Acer Risk Management Organization Structure
 

The Risk Management Working Group compiles the results of the aforementioned analyses and tests, draws up a follow-up implementation plan, and reports them to the Risk Management Committee on a regular basis (quarterly); in 2022, the Risk Management Working Group has a total of 16 departments/units to coordinate with. To integrate the implementation of ERM with the daily operation procedures of each department/unit and the Business Objective, each department/unit first compiles 46 Key Performance Indicators (KPIs) and then develops/identifies 82 Risk Scenarios that may actually cause operational impacts on the aforementioned KPIs. Based on the identified and analyzed risk items, the relevant department staff are assigned to prepare the subsequent risk management strategy and related implementation plan (Risk Mitigation), including the common risk management responses in practice: Loss Prevention, Avoidance, Separation & Duplication, Transfer and Retention. Duplication, Transfer, and Retention, etc., and evaluate the appropriate resource input, implementation priorities, and follow-up progress tracking methods. At the same time, we have developed the Incident Response and Crisis Management plans to minimize the negative impact of potential risks on our business objectives and to strengthen the risk resilience of our overall operations. The aforementioned risk management strategy and related implementation plan are based on the cycle of Plan, Do, Check, and Action, and the effectiveness of the risk management plan and the room for improvement are reviewed periodically during the working group meetings for continuous adjustment/refinement. Finally, progress reports on material risk information and corporate risk management operations are made regularly to the Risk Management Committee and the Audit Committee.。   

In summary, we continue to actively engage in risk management activities with a proactive approach to address current and future risks and challenges in a prudent manner. The Audit Committee also summarizes the risk environment, risk management focus, risk assessment results and the corresponding response measures, which are reported by the Chairman at the Board of Directors' meeting.

Emerging Risks

The Risk Management Working Group has identified emerging risks such as information security risks, extreme climate risks, large-scale infectious diseases, supply chain-related risks and geopolitical risks in 2021. After regular reconsideration and review in 2022, the Risk Management Committee and Working Group identified a number of emerging risks in 2022, including geopolitical risks (including geo-economic), ICT market downside, inventory management, inflation (including green inflation), interest rate increase, and global climate change. Through group discussions and focused thinking, we hope to carefully assess the potential negative impact of each emerging risk item on the company's future operations, and to consider and structure feasible and cost-effective risk management action plans for registration in the risk analysis/registration worksheet. Cyber Security Risk continues to be a key risk concern for the Company, especially considering the risk correlation between geopolitical and global economic environment and cyber security risk. The Risk Management Working Group summarizes possible loss types (including loss of goodwill, business interruption, data leakage, ransomware, etc.), and the IT department has also compiled the following basic information security principles and continues to work on them to obtain ISO 27001 international certification for information security in 2020.   

In addition, Acer has continued to purchase global information security insurance policies since 2018 and regularly reviews the integrity of the overall coverage every year. In addition to risk transfer considerations, Acer also expects to obtain further assistance and resources from external information security experts through the international information security insurance market. With the rapid development of information technology, the trend of digital transformation and the continuous investment in various innovative applications, we will continue to pay attention to the development trend of cyber security risks (e.g., cyber security risks arising from the adoption of remote working mode) in order to continuously review and improve the relevant information security principles and appropriate risk transfer measures.