Corporate Governance

This committee consists entirely of independent directors, numbering no fewer than three members, one of whom acts as the convener. Additionally, at least one member should possess expertise in accounting or finance. The committee's responsibilities are as follows:

• Establishing or amending internal control systems in accordance with Article 14-1 of the Securities and Exchange Act.

• Assessing the effectiveness of internal control systems.

• Establishing or amending procedures for significant financial transactions such as acquisition or disposal of assets, engaging in derivative transactions, lending funds, endorsing for others, or providing guarantees, as stipulated in Article 36-1 of the Securities and Exchange Act.

• Handling matters involving conflicts of interest concerning directors themselves.

• Significant asset or derivative transactions.

• Significant lending of funds, endorsement, or provision of guarantees.

• Issuance, offering, or private placement of equity securities.

• Appointment, dismissal, or remuneration of certifying accountants.

• Appointment or dismissal of financial, accounting, or internal audit directors.

• Annual financial reports signed or stamped by the Chairman, managers, and accounting directors, as well as semi-annual financial reports requiring certification by certified public accountants.

• Other significant matters required by the company or regulatory authorities.

The members of this committee are appointed by resolution of the board of directors, with a minimum of three members, the majority of whom should be independent directors. The responsibilities of the committee are as follows:

• Regularly review this regulation and propose amendments.。

• Formulate and periodically review the company's policies, systems, standards, and structures for evaluating the performance of directors and executives, as well as compensation and remuneration.

• Conduct periodic evaluations of the compensation and remuneration of directors and executives.

The Committee is composed of at least three directors appointed by the Board, with a majority being independent directors. Its responsibilities include:

• Set and review selection criteria and succession plans for directors and managers.

• Select and evaluate candidates for directors and managers. Assess independence of independent directors and recommend nominees to the Board.

• Establish and review structure, duties, and operation of Board committees. Review qualifications and potential conflicts of interest of committee members.

• Develop and review training plans for directors.

• Other matters assigned by Board resolutions.

Our company adheres to legal requirements to establish an internal control system. The audit unit has internal audit implementation regulations based on the internal control system, according to which it executes and evaluates the effectiveness and compliance of current control systems and procedures. The internal audit is an independent unit directly subordinate to the board of directors, with dedicated auditors, and reports to the board of directors at regular meetings.

As of March 26, 2024, as resolved by the board of directors, Ms. Sandy Chung has been appointed as the Corporate Governance Supervisor of our company. She meets the requirements set forth in Article 23 of the "Guidelines for the Establishment and Exercise of Powers of the Board of Directors of Listed Companies." She has over three years of experience in managerial positions related to legal affairs, compliance, internal audit, finance, stock affairs, or corporate governance as stipulated in Article 21. Her responsibilities include:

• Handle matters related to board meetings and shareholder meetings in accordance with the law.

• Prepare minutes of board meetings and shareholder meetings.

• Assist directors in their appointment and ongoing education.

• Provide information required for the execution of director's duties.

• Assist directors in compliance with laws and regulations.

• Report to the board of directors on the results of the examination of the qualifications of independent directors in nomination, appointment, and during their term of office.

• Handle matters related to changes in directors.

• Other matters stipulated in the company's articles of incorporation or contracts.

CHANGING's mission in information security is to build a resilient, secure, and trusted enterprise. We promote digital transformation, implement security management systems, ensure data accuracy, availability, and protect systems, devices, and networks. Regular drills and training raise awareness and vigilance. All staff follow clear guidelines and actively support policies to secure employees, data, systems, devices, and networks, ensuring business continuity.

To meet ISO 27001 requirements, CHANGING strengthens processes, compliance, training, and technology, protecting data, systems, and networks from errors, attacks, or disasters. This ensures commitments to shareholders and clients, maintaining business operations.

The IT Service Dept. handles security affairs, with a dedicated team reviewing security management, monitoring systems, and holding meetings when needed. The GM serves as CISO, IT manager as security rep, and R&D heads join the team. The "Security Policy" protects information assets of staff, clients, and partners, ensuring sustainable business.

The Security Management Committee has 10 permanent members and 8 task group members. The task group meets biweekly to handle incidents, risks, and policies. Internal audit team manages ISO audits. The security rep handles daily work, the CISO confirms policy and major incidents, and reports to the board.

To ensure proper management of data centers, files, networks, and access control, the company adopts:

• ISO 27001 certified by AFNOR. Updated to ISO 27001:2022 in 2024.

• ISMS strengthens incident response and disaster recovery, protecting company and client data.

• In 2022, passed government zero-trust identity compliance. In 2023, first certified for zero-trust device compliance. Applied internally with PKI and MFA, ensuring strong defense.