Risk Policy

Risk Management Organization

RichWave has established a cross-departmental Business Continuity Planning (BCP) Management Office, which includes an emergency response team, a logistics support team, and a climate change risk response team. The President serves as the convener of the Management Office, which consists of representatives from various business units. The Corporate Sustainability Committee is responsible for planning, executing, and overseeing risk management matters, including risk policies, strategies, and procedures, with the Board of Directors serving as the highest governing body for risk management. To prevent potential major risks from harming the company, the BCP Management Office conducts rigorous risk evaluation to formulate response strategies, arrange for emergency response measures, as well as carrying out drills from time to time, and engage in ongoing improvement.

Risk Policy and Management Process

To ensure that RichWave operates in a proactive and cost-effective manner, it integrates and manages a variety of strategic, operational, financial, and hazard-related risks that may affect its operations and profitability. The Company enhances the oversight function of its Board of Directors in the area of risk management. RichWave has established a "Risk Management Policy and Procedures" which has been approved by the Board of Directors. The Company conducts a comprehensive evaluation and management of existing risk factors through the processes of risk identification, risk analysis, risk assessment, risk response and control, and risk monitoring. The Company maintains regular monitoring of emerging risks that may potentially have an impact, and endeavors to acquire a comprehensive understanding of the extent of each risk. The Company implements appropriate measures and allocates resources to ensure the effective management of relevant risks.

Risk Item Identification and Management

By analyzing the global conditions, industry trends, and regulatory trends, RichWave can identify risks related to five dimensions including Strategy, Operation, Finance, Hazardous Events, and Legal Compliance:

In regard to the risk items that may be encountered during the company’s day-to-day operations, RichWave has developed a risk and opportunity management protocol to conduct a SWOT analysis based on the company’s background. Furthermore, the stakeholders’ concerns and appeals are included in the stakeholder risk analysis and controlled by the risk analysis team. The two major high-risk items identified in 2025 include legal compliance and operational management. Regarding legal compliance, each relevant department should continuously monitor changes in regulations to ensure the Company stays informed and updates its internal policies accordingly. In 2025, due to the ongoing Ukraine-Russia war, we continued to cooperate with Taiwan’s export control regulations by implementing due diligence for our product sales. This includes requiring RichWave customers to sign acknowledgments of compliance with export control regulations of Taiwan, the United States, and the European Union, including the EU’s controls on dual-use items. Through an ongoing Business Continuity Plan (BCP), we strengthen and enhance corporate governance across five key areas: strategy, operations, finance, hazard events, and regulatory compliance. The following are the main projects implemented in 2025 to mitigate high-risk items: Due to the inconsistent implementation of contract expiration and automatic renewal date controls across departments, the Company was exposed to potential legal and cost risks. Failure to terminate or renegotiate contracts in a timely manner could have led to unnecessary expenditures, renewal lock-ins, and breach of contract liabilities. To address this, in addition to strengthening internal training and enhancing the monitoring capabilities of relevant departments regarding contract execution, the Company ensured that each department head held clear accountability for contract fulfillment and collaborated closely with the supply chain, finance, and legal departments. The Legal Department completed a risk review of all auto-renewing contracts and inventoried 644 contracts to standardize expiration dates and renewal terms. Furthermore, a contract system notification process was launched, with all expiration dates, notice periods, and automatic renewal terms entered into the system to ensure the accuracy and completeness of the reminder mechanism. In 2026, we will continue to review and mitigate operational risks associated with high-risk items, such as the consistency between the shipping terms specified in contracts and actual shipping practices.

The Company reported the current status of the its risk management and identification efforts and relevant response measures on December 19, 2025, and approval was obtained from the Board of Directors.

Audit and Internal Control

Sustainability information was incorporated into our internal control system

In accordance with the FSC's Regulations Governing Establishment of Internal Control Systems by Public Companies, the Reference Items for Determining the Effectiveness of Internal Control Systems examples, and the Rules Governing the Preparation and Filing of Sustainability Reports by TWSE Listed Companies, RichWave has established the "Sustainability Information Management Regulations" and incorporated them into its internal control system. The internal audit unit also carries out its duties in accordance with the audit plan and reports the results to the Audit Committee and the Board of Directors on a regular basis. The internal audit unit completed the internal control audit of this year's sustainability information in the fourth quarter of 2025 and reported the results to the Board of Directors on March 5, 2026.

RichWave has formulated the "Internal Control System Self-Assessment Procedures," which apply to all operational activities of Company and its subsidiaries. The internal control system comprises five primary components: the control of the environment, risk assessment, control of operations, information and communication, and monitoring operations. Each component possesses a distinct set of detailed items.

The effectiveness of the organization's internal control system is evaluated using the above evaluation criteria. The internal control operations for 2025 was completed on March 05, 2026, confirming the effectiveness of the Company's operations, the achievement of efficiency objectives, and compliance with laws and regulations, and releasing an internal control system statement approved by the Board.