance evaluation, and compensation of internal audit personnel shall be submitted to the Board of Directors for approval or reported by the Chief Internal Auditor to the Chairman for final approval.
• Internal auditors participate in continuing professional education programs organized by professional institutions each year to maintain their professional competence. Relevant personnel information is disclosed on the Market Observation Post System (MOPS) in accordance with regulations.

Scope of Internal Audit

The Internal Audit Unit conducts reviews in accordance with the Detailed Rules for Internal Audit Implementation to assess the adequacy and effectiveness of the internal control system and the implementation of general operational procedures. Both routine and special audits are performed. The audit scope covers all internal operations of the Company and its subsidiaries.

Purpose of Internal Audit

The purpose of establishing the internal audit function is to assist the Board of Directors and management in examining and reviewing deficiencies in the internal control system, as well as evaluating the effectiveness and efficiency of operations.
Through risk assessments, system reviews, and on-site audits, the internal audit function provides timely recommendations for improvement, helps departments identify opportunities for process enhancement, and promotes continuous self-improvement. The ultimate goal is to enhance overall operational performance and create greater value for shareholders and stakeholders.

Operation of Internal Audit

At the end of each year, risk assessments are conducted based on changes in the operating environment, the characteristics of the regions in which subsidiaries operate, the Company’s future business strategies, and the results of previous audits. Based on these assessments, the annual audit plan for the following year is formulated, submitted to the Audit Committee for review, and approved by the Board of Directors for implementation.
The results of monthly audits are reported in writing to the Audit Committee before the end of the following month. Any issues requiring clarification are further communicated via email, telephone, or other means.
Key audit findings are reported quarterly to senior management and formally presented to the Board of Directors.
If circumstances change during the execution of the audit plan, the audit plan will be adjusted accordingly with the approval of the Board of Directors.
Prior to each quarterly Audit Committee meeting, independent directors and the Chief Internal Auditor engage in two-way communication.
Before each semi-annual Board of Directors meeting, the external certified public accountants are invited to attend the Audit Committee meeting to engage in two-way communication with the independent directors, financial officers, and the Chief Internal Auditor. Relevant managers may also be invited to attend as necessary.

Self-Assessment of Internal Control

The Company’s internal control system is established by management in accordance with the Regulations Governing Establishment of Internal Control Systems by Public Companies and based on the Company’s overall operating activities. The system is approved by the Board of Directors.

The internal control system is designed to reasonably ensure the achievement of the following objectives:

• Operational effectiveness and efficiency
• Reliability, timeliness, transparency, and regulatory compliance of reporting
• Compliance with applicable laws and regulations

Each department and subsidiary of the Company conducts a self-assessment of internal control at least once a year. The Internal Audit Unit reviews the self-assessment reports submitted by each unit and subsidiary and consolidates them together with the status of improvements on previously identified internal control deficiencies and irregularities. These materials serve as the primary basis for the Chairman and President to evaluate the overall effectiveness of the internal control system and to issue the Internal Control Statement.

The Company did not identify any material internal control deficiencies in 2025.