Risk Management

As a company dedicated to providing high quality steel structure products, CT regards sustainable development as one of its core corporate values. Continuously monitor risks in operating activities, and through management mechanisms, reduce operational risks, financial risks, information security risks, environmental and carbon reduction energy risks, and corporate sustainability risks. By ensuring the effectiveness and sustainability of risk management, sustainable corporate operations can be achieved. To assess and address various potential risks, the Company has adopted multiple risk management measures and integrated them with the ISO management system to continuously monitor major risk issues.

Internal Audit System: Oversee and manage operational processes to prevent potential governance risks

An Internal Audit Department has been established and reports directly to the Board of Directors. Its duties are to audit various operational activities and provide recommendations for improvement in areas such as operational effectiveness and efficiency, reliability of financial information, and compliance with relevant laws and regulations. The internal audit reports and audit follow‑up reports are submitted to the independent directors for review, and the Head of the Audit Department attends board meetings to report on audit work carried out according to the audit plan.

Internal audits are conducted in accordance with the requirements set by the FSC. In addition to the major transaction cycles (engineering and collections, procurement and payments, investment, financing, production, payroll, and fixed assets), the audits also focus on guarantees and endorsements, loans to others, asset management, budget management, financial statements, derivative financial instruments, related‑party transactions, supervision and management of subsidiaries, board meeting procedures, and prevention of insider trading. The internal audit reports and audit follow‑up reports are submitted to the Audit Committee for review as required by regulations.

To prevent potential ethical risks among employees during corporate operations, in addition to imposing strict standards on personnel integrity, the Company has established governance structures and implemented internal control mechanisms to ensure that all staff and operations fully comply with relevant laws and regulations, thereby deterring misconduct.

ž   Planned Audit Operations

Before the end of each year, the Internal Audit Office formulates the annual audit plan based on risk assessment results, and after executing the audits, submits any identified internal control deficiencies and anomalies along with recommendations for improvement to the independent directors for review in order to ensure the internal control system is continuously and effectively implemented.

ž   Self-assessment Operations

To implement the Company’s self‑management and supervision mechanisms, a self‑assessment is conducted at the end of each year, whereby each department carries out its own internal control system evaluation, which is then reviewed by the Internal Audit Office and submitted to the General Manager for approval to ensure that the design and implementation of the internal control system can be adjusted promptly in response to changes in the operating environment.

1.3.2 Ethical Management System: Establish corporate governance and risk control mechanisms to ensure implementation of the Ethical Corporate Management Best Practice Principles.

The Company has established the “Ethical Corporate Management Best Practice Principles” to ensure that business activities are conducted honestly, fairly, with integrity, and transparently. In internal regulations, the annual report, the Company website, various promotional materials, and external events, the Company declares its ethical corporate management policy so that managers, employees, suppliers, customers, and other business‑related organizations and personnel can understand the Company’s ethical corporate management principles and standards.

The Company has established multiple reporting channels, such as a telephone hotline, reporting mailbox, post office box, and reporting system on the Company website, and the Internal Audit Office accepts reported cases. The identity of the whistleblower is kept confidential, including during the process of handling complaint cases, under the principle of confidentiality, so as to protect and safeguard the whistleblower’s rights; according to statistics, the total number of complaint cases received and processed in 2025 was 0.

If any complaints are received, they are carefully verified and reviewed before being duly handled by the relevant department, and the audit results confirm whether there has been any material corruption or bribery violations of operating regulations.

Whistleblowing Channel

Company website: http://www.century.com.tw/tw/duty/47/

Century Iron & Steel Whistleblower Mailbox: jack.lee＠century.com.tw

Telephone: (03) 473-0201 #215

Fax: (03) 473-5235

Information Security System: Prevent, monitor, and reduce the impact of various information security risks on operations

Information security management is closely linked to sustainable development and plays a vital role in corporate governance. Manufacturing enterprises also face an increasing number of information security threats, including data breaches, ransomware attacks, and supply chain vulnerabilities. Therefore, we must take effective measures to ensure that the Company’s data and information systems are adequately protected. This not only safeguards the Company’s interests but also is key in maintaining the trust of customers and partners.

ž   Information Security Policy and Organization

To strengthen information security risk control and protection, Century established the “Information Security Management Czommittee” in August 2023, responsible for planning and promoting the establishment and maintenance of the Information Security Management System (ISMS). It adopts the PDCA (Plan-Do-Check-Act) information security management cycle mechanism, formulates information security standards and operating procedures, and controls potential threats and vulnerabilities in accordance with the “Electronic Data Processing Operation Cycle” under the internal control system, achieving management planning for advance prevention, continuous monitoring, and emergency response handling, and became the first company of TÜV Rheinland Taiwan to obtain ISO 27001 certification, with the certificate valid from March 7, 2024 to March 6, 2027. This milestone not only demonstrates the Company’s strong commitment to information security but also integrates it into the overall framework of sustainable operations, further enhancing the Company’s risk management capabilities and competitiveness and showcasing the Company’s outstanding performance and contributions across various fields.

ž   Resources Invested in Cybersecurity Management

In 2025, the Company’s budget for information security remained stable. To ensure the security of systems and data, the Company has continued to strengthen the application of relevant technologies and protective measures, such as implementing MDR, social engineering drills, vulnerability scanning, and mail server maintenance. At the same time, the Company has continued to invest in employee training, risk management, and emergency response capabilities to ensure that it can respond swiftly to potential threats.