The Company’s ability to respond to and deal with risks has been an important key to its continued growth and stable operations. President Chain Store Corporation is committed to maintaining a comprehensive risk management system that includes the Group’s organization and subsidiaries in the scope of risk management. To further ensure the effectiveness of enterprise risk management and align with international standards, the Company adopted the ISO 31000:2018 Risk Management System in 2024. The Internal Audit Office conducted an internal audit of the overall risk management process in May 2025 in line with the internal audit system, and audited the risk assessment process (including risk review, exposure review, etc.), as well as issuing an audit report. The 2024 audit results indicated that relevant processes were well executed in accordance with established procedures, with no major deficiencies identified. Looking ahead, internal audits are scheduled to be conducted regularly (at least once every two years) to ensure the continued effectiveness of risk control. In 2026, the Company commissioned BSI, a third-party organization, to assess its enterprise risk management process to ensure alignment with ISO 31000. The scope of verification covered store construction, maintenance and repair management, strategic planning and management for fresh food, store expansion management, logistics management, and recruitment management for directly operated stores. The assessment was completed in May 2026, confirming that the organization has established risk assessment procedures and addressed risks based on the assessment results. No deficiencies were identified during the audit. The Company only needs to strengthen the written presentation of its risk management procedures and the retention of relevant records. For matters that require improvement, the Company has continued to actively communicate with external consulting firms to implement enhancement measures.

 

Risk Management Structure

The Company’s Board of Directors is the highest risk management unit that is responsible for approving risk management policies and structures to ensure the effectiveness of risk management. The Integrity, Risk and Cybersecurity Management Committee is affiliated to the Board of Directors with the “Risk Management Execution Office” underneath that is a cross-departmental risk management decision-making. It exercises its powers independently of other business functions and operating activities, with the Executive Vice President of the Corporate Services Group serving as the convener. Task forces have been set up under the execution office for overall risk monitoring, assessment and measurement for President Chain Store Corporation, integrating and managing various strategic, operational, financial and other potential risks that may have an impact on the operations and profits, as well as regularly reporting to the Risk Management Execution Office. Annual plans and implementation results are submitted to the Board of Directors after discussion by the Integrity, Risk and Cybersecurity Management Committee.

 

Three Lines of Defense Model for Risk Management

Risk Management Processes

The Risk Management Execution Office identifies, analyzes, measures, monitors, responds to, reports risks based on the risk characteristics and impact levels compiled by each task force, as well as improving response measures. The processes are as follows:

Process 1 Risk Identification	Each unit should identify risks associated with their tasks based on risk management policies and procedures, including strategic risks, operational risks, financial risks, legal compliance risks, integrity risks and other emerging risks (such as climate change or infectious diseases).
Process 2: Risk Analysis and Measuremen	All risks that have been identified should be assessed based on the “Table of Impact Degree Judgment Criteria” to analyze the cause and negative impact on the Company, as a reference for formulating subsequent corresponding measures.
Process 3: Risk Monitoring and Response	Based on the result of risk analysis, relevant personnel of each unit plan and implement risk response measures requiring prioritization, as well as serving as a reference for each operating unit to formulate and select improvement measures in the future.
Process 4: Risk Report	Regularly summarizing the status quo of risk management and control to report to the Integrity, Risk and Cybersecurity Management Committee and the Board of Directors.

Risk Identification and Ranking

President Chain Store Corporation’s scope of risk management includes but is not limited to operational risks, market risks, financial risks, compliance risks, climate risks and other risks that may cause significant losses to the Company. When identifying risks, each business unit analyzes the sources of risks (such as disasters/infectious diseases, contracts/laws, financial conditions, personnel behavior, asset losses, quality, supplier operating conditions, etc.) and their potential impacts (such as finance, production/products and services, personnel, reputation and image, etc.) to understand all potential types of risks.

 

Risk identification and ranking take into account the dual-axis risk matrix. The X-axis represents the level of severity (I), and it is graded from 1 to 5 points. The Y-axis represents the risk likelihood (L), and it is graded from 1 to 5 points. The two are multiplied for risk level (R), which is used as the standard for finding out the scores of each financial, food safety, franchise, legal and other risks. The risks are then ranked in line with the impact and results to highlight the level of impact, likelihood and importance of each risk.

Relevant units will implement prevention and improvement measures for each level of risk. When the risk level (R) is higher than 14 points, the impact on the Company’s operations will be more significant, so this score is adopted as the risk appetite. If risks above this level occur, relevant units should promptly respond and improve. None of the 46 risks assessed this year exceeded the risk appetite. Therefore, the top three risks were selected. After review and adjustment by the head of the Risk Management Execution Office, the top three risks in 2025 were carbon reduction, food waste and labor shortage (Note).

(Note) For the mitigation and response measures related to the 2025 risk identification results, please refer to the 2025 Sustainability Report.

 

 

Incorporation of risk criteria in the development of products and services

President Chain Store Corporation places great importance on the safety and integrity of its products and services by incorporating risk standards into the product development and review process. Specific measures include conducting risk assessments using Hazard Analysis and Critical Control Point (HACCP) methods, offering training and guidance to suppliers on risk awareness and control, and, for food safety risks, performing regular and ad-hoc product sensitivity stress testing, food hazard factor inspections, and supplier capability assessments.

(Note) For results of food hazard factor inspections and supplier capability assessments, please refer to the Raw Material Management section.

 

Financial incentives which incorporate risk management metrics

In 2025, President Chain Store Corporation incorporate sustainability performance into the compensation evaluation of senior executives. Given that carbon reduction is one of the Company’s top three risks, the “Proportion of direct (Scope 1) and indirect (Scope 2) GHG emission intensity” has been designated as a key performance indicator, with a target of a 1.5% reduction compared to the previous fiscal year by 2026. This indicator will account for 2.5% of the performance evaluation for the President, Executive Vice Presidents, and Division Heads (including Deputy Division Heads), and will be scored based on the level of achievement.

 

Focused training throughout the organization on risk management principles

To foster a culture in which all employees actively participate in risk management, President Chain Store Corporation organizes regular annual training sessions for board members on risk management and internal controls to strengthen their professional judgment and capabilities in handling risk-related matters. In 2025, all board members completed two sessions of risk management training. Additionally, to ensure that every employee can identify, understand, and proactively manage risks, the company launched a corporate risk management awareness training in 2024. In 2025, a follow-up in-person training session (1.5 hours) was held, covering general knowledge, principles, identification, and assessment processes of risk management, with a total of 29 participants. This in-person training was also recorded and developed into a mandatory e-learning course for employees who could not attend the live session. As of 2025, the completion rate for company-wide risk management training reached 100% (Note), demonstrating the Company’s strong commitment to embedding a culture of risk ownership throughout the organization.

(Note) Completion rate is based on all employees as of December 31, 2025, including both head office and store staff, excluding those who have resigned, who are on unpaid leave, or on long-term medical leave.