STRUCTURE AND MECHANISM OF CORPORATE GOVERNANCE

Principle 9: Identify and Analyze Significant Changes

1. Assess changes in the external environment
   The risk identification process takes into account changes in external factors that significantly affect the Company's ability to achieve its objectives.
2. Assess business model changes
   The Company considers the potential impact of a new business, major changes to the composition of the existing business, acquiring or divesting business operations of the Internal Control System, changes in overseas geography, new technologies, and changes in the physical environment in which the business operates.
3. Assess leadership changes
   The Company considers changes in management, namely the behavior and management philosophy of the Internal Control System.

CONTROL ACTIVITIES - FINANCIAL AND OPERATIONAL CONTROL

Control activities are actions that are built through policies and procedures that help to ensure that management directives can be carried out correctly. Control activities are carried out at all levels of the Company at various stages of the business process, and in the technology environment. Control activities can be preventive or detective and include both manual and automated activities. The separation of functions is built into the establishment and development of control activities. When segregation of functions is impractical, management establishes and develops compensatory controls.

Principle 10: Establish and Develop Control Activities

The Company establishes and develops control activities to mitigate significant risks to the achievement of the Company's objectives to an acceptable level.

1. Integrated with risk assessment process
   Control activities assist and ensure that risk responses have been implemented to address and mitigate significant risks. Following the risk assessment process, management identifies and implements the activities required to respond to specific risks.
2. Define relevant business processes
   Management determines the relevant business processes that require control activities.
3. Taking into account entity-specific factors
   Management considers the complexity, nature, and operational environment, as well as the specific characteristics of the Company that affect the selection and development of control activities.
4. Evaluating the mix of control activity types
   Control activities include the range, variety, and mix of controls to mitigate risk, taking into account manual and automated controls, as well as preventive and detective controls.
5. Implement segregation of functions/duties
   Management separates incompatible functions/tasks (cannot concurrently), and when such separation becomes impractical and efficient, management determines and develops alternative control activities (compensative control).