
Empowerment and Accountability
MERRY proactively manages risks that may arise during its operations. The Risk Management Team establishes relevant risk management procedures by referencing the ISO 31000:2018 Risk Management Framework and ISO 22301:2019 Business Continuity Management System. The team regularly assesses and monitors its risk appetite, the current status of accepted risks, determines risk response strategies, and ensures compliance with risk management procedures. The operational results are reported to the Board of Directors annually (most recently, the annual performance and next year's plan were reported to the Board of Directors on 2024/12/26). The current scope of risk management encompasses 17 risk categories: "Operational," "Quality," "Energy," "Environmental," "Technological," "Supply Chain," "Financial," "Taxation," "Information Security," "Human Resources," "Facilities," "Occupational Safety and Health," "Strategic," "Legal," "Integrity Management," "Business Interruption," and "Human Rights." Utilizing the risk assessment tools specified in the Risk Management Procedures document, risk measurement, based on likelihood and consequence, is categorized into 4 levels. Discussions are conducted with each accountable unit to determine if additional control measures are necessary for identified risk items, subsequently generating a risk matrix analysis. Furthermore, this risk operation also integrates implemented management systems such as I SO 9001, ISO 27001, ISO 45001, ISO 50001, TIPS, and GB/T 29490. The effectiveness of risk management control measures is confirmed through annual internal and external audits of each system. Additionally, to ensure the company's steady growth and sustainable operation objectives, the Risk Management Team has successively launched risk management education and training courses. It has also promoted the developed climate-related financial disclosure (TCFD) risk items to the group's subsidiaries. In the future, the company will continue to follow the Business Continuity Management (BCM) ISO 22301 standard, regularly exercising the Business Continuity Plan (BCP) established based on the results of the business impact analysis and the organization's cur[1]rent situation. 2024 Risk Management Execution Status Risk Matrix Analysis Following the implementation of risk control measures, the matrix analysis of residual risk distribution is as follows:
Estimated Residual Risk Distribution