Quanta emphasizes corporate governance and sustainable management, and is committed to establishing an effective corporate governance structure, gradually formulating and promoting various systems and practices for sound compliance, introducing the system of independent directors, and optimizing the diversified composition of the board of directors to strengthen the functions of the board of directors; in 2016, the Audit Committee was established to oversee the fair presentation of the company's financial statements and the effective implementation of internal controls. In addition, a Compensation Committee was established in 2011 to review the policies, systems, standards and structures of directors' and managers' performance evaluation and compensation; a Corporate Governance Director was appointed in 2020 to ensure that the Company's shareholders' meetings and board of directors' meetings are held in accordance with relevant laws and regulations and the Corporate Governance Code. In addition, a Sustainable Steering Committee has been established to coordinate matters related to the Corporation's sustainable development, and to compile the results of the environmental, social and governance work in a Corporate Sustainability Report.
For details of the relevant operations, please refer to "3.4 Implementation of Corporate Governance" in the Quanta Computer Inc. Annual Report 2023.
Corporate Governance Organization Structure
Composition and Diversity of the Board
The selection and nomination of directors of the Company is governed by Articles 17 and 17-1 of the Articles of Incorporation:
Article 17: This Corporation will have five to nine (5-9) directors. The election of directors shall adopt candidates' nomination system, and the shareholders shall elect among the nominees listed in the roster of directors' candidates. The total number of shares of this Corporation held by directors shall be subject to the regulations set by the competent authority in charge of securities.
Article 17-1: The independent directors of the Company shall not be less than two in number and not less than one-fifth of the total number of directors. The election of independent directors and directors shall be carried simultaneously and be counted separately.
The professional qualifications, restrictions on shareholdings and concurrent positions held, assessment of independence, method of nomination and appointment, exercising duties and rights and other matters for compliance with respect to independent directors shall be handled in accordance with Securities and Exchange Act and relevant regulations.
For a description of the qualifications, independence and diversity of the Board members, please refer to the Company's website and the following sections of Quanta Computer Inc. Annual Report 2023:
- 3.2.1 Directors and Supervisors
- 3.2.1.1 Profiles of Directors
- 3.2.1.3 Professional Qualifications and Independence Analysis of Directors and Members of the Audit Committee
- 3.2.1.4 Diversity of the Board of Directors
- 3.3 Remuneration of Directors, Presidents, and Vice Presidents In Recent Years
- 3.4.1 Operation of the Board of Director (BoD)
- 3.4.1.2.2 Execution of Directors' Avoidance of Motions in Conflict of Interests
- 3.4.2.2.3 Communication between Independent Directors, the Chief Internal Auditor and accountants
The specific management objectives of the Diversification Policy and the circumstances under which they were achieved are as follows:
| Management objectives | Achievement |
|---|---|
| More than 1/3 of independent directors | |
| None of the newly elected board members has served on the board for more than three consecutive terms. | |
| Added one seat of female board member | |
| The board of directors' performance evaluation shall be conducted by an external professional independent institutions at least once every three years. | |
Evaluation of the Board of Directors
The Company has established the “Procedures to Evaluate the Performance of the Board of Directors and Functional Committee” in 2019 and the procedures were modified in December 2020 to contract external professional independent institutions or external professional scholars for assessment at least once every three years.
At the end of each fiscal year, the Company would evaluate performance of the board and functional committees for the year based on evaluation indicators. The evaluation is completed before the end of the first quarter of the following year to ensure the operation of the board is in compliance with relevant law and regulations. The Company has completed the self-assessment for 2023, confirming that the operations of the Board of Directors and functional committees are in full compliance with relevant laws and regulations. In terms of external assessment on the performance evaluation of the Board of Directors, the Company has contracted “Taiwan Institute of Ethical Business” as the external independent assessment institute to conduct the performance evaluation of the Company's Board of Directors, and the recent external assessment time is 2022.The assessment results were reported to the Remuneration Committee on March 6, 2023 and the Audit Committee on March 15, 2023. The external assessment institute was invited to report the evaluation results and to provide improvement suggestions at the Board of Directors meeting.
Please refer to the section " 3.4.1.2.3 Evaluation of the Board of Directors" of the Quanta Computer Inc. Annual Report 2023 and company website for details of the relevant operations:
Functional committees
| Committee | Duty | Member | Number of meetings | Attendance rate |
|---|---|---|---|---|
| Audit Committee |
The fair presentation of the Company's financial statements. The selection, independence, and performance of the certifying accountant. Effective implementation of the Company's internal controls. The Company's compliance with relevant laws and regulations. Control of the Company's risks or potential risks. |
Independent director Hung Ching Lee Independent director Dr. Pisin Chen Independent director Su-Pi She |
6 | 100% |
| Compensation Committee |
To faithfully perform the following duties and responsibilities with
the care of a good manager and to submit proposals to the Board
of Directors for discussion: To establish and regularly review the policies, systems, standards and structures for the evaluation of performance and compensation of directors and managers. To regularly evaluate and set the compensation of directors and managers. |
Independent director Hung Ching Lee Independent director Su-Pi She Designated person Samuel Lee |
3 | 100% |
|
Sustainability
Steering Committee |
According to the work plan of the sub-committees, the subcommittees
will meet at least twice a year to discuss the annual
plan and the overview of the goals achieved. The Steering Committee for Sustainable Development reviews the work of each subcommittee, discusses future development strategies, and reports specific results and work to the Board of Directors. |
Chairman Barry Lam Vice Chairman & President C. C. Leung Director C. T. Huang After the meeting, a person will be assigned to report to the board of directors on the operation and implementation of sustainable development, and to report quarterly on the implementation of the greenhouse gas inventory and verification schedule plan, and to submit the "ESG Sustainable Development Strategy Direction" for the next year to the board of directors for a resolution to implement the contents, direction, and results of the meeting |
10 | - |
| Please refer to the section "3.4.2 Operation of the Audit Committee" and "3.4.4 Operation of Remuneration Committee" of the Quanta Computer Inc. Annual Report 2023 for details of the relevant operations. | ||||
Company Profile
Established in May 1988, Quanta Computer is a one of the Fortune Global 500 Companies and also one of the world's leading manufacturers in notebooks, AI servers, advanced computing equipment, and cloud infrastructure related products. The scope of our business includes cloud computing solutions, mobile computing equipment, smart home, smart mobility, smart manufacturing, smart medicine AIoT market, and etc. We proactively devote R&D resources into technology and innovations to expand new business opportunities and new applications.
Leveraging our strong R&D capacity, high-efficiency and high-quality product development and production capability, global logistics, speedy and flexible delivery services, and economies of scale, Quanta has taken the lead in the first wave of infrastructure build out for generative AI. Our product offerings in 3A categories, including AI PCs, AI servers, and AI car computer, are firmly established. As AI applications and services become widely available, we aim to capitalize our 3A product categories with the rise of AI revolution to propel Quanta forward in becoming an "A+" company.
Aside from maintaining our leadership position in key market segments, such as global notebook design, ODM, manufacturing and cloud computing hardware, we also expand focuses on the needs of large-scale cloud service providers to accelerate the deployment of AI data center infrastructure and related application services, doing so will strengthen our share in AI server market. Furthermore, we target at the business opportunities from the infrastructure reform of private cloud service providers, telecommunication operators, and the raising demand of cloud data centers. Quanta has established strategic partnerships with worldwide system integrators and already set up local sales offices in the U.S., Germany, Mainland China, Japan, South Korea, and Singapore to stay proximity to markets and to respond fast to customer demands. We have business presence across North America, Europe, and Asia Pacific regions, becoming an important AI-enabled cloud infrastructure and applications supplier with global deployment.Please refer to the section "V. Business Activities" of the Quanta Computer Inc. Annual Report 2023 for details of the relevant informations.
The total number of employees in the scope of this report is approximately 51,000 (including employees of QRDC, QTMC, QSMC, QCMC and QMB). Quanta Computer Inc. was listed in Taiwan Stock Exchange (TWSE) with the ticker of 2382 TTIn 2023, the Company did not merge or acquire shares of other companies to issue new shares. For related information, please refer to the section "4.1.1 Sources and Types of Capital " in Quanta Computer Inc. Annual Report 2023.
Overview of Market and Sales
Our Major products include notebook PCs, servers, automotive products, and other consumer products and are mostly for export. Major exporting regions are as follows:
| Region | FY2022 | FY2023 |
|---|---|---|
| U.S. | 53.21% | 57.15% |
| Mainland China | 9.05% | 9.28% |
| The Netherlands | 6.20% | 4.07% |
| Japan | 4.73% | 4.98% |
| Others | 26.81% | 24.52% |
| Total | 100.00% | 100.00% |
Our products are sold worldwide and a diversified composition of customer portfolio, with the U.S. being the major exporting region, followed by Mainland China. We have assembly sites and after-sales service centers established in Taiwan, California and Tennessee in the U.S., Mexico, Germany, South Korea, Japan, Singapore, Thailand, and Vietnam. With SAP information systems implemented, we provide branded notebook suppliers and mega data center customers with more efficient global services and technical supports.
Sources and Types of Capital
| Share Type | Authorized Capital | Remarks | ||
|---|---|---|---|---|
| Outstanding Shares | Unissued Stock | Total | ||
| Common | 3,862,627,432 | 737,372,568 | 4,600,000,000 | (Note) |
| Total | 3,862,627,432 | 737,372,568 | 4,600,000,000 | – |
Structure of shareholdings
| Item | Government Agencies | Financial Institutions | Other Institutional Investors | Foreign Institutions and Individuals | Domestic Natural Persons | Treasury Stock | Total |
|---|---|---|---|---|---|---|---|
| Number of shareholders | 1 | 79 | 936 | 1,621 | 171,519 | 0 | 174,156 |
| Shareholdings | 10 | 402,639,662 | 1,221,550,137 | 1,048,140,710 | 1,190,296,913 | 0 | 3,862,627,432 |
| Percentage (%) | 0.00% | 10.42% | 31.62% | 27.14% | 30.82% | 0.00% | 100.00% |
Technology advancement happens rapidly, and market dynamics are difficult to predict, Quanta has taken the lead in the first wave of infrastructure build out for generative AI. Our product offerings in 3A categories, including AI PCs, AI servers, and AI car computer, are firmly established. As AI applications and services become widely available, we aim to capitalize our 3A product categories with the rise of AI revolution to propel the value of company.
The technology industry has gone through several cycles of changes. Drawing from past experiences, the key success factors in adopting new technologies depend not only on the technology itself, but also on changes in user behavior, as well as the formation of new business models. We must continuously monitor and observe the trends of innovation, and incorporate the AI technology in the three major fields of "SMART X", including "Smart Medicine, Smart Manufacturing, and Smart Mobility." We shall provide the most appropriate tools in SMART X to assist our clients in developing high-quality services and solutions. Doing so would enable Quanta to seize the moment of business opportunities precisely when applications of new technology arise.
R&D Expensesin the past two years:
| Year | Expense (A) | Revenue (B) | (A)/(B) % |
|---|---|---|---|
| FY2022 | 21,336,340 | 1,280,429,312 | 1.67% |
| FY2023 | 23,293,587 | 1,085,611,052 | 2.15% |
R&D expenses in FY2023 was around NT$23.2 billion, an increase of NT$2 billion from NT$21.3 billion in 2022 or 9% increase. R&D expenses as a percentage of revenue in these two years are 2.15% and 1.67% respectively.
Quanta's production and service sites are across Asia, the Americas, Europe, and Southeast Asia countries in Thailand and Vietnam, etc. Our product lines are across information, communications, consumer electronics, and cloud computing areas. We also actively develop our R&D and manufacturing center in Taiwan to achieve our strong competitiveness in global manufacturing and sales.
Quanta spares no effort to develop new technologies and products. In protection of intellectual property rights of our R&D efforts, we have applied for 8,425 patents by 2023 in Taiwan, the U.S., Mainland China, Japan, and Europe and acquired 6,447 patents covering notebook PCs, servers, AI, big data, cloud applications, and AR/VR from Mainland China, the U.S., England, France, Germany, and Japan. In 2023, a total of 11 ESGrelated patents were granted, demonstrating Quanta's investment and achievements in sustainable design through innovative technology research and development throughout the product life cycle, including design, production, packaging, use, and recycling.
In the field of AI development, innovation and breakthroughs often require advanced planning and continuous exploration efforts. In the early stages of current technological revolution, Quanta has invested a substantial amount of resources in actively exploring untapped opportunities. We have undergone a comprehensive process of development of applications, verification testing, production planning, and market feedback analysis in collaboration with partners. The investments are evident in our success in capitalizing on AI infrastructure business opportunities. These achievements not only symbolize technological innovation, but also demonstrate our customers' long-term recognition and trust in Quanta's core capabilities.
In addition, Quanta continuously monitors the progress of new technologies through the Quanta ELITE School. The curriculum includes online and physical courses, accumulating a database of over a thousand courses to enable employees to stay updated and learn in line with the latest advancements. Quanta also incentivizes employees who propose research and development outcomes by providing bonuses upon patent applications and approvals. Each year, the best patent designs and inventors are selected, and awards are presented at the company's annual gathering, motivating employees to continue innovating.
Abstract of Quanta's Performance in FY2023
In FY2023, total notebook shipment delivered was 46.9 million units, securing our dominant position in the notebook market. At the same time, we seized the rising opportunities in AI server business, while the Smart Mobility business also gained traction among branded auto makers in Europe, the U.S., and various regions in Asia. Quanta has taken steady steps in laying a solid foundation for success. In response to future business growth in coming years, and to provide services in proximity, as well as to diversify the origin risks, the Company has recently announced expansion plans for several overseas locations outside China and Taiwan, including increased capacity in the U.S., Mexico, Thailand, Vietnam, and Germany, etc. The newly added capacity would further enhance Quanta's global manufacturing and service capabilities.
FY2023 reported consolidated revenue was NT$1.09 trillion. Although the reported revenue was a decrease compared to the previous year's revenue of NT$1.28 trillion, the Company still delivered improvements in gross margin, operating margin, and net profit margin through product mix enhancement and stringent cost control. The reported gross profit margin, operating profit margin, and net profit margin in FY2023 were 7.8%, 4.0%, and 3.7% respectively, which showed significant improvement compared to 5.5%, 2.4%, and 2.3% reported in FY2022.
FY2023 reported gross profit reached record high of NT$84.89 billion, representing a year-over-year growth of 19.7% compared to NT$70.91 billion reported in FY2022. Net income after tax in the past two years was NT$40.49 billion and NT$29.72 billion, respectively. Net profit attributable to owners of parent company was NT$39.68 billion in FY2023 and NT$28.96 billion in FY2022, representing a year-on-year increase of 37.0%. EPS for FY2023 was NT$10.29 and the Board of Directors also resolved the cash dividend distribution plan of NT$9.0 per share, which represents a dividend payout ratio of approximately 87.5%. The total non-operating income amounted to approximately NT$8.18 billion.
| Item | 2022 | 2023 |
|---|---|---|
| Net sales | 1,280,429,312 | 1,085,611,052 |
| Operating Income | 31,188,812 | 43,549,597 |
| Income Before Tax | 40,780,600 | 51,731,472 |
| Net Income | 29,722,669 | 40,488,586 |
| EPS | 7.51 | 10.29 |
| Cash Dividends | 6.00 | 9.00 |
| Total assets | 816,128,200 | 690,120,045 |
| Total Stockholders' Equity | 176,523,457 | 193,892,326 |
Sales in The Past Two Years
| Year | FY2022 | FY2023 | ||||||
|---|---|---|---|---|---|---|---|---|
| Sales | Domestic | Export | Domestic | Export | ||||
| Major Products | Quantity | Value | Quantity | Value | Quantity | Value | Quantity | Value |
| Computer Products | - | - | - | 1,275,258,755 | - | - | - | 1,081,733,676 |
| Other Electronics | * | 774,106 | * | 4,396,451 | * | 451,053 | * | 3,426,323 |
| Total | * | 774,106 | * | 1,279,655,206 | * | 451,053 | * | 1,085,159,999 |
| *Note: Difficult to categorize due to complexity of product types. | ||||||||
Risk Management Policies and Procedures
The Company has established the "Risk Management Guidelines" and was approved by the Board of Directors in December 2020 as the guiding principles for risk management and to facilitate the identification, analysis, evaluation and control of operational risks. The Board of Directors is responsible for establishing and overseeing the risk management structure of the Group, including the Company and important production sites. The President is responsible for the development and control of the Consolidated Companies' risk management policies and reports regularly to the Board of Directors on its operations. The most recent reporting date was December 20, 2023.
Scope of Risk Management
The main objective is to mitigate the impact of risks on the enterprise, to ensure that the operational risks of the Group are under the scope of control, to enable the Group's overall operations to focus on business growth and operational efficiency, and to help safeguard shareholders' equity.
Based on the risk events that occurred in the previous year and the opinions of external experts, the Group deliberates on the issues that may adversely affect the operations of the Company and the Consolidated Companies in the current year at the beginning of the period and use them as the basis for the overall assessment and risk ranking of operational risks in the following year. Planned risk control items then undergo proposed risk management measures after approval for overall monitoring or mitigation.
The monitoring and control tools mentioned above include, but are not limited to, the use of self-risk management as a risk control/risk retention, or risk transfer/insurance.
The Company's risk management procedures include risk identification, risk measurement, risk monitoring, risk reporting and disclosure, and risk response.
Please refer to the section "7.6 Analysis of Risk Management" and “5.6 Information Security Management” of the Quanta Computer Inc. Annual Report 2023 for details of the relevant operations.
Policies and Procedures
Quanta believes that honest operation is the way for the company's long-term development and has set a goal to establish a culture of integrity among all employees. To ensure that all Quanta employees, including directors, managers, employees, and suppliers, understand the principles of honest operation and have a shared understanding of compliance, the company has established the "Ethical Corporate Management Best Practice Principles," "Corporate Governance Best Practice Principles," "Code of Ethical Conducts," and "Procedures for Insider Trading Prevention." After being approved by the Board of Directors, these regulations can be read and queried on the Quanta Computer official website under Corporate Governance and Important Company Regulations.
In 2022, to strengthen the moral and ethical awareness of all employees, Quanta has formulated the "Policies on Ethics and Integrity," which have been announced on the website after being approved by the General Manager. The company also has an "Employee Code of Ethics," which is regularly disseminated to colleagues every year. Please refer to company website for details of the relevant operations.
All of Quanta's honest operation policies and procedures clearly indicate that the company has a zero-tolerance policy for any form of violation of business ethics, corruption, or bribery. Quanta's employees are not allowed to accept inappropriate gifts or engage in insider trading. When engaging in business activities related to the company, employees mustn't sacrifice the company's interests due to conflicts of interest with their personal interests. We are committed to respecting intellectual property rights and will not engage in business activities that violate the Fair-Trade Act or the Antitrust Act. When personal information needs to be collected for business purposes, we will also comply with the laws and regulations of each country. We pledge to disclose economic performance and business activities transparently in accordance with the law, and charitable donations will also be made based on legal requirements and publicly disclosed.
Since 2015, Quanta has required selected suppliers to sign the "Quanta Supplier RBA Code of Conduct Compliance Statement," which requires suppliers to comply with the standards and regulations for labor, ethics, safety and health, environment, and management systems outlined in the code of conduct. We also encourage suppliers to voluntarily undergo RBA audits or to be audited by our own CSR team. This will help promote consensus and gain support from customers, suppliers, business partners, and other stakeholders involved in business transactions.
All our efforts to have suppliers sign the "Quanta Supplier RBA Code of Conduct Compliance Statement" have paid off, with all 146 targeted suppliers achieving compliance by 2023. We are proud to announce that a total of 1406 suppliers have completed this process to date. The communication ratio is 100 percent.
Execution of Ethics and Integrity
Our company has implemented many procedures to prevent conflicts of interest. First, when directors or managers engage in activities within the scope of the company's business, whether for themselves or others, they should obtain prior approval from the shareholders' meeting or the board of directors in accordance with legal requirements. This is to ensure corporate governance, strengthen supervisory functions, and enhance management capabilities, so that the board of directors and senior management can collaborate in implementing ethical business practices. Therefore, appropriate measures have been established in accordance with legal regulations for compliance. Major matters such as operational policies, investment projects, asset acquisition or disposal, lending of funds to others, and endorsement guarantees are also analyzed and executed in compliance with relevant regulations. The corresponding rights and responsibilities are reported and announced in accordance with the law. At the same time, we conduct annual self-inspection operations to ensure that we review the appropriateness and implementation of internal controls in a timely manner, taking into account organizational and environmental changes. This helps us ensure the effective implementation of internal controls.
For details of the implementation, please refer to "3.4.6 Fulfillment of Ethical Corporate Management and Deviations from the "Ethical Corporate Management Best Practice Principles for TWSE/GTSM Listed Companies" in the Quanta Computer Inc. Annual Report 2023.
The Company has established "Rules and Procedures for the Board of Directors Meeting" as a guideline for BoD operation to enforce corporate governance, to optimize organizational supervision, and to strengthen organizational management. In the event that a proposal involves conflict of interests of a director and such proposal may harm the organization's interests, the related director will follow the principle of directors' avoidance of motions in conflict of interests to protect the interests of the Company and its shareholders.For details of the implementation, please refer to "3.4.1.2.2 Execution of Directors' avoidance of motions in conflict of interests" in the Quanta Computer Inc. Annual Report 2023.
To help employees develop a deeper understanding of the Company's principles of integrity, the Company reminds all managers and employees to read the Code of Ethics and sign off as acknowledgement the code. Matters involving avoidance of interests should also be truthfully reported, and should be confirmed by supervisors at all levels whether there is any impact, and necessary preventive actions should be taken. Upon verification from the President, the annual declaration of ethics and avoidance of interests should be completed. Except for employees who are on leave or suspension during the declaration period, all governance staff and indirect personnel with computers are required to complete the interest conflict declaration within two weeks. In 2023, a total of 4,373 senior managers from the Taiwan plant (3,498), the China plant (875), and the Thailand plant (5) have completed the declaration, with a ratio of 100%. (Senior managers are defined as deputy managers to managers or above.)
Promotion and Education Training
During new employee training, each plant's new recruits receive training on the company's integrity and ethical policies and are explicitly informed that the company prohibits any form of corruption, bribery, fraud, extortion, or embezzlement of public funds. Any violation will result in strict disciplinary action or legal action. Employees are also informed of the upper limit for receiving gifts based on normal social relationships, and the handling principles when the gift value exceeds that limit. Employees are aware of the channels for anonymous or named reporting of violations of business ethics. Related regulations can also be found in the new employee handbook.
In the mandatory training courses for supervisors, such as management case studies, talent selection, goal setting, and performance management, the concept of anticorruption is integrated into the core competencies of 2B culture, such as "proactivity" and "high self-demand", through the supervisor's manual. The CSR annual training includes classroom courses and online corporate social responsibility training videos, which aim to promote and educate anti-corruption policies in Quanta.
A total of 8,211 employees in the Taiwan plant, 73,295 in the China plant, and 3,917 in the Thailand plant have received training on integrity policies, with a ratio of 100%.
Channels and Handling of Complaints
All employees should remain vigilant against any violation of the employee code of ethics. When there are concerns or discoveries of any violations of the employee code of ethics, it is the responsibility of all employees to report them to their supervisors. If necessary, they may report directly to the HR director, the internal audit manager, or through an employee complaint channel.
Employees can use the following channels on the official website to file complaints, express opinions, or make inquiries with all stakeholders at Quanta, in addition to the aforementioned channels: The Channels are as follows:
All complaints can be filed anonymously or with identification. If a reported violation involves a member of the governance level, the report will be submitted to the chairman or vice chairman, who will then assign dedicated supervisor and audit personnel to conduct an independent investigation. If the reported violation involves an ordinary employee, the audit team will investigate and provide a report to the highest-level executive in charge of the relevant area for further handling. If an employee violates the employee code of ethics, they will be punished in accordance with the relevant rules and regulations, and in serious cases, law enforcement agencies will be notified. If a supplier violates Quanta's employee code of ethics, the partnership will be suspended in accordance with the contract provisions. The annual results of these actions will be reported to the Board of Directors, including details of the investigation and improvement plans. Quanta promises to protect any stakeholder who reports any violations of the employee code of ethics and participates in the investigation process to avoid unfair retaliation or treatment.
2023 Performance Report
- In 2023, there were 2 cases of employees involved in violations of professional ethics such as corruption, bribery, acceptance of inappropriate gifts related to their duties, insider trading, or actions conflicting with the Company's interests that resulted in punishment.
- There were also no cases of confirmed anti-competitive behavior (including antitrust and unfair competition) or fines resulting from such behavior.
- The rate of declaration of interest avoidance by employees in e ach site was 100%.
Strategies and Objectives
Information security is a crucial cornerstone for sustainable development and maintaining core competitiveness in the enterprise. At Quanta, we are committed to enhancing the overall management of information security as our goal. We have established a layered defense framework to enhance overall protection and conduct comprehensive risk monitoring. We will continue to refer to domestic and international trends, international standards, and advice from external professional consultants to allocate appropriate security budgets annually, optimize various protective control measures, strengthen education and training for all personnel, improve security awareness and response capabilities, and safeguard the company's operations and information security.
"Everyone participates, controls risks, and ensures the effective operation of the information security system to protect the normal operation of the company. " is the motto of Quanta's information security strategy.
Quanta's information and communication security policy has three objectives: "Everyone participates and controls risks", "actively prevents, continually improves," and "customer trust, sustainable operation".
- Everyone participates and controls risks: Establishing an information security management system, determining the functions and responsibilities of information security, and managing information security comprehensively across all processes and staff. According to the characteristics of the company's information security, the requirements of laws and regulations, the risk assessment procedures are established, and the risk acceptance criteria are determined. Conducting regular risk assessment and taking appropriate measures to reduce potential risks.
- Actively prevents, continually improves: In business operations, emphasis is placed on information security, identifying, and analyzing weaknesses and potential threats in information systems, considering the balance of costs, benefits, and risks, classifying and protecting assets, and protecting information systems at an appropriate cost.
- Customer trust, sustainable operation: By conducting performance evaluations and continuous improvement, we ensure the effectiveness of the information security management system and achieve the goals of customer trust and sustainable business operation.
Organization
In the first quarter of 2022, the Board of Directors approved the establishment of a Cybersecurity unit and the appointment of a full-time minister. The cybersecurity unit is called the "Information Security Center" and reports directly to the general manager or his designated representative. It is responsible for convening meetings of the Proprietary Information Security Committee (PIS)。The "Information Security Center" has set up the "Information Security Management Department" and the "Information Security Technology Department", responsible for the management of cybersecurity matters within the group. This includes coordinating cybersecurity policies, international cybersecurity standards verification and auditing, implementing and verifying cybersecurity mechanisms, building layered defenses, enhancing cybersecurity levels, and aligning with international standards. The center regularly reports on relevant risks, issues, and management effectiveness.
To demonstrate the company's good cybersecurity management and strengthen cross-departmental collaboration within the group, the existing PIS committee has been expanded to become the highest guidance unit for group-wide information security. Through biannual committee meetings, monthly meetings of the Information Security Center, and regular and ad hoc project meetings, various information security management policies and measures are continuously promoted. Comprehensive reviews and optimizations of information security policies and cybersecurity measures are conducted at least once a year, and the execution of information security is reported to the board of directors at least once a year. The most recent report was submitted on November 10, 2023.
Information Security Promotion Goals
In order to evaluate the performance and effectiveness of the information security management system, the company has established several security indicators for the organization, personnel, processes, and technical aspects of information security, strictly examining the implementation of the cybersecurity management. All cybersecurity indicators were controlled and improved and successfully achieved in 2023.
| Aspects | Cybersecurity KPI | Handling status in 2023 |
|---|---|---|
| Organization | Regular review of the information security management system documents | Achieved |
| Conducting risk assessments regularly | Achieved | |
| Personnel | All employees sign confidentiality agreements | Achieved |
| Receiving appropriate information security education and training in accordance with regulations | Achieved | |
| Technology | No audit records that are supposed to be open but are unopened | Achieved |
| Conducting vulnerability scans regularly | Achieved | |
| No firewall rules that have not been removed or have inappropriate permissions | Achieved | |
| The availability rate of core servers is ≧ 99.98% per month | Achieved | |
| The availability rate of the data center infrastructure is ≧99.98% per month | Achieved | |
| The availability rate of the external network is ≧95% per month | Achieved | |
| Process | No unauthorized personnel have access to the production environment | Achieved |
| No unauthorized software installation | Achieved | |
| Application system changes are all authorized | Achieved | |
| Report of cybersecurity incidents within the specified time according to regulations | Achieved | |
| Conducting regular business continuity exercises | Achieved | |
| Keeping relevant records for entering and exiting the data center and granting appropriate permissions | Achieved | |
| Conducting regular checks on system security-related settings | Achieved |
Quanta has established four dimensions of information security governance to achieve its vision and goals: establishing a robust security organization, implementing a multi-layered defense technology, optimizing security management processes, and nurturing high-quality security personnel. In response to the increasing security risks, Quanta continuously adjusts its information security direction based on risk management results, as well as the development of information and communication technology and external environmental changes. Quanta aims to establish consistent security standards throughout the company, strike a balance between business and security, and ensure that all employees actively participate in collaborative maintenance to meet the company's security policy requirements.
| Aspects | Direction of Promotion | Short-term Focus | Long-term Goals |
|---|---|---|---|
| Organization |
|
|
|
| Personnel |
|
|
|
| Technology |
|
|
|
| Process |
|
|
|
Constructing an overall information security framework
The company places great importance on maintaining information security. Since 2008, it has been insured for cybersecurity, and in 2009, it developed "Information Security Management Policies" and an "Information Security Risk Management Framework". Since 2020, it has actively aimed to obtain the ISO 27001 certification and has been working to meet the requirements for information security enhancements in 2021. The certification has been acquired in the second quarter of 2022. The main operations are as follows:
Results of cybersecurity control execution
Our company conducts regular internal and external cybersecurity audits and customer audits, and no major deficiencies or incidents that caused customer or company losses have been found. We are able to respond to and control internal and external cybersecurity threats through various control measures.
To respect intellectual property rights and protect personal information and customer privacy, Quanta has established the Proprietary Information Security (PIS) Committee. In 2022, the PIS assumed greater responsibilities and, within the existing framework, was reorganized as the top-level advisory unit for group information security, overseeing and coordinating related matters. Through biannual committee meetings, we continuously promote various confidential information protection policies and measures, with the goal of ensuring that Quanta employees and the entire supply chain comply with the company's policies related to the protection of proprietary information.
Confidential Information Protection Policy
To protect proprietary information, the company has established policies and procedures such as "Patent Management Regulations," "Integrity and Ethics Policies", "Privacy Protection Management Procedures," the "Quanta Computer Personal Data Protection Act," "The Five Do Nots for Protecting Confidential Information", and security management measures at each plant. These policies and procedures disclose the company's management systems for confidential information, including intellectual property rights, personal privacy, and access control that may pose a risk to the company's confidential information. After joining the company, employees sign confidentiality agreements to clearly understand their confidentiality obligations. If a project involves proprietary information, the employees and suppliers involved will also sign a confidentiality agreement. Comprehensive policies and management systems are in place to ensure the complete protection of company and customer proprietary information. Personal data is also saved and used according to relevant management procedures.
Implementation
The company promotes and manages relevant policies through the PIS committee and reviews management policies for any necessary adjustments through regular meetings. In addition, the company undergoes periodic audits from customers to comprehensively review whether there are any deficiencies in the implementation of the company's confidential information protection measures. There have been no significant incidents of customer audits or complaints regarding violations of proprietary information protection or privacy infringement or loss of confidential information since 2023.
Filing Complaints and Management
If any matters that may endanger confidential information are found, they can be reported to the company through the Code of Ethics (Headquarters' Independent Window) . Internal colleagues can also file complaints by reporting them to their supervisors or through the channels provided by the Human Resources department. Once a complaint is received, Quanta will assign responsible personnel to handle the situation, and if a violation is confirmed, the company will take appropriate disciplinary action according to its work rules.
Education, Training, and Awareness
In 2023, a total of eight awareness campaigns were conducted. The annual training focus for the year was on information security protection measures, with a completion rate of 100%.
Achievements in 2023
- The number of confirmed complaints related to customer privacy infringement or loss of customer data was zero.
- The number of confirmed complaints related to personal data not being saved or used according to relevant management procedures was zero.
- There were zero incidents of customers complaining directly to the company about violations of confidentiality obligations.