Risk Management Committee

Chunghwa Telecom faces rapid operational, industrial, and technological changes, including challenges in market competition, technological evolutions, laws and regulations, as well as climate change. To ensure a robust development and sustainable development of the Company, the “Risk Management Committee” was officially established in 2016. Followed by its elevation to a functional committee under the Board of Directors in 2023 (the original management-level committee was renamed the “Risk Management Steering Committee”), the committee serves as the highest decision-making and supervisory body on risk management for the Board of Directors at the Company. (The Chairperson is an Independent Director, and >50% of the members are Independent Directors.)

The Risk Management Steering Committee is in charge of the review, monitoring, and formulation of corporate risk management policies and mechanisms as well as reports to the Risk Management Committee on a regular basis. In 2023, a total of 3 management-level risk management meetings were held, including 2 meetings of the Risk Management Committee and 1 meeting of the Risk Management Steering Committee. There were also 4 reports submitted to the Board of Directors' functional committees, which included 3 reports to the Audit Committee and 1 report to the Risk Management Committee, along with 4 reports to the Board of Directors.

The Board of Directors stipulated the risk management policies, framework, and culture at CHT. The “Risk Management Committee,” established as a functional committee under the Board of Directors, supervises and reviews risk management policies, procedures, and frameworks. The “Risk Management Steering Committee,” established at the management level, is in charge of promoting and implementing the overall risk management operations at the Company. The Audit Department reviews risk events, reports the risks that have already occurred to the Audit Committee, and reports the risks that are to occur or to be averted to the Risk Management Committee.

Line of Defense	Description
First Line: Risk Owner and Approval Process	Each risk management execution unit carries out daily risk management activities. The dedicated owner and approval process are in place in the aforementioned units for risk management in daily operations, enabling timely response and management of various operational risks.
Second Line: Risk Management Project Unit and Regulations	The risk management and control unit has been created to enforce risk management measures. The “Risk Management Steering Committee” and the “Risk Management Committee” jointly form the second line of defense for the management and control mechanism. The “Regulations Governing the Risk Management” and the “Directions Governing the Risk Management Operation” have been stipulated as the guiding documents for all employees in operations so as to institutionalize and standardize the risk management processes.
Third Line: Internal Audit	An independent “internal audit unit” under the Board of Directors has been established, responsible for the third line of defense for management and control. The internal audit unit formulates an annual audit plan based on the results of risk assessments and performs assessment and audit of the internal control system. Through routine and project-based audits, internal control cyclical audits of each operating site and subsidiary are performed, with audit reports presented, to provide objective verification and recommendations on the operation of the internal control system, offering the management insights into the existing or potential internal control weaknesses. Audit results are regularly reported to the Board of Directors and the Audit Committee, and the monthly audit report is submitted to the Independent Directors on the Audit Committee for review, to provide objective risk management effectiveness assessments and improvement suggestions to assist the Board of Directors and managers in assessing the results and efficiency of various operational risk management efforts.

To learn more about the risk management audit mechanism, please visit here.

Practice of Corporate Risk Culture

An Enterprise Risk Management（ERM）System is in place at CHT to manage various business risks. Meanwhile, risk management is tied with the performance appraisal of the executives to practice the culture of risk management.

Aspect	Description
Organization	CHT approved "Risk Management Committee" to its functional committees under the Board of Directors, supervising the mechanisms related to risk management operations. The Risk Management Steering Committee is responsible for cross-departmental communication and coordination to implement the Risk Management Policy and risk management operations.
Policy	The Risk Management Policy and risk management framework stipulated by the Board of Directors The Regulations Governing the Risk Management as the basis for all personnel’s reference in conducting business
Management System	The Enterprise Risk Management（ERM）System to manage business risks regularly and monitor risks on the rolling basis.
Assessment Tools	The "Risk Assessment Matrix" serves as an assessment tool for evaluating various types of risks, including operational, strategic, compliance, and reporting risks. Various procedures have been established in daily operations to identify and assess potential risks.
Appraisal	The "Risk Management Steering Committee" promotes the implementation of risk management actions and evaluates the performance of risk control. The Audit Department carries out an independent internal audit and reports directly to the Board of Directors. Results of risk management are included in the performance appraisal
Feedback and Improvement	Risk status is followed up monthly. The Risk Management Steering Committee convenes regularly as well as reports to the Risk Management Committee, and the Board of Directors. The risk management mechanism is refined based on the resolutions adopted in the aforementioned meeting to ensure that the process better meets the needs of operational risk management of the Company.
Implementation Results in 2023	3 management-level meetings convened with focuses on the enterprise-level risks tied with the objectives in the business plans and deliberations on directions of material risk issues 4 reports on the implementation of risk management to the Board of Directors Rigorous monitoring and execution of risk mitigation actions were carried out, successfully containing the residual risks within the defined risk appetite.

Risk Governance

Risk Governance

Risk Management Process

Emerging Risks and Response Strategies

Risk Management Committee

Practice of Corporate Risk Culture