The Corporate Compliance Department organized training and awarded certificates to PDPA Data Champions at a knowledge training course to promote better understanding of personal data protection and operational supervision to achieve corporate compliance and personal data protection policy. 3. Corporate Compliance Monitoring & Evaluation IRPC has inspected and monitored and evaluate the corporate compliance continuously to ensure the company and its subsidiaries the Group are fully in compliance in every aspect. In 2023 the company has conducted assessment of compliance with personal data protection laws to underscore its importance and use it as a tool for operational review. Some 84 percent of the company’s total employees completed the assessment questionnaires on PDPA compliance. In addition, IRPC also required 3 of its wholly-owned subsidiaries, IRPC Oil Company Limited, Rakpasak Company Limited, and IRPC Technology College, to undergo assessment for PDPA compliance in accordance with the supervision oversight policy and applicable law. 4. Corporate Compliance Reporting IRPC submitted corporate compliance supervisory oversight report to the Board of Directors for acknowledgement on a quarterly basis. The Board commented on the report and provided valuable suggestions to the company. Governance Risk & Internal Control & Compliance (GRC) IRPC has consistently integrated the GRC in its management. In 2022, the company applied GRC procedures to monitor two operational processes: (1) Merger & Acquisition in existing and new businesses, and (2) procurement. In 2023, IRPC has further expanded GRC integration by applying it to its property tax payment process and record and document retention system as recommended by a GRC consultant. Findings from the assessment show that GRC has already been integrated into such process and system. However, in order to improve efficiency of the work of personnel responsible for the process and system in terms of ease of inspection and assessment, the company determined that further development was required along with development of process handbook and workflow that needed to be defined in greater detail, clarity to be more efficient. In addition, it was determined that more effective communication must be implemented among work units involved to prevent and reduce non-compliance risk. Furthermore, IRPC has also assigned its GRC working group to participate in activities to promote better understanding of GRC integration among employees. Senior executive officers were interviewed so that the company may acknowledge their expectation from GRC integration and feedback in order to further improvement in its application and GRC planning. Activities relating to GRC were reported to the GRC committee every two months and to the Corporate Governance and Sustainability every quarter. 217 Corporate Governance Policy 56-1 ONE REPORT 2023
RkJQdWJsaXNoZXIy ODg4NTI=