Risk Management

Risk Management

In response to global political and economic development trends and changes, EOI formulated the "Risk Management Policy", which was approved by the Board of Directors on December 23, 2020, as the highest guiding principle for the Company's risk management.

According to the four aspects of environment, society, economy (including corporate governance) and others (including information security), with a complete risk management organizational structure and practical promotion methods, we can grasp the relevant risks that may affect the sustainable development of enterprises.

Through the identification, assessment, control, supervision and communication of potential risks, and qualitative or quantitative management methods, the various risks faced by the Group's operations are reduced to a tolerable and controllable range, and serving as a reference for the formulation of business strategies to reasonably ensure the achievement of the Company's strategic objectives. This policy is specially formulated for the above purpose.

Risk Management Organizational Structure

The President serves as the top risk management supervisor of the Company, and the senior executives, functional unit supervisors and business contractors serve as the first-line risk management personnel to detect, identify, evaluate and formulate relevant countermeasures for various risks, and review and supervise at operational meetings. For different risks, the President also sets up relevant response teams according to different events, and assigns different responsible supervisors to coordinate the response. In addition, for the internal control system, the audit unit is responsible for auditing the implementation situation.

Risk management operation

Risk Management Process

The Company's risk management process includes risk topic identification, risk assessment, risk control, risk reporting and disclosure, and risk disclosure response, and is continuously managed through the PDCA (Plan, Do, Check, Act) cycle process.

Risk Scope and Issue Identification

According to the principle of materiality, EOI divides risks into 8 categories according to the four aspects of environment, society, economy (including corporate governance) and others.

Risk Matrix

According to the risk matrix of the impact possibility and impact degree of various risk projects of the department, the main risk issues are evaluated, and the key risk projects are identified, so that the Company can take further countermeasures. And through the PDCA management cycle operation, continue to effectively improve and master various risk factors in order to reduce the probability and degree of damage caused by risks.
Since 2021, EOI has held a risk management response meeting at least once a year and submitted a report to the board of directors, so that the board of directors can fully guide and supervise the Company's strategy, major business and risk management responsibilities, and meet the requirements of corporate governance so as to reduce and avoid any possible operational risks.

Information security enforcement

1. Continuously require that information security training is included as a mandatory course in onboarding education for new employees.
2. In 2024, personnel involved in information security attended a total of 18 hours of external information security training and workshops.
3. Throughout 2024, continued efforts to strengthen information security awareness were carried out, with quarterly implementations and company-wide information security education sessions.
4. Conducted two social engineering exercises in 2024.
5. Achieved the 2024 targets by executing emergency response drills for the information environment and conducting social engineering security exercises.
6. The implementation of ISO 27001:2022 is currently in progress.