Governance
Risk Management
In 2025, WNC adopted a set of Risk Management Policies and Procedures, establishing a Board-supervised, top-down risk management framework. Through mechanisms including employee training, risk assessment, early-warning reporting, performance management, and information disclosure, the Company aims to cultivate a strong risk-aware culture, enhance corporate governance and operational resilience, and address uncertainties arising from internal and external environmental changes — thereby safeguarding the interests of shareholders and stakeholders.
Three defensive lines of risk management
First defensive line
Risk identification is incorporated into procurement, R&D, and production SOPs through a “risk liaison” system within each unit.
Second defensive line
The Risk Management Team under the Audit Committee is responsible for risk identification, analysis, response planning and monitoring, reporting, and disclosure.
Third defensive line
The Internal Audit unit reports directly to the Board of Directors. It establishes internal control systems in compliance with applicable laws and regulations, and regularly reviews and evaluates the effectiveness of existing controls and the level of compliance.
Risks and mitigation measures
WNC promotes risk management across all business units to strengthen emergency response and recovery capabilities, while collaborating with suppliers to enhance resilience to external disruptions. To strengthen risk management awareness among all employees, WNC launched an online course in 2026 to help employees learn how to identify, assess, and respond to risks. From a governance perspective, the Board of Directors and the Sustainable Development Committee provide oversight and regularly assess the impacts of external trends on operations and the value chain through materiality assessment. In terms of risk scope, WNC manages three core risks, which are Non-compliance Risk Related to Export Controls and Economic Sanctions, Inaccurate Demand Forecasting and Supply–Demand Planning Risk and Risk of Operational Disruption Caused by Major Cyberattacks. Climate risk is also a key management priority. For specific actions, please refer to WNC’s 2025 T(C)NFD Report. In 2025, WNC focused on technological transformation driven by the rise of AI and the risk of resource depletion resulting from extreme climate events, while continuing to advance relevant mitigation and response measures.
Risk Identification
In 2026, WNC Corporation established five risk management functional teams covering Information Security and Information Systems, Supply Chain and Manufacturing, Technology and R&D, Compliance and Governance, and Operations and Talent. Through cross-functional collaboration, these teams promote the systematic identification, assessment, and management of risks.
The Company also developed a risk management dashboard to enhance risk monitoring and early-warning capabilities. In 2026, the Company completed the identification of 38 risk items and used a risk matrix to assess their impact and likelihood of occurrence. Based on the identification results, the Company implemented tiered management and response measures, continuously strengthening its risk governance capabilities to ensure sound operations and sustainable development.
| Risk | Category | Risk Description and Response Measures |
|---|---|---|
| Non-Compliance Risks Related to Export Controls and Economic Sanction | Major risk management | Failure of sanctions-list management or transaction-screening mechanisms may result in violations of export control or economic sanctions regulations, leading to regulatory penalties, reputational damage, and business disruption. Response measures include establishing real-time sanctions-list updates and transaction-screening mechanisms, strengthening compliance management for export control and economic sanctions regulations, and enhancing the capability to identify and prevent high-risk transactions in advance. The Company also establishes exception-case review and continuous monitoring mechanisms to strengthen the control of abnormal transactions and risk early-warning capabilities, thereby reducing the risks of regulatory violations, reputational damage, and operational impact. |
| Inaccurate Demand Forecasting and Supply-and-Demand Planning Risk | Significant fluctuations in market demand, customer orders, or demand forecasts may lead to an imbalance between supply and demand and deviations in capacity allocation. These may, in turn, result in inventory, delivery, and operational efficiency risks, affecting revenue, profitability, cash flow, and operational resilience. Response measures include the following:
| |
| Risk of Core Business Operations Being Disrupted by Major Cybersecurity Attacks | Ransomware attacks, unauthorized intrusions, or the exploitation of zero-day vulnerabilities may result in the damage, leakage, or interruption of critical information systems, endpoint devices, or important data, thereby affecting business continuity, regulatory compliance, and corporate reputation. Response measures include the following:
| |
| Technology risk (quantum computing risk) | Emerging risk management | The rapid development of quantum computing technologies may present potential risks to existing encryption technologies and information security architectures, with possible implications for data protection, network communication security, and product reliability. To address this risk, WNC has established a technical task force to monitor developments in post-quantum cryptography (PQC) technologies and regulations, and formed strategic alliances to accelerate the integration of PQC technologies into its products. These efforts aim to ensure compliance with international cybersecurity standards and mitigate potential risks. |
| Risk of rare resource depletion | The manufacturing and assembly of network communication equipment rely heavily on various rare metals and critical minerals. With the continued expansion of global demand for electronic products and the rise of resource nationalism in various countries, the industry faces long-term risks of supply shortages, significant price volatility, and export controls. WNC regularly assesses its value chain’s dependencies and impacts on natural resources. In line with its Sustainable Raw Materials Policy, the company incorporates resource risks into strategic planning to ensure the quality and functionality of alternative or recycled materials. WNC plans to adopt the ISO 20400 Sustainable Procurement Guidance to reduce dependence on single resources and suppliers, while advancing circular economy initiatives and product design for reuse and recycling to reduce resource demand. |
Risk Appetite and Management Principles for Major Risk Categories
Risk appetite refers to the range and boundaries of risk that the Company is willing to accept in pursuit of its strategic objectives, taking into consideration its financial capacity, operational resilience, regulatory requirements, and stakeholder expectations. Each business and functional unit identifies, assesses, and manages risks in accordance with the enterprise risk management system. The Management Risk Committee is responsible for reviewing risks and allocating resources; the Board of Directors approves the risk appetite and oversees major risks; and Internal Audit provides independent assurance to ensure that risk management remains aligned with the Company’s strategies and governance requirements. WNC's risk appetite is categorized into four levels: very low, conservative, prudent, and growth-oriented, each with its own management principles. Based on the identified risk issues, the Risk Committee classifies these issues according to the following four risk appetite attributes, as shown in the table below:
Risk Appetite Attributes and Corresponding Management Principles:
| Very Low Risk Appetite | Conservative Risk Appetite | Prudent Risk Appetite | Growth-Oriented Risk Appetite |
|---|---|---|---|
| No acceptance of major regulatory violations or major incident risks | Prioritize product safety, information security, and customer trust | Maintain operational resilience and steady growth within controllable risk levels | Assume strategic risks under effective governance and stop-loss mechanisms |
Risk Appetite for Major Risk Categories:
| Very Low Risk Appetite | Conservative Risk Appetite | Prudent Risk Appetite | Growth-Oriented Risk Appetite |
|---|---|---|---|
|
|
|
|
Training on risk culture
Risk management training for board members: To strengthen the Board's governance capabilities and enhance organizational resilience and sustainability competitiveness, all board members participated in courses related to risk management, including Cybersecurity Governance and Management under Geopolitical Conditions, The Current Global Economic Situation and the Effects of the Trump Administration's New Policies, 2025 Cathay Pacific Sustainable Finance and Climate Change Summit and Analysis of Artificial Intelligence Trends and Corporate Risk Management Strategies. In 2025, accumulating a total of 69 training hours.
Case study workshop for risk management: The risk management team regularly participates in workshops to build quantitative risk assessment capabilities among personnel in key positions. Regular awareness programs on ethical business conduct and cybersecurity drills are conducted to ensure employees can identify potential risks and report them promptly.
Company-wide risk training: To enhance risk management awareness and sensitivity among employees worldwide, WNC conducted a Risk Management Awareness Training Course for all employees in September 2026. The course was designed to build core risk management capabilities across all levels of the organization, from frontline employees to management, ensuring that employees are equipped to respond to risks appropriately and collectively implement the company's risk management mechanisms.
Business continuity management
In response to extreme weather, supply chain disruptions, and changes in the global operating environment, WNC has established a Business Continuity Management and Disaster Recovery Standard and Contingency Plan Control Procedure. Business Continuity Plans (BCPs) have been developed for major disaster scenarios and are tested at least annually. In 2025, drill scenarios covered information system outages, cybersecurity incidents, chemical spills, earthquakes and fires, power outages and restrictions, supply chain disruptions, labor shortages, and infectious diseases.
In 2025, no major natural or human-made disaster incidents occurred at any of WNC’s operating sites. WNC has launched an ISO 22301 Business Continuity Management System implementation project, integrating cross-functional efforts to enhance Business Impact Analysis (BIA), Risk Assessment (RA), BCPs, and scenario-based drills. The program ensures the adequacy of staffing, resource allocation, and response arrangements, and is continuously refined through training, drills, internal audits, changing conditions, customer audit feedback, and operational needs to maintain overall business stability.
Information security business continuity management
WNC integrates its ISO/IEC 27001 information security management system with BCPs to strengthen information security business continuity management and build a resilient risk response and recovery framework. In addition to strengthening cybersecurity policies, operational processes, and employee awareness, WNC places particular emphasis on protecting personal privacy and customer confidential information, including trade secrets and intellectual property, to mitigate the impact of operational disruptions on critical business activities.
Information assets are inventoried and updated, and risk assessments are conducted semi-annually. Annual business impact analyses identify critical operations and define recovery time objectives (RTOs) and recovery point objectives (RPOs) to guide resource allocation. Meanwhile, based on risk evaluation results and internal and external trends, WNC has established simulation models for diverse scenarios. It has formulated drill plans for disaster recovery (DR) and business continuity to validate the effectiveness of its response measures. In 2025, 18 cybersecurity and business continuity exercises were completed, achieving a 100% completion rate. The exercises covered core operational system recovery, malware response, and enterprise-level joint BCP drills across sites and business groups, enhancing incident response capabilities and operational resilience.
Number of information security BCP drills conducted in 2025
| Type/region | Taiwan, HQ | Taiwan, S1 | Taiwan, S3 | China | Vietnam | UK |
|---|---|---|---|---|---|---|
| Cross-site business continuity drills | 1 |
|
| |||
| Physical security drills |
| 1 | ||||
| Core information system recovery drills | 6 | 1 | 1 | 2 | 2 |
|
| Virus/hacker attack prevention drills | 1 | 1 | 1 | 1 |
| |
| Total | 18 | |||||
