Risk Management and Strategy

We incorporate cybersecurity and information-technology risks into our overall internal-control and risk-management framework and implement technical and administrative measures based on the nature of our business, the information systems we use and the types of data we process.

We use WeCom, financial systems, online banking, email, cloud services and other office and business systems in our day-to-day operations. System access rights are generally assigned based on employee roles and responsibilities, with individual user accounts used where practicable and shared accounts restricted. Access rights are added, modified or terminated in connection with employee onboarding, changes in responsibilities or termination. Access to key systems and online banking is subject to review by appropriate management or finance personnel. We also use segregation of duties and management-review controls to reduce the risk that a single individual has end-to-end control over critical systems or financial processes.

Important business and financial information is maintained through system- and cloud-based backup functions, internal archival procedures and other appropriate storage arrangements. Important contracts, financial reports and audit-supporting documentation are also archived. We use login, approval, operational and transaction logs available through our systems to track and review unusual logins, access changes, transaction anomalies and other potential information-security matters.

For standard office, financial and cloud-based systems, we principally rely on third-party service providers with established market reputations and service capabilities and consider service stability, data security, confidentiality obligations and technical-support capabilities in selecting and managing such providers. For internally developed systems and software, we apply controls relating to requirements, development, testing, acceptance and version management.

Employees are expected to report account irregularities, viruses, phishing emails, data leakage, system interruptions and other potential information-security incidents to management or the relevant system administrator on a timely basis. Depending on the nature and potential impact of an incident, responsive measures may include password resets, suspension of access rights, device isolation, support from third-party service providers, data restoration and, where appropriate, legal, regulatory and disclosure assessments.

Our Board of Directors has overall oversight responsibility for cybersecurity and information-technology risk management. Management is responsible for the day-to-day implementation of cybersecurity and information-technology risk-management policies and controls, with personnel in finance, administration, technology and other relevant functions participating in such processes based on their respective responsibilities.

Management identifies and monitors information-technology and cybersecurity risks through system-access management, incident reporting, data-backup procedures, system logs, vendor management and other internal-control procedures. Material cybersecurity incidents or information-security matters that could materially affect our financial reporting, operations or disclosures are required to be escalated to senior management and, depending on their nature and significance, to the Board of Directors or Audit Committee for oversight.