Group basic policies on risk management

The Vantec Group categorizes its corporate risk into eight components that are defined as follows.

1. 1.Credit risk
   Controls :
   To establish a credit lines policy for customers
   To set a proper limit on each customer's credit as well as quickly and accurately revise the limit in response to unexpected changes of its credit condition.
   Definitions :
   Risk of incurring financial losses that may arise from customers' default on its payment obligations due to bankruptcy, business failure, insufficient funding or other reasons.
2. 2.Business risk
   Controls :
   To periodically monitor return on investment (ROI) for each business project
   Definitions :
   (1) Risk of investment on a new business project
   The risk of impairing its corporate value due to the investment decision which underestimates required cost of capital
   (2) Risk of deterioration of ROI of an on-going project
   The risk of damaging its corporate value that may arise from deterioration of a targeted ROI of this project resolved by the BODs' meeting
   (3) Risk of continuing a deficit business
   The risk of accumulating financial losses caused by continuing business deficits without setting any definite criteria for withdrawal
3. 3.Compliance risk
   Controls & definitions :
   See Compliance section
4. 4.Operational risk
   Controls :
   To ensure reliability and accuracy of financial reporting
   Definitions :
   The risk of incurring financial losses caused by material events such as clerical errors, noncompliance of operational procedures, accidents, and employee frauds.
   (The risk recognition is limited in the process of preparing financial statements.)
5. 5.Legal risk
   Controls :
   Signed contracts/agreements are strictly in control, and these drafts are routinely reviewed by legal staff of the compliance section. Reforms of existing laws and regulations related with corporate activities are occasionally monitored.
   Definitions :
   The risk of incurring economical losses as well as legal claims (or litigations ) from outside parties (including customers) due to the failure (or the delay) in setting out counter-plans of the following each item :
   1) Investigation of enforcements and revisions of applicable laws and regulations, and control over and response to the compliance with the laws and regulations
   2) Continuous legal check on contracts/agreements, and filings of the created documents as well as storage of their administrative data in the stage of completing these documents or responding to various legal actions.
   3) Proper responses to lawsuits filed by a contractual party or other parties and to inspections conducted by governmental/local authorities for investigating suspicious violations against applicable laws and regulations
   4) Proper responses to the events that may arise from legal uncertainties
6. 6.Natural disaster risk
   Controls :
   To prepare for natural disasters, including the preparation and notification of disaster risk control manuals and an emergency communication route chart
   Definitions :
   The risk of human, material and economical losses due to natural disasters such as an earthquake, a volcanic eruption, a tsunami, high tide, a typhoon, cataract, abnormal climate, a spread of the epidemic/ a pandemic/ an outbreak of unidentified illness, a biohazard or any natural phenomenon
7. 7.Health and safety management risk
   Controls :
   To continuously improve the health and safety management system, including the education system and monitoring system for prevention of industrial accidents or traffic accidents caused by employees or subcontractors
   Definitions :
   1) Safety risk
   The risk of incurring losses for our group due to the accidents(automobile / freight / environment / finished car) which generated in all the duties concluded with clients or the accidents on the way of commuting, causing unfavorable effects on operations, provision of services to customers
   2) Health risk
   The risk of incurring losses for our group due to industrial accidents, overwork or inappropriate working environments, causing unfavorable effects on provision of services to customers
8. 8.IT system risk
   Controls :
   To prevent suspension of operations due to IT system failure or troubles. To take adequate steps for confidentiality of corporate information and personal information, protection of copyrights, illegal access and computer virus
   Definitions :
   (1) Risk of system failure
   The risk of incurring losses for customers, business partners or our group due to delay or disorder in providing services to customers caused by IT system failure in hardware, software, blackout or network down
   (2) Risk of IT system breakdown by natural disasters
   The risk of having a material negative impact on corporate activities due to destruction of a part of or the whole IT system caused by natural disasters such as an earthquake, fire or flood, leading to a long-time suspension of operations or difficulties in maintaining proper functions of IT systems
   (3) Risk of data leakage
   The risk of incurring material losses for customers, business partners or the Group due to the damage of the corporate credit in the society caused by data leakage whatever on purpose, by mistake, or by hacking from outside, of corporate confidential information, customer information, business partners' information or personal information
   (4) Risk of unauthorized usage of licenses
   The risk of damaging corporate reputation due to the illegal usage of unauthorized copies, leading to lawsuits or announcements in public of the fact by license holders
   (5) Risk of virus infection
   The risk of damaging corporate reputation due to the virus infection through e-mails or data storage media such as Web, USB, leading to data destruction, data leakage, virus diffusion to customers.

The Vantec group is committed to managing the above-mentioned risks properly, evaluating them in a proper manner and preparing corresponding management organizations if required. Each corresponding organization shall formulate risk management manuals, update them time-to-time and roll out risk management activities proactively to achieve a comprehensive and high-level risk management system.