Corporate Governance

The company’s Audit Committee is composed of all independent directors (including one financial and accounting expert), with a term of three years. All four independent directors meet the legal requirements for independence, professional qualifications, and experience, and undergo an annual internal performance evaluation of the Audit Committee.

1. Fair presentation of the financial reports of this Corporation.
2. The hiring (and dismissal), independence, and performance of certificated public accountants of this Corporation.
3. The effective implementation of the internal control system of this Corporation.
4. Compliance with relevant laws and regulations by this Corporation.
5. Management of the existing or potential risks of this Corporation.
6. The company conducts mergers and acquisitions in accordance with the Enterprise Merger and Acquisition Law.

1. The adoption of or amendments to the internal control system pursuant to Article 14-1 of the Securities and Exchange Act.
2. Assessment of the effectiveness of the internal control system.
3. The adoption or amendment, pursuant to Article 36-1 of the Securities and Exchange Act, of the procedures for handling financial or business activities of a material nature, such as acquisition or disposal of assets, derivatives trading, loaning of funds to others, and endorsements or guarantees for others.
4. Matters in which a director is an interested party.
5. Asset transactions or derivatives trading of a material nature.
6. Loans of funds, endorsements, or provision of guarantees of a material nature.
7. The offering, issuance, or private placement of equity-type securities.
8. The hiring or dismissal of a certified public accountant, or their compensation.
9. The appointment or discharge of a financial, accounting, or internal audit officer.
10. The annual financial report signed or sealed by the chairman, manager and accounting supervisor

and the semi-annual financial report that must be verified and certified by certified public accountant.

11. Business reports and proposals for profit distribution or loss appropriation.
12. Other material matters as may be required by this Corporation or by the competent authority.

Our Compensation Committee consists of three independent directors serving a term of three years, with a requirement to meet at least twice annually and conduct an annual internal performance evaluation of the committee.

1. Establishing and periodically reviewing the performance assessment standards, annual and long-term performance goals, and the policies, systems, standards, and structure for the compensation of the directors and managerial officers of the Company.
2. Periodically assessing the degree to which performance goals for the directors and managerial officers of the Company have been achieved, setting the types and amounts of their individual compensation.

The internal audit of the Company is an independent unit, directly subordinate to the board of directors. Its responsibility is to investigate and evaluate the effectiveness of the establishment and implementation of the internal control system, the effectiveness and efficiency of operations, the reliability of reporting and compliance with relevant laws, discover existing or potential deficiencies in a timely manner, and provide improvement suggestions to ensure the continuous and effective implementation of the internal control system.

The audit method is mainly based on the audit plan approved by the board of directors. The audit plan is formulated based on the identified risks. Special audits or reviews are also carried out as necessary to discover possible deficiencies in internal control in a timely manner, provide improvement suggestions, and assist the board of directors and management to achieve set goals and issues audit reports. In addition to regularly reporting the implementation status to the board of directors, it also reports to the chairman and independent directors every month or when necessary.

Internal audit urges each unit to perform internal control self-assessment every year, establish a self-supervision mechanism, and review the self-assessment results of each unit as the main basis for issuing an internal control statement.

The appointment and dismissal of the company’s internal audit manager must be approved by the audit committee in accordance with the law and submitted to a resolution of the board of directors. The appointment, removal, assessment, and remuneration of auditors are in accordance with the company’s “Sustainable Development Best Practice Principles” and signed by the audit manager and then submitted to the chairman of the board for approval.

AOT is committed to safeguarding the confidentiality, integrity, availability, and legality of its information assets. Understanding that robust information security is vital to maintaining a competitive advantage and ensuring organizational longevity, AOT is dedicated to implementing and maintaining effective information security management practices. This includes continuously enhancing our capabilities to protect sensitive information, increasing employee awareness, and fostering vigilance concerning information security. We strive to prevent unauthorized use, disclosure, alteration, or loss of information due to human error, deliberate sabotage, or natural disasters. Our goal is to protect the interests of the company, its shareholders, employees, customers, and suppliers.

1. Conduct Annual Information Security Training: Facilitate comprehensive information security training sessions at least once per year and periodically disseminate and promote information security updates to reinforce employee awareness and accountability regarding information security responsibilities.
2. Perform Annual Internal Audits: Execute internal audits of information security protocols annually to ensure adherence to established security practices and verify effective implementation.
3. Implement Annual Disaster Recovery Drills: Conduct disaster recovery exercises annually to ensure familiarity with recovery procedures and mitigate potential operational disruptions.
4. Ensure High System Availability: Guarantee that critical operational systems achieve a minimum availability rate of 99.7% following planned maintenance activities each year.
5. Prevent Data Leakage Incidents: Maintain a record of no incidents involving the leakage of critical business data to safeguard the interests of the company, its clients, and its stakeholders.

• The dedicated information security team is tasked with the oversight and execution of the company’s information security policies, the promotion of information security awareness, and the enhancement of employee understanding regarding security responsibilities. This team is responsible for regularly reporting information security outcomes to the Chief Information Security Officer (CISO) and the General Manager. Furthermore, the CISO will deliver an annual report to the Board of Directors on information security governance matters, including the evaluation and verification of the effectiveness of internal controls over information operations. This framework aims to ensure the confidentiality, integrity, and availability of information by establishing a “Continuous Improvement of Information Security Resilience” management structure to mitigate risks associated with unauthorized access, damage, or leakage.
• To advance ESG (Environmental, Social, and Governance) sustainability, comply with regulatory requirements and corporate governance assessments, and enhance enterprise information risk management and data protection, the company is committed to investing in the upgrading and implementation of information security technologies and solutions. This includes the ongoing integration of ISO/IEC 27001:2022 Information Security Management System standards to bolster organizational resilience, minimize operational risks, and fortify corporate reputation and competitive edge.

• Evolving Cyber Threats: With the constant evolution of cyberattack techniques, information systems face significant challenges in fully mitigating disruptive attacks from external parties. These attacks may involve methods such as phishing emails, spear-phishing, brute-force attacks, and the deployment of malicious software within the company’s internal network to cause damage or data theft. Destructive attacks could lead to interruptions in production and operations, while data theft attacks may result in the exposure of critical operational data or personal information of employees and customers. The company is proactively planning and implementing information security measures, continuously improving the security environment and infrastructure to mitigate information security risks.
• Management Framework: Employing a Zero Trust Architecture, the management framework encompasses policies and procedures across various domains, including organizational responsibilities, asset management, access control, physical security, personnel security, document management, communications and operations management, system development and maintenance, business continuity management, incident management, and regulatory compliance.
• Technical Measures: Implementing a suite of technical controls, including network firewalls, backup and redundancy systems, antivirus software, regular operating system updates, email security systems, virtual private network (VPN) management, security monitoring systems, and vulnerability scanning tools.
• Audit and Testing: Conducting a comprehensive audit of the company’s information security management system in the first half of the year, and scheduling emergency response plans and disaster recovery drills in the latter half. Annual reviews are conducted to assess information security operations, risk controls, and incident remediation efforts to manage and reduce information security risks.