To establish a comprehensive risk management framework and support sustainable business development, Arcadyan adopted the Risk Management Policy and Procedures, as approved by the Board of Directors on November 10, 2022. The Company integrates risk management awareness into daily decision-making and operational activities, fostering a comprehensive enterprise risk management culture.
Taking into consideration its scale, industry characteristics, business operations, and sustainability priorities, Arcadyan conducts comprehensive risk assessments covering strategic, operational, financial, information security, compliance, and integrity risks, as well as emerging risks such as those related to climate change and infectious diseases. For each identified risk event, the Company evaluates its nature and characteristics, analyzes the likelihood of occurrence and potential impact, and performs risk assessments to serve as the basis for developing appropriate response and mitigation measures.
Risk Management Policy and Procedures
Amid growing uncertainties arising from geopolitical developments, climate change, technological transformation, and shifting market demands, business risks have become increasingly diverse and complex. To establish a robust Enterprise Risk Management (ERM) framework, Arcadyan adopted the Risk Management Policy and Procedures in 2022, creating a Group-wide risk management structure and integrating risk management principles and processes into daily operations and decision-making. In addition, Arcadyan has implemented the ISO 22301 Business Continuity Management System (BCMS) to proactively identify, manage, and prepare for potential disruptions, ensuring that critical products and services can be restored within predefined timeframes, thereby minimizing operational impacts and maintaining business continuity.
Arcadyan has established a comprehensive Operational Risk Management Procedure encompassing five key elements: risk identification, risk analysis, risk assessment, risk response, and monitoring and review, which together form the foundation of its risk management framework. Through this systematic approach, Arcadyan identifies and evaluates potential operational risks across its global operations and subsidiaries, covering environmental, economic, governance, and social aspects, to support effective risk management and sustainable business operations.
Through its risk identification and assessment mechanisms, Arcadyan incorporates strategic, operational, compliance, integrity and ethical, and financial risks into its risk management framework, and evaluates the Company's risk exposure based on the likelihood and potential impact of identified risks. In 2025, considering industry trends, global political and economic developments, supply chain changes, and the Company's operational characteristics, Arcadyan identified five key risks across strategic, operational, and compliance dimensions and developed corresponding mitigation measures. The responsible departments continuously monitor and manage these risks and improvement actions, and regularly report their progress to the Audit Committee and Board of Directors to further strengthen operational resilience and risk response capabilities.
2025 Key Risks and Mitigation Strategies
Emerging Risks
Amid the rapidly evolving external environment in 2025, Arcadyan continues to monitor emerging risks that could affect its long-term operational resilience and competitiveness, with reference to the Global Risks Report 2025 published by the World Economic Forum. Among these, talent resources shortages and AI-driven cybersecurity threats have been identified as key areas of concern due to their potential impact on technological advancement, digital governance, organizational resilience, and global operational capabilities. To mitigate these risks, Arcadyan has implemented measures including talent development, succession planning, critical knowledge transfer, cybersecurity enhancement, AI governance, and business continuity management, thereby reducing potential impacts on its operations, brand trust, and digital governance effectiveness.
Risk Culture Development
To strengthen risk awareness across the organization, Arcadyan incorporates risk management training into new employee orientation programs and annual awareness training for all employees, with a primary focus on the ISO 22301 Business Continuity Management Policy. In 2025, a total of 3,918 participations were recorded, achieving a training completion rate of 95.2%, demonstrating the Company’s ongoing efforts to enhance employees’ risk management awareness and response capabilities. In addition, directors participated in annual continuing education programs covering ESG-related risks and global economic and trade developments, further strengthening leadership-level risk governance capabilities and promoting a top-down risk management culture throughout the organization.
