Business Ethics and Compliance

Compliance System

IRPC adopts an integrated Governance, Risk Management/Internal Control, and Compliance (GRC) framework as part of our management approach. This enables the Company to systematically identify, assess, and manage risks while ensuring compliance with applicable laws and guidelines. To support effective implementation, we have established a GRC working group to promote understanding and integration of GRC principles among employees, with dedicated help desks and focal points in place to provide support. Progress on GRC-related activities is reported to the GRC Committee on a bi-monthly basis and to the Corporate Governance and Sustainability Committee on a quarterly basis.

Reporting on Breaches

IRPC strictly implements the defined Code of Conduct, with designated units responsible for execution. Help desks and reporting channels are available to both internal staff and external stakeholders, supported by clearly defined, unbiased, and transparent investigation and resolution processes. Stakeholders can report concerns through various whistleblowing channels, including telephone, company website, email, and PO Box, and may also directly contact the Chairman of the Audit Committee and the Corporate Governance and Sustainability Committee. These mechanisms accept submissions related to violations of laws, the Code of Conduct, and all forms of corruption, including bribery and other unethical or inappropriate conduct across all levels of the organization, covering directors, executives, employees of IRPC and subsidiaries, as well as stakeholders and related parties. Information provided is treated confidentially, with safeguards in place to protect whistleblowers, complainants, and relevant witnesses in accordance with the Whistleblowing policy.

All complaints are first received and reviewed by the Internal Audit Office for initial screening. The Internal Audit Office records the case, conducts preliminary assessment, and determines whether further investigation is required. If the matter is not substantiated, the case is closed and the complainant is notified in accordance with company procedures. If the case is substantiated, the Internal Audit Office reports the matter to the President and CEO, who may assign a responsible person or committee to conduct further investigation. The investigation findings are reported back to the President and CEO for consideration. For corruption-related and other significant cases, the Internal Audit Office reports directly to the Audit Committee and Board of Directors. Where wrongdoing is confirmed, disciplinary actions are taken in accordance with company regulations, and relevant parties, including the complainant, are notified.

In addition, the Company summarizes complaint data, analyzes root causes and risks, and reviews them to determine appropriate additional control measures. IRPC has also enhanced rules on complaint handling and whistleblowing across IRPC and subsidiaries to align with corporate governance principles and internationally accepted standards, incorporating stakeholder feedback to continuously improve the process and system.

Consequence of Breaches

IRPC has defined penalties in case of legal or regulatory violations in a fair and transparent manner in all circumstances. The Office of Corporate Internal Audit and relevant committees are responsible for reviewing and reporting incidents to the Audit Committee and the Board of Directors, as well as to related departments, in the sequence specified in the Complaint Management Procedure.