Corporate
Governance

Risk Management

On March 13, 2025, during the 11th meeting of the 11th Board of Directors, the Company approved the "Risk Management Policy and Procedures" as the highest guiding principle for implementing risk management. The Company conducts annual risk assessments, considering all risks that may affect the achievement of corporate objectives, formulates corresponding risk management policies, and ensures their implementation. Through systematic identification, measurement, and control mechanisms, the Company effectively manages risks arising from business activities, keeping them within acceptable levels and enhancing operational stability and corporate resilience.

The key risk management priorities and implementation status for 2025 were reported to the Board of Directors on November 10, 2025.

Risk Management Organizational Structure and Responsibilities

  1. Board of Directors: The Board of Directors serves as the highest supervisory body for the Company’s sustainable development and risk management. It is responsible for overseeing the establishment and promotion of the Company’s sustainability policies, objectives, and risk management framework. The Board also regularly reviews reports on implementation progress to ensure that the Company’s operational strategies incorporate both sustainable development and effective risk control.

  2. Audit Committee: The Audit Committee assists the Board of Directors in overseeing the operation of the Company’s internal control and risk management systems. It also reviews the effectiveness of relevant management mechanisms to strengthen corporate governance and risk control.

  3. Corporate Governance Task Force: The Company’s sustainability-related affairs are currently coordinated and promoted by the Corporate Governance Task Force. Its primary responsibilities include planning and advancing policies and systems related to Environmental, Social, and Governance (ESG) matters; consolidating implementation results from various departments; conducting stakeholder communication and materiality analysis; and managing sustainability disclosures and corporate social responsibility initiatives. The Task Force regularly reports progress to the Board of Directors.

  4. Internal Audit: The Internal Audit unit reports directly to the Board of Directors and is responsible for reviewing the implementation of the Company’s internal control systems and related management mechanisms. It also provides recommendations for improvement regarding the implementation of risk management and sustainability frameworks to help enhance corporate governance and management effectiveness.

  5. Operating Units: Each operating unit implements sustainability initiatives and risk management measures in accordance with the Company’s sustainability policies and related management systems. They also collaborate with the Corporate Governance Task Force to advance related initiatives and jointly achieve the Company’s sustainable development objectives.

Risk Management Implementation

Risk Dimension Risk Factor Response Measures

Information Security Risk

Information Security

  • Obtain ISO27001 certification, conduct regular information security training, perform security drills, regularly review external security risks, and update internal systems.

  • Implement security technologies and promote security awareness training in accordance with the company's management and IT policies.

Financial Risk

Credit Risk

  • CRM system overdue section: Built-in accounts receivable overdue section allows sales personnel to track overdue customers and amounts in real time, enhancing risk monitoring and early warning capabilities.

  • Regular aging analysis reports: The finance department compiles monthly aging reports and proactively provides them to sales and management for collection and risk response planning.

  • Overdue reporting in sales meetings: Weekly sales meetings include overdue account tracking; sales staff report collection progress and overdue handling to supervisors and develop timely response measures.

Market Risk

  • Monitor domestic and international economic trends, pay attention to exchange rate and interest rate fluctuations, and respond promptly.

  • Offer foreign clients stricter credit conditions to shorten collection periods and reduce exposure to exchange rate fluctuations.

  • The finance department primarily invests in short-term or easily convertible financial instruments; when international interest rate policies are unfavorable, adjust fund allocation quickly while maintaining good relationships with banks to enhance liquidity and risk response capability.

Tax Risk

  • Monitor tax law revisions and draft bills regularly for proactive tax planning.

  • For major company decisions, consult professional tax advisors to address uncertain tax risks.

  • All transactions comply with applicable tax laws and legislative intent.

  • Utilize legal and transparent tax incentives; do not exploit laws for improper tax benefits.

  • Tax planning is not conducted for the purpose of tax avoidance.

  • Financial information is transparent; tax disclosures in financial reports comply with regulations and are audited by certified accountants.

  • Maintain honest tax practices and good communication with tax authorities.

Operational Risk

Operational Risk

  • Establish teams for R&D, technical services, project services, quality assurance, and sales, with clear division of responsibilities.

  • Emphasize training for new and current employees to continuously improve professional capabilities.

  • Implement internal controls for R&D, production, and sales; conduct regular audits and reviews to reduce operational risks.

Brand Reputation

  • Establish marketing audit processes, promote responsible marketing principles, and conduct regular brand reputation monitoring.

Regulatory Compliance

  • Participate in compliance training courses and establish a marketing content review mechanism.

Customer Satisfaction

  • Provide diverse and real-time customer service channels, including dedicated email and Line accounts, to respond quickly to inquiries; regularly conduct customer satisfaction surveys to continuously improve service processes and quality.

Market Trend

  • Enhance green product marketing strategies, adjust product mix, and proactively educate the market and customers.

Risk Management Policies and Procedures Download
2025 Risk Management Operation Status Download

Supplier Sustainability Management

CHANGING refers to internationally recognized standards, including the UN Guiding Principles on Business and Human Rights, the International Labour Organization’s Declaration on Fundamental Principles and Rights at Work, and the UN Universal Declaration of Human Rights, to formulate its Supplier Code of Conduct. This ensures that CHANGING Information Technology Inc.'s supply chain upholds the principles of corporate governance, social responsibility, sustainable operations, and integrity in business.

Supplier Types and Proportions

CHANGING Information Technology Inc. collaborates with partners across various industries, while its upstream supply chain mainly consists of domestic and international hardware/software suppliers, distributors, and outsourced project vendors. In 2024, CHANGING procured from nearly 80 supplier partners, which can be categorized into three types: Original Manufacturers, Distributors, and Outsourced Vendors.

Local Procurement Expenditure Ratio

In 2024, CHANGING Information Technology Inc.'s local procurement amounted to NT$73 million, with domestic procurement making up the majority of total purchases. CHANGING will continue to promote local sourcing, reducing carbon footprint and demonstrating its commitment to sustainable development.

Supplier Selection and Management

CHANGING is committed to establishing a responsible and sustainable supply chain management mechanism. According to the Procurement Management Procedures, we conduct comprehensive evaluations for new suppliers, covering financial stability, technical capabilities, and quality management, ensuring suppliers maintain consistent quality and service standards. Through the annual CHANGING Supplier Satisfaction Survey, we continuously monitor and assess the performance, technical support, and service quality of both new and long-term suppliers.

To further strengthen sustainable governance across the supply chain, CHANGING will gradually implement more comprehensive supplier sustainability management systems. Corporate social responsibility, integrity in business, and sustainable development principles will be integrated into the Procurement Management Procedures, Supplier Management Procedures, and the Annual Supplier Performance Evaluation Form, serving as key references for supplier selection and management. Through these institutionalized measures, we jointly advance the practice of social and environmental responsibility.

We recognize that pursuing business growth and economic benefits must be balanced with awareness of the potential impacts on society, the environment, and local communities. Therefore, CHANGING commits to sustainable operations in its business activities, promoting responsible supply chain governance, and achieving mutual prosperity with stakeholders.

Supplier Types and Proportions

In 2024, 13 suppliers completed their annual audits covering quality, technology, and service. The audit results showed 11 suppliers passed, 1 supplier failed but improved after notification, and 1 supplier failed and is no longer engaged.

Intellectual Property Management Plan

1. Intellectual Property Management Implementation Status

The Company has established an Intellectual Property (IP) Management Plan, which is promoted and implemented by the responsible departments. The implementation status of the IP Management Plan is reported to the Board of Directors on a regular basis (at least once a year), enabling the Board to oversee the Company’s IP management and protection practices and supervise the continuous improvement of related mechanisms. The 2025 IP Management Plan and its implementation status were reported to the Board of Directors on August 11, 2025.

2. Purpose

The Company has established an Intellectual Property Management Plan to ensure effective protection and proper utilization of trademarks, patents, copyrights, and trade secrets. This strengthens corporate governance and board oversight, safeguards business interests and competitive advantage, and demonstrates our governance philosophy and core values.

To reduce the risk of intellectual property infringement, the company implements a systematic management mechanism that covers the entire lifecycle from creation, protection, management, to utilization. Regular training and internal awareness programs are conducted to enhance employees' understanding and management of intellectual property, thereby ensuring effective implementation of IP management and supporting sustainable growth and continuous innovation.

3. Strategy
  • Trademark Registration: Strategically name products and services and register trademarks to enhance market competitiveness and prevent infringement.

  • Enhance IP Awareness: Conduct periodic training and internal campaigns to improve employees' understanding and appreciation of intellectual property, developing their ability to identify, use, manage, and protect company IP.

  • Systematic Trade Secret Management: Protect core technologies that cannot be covered by patents or other registrations (e.g., algorithms, business models, customer data processing) as trade secrets, using documentation, labeling, access control, and other systematic measures for risk management.

  • Strengthen Information and Confidential Data Protection: Establish clear confidentiality policies, implement data classification and access control mechanisms to reduce the risk of leaks. The company has formulated a Confidential Information Management Procedure to manage sensitive files and guide internal departments in handling confidential data.

4. Implementation
  • Trademarks and Patents:

    1. Registered 17 trademarks including FastSIGN, IDExpert, inSAFE, and obtained trademark certificates in Taiwan. Filed 4 patent applications. All trademark certificates and expiration dates are systematically managed with regular renewal tracking.

    2. To strengthen employees' IP protection awareness, the company continuously conducts IP-related training covering trademarks, patents, and software copyrights, effectively improving overall patent and R&D management efficiency.

  • Trade Secrets:

    1. Established comprehensive information security mechanisms and internal access controls. Using version control, access logs, authentication, and encryption technologies to prevent confidential information leaks, with regular risk assessments and audits to ensure continued effectiveness.

    2. All new employees sign a Confidentiality Agreement on their first day to enforce trade secret management, increase awareness of trade secret protection, and reduce the risk of leaks.