Risk Management Policies and Procedures
To ensure the robust operating performance and sustainable development of the Company, various risks were defined based on the Company’s operating strategies and objectives. Potential losses shall be restricted within the tolerable range, and an overall risk management organization framework and risk management mechanism shall be established.
The “Guidelines for Risk Management” of the Company were approved by the Board of Directors on December 27, 2013, as the top guiding principles of the Company’s risk management. On December 24, 2018, Guidelines for BCP Risk Control Procedures were promulgated and amended. The Company regularly assesses risks annually, and promulgates risk management policies for each type of risk covering management objectives, organizational structures, accountability, and risk management procedures to effectively identify, measure, and control the Company’s various risks arising from business activities and restrict them within a tolerable range.
I. Important Risk Categories
Overall, the risks the Company may encounter are divided into the following five categories:
[Strategic Risks] The impact on the Company’s financial business due to changes in the overall domestic and foreign economic situation, and/or important policies and laws.
[Operational Risks] Including risks of sales concentration, procurement concentration, legal regulations, talent recruitment and retaining, and impacts of technological and industrial changes, etc.
[Financial Risks] Interest rate changes, exchange rate changes, inflation, deflation, as well as impacts on the Company’s profits and losses due to policies for high-risk/high-leverage investment, capital loans to other parties, endorsements, and derivative commodity transactions.
[Information Security Risks] The risks of information disclosure of the Company’s major operating information, personal data, and/or client data required to be protected under contract provisions due to computer viruses, hacking, and/or various internal and external information security threats.
[Other Risks] Risks that are not specified in Subparagraphs 1 to 4 of the preceding Paragraph, such as climate change or environmental protection agreements, are expected to have a certain level of impact on the Company’s financial and business performance.
II. Organizational Structure
| Organizations for Risk Management | Responsibilities |
| Board of Directors | The top unit of risk management, with the goal of complying with laws and regulations, promoting and implementing the Company’s overall risk management, ensuring the effectiveness of risk management, and assuming the overall responsibility for risk management. |
| Department of Finance | Establish a high-efficiency and high-quality financial platform to provide transparent and credible financial information, operation analysis, and improvement plans. Adopt strict control, and legal tax planning, credit risk control, and financial crisis prediction models to mitigate corporate risks. |
| Audit Office | Review the existing or potential risks of each operation based on the risk-oriented annual audit plans. Assume the responsibility for the revision and promotion of the internal control system to ensure that the Company can implement effective operation risk management. |
| Department of Information Technology | Plan and improve the Company’s information management system, assume the responsibility for network information security control and protection measures, and provide management levels with fast and effective operation management information to mitigate information security risks. |
| Business Units | The head of each business unit is responsible for the front-line risk management, analyzing and monitoring the relevant risks in the respective unit to ensure that the risk control mechanism and procedures are being effectively implemented. |
III. Mechanism for Risk Management
| Risk Management Mechanisms | Levels | Responsibilities for Risk Management and Control |
| First-tier Mechanism | Business Units and Staff in-charge |
Initial detection, assessment, and control of risks |
| Second-tier Mechanism | Operational Meetings or Executive Meetings |
Feasibility assessment and various risk assessment |
| Third-tier Mechanism | Board of Directors Audit Committee Audit Office |
The Audit Office is responsible for risk inspection, assessment, supervision, and improvement tracking, summarizes the implementation of risk management of various departments within the Company, and timely provide company risk management reports to the Board of Directors and the Audit Committee. The Board of Directors and the Audit Committee are responsible for the decision-making and final control of risk assessment and control. |
IV. Operation Status
The “Guidelines for Risk Management” of the Company were approved and promulgated by the Board of Directors on December 27, 2013. Since then, the Company has actively promoted the implementation of risk management mechanisms and reported to the Board of Directors the tables for risk assessment analysis and operation status on an annual basis. The data from the risk assessment analysis table would be used as the focal points for the audit of the coming annual period year.
Annual key operation status over the years and respective analysis of risks:
In December 2013, the “Guidelines for Risk Management” were promulgated.
In 2014, the “Risk Assessment Analysis Form” and the “Risk Factor Weight Table” were included in the important risk review indicators of the audit plans.
In 2017, the “Self-assessment Report of Internal Control” and “Annual Audit Findings” and other operational risk loss data were collected and included in the important risk review indicators of the audit plans.
In December 2018, the “Guidelines for BCP Risk Control Procedures” were promulgated.
In 2021 (The Annual Operation Status)
The Company at the Audit Committee meeting held on December 29, 2021, reported on the ever-changing risk environment currently faced by the Company, risk management priorities, risk assessment, and relevant measures based on “Key Risk Assessment Analysis Form for 2021” and the “Audit Plans for 2022”. (See the Table below)
| Key Risks | Potential Risks | Risk Level % | Risk Management Type | Current Management Approaches | Enhancement and Improvement Approaches | Implementation Status |
| Operational Risk | Risk of poor project progress control | 25 | (2)Mitigation | 1. Enhance professional training. 2. Enhance the capability to control the current market conditions. 3. Enhance the capabilities and resilience of project managers on the comprehensive planning of the work process at each stage. 4. Enhance the capabilities of project managers to control the schedules and risks of projects. |
1. Enhance the communication with the business units, confirm that the R&D resources are distributed to the projects required for business, and prioritize the projects based on the priority of clients’ demands. 2. Clearly define the job responsibilities of RDs to ensure that each RD can be utilized upmost in the project to improve efficacy. Supporting works are done by non-RD engineers to improve efficiency. 3. Introduce the Issue tracking system to allow the project progress tracking. |
1. Track and support project progress with R&D professional platform and weekly meetings |
| Operational Risk | Risk of the R&D data breach | 20 | (1)Avoidance | Introduce the Data Loss Prevention system, and use the file encryption right after saving to prevent a data breach. | In addition to the protection of the DLP system, the Company also has full control of the access of USBs of all computers to prevent the risk of a data breach. | Various firewalls and file encryption operations within the Company have been enhanced and the use of USB has been completely prohibited. |
| Operational Risk | Risk of the outflow of talents | 12 | (2)Mitigation | 1. Development programs for key talents 2. Provide a good workplace environment 3. Employees care 4. Succession plans 5. Recommended graduates from VTESC 6. College graduates or undergraduates recommended by faculties of relevant departments |
1. TTQS promotion Program for talents 2. Provide a complete and fair promotion system 3. Design creative recruitment ads 4. Contact college professors and VTESC staff closely. |
1. Enhance the functions of the education and training platform and improve the education and training courses 2. Brand marketing of MACHVISION SPORTS 3. The areas from the 1st to 6th floors have been renovated and improved to provide a more comfortable work environment |
| Information Security Risk | *Environmental risk (5%) Floods, fires, earthquakes... |
10 | (2)Mitigation | Off-site backup | Off-site backup | Regularly review information security content, increase remote backup mechanisms and prevent data loopholes |
