Shaping a Risk Management Culture

To effectively improve the quality of risk management, the Risk Management Division of SinoPac Holdings evaluates the implementation status of risk management by subsidiaries each year in the terms of "Risk Management Mechanisms", "Risk Management Awareness Education and Training", and "Risk Incident Reporting". The subsidiaries prepare the "Annual Enhanced Focus" plan each year and report the implementation of key work items and achievement rates each quarter. The results of assessments are used as the basis for determining the annual performance of subsidiaries. Performance evaluations for risk management personnel of SinoPac Holdings and its subsidiaries are based on the Employee Evaluation Guidelines, and a rating is assigned to each employee based on his/her annual work performance, goal attainment, and attendance.

SinoPac Holdings Internal Control Indicators and Weight Linked with Performance Evaluation

SinoPac Holdings' Actions for Shaping Risk Culture

Inclusion of risk management criteria into employee performance evaluation

• The Risk Management Division established evaluation indicators for subsidiaries in accordance with the "Subsidiary Performance Evaluation Regulations". The evaluation indicators include “Risk Management Mechanisms”, “Risk Management Awareness Education and Training”, and “Enhanced Measures for Risk Incidents”.

Establish mechanisms for proactive identification and reporting

• The Risk Management Division encourages employees to identify potential risks in daily operations, propose response measures and solutions, and actively discuss feasible measures with the unit supervisor.
• According to the "Employee Rewards and Punishment Regulation", employees that provide specific recommendations or achieve results are eligible for feedback incentives.

Encourage involvement of employees in structured feedback process

• In terms of information security risks, employees also actively collected intelligence on online attacks from police authorities, TWNIC, F-ISAC, and RSA, and discussed and analyzed feasible response strategies in groups to continue to improve risk management mechanisms.

Incorporating risk assessment in product development process

• SinoPac Holdings requires all subsidiaries to establish management guidelines for new products or new businesses. Subsidiaries must also implement related risk assessments, risk management procedures, control mechanisms, and accounting and operation procedures, and obtain the approval of related units or the Board of Directors.
• SinoPac Holdings evaluates security management and control measures through architecture review meetings to ensure that the development process of new systems meets requirements of the secure software development life cycle to reduce security risks.

Training programs and awareness campaigns

• SinoPac Holdings organizes regular joint seminars on audit, compliance, and risk management to discuss related issues and establish a risk management culture for the entire group.
• The anti-money laundering supervisors and personnel of SinoPac Holdings and its subsidiaries must attend AML, compliance, and ethical corporate management training each year.