Shaping a Risk Management Culture

To effectively improve the implementation results of the mechanisms and culture of risk management, the Risk Management Division of SinoPac Holdings uses the Company's core corporate vision and cultural values to implement supervision and management, provide strategic leadership, and create comprehensive results. Each year, the assessment items and their scoring standards are set according to the attributes of each unit and subsidiary of the Company. The metrics include "Risk Management Mechanisms", "Risk Management Awareness Education and Training", and "Timeliness and Accuracy in Risk Incident Reporting". In addition, the Subsidiaries also cooperate by implementing the "Annual Enhanced Focus" plan each year and report the implementation of key work items and achievement rates each quarter. The results of assessments are used as the basis for determining the annual performance of subsidiaries. Performance evaluations for risk management personnel of SinoPac Holdings and its subsidiaries are based on the Employee Evaluation Guidelines, and a rating is assigned to each employee based on his/her annual work performance, goal attainment, and attendance.

SinoPac Holdings Internal Control Indicators and Weight Linked with Performance Evaluation

SinoPac Holdings' Actions for Shaping Risk Culture

Inclusion of risk management criteria into employee performance evaluation

• The Risk Management Division established evaluation indicators for subsidiaries in accordance with the “Subsidiary Performance Evaluation Regulations”. The evaluation indicators include “Risk Management Mechanisms”, “Risk Management Awareness Education and Training”, and “Enhanced Measures for Risk Incidents”.

Establish mechanisms for proactive identification and reporting

• The Risk Management Division encourages employees to identify potential risks in daily operations, propose response measures and solutions, and actively discuss feasible measures with the unit supervisor.
• According to the “Employee Rewards and Punishment Regulation”, employees that provide specific recommendations or achieve results are eligible for feedback incentives.

Encourage involvement of employees in structured feedback process

• In terms of information security risks, employees also actively collected intelligence on online attacks from police authorities, TWNIC, F-ISAC, and RSA, and discussed feasible response strategies to continue to improve risk management mechanisms.

Incorporating risk assessment in product development process

• SinoPac Holdings requires all subsidiaries to establish management guidelines for new products or new businesses. Subsidiaries must also implement related risk assessments, risk management procedures, control mechanisms, and accounting and operation procedures, and obtain the approval of related units or the Board of Directors.
• SinoPac Holdings evaluates security management and control measures through architecture review meetings to ensure that the development process of new systems meets requirements of the secure software development life cycle to reduce security risks.

Training programs and awareness campaigns

• SinoPac Holdings organizes regular joint seminars on audit, compliance, and risk management to discuss related issues and establish a risk management culture for the entire group.
• The supervisors and personnel of SinoPac Holdings and its subsidiaries and executives of related business units must attend AML, compliance, and ethical corporate management training each year.