Risk Management System and Structure
Sustainable Operations Philosophy
-
-
- Compal has established a Risk Management Policy, which was approved and became effective upon Board approval on March 15, 2022, serving as the highest guiding principle for the Company’s risk management practices. The core principle of the policy is to follow international standards and benchmark against leading enterprises while ensuring regulatory compliance to achieve sustainable corporate operations.
- The Company follows the Regulations Governing Establishment of Internal Control Systems by Public Companies issued by the Financial Supervisory Commission to establish financial, operational, and accounting management systems, and to evaluate and monitor operational risks. The management team actively participates in formulating risk management policies and corresponding guidelines to ensure that operational risks remain within acceptable levels.
- The Company also complies with local laws and regulations applicable to its major production sites. For example, it follows the guidance related to the “Basic Norms for the Internal Control of Enterprises” jointly issued by the Ministry of Finance of the People’s Republic of China, the China Securities Regulatory Commission, the National Audit Office, the China Banking Regulatory Commission, and the China Insurance Regulatory Commission.
Internal Control Design with Full Employee Participation
- Based on organizational structure, delegated responsibilities, and process control points, the Company has established an internal control framework. Through internal control self-assessments and performance evaluations, the Company ensures effective implementation of internal controls.
- The Company promotes internal control self-assessment covering both entity-level and operational-level controls. In 2025, a total of 380 units (department-level units or independent units) conducted self-assessments, with 249 individuals completing the self-evaluation process, including the Chairperson, President, independent directors, and related managerial personnel. The comprehensive coverage was sufficient to ensure the effective introduction and implementation of internal control procedures.
Ethical Management and Risk Management Organization Structure
- The Ethical Corporate Management Best Practice Principles and Procedures for Ethical Management and Guidelines for Conduct were established by the Company in accordance with the Ethical Corporate Management Best Practice Principles for TWSE/GTSM Listed Companies and Procedures for Ethical Management and Guidelines for Conduct published by the TWSE.
- The Company has also formulated its risk management organization and processes by referencing the Three Lines Model framework published by The Institute of Internal Auditors (IIA), while incorporating practical operational considerations based on the Company’s organizational structure.
- To promote risk management, each department head establishes responsible units according to their duties and responsibilities. These units are responsible for day-to-day risk management and, through communication, coordination, and collaboration among departments, jointly promote and execute annual plans and projects to implement comprehensive risk management across all business operations.
- Risk Management Training: To cultivate employees’ awareness of risk management and reinforce information security concepts among all employees, the Company provides educational training programs and seminars on Compal’s sustainable development, risk management, information security, and confidentiality awareness for all employees. These initiatives aim to strengthen employees’ risk awareness and vigilance.
.png)
Risk Identification and Priority for 2026
The Company follows the ISO 31000 framework and methodology to carry out the processes of risk identification, analysis, and evaluation. A total of 42 risk issues were identified and consolidated under five categories: Strategy, Finance, Operations, Compliance, and Environment. The Risk Analysis Matrix was then applied, taking into account the Company’s resources, to determine the prioritization of risk management efforts.
Risk Response Strategy
Based on the results of the Risk Analysis Matrix, Compal analyzed internal and external environments for the top three risks, identified specific risks, and formulated corresponding response strategies, as detailed below.
Identification of Emerging Risks
ETHICAL MANAGEMENT AND ANTI-CORRUPTION
Management System
Compal is committed to the establishment of the corporate culture of ethical management and upholds the principle of “Zero Tolerance”for unethical conduct, including bribery and corruption. See relevant policies on Compal website.
- Compal maintains a zero-tolerance policy toward corruption and bribery at all times. To strengthen the Company’s standards of business integrity and effectively address risks related to conflicts of interest and other associated matters, Compal has established an Ethical Management and Anti-Corruption Management System with reference to the ISO 37001 international anti-bribery management standard, in response to international organizations’ expectations regarding transparency and disclosure assessments, and in compliance with regulatory requirements and expectations.
- The Ethical Management and Anti-Corruption management team regularly benchmarks international best practices and references the U.S. Foreign Corrupt Practices Act (FCPA) and the UK Bribery Act 2010 (UKBA) to strengthen internal management and audit procedures. These efforts enable the Company to effectively respond to challenges arising from the external environment and establish a solid foundation for global expansion and advancement toward becoming a world-class enterprise.
Coverage Locations
Compal conducts corruption risk assessments for all global operating locations at least once annually. Depending on operational risk levels and materiality, either on-site assessments or written assessments are conducted accordingly. Coverage locations include Taiwan headquarters, China, Vietnam, North America, Central and South America, and Europe. The coverage rate has remained at 100% over the past three years.
Implementation Results-Completed in 2025
o Integrity management training for directors: The Company encourages and assists directors in enhancing their ethical management concepts and management capabilities through training programs. Relevant courses are either organized by the Group’s affiliated enterprise, KINPO GROUP MANAGEMENT SERVICE COMPANY, in compliance with regulatory requirements, or conducted by external professional institutions. As of December 31, 2025, directors had completed a total of 117 training hours.
o Ethical management and anti-corruption training for employees: The Company conducts regular annual ethical management and anti-corruption training programs. The implementation status for 2025 is shown in the table below:
Summary of Violations
Cyber Security
ISO 27001Information Security Policy
To achieve the information security strategy of "ensuring business continuity and enhancing customer satisfaction," Compal has implemented an information security management system. This includes formulating roles and responsibilities for information security, ensuring full participation from all employees and contractors. We identify information assets, conduct information security risk assessments, comply with laws and regulations, meet customer security requirements, and carefully evaluate overall information security risk items and acceptance criteria.
In response to the evolving digital environment and ever-changing new technologies, we strengthen digital resilience and implement information security controls with a proactive defense mindset. This includes identification, protection, detection, response, and recovery, aimed at maintaining the confidentiality, integrity, and availability of critical information assets. Through management reviews and performance evaluations, we continuously improve and maintain the effectiveness of the information security management system. Our goal is to gain customer trust, fulfill commitments to shareholders, and achieve sustainable business operations.
Compal Information Security Management Organization
Policies and Regulation for the Protection of Personal Data and Privacy
Compal formulates "Compal Group - Policies and Regulations for the Protection of Personal Data and Privacy", stating the employees should abide by and protect various forms of personal data processing procedures, the scope of application, corrective actions, and disciplinary actions. "Compal Group - Policies and Regulations for the Protection of Personal Data and Privacy" applies to all group-wide in Compal. The "Personal Data Management Team" (known as the "Data Management Team" is established across functions for the proper protection of privacy right, and the hotline at +886287978588#14385, or the e-mail at Compal_PIR@compal.com is set for filinging a complaint and reporting. Compal adopts a zero-tolerance policy for privacy protection. In the use of personal information, unless the individual explicitly agrees, Compal will not collect any personal information. In addition, Compal is also prohibited from using personal information for secondary purposes. There was zero secondary use through internal monitoring in 2025. If any relevant personnel is in breach of duty, Compal will take disciplinary actions and corrective actions to protect data privacy.
◼ISO 27001 Certification 
◼Compal Group Policies and Regulations for the Protection of Personal Data and Privacy
ETHICAL MANAGEMENT AND ANTI-CORRUPTION
Compal has established its Responsible AI Policy and Guidelines, which define the scope of AI development and application, as well as the requirements, corrective actions, and disciplinary measures that employees must follow. The policy applies to all Compal Group personnel and AI-related supply chain partners.
To ensure effective AI governance, Compal has established an AI Governance Office to oversee and coordinate all Responsible AI governance activities. In the development and use of AI, the following principles shall be upheld:
1.Accountability
2.Cybersecurity
3.Transparency and Explainability
4.Fairness and Non-Discrimination
5.Data Privacy and Personal Data Protection
6.Human-in-the-Loop Decision-Making
7.Environmental and Ethical Impact
8.Education, Training, and Responsible Use
Based on these principles, Compal implements its Responsible AI Program. Individuals who believe their rights or interests may have been adversely affected by AI systems, including issues related to privacy protection, fairness, or bias prevention, may submit complaints or reports through the designated protection hotline mentioned above.
◼ Responsible AI Guidelines 
◼ Compal Responsible AI Program 