Risk Management Policy and SOP

Based on ethical corporate management, we actively promote and implement the risk management mechanism to ensure steady operations and sustainable development and lower potential operational risk. In 2020, the Board approved the establishment of the “Risk Management Policy and SOP”, Accordingly, the President’s Office shall supervise the operations and performance of each risk management unit, periodically assess risk every year, define different types of risk according to USI’s overall business policy, establish a risk management mechanism for the early identification, accurate measurement, effective supervision, and strict control of risks to prevent potential risks within the bearable range. The President’s Office should also keep track on the development of the risk management system at home and abroad to review and improve this policy and optimize the risk management method through continual adjustment, in order to enhance USI’s risk management effectiveness to protect the interests of USI, employees, shareholders, and stakeholders.

The President’s Office shall report the risk management performance of the year to the Audit Committee and the Board at least once a year and disclose related information in the annual report and on the corporate website.

Please refer to the Risk Management Policy and SOP for details.

Risk Management Organization Framework

For effective risk management, the BOD, Audit Committee, President’s Office, Audit Office, all risk management units, and all subsidiaries participate in and operate the risk management mechanism.

USI-ESG-Risk Management

Risk Management Process

The risk management units of USI review the characteristics of their business and operations, identify the potential risk factors in business operations, develop a complete risk category framework, and establish appropriate measuring methods for the reference of risk management.

All risk management units shall constantly monitor the risks in their business and propose countermeasures, periodically report the risk status to the senior management for the reference of management, and ensure the normal operation of the management framework and risk control functions.

USI-ESG-Risk Management

Scope of Risk Management

We establish the risk categories after integrating the major risk sources of business operations and considering the feasibility of mitigating controls. Each year the working group of the CSR Committee conducts a questionnaire survey to identify risks. In view of the increasing impact of global climate change, government energy, and related financial and taxation issues, in 2021, we identified one emerging risk: energy resource risk and included in the inherent risk category. After combining with the 15 risks found in 2021, we identified the likelihood of occurrence and degree of impact. Each risk management unit periodically adjusts the controls with respect to the changes in the internal (external) operational environment.

Risk Management Matrix

USI-ESG-Risk Management

Information security policy

  1. ISO 27001 information security system:
    We applied the ISO 27001:2013 information security management system (ISMS) since 2014 and hired BSI Taiwan, an external third-party certification organization, to re-certificated and re-surveyed for 7 years continuously.
  2. NIST Cybersecurity Framework (CSF):
    We also apply the Cybersecurity Framework (CSF) developed by the US National Institute of Standards and Technology (NIST).
  3. Base on the ISO 27001 ISMS and NIST CSF, we enhance our risk control, improve the capabilities and tolerance of information security events, therefore, we can get recovery rapidly from the disaster to keep on providing the key operation service.
USI-ESG-Risk Management

Network defense-in-depth deployment

USI-ESG-Risk Management
USI-ESG-Risk Management

Framework of the information security organization

USI-ESG-Risk Management

Establishment of CISO and the responsible information security unit: In 2022 we established the CISO and responsible unit, supervisors, and staff for information security in accordance with the addition of Article 9-1 to the Regulations Governing Establishment of Internal Control Systems by Public Companies promulgated by the Financial Supervisory Commission.