2023 Quanta Computer Sustainability Report
Scroll for more

Quanta emphasizes corporate governance and sustainable management, and is committed to establishing an effective corporate governance structure, gradually formulating and promoting various systems and practices for sound compliance, introducing the system of independent directors, and optimizing the diversified composition of the board of directors to strengthen the functions of the board of directors; in 2016, the Audit Committee was established to oversee the fair presentation of the company's financial statements and the effective implementation of internal controls. In addition, a Compensation Committee was established in 2011 to review the policies, systems, standards and structures of directors' and managers' performance evaluation and compensation; a Corporate Governance Director was appointed in 2020 to ensure that the Company's shareholders' meetings and board of directors' meetings are held in accordance with relevant laws and regulations and the Corporate Governance Code. In addition, a Sustainable Steering Committee has been established to coordinate matters related to the Corporation's sustainable development, and to compile the results of the environmental, social and governance work in a Corporate Sustainability Report.

For details of the relevant operations, please refer to "3.4 Implementation of Corporate Governance" in the Quanta Computer Inc. Annual Report 2023.

Corporate Governance Organization Structure

Corporate Governance Organization Structure

Composition and Diversity of the Board

The selection and nomination of directors of the Company is governed by Articles 17 and 17-1 of the Articles of Incorporation:

Article 17: This Corporation will have five to nine (5-9) directors. The election of directors shall adopt candidates' nomination system, and the shareholders shall elect among the nominees listed in the roster of directors' candidates. The total number of shares of this Corporation held by directors shall be subject to the regulations set by the competent authority in charge of securities.

Article 17-1: The independent directors of the Company shall not be less than two in number and not less than one-fifth of the total number of directors. The election of independent directors and directors shall be carried simultaneously and be counted separately.

The professional qualifications, restrictions on shareholdings and concurrent positions held, assessment of independence, method of nomination and appointment, exercising duties and rights and other matters for compliance with respect to independent directors shall be handled in accordance with Securities and Exchange Act and relevant regulations.

For a description of the qualifications, independence and diversity of the Board members, please refer to the Company's website and the following sections of Quanta Computer Inc. Annual Report 2023:

3.2.1 Directors and Supervisors
3.2.1.1 Profiles of Directors
3.2.1.3 Professional Qualifications and Independence Analysis of Directors and Members of the Audit Committee
3.2.1.4 Diversity of the Board of Directors
3.3 Remuneration of Directors, Presidents, and Vice Presidents In Recent Years
3.4.1 Operation of the Board of Director (BoD)
3.4.1.2.2 Execution of Directors' Avoidance of Motions in Conflict of Interests
3.4.2.2.3 Communication between Independent Directors, the Chief Internal Auditor and accountants

The specific management objectives of the Diversification Policy and the circumstances under which they were achieved are as follows:

Scroll for more
Management objectives Achievement
More than 1/3 of independent directors
None of the newly elected board members has served on the board for more than three consecutive terms.
Added one seat of female board member
The board of directors' performance evaluation shall be conducted by an external professional independent institutions at least once every three years.

Evaluation of the Board of Directors

The Company has established the “Procedures to Evaluate the Performance of the Board of Directors and Functional Committee” in 2019 and the procedures were modified in December 2020 to contract external professional independent institutions or external professional scholars for assessment at least once every three years.

At the end of each fiscal year, the Company would evaluate performance of the board and functional committees for the year based on evaluation indicators. The evaluation is completed before the end of the first quarter of the following year to ensure the operation of the board is in compliance with relevant law and regulations. The Company has completed the self-assessment for 2023, confirming that the operations of the Board of Directors and functional committees are in full compliance with relevant laws and regulations. In terms of external assessment on the performance evaluation of the Board of Directors, the Company has contracted “Taiwan Institute of Ethical Business” as the external independent assessment institute to conduct the performance evaluation of the Company's Board of Directors, and the recent external assessment time is 2022.The assessment results were reported to the Remuneration Committee on March 6, 2023 and the Audit Committee on March 15, 2023. The external assessment institute was invited to report the evaluation results and to provide improvement suggestions at the Board of Directors meeting.

Please refer to the section " 3.4.1.2.3 Evaluation of the Board of Directors" of the Quanta Computer Inc. Annual Report 2023 and company website for details of the relevant operations:

Functional committees

Scroll for more
Committee Duty Member Number of meetings Attendance rate
Audit Committee The fair presentation of the Company's financial statements.
The selection, independence, and performance of the certifying accountant.
Effective implementation of the Company's internal controls.
The Company's compliance with relevant laws and regulations.
Control of the Company's risks or potential risks.
Independent director   Hung Ching Lee
Independent director   Dr. Pisin Chen
Independent director   Su-Pi She
6 100%
Compensation Committee To faithfully perform the following duties and responsibilities with the care of a good manager and to submit proposals to the Board of Directors for discussion:
To establish and regularly review the policies, systems, standards and structures for the evaluation of performance and compensation of directors and managers.
To regularly evaluate and set the compensation of directors and managers.
Independent director   Hung Ching Lee
Independent director   Su-Pi She
Designated person    Samuel Lee
3 100%
Sustainability
Steering Committee
According to the work plan of the sub-committees, the subcommittees will meet at least twice a year to discuss the annual plan and the overview of the goals achieved.
The Steering Committee for Sustainable Development reviews the work of each subcommittee, discusses future development strategies, and reports specific results and work to the Board of Directors.
Chairman           Barry Lam
Vice Chairman & President   C. C. Leung
Director            C. T. Huang
After the meeting, a person will be assigned to report to the board of directors on the operation and implementation of sustainable development, and to report quarterly on the implementation of the greenhouse gas inventory and verification schedule plan, and to submit the "ESG Sustainable Development Strategy Direction" for the next year to the board of directors for a resolution to implement the contents, direction, and results of the meeting
10 -
Please refer to the section "3.4.2 Operation of the Audit Committee" and "3.4.4 Operation of Remuneration Committee" of the Quanta Computer Inc. Annual Report 2023 for details of the relevant operations.

Company Profile

Established in May 1988, Quanta Computer is a one of the Fortune Global 500 Companies and also one of the world's leading manufacturers in notebooks, AI servers, advanced computing equipment, and cloud infrastructure related products. The scope of our business includes cloud computing solutions, mobile computing equipment, smart home, smart mobility, smart manufacturing, smart medicine AIoT market, and etc. We proactively devote R&D resources into technology and innovations to expand new business opportunities and new applications.

Leveraging our strong R&D capacity, high-efficiency and high-quality product development and production capability, global logistics, speedy and flexible delivery services, and economies of scale, Quanta has taken the lead in the first wave of infrastructure build out for generative AI. Our product offerings in 3A categories, including AI PCs, AI servers, and AI car computer, are firmly established. As AI applications and services become widely available, we aim to capitalize our 3A product categories with the rise of AI revolution to propel Quanta forward in becoming an "A+" company.

Aside from maintaining our leadership position in key market segments, such as global notebook design, ODM, manufacturing and cloud computing hardware, we also expand focuses on the needs of large-scale cloud service providers to accelerate the deployment of AI data center infrastructure and related application services, doing so will strengthen our share in AI server market. Furthermore, we target at the business opportunities from the infrastructure reform of private cloud service providers, telecommunication operators, and the raising demand of cloud data centers. Quanta has established strategic partnerships with worldwide system integrators and already set up local sales offices in the U.S., Germany, Mainland China, Japan, South Korea, and Singapore to stay proximity to markets and to respond fast to customer demands. We have business presence across North America, Europe, and Asia Pacific regions, becoming an important AI-enabled cloud infrastructure and applications supplier with global deployment.Please refer to the section "V. Business Activities" of the Quanta Computer Inc. Annual Report 2023 for details of the relevant informations.

The total number of employees in the scope of this report is approximately 51,000 (including employees of QRDC, QTMC, QSMC, QCMC and QMB). Quanta Computer Inc. was listed in Taiwan Stock Exchange (TWSE) with the ticker of 2382 TTIn 2023, the Company did not merge or acquire shares of other companies to issue new shares. For related information, please refer to the section "4.1.1 Sources and Types of Capital " in Quanta Computer Inc. Annual Report 2023.

Overview of Market and Sales

Our Major products include notebook PCs, servers, automotive products, and other consumer products and are mostly for export. Major exporting regions are as follows:

Scroll for more
Region FY2022 FY2023
U.S. 53.21% 57.15%
Mainland China 9.05% 9.28%
The Netherlands 6.20% 4.07%
Japan 4.73% 4.98%
Others 26.81% 24.52%
Total 100.00% 100.00%

Our products are sold worldwide and a diversified composition of customer portfolio, with the U.S. being the major exporting region, followed by Mainland China. We have assembly sites and after-sales service centers established in Taiwan, California and Tennessee in the U.S., Mexico, Germany, South Korea, Japan, Singapore, Thailand, and Vietnam. With SAP information systems implemented, we provide branded notebook suppliers and mega data center customers with more efficient global services and technical supports.

Sources and Types of Capital

Scroll for more
Note:
  1. Above shares have been publicly offered.
  2. Unissued stock includes 100 million shares of employee options/warrants.
  3. No preferred share was issued.
Share Type Authorized Capital Remarks
Outstanding Shares Unissued Stock Total
Common 3,862,627,432 737,372,568 4,600,000,000 (Note)
Total 3,862,627,432 737,372,568 4,600,000,000

Structure of shareholdings

Scroll for more
Item Government Agencies Financial Institutions Other Institutional Investors Foreign Institutions and Individuals Domestic Natural Persons Treasury Stock Total
Number of shareholders 1 79 936 1,621 171,519 0 174,156
Shareholdings 10 402,639,662 1,221,550,137 1,048,140,710 1,190,296,913 0 3,862,627,432
Percentage (%) 0.00% 10.42% 31.62% 27.14% 30.82% 0.00% 100.00%

Technology advancement happens rapidly, and market dynamics are difficult to predict, Quanta has taken the lead in the first wave of infrastructure build out for generative AI. Our product offerings in 3A categories, including AI PCs, AI servers, and AI car computer, are firmly established. As AI applications and services become widely available, we aim to capitalize our 3A product categories with the rise of AI revolution to propel the value of company.

The technology industry has gone through several cycles of changes. Drawing from past experiences, the key success factors in adopting new technologies depend not only on the technology itself, but also on changes in user behavior, as well as the formation of new business models. We must continuously monitor and observe the trends of innovation, and incorporate the AI technology in the three major fields of "SMART X", including "Smart Medicine, Smart Manufacturing, and Smart Mobility." We shall provide the most appropriate tools in SMART X to assist our clients in developing high-quality services and solutions. Doing so would enable Quanta to seize the moment of business opportunities precisely when applications of new technology arise.

R&D Expensesin the past two years:

Scroll for more
(expressed in NT$ thousand)
Year Expense (A) Revenue (B) (A)/(B) %
FY2022 21,336,340 1,280,429,312 1.67%
FY2023 23,293,587 1,085,611,052 2.15%

R&D expenses in FY2023 was around NT$23.2 billion, an increase of NT$2 billion from NT$21.3 billion in 2022 or 9% increase. R&D expenses as a percentage of revenue in these two years are 2.15% and 1.67% respectively.

Quanta's production and service sites are across Asia, the Americas, Europe, and Southeast Asia countries in Thailand and Vietnam, etc. Our product lines are across information, communications, consumer electronics, and cloud computing areas. We also actively develop our R&D and manufacturing center in Taiwan to achieve our strong competitiveness in global manufacturing and sales.

Quanta spares no effort to develop new technologies and products. In protection of intellectual property rights of our R&D efforts, we have applied for 8,425 patents by 2023 in Taiwan, the U.S., Mainland China, Japan, and Europe and acquired 6,447 patents covering notebook PCs, servers, AI, big data, cloud applications, and AR/VR from Mainland China, the U.S., England, France, Germany, and Japan. In 2023, a total of 11 ESGrelated patents were granted, demonstrating Quanta's investment and achievements in sustainable design through innovative technology research and development throughout the product life cycle, including design, production, packaging, use, and recycling.

In the field of AI development, innovation and breakthroughs often require advanced planning and continuous exploration efforts. In the early stages of current technological revolution, Quanta has invested a substantial amount of resources in actively exploring untapped opportunities. We have undergone a comprehensive process of development of applications, verification testing, production planning, and market feedback analysis in collaboration with partners. The investments are evident in our success in capitalizing on AI infrastructure business opportunities. These achievements not only symbolize technological innovation, but also demonstrate our customers' long-term recognition and trust in Quanta's core capabilities.

In addition, Quanta continuously monitors the progress of new technologies through the Quanta ELITE School. The curriculum includes online and physical courses, accumulating a database of over a thousand courses to enable employees to stay updated and learn in line with the latest advancements. Quanta also incentivizes employees who propose research and development outcomes by providing bonuses upon patent applications and approvals. Each year, the best patent designs and inventors are selected, and awards are presented at the company's annual gathering, motivating employees to continue innovating.

Abstract of Quanta's Performance in FY2023

In FY2023, total notebook shipment delivered was 46.9 million units, securing our dominant position in the notebook market. At the same time, we seized the rising opportunities in AI server business, while the Smart Mobility business also gained traction among branded auto makers in Europe, the U.S., and various regions in Asia. Quanta has taken steady steps in laying a solid foundation for success. In response to future business growth in coming years, and to provide services in proximity, as well as to diversify the origin risks, the Company has recently announced expansion plans for several overseas locations outside China and Taiwan, including increased capacity in the U.S., Mexico, Thailand, Vietnam, and Germany, etc. The newly added capacity would further enhance Quanta's global manufacturing and service capabilities.

FY2023 reported consolidated revenue was NT$1.09 trillion. Although the reported revenue was a decrease compared to the previous year's revenue of NT$1.28 trillion, the Company still delivered improvements in gross margin, operating margin, and net profit margin through product mix enhancement and stringent cost control. The reported gross profit margin, operating profit margin, and net profit margin in FY2023 were 7.8%, 4.0%, and 3.7% respectively, which showed significant improvement compared to 5.5%, 2.4%, and 2.3% reported in FY2022.

FY2023 reported gross profit reached record high of NT$84.89 billion, representing a year-over-year growth of 19.7% compared to NT$70.91 billion reported in FY2022. Net income after tax in the past two years was NT$40.49 billion and NT$29.72 billion, respectively. Net profit attributable to owners of parent company was NT$39.68 billion in FY2023 and NT$28.96 billion in FY2022, representing a year-on-year increase of 37.0%. EPS for FY2023 was NT$10.29 and the Board of Directors also resolved the cash dividend distribution plan of NT$9.0 per share, which represents a dividend payout ratio of approximately 87.5%. The total non-operating income amounted to approximately NT$8.18 billion.

Scroll for more
Unit: NT$ thousands
Item 2022 2023
Net sales 1,280,429,312 1,085,611,052
Operating Income 31,188,812 43,549,597
Income Before Tax 40,780,600 51,731,472
Net Income 29,722,669 40,488,586
EPS 7.51 10.29
Cash Dividends 6.00 9.00
Total assets 816,128,200 690,120,045
Total Stockholders' Equity 176,523,457 193,892,326

Sales in The Past Two Years

Scroll for more
(expressed in 1,000 pieces/NT$ thousand)
Year FY2022 FY2023
Sales Domestic Export Domestic Export
Major Products Quantity Value Quantity Value Quantity Value Quantity Value
Computer Products - - - 1,275,258,755 - - - 1,081,733,676
Other Electronics * 774,106 * 4,396,451 * 451,053 * 3,426,323
Total * 774,106 * 1,279,655,206 * 451,053 * 1,085,159,999
*Note: Difficult to categorize due to complexity of product types.

Risk Management Policies and Procedures

The Company has established the "Risk Management Guidelines" and was approved by the Board of Directors in December 2020 as the guiding principles for risk management and to facilitate the identification, analysis, evaluation and control of operational risks. The Board of Directors is responsible for establishing and overseeing the risk management structure of the Group, including the Company and important production sites. The President is responsible for the development and control of the Consolidated Companies' risk management policies and reports regularly to the Board of Directors on its operations. The most recent reporting date was December 20, 2023.

Scope of Risk Management

The main objective is to mitigate the impact of risks on the enterprise, to ensure that the operational risks of the Group are under the scope of control, to enable the Group's overall operations to focus on business growth and operational efficiency, and to help safeguard shareholders' equity.

Based on the risk events that occurred in the previous year and the opinions of external experts, the Group deliberates on the issues that may adversely affect the operations of the Company and the Consolidated Companies in the current year at the beginning of the period and use them as the basis for the overall assessment and risk ranking of operational risks in the following year. Planned risk control items then undergo proposed risk management measures after approval for overall monitoring or mitigation.

The monitoring and control tools mentioned above include, but are not limited to, the use of self-risk management as a risk control/risk retention, or risk transfer/insurance.

The Company's risk management procedures include risk identification, risk measurement, risk monitoring, risk reporting and disclosure, and risk response.

Please refer to the section "7.6 Analysis of Risk Management" and “5.6 Information Security Management” of the Quanta Computer Inc. Annual Report 2023 for details of the relevant operations.

Policies and Procedures

Quanta believes that honest operation is the way for the company's long-term development and has set a goal to establish a culture of integrity among all employees. To ensure that all Quanta employees, including directors, managers, employees, and suppliers, understand the principles of honest operation and have a shared understanding of compliance, the company has established the "Ethical Corporate Management Best Practice Principles," "Corporate Governance Best Practice Principles," "Code of Ethical Conducts," and "Procedures for Insider Trading Prevention." After being approved by the Board of Directors, these regulations can be read and queried on the Quanta Computer official website under Corporate Governance and Important Company Regulations.

In 2022, to strengthen the moral and ethical awareness of all employees, Quanta has formulated the "Policies on Ethics and Integrity," which have been announced on the website after being approved by the General Manager. The company also has an "Employee Code of Ethics," which is regularly disseminated to colleagues every year. Please refer to company website for details of the relevant operations.

All of Quanta's honest operation policies and procedures clearly indicate that the company has a zero-tolerance policy for any form of violation of business ethics, corruption, or bribery. Quanta's employees are not allowed to accept inappropriate gifts or engage in insider trading. When engaging in business activities related to the company, employees mustn't sacrifice the company's interests due to conflicts of interest with their personal interests. We are committed to respecting intellectual property rights and will not engage in business activities that violate the Fair-Trade Act or the Antitrust Act. When personal information needs to be collected for business purposes, we will also comply with the laws and regulations of each country. We pledge to disclose economic performance and business activities transparently in accordance with the law, and charitable donations will also be made based on legal requirements and publicly disclosed.

Policies and Procedures

Since 2015, Quanta has required selected suppliers to sign the "Quanta Supplier RBA Code of Conduct Compliance Statement," which requires suppliers to comply with the standards and regulations for labor, ethics, safety and health, environment, and management systems outlined in the code of conduct. We also encourage suppliers to voluntarily undergo RBA audits or to be audited by our own CSR team. This will help promote consensus and gain support from customers, suppliers, business partners, and other stakeholders involved in business transactions.

All our efforts to have suppliers sign the "Quanta Supplier RBA Code of Conduct Compliance Statement" have paid off, with all 146 targeted suppliers achieving compliance by 2023. We are proud to announce that a total of 1406 suppliers have completed this process to date. The communication ratio is 100 percent.

Execution of Ethics and Integrity

Our company has implemented many procedures to prevent conflicts of interest. First, when directors or managers engage in activities within the scope of the company's business, whether for themselves or others, they should obtain prior approval from the shareholders' meeting or the board of directors in accordance with legal requirements. This is to ensure corporate governance, strengthen supervisory functions, and enhance management capabilities, so that the board of directors and senior management can collaborate in implementing ethical business practices. Therefore, appropriate measures have been established in accordance with legal regulations for compliance. Major matters such as operational policies, investment projects, asset acquisition or disposal, lending of funds to others, and endorsement guarantees are also analyzed and executed in compliance with relevant regulations. The corresponding rights and responsibilities are reported and announced in accordance with the law. At the same time, we conduct annual self-inspection operations to ensure that we review the appropriateness and implementation of internal controls in a timely manner, taking into account organizational and environmental changes. This helps us ensure the effective implementation of internal controls.

For details of the implementation, please refer to "3.4.6 Fulfillment of Ethical Corporate Management and Deviations from the "Ethical Corporate Management Best Practice Principles for TWSE/GTSM Listed Companies" in the Quanta Computer Inc. Annual Report 2023.

The Company has established "Rules and Procedures for the Board of Directors Meeting" as a guideline for BoD operation to enforce corporate governance, to optimize organizational supervision, and to strengthen organizational management. In the event that a proposal involves conflict of interests of a director and such proposal may harm the organization's interests, the related director will follow the principle of directors' avoidance of motions in conflict of interests to protect the interests of the Company and its shareholders.For details of the implementation, please refer to "3.4.1.2.2 Execution of Directors' avoidance of motions in conflict of interests" in the Quanta Computer Inc. Annual Report 2023.

To help employees develop a deeper understanding of the Company's principles of integrity, the Company reminds all managers and employees to read the Code of Ethics and sign off as acknowledgement the code. Matters involving avoidance of interests should also be truthfully reported, and should be confirmed by supervisors at all levels whether there is any impact, and necessary preventive actions should be taken. Upon verification from the President, the annual declaration of ethics and avoidance of interests should be completed. Except for employees who are on leave or suspension during the declaration period, all governance staff and indirect personnel with computers are required to complete the interest conflict declaration within two weeks. In 2023, a total of 4,373 senior managers from the Taiwan plant (3,498), the China plant (875), and the Thailand plant (5) have completed the declaration, with a ratio of 100%. (Senior managers are defined as deputy managers to managers or above.)

Promotion and Education Training

During new employee training, each plant's new recruits receive training on the company's integrity and ethical policies and are explicitly informed that the company prohibits any form of corruption, bribery, fraud, extortion, or embezzlement of public funds. Any violation will result in strict disciplinary action or legal action. Employees are also informed of the upper limit for receiving gifts based on normal social relationships, and the handling principles when the gift value exceeds that limit. Employees are aware of the channels for anonymous or named reporting of violations of business ethics. Related regulations can also be found in the new employee handbook.

In the mandatory training courses for supervisors, such as management case studies, talent selection, goal setting, and performance management, the concept of anticorruption is integrated into the core competencies of 2B culture, such as "proactivity" and "high self-demand", through the supervisor's manual. The CSR annual training includes classroom courses and online corporate social responsibility training videos, which aim to promote and educate anti-corruption policies in Quanta.

A total of 8,211 employees in the Taiwan plant, 73,295 in the China plant, and 3,917 in the Thailand plant have received training on integrity policies, with a ratio of 100%.

Channels and Handling of Complaints

All employees should remain vigilant against any violation of the employee code of ethics. When there are concerns or discoveries of any violations of the employee code of ethics, it is the responsibility of all employees to report them to their supervisors. If necessary, they may report directly to the HR director, the internal audit manager, or through an employee complaint channel.

Employees can use the following channels on the official website to file complaints, express opinions, or make inquiries with all stakeholders at Quanta, in addition to the aforementioned channels: The Channels are as follows:

All complaints can be filed anonymously or with identification. If a reported violation involves a member of the governance level, the report will be submitted to the chairman or vice chairman, who will then assign dedicated supervisor and audit personnel to conduct an independent investigation. If the reported violation involves an ordinary employee, the audit team will investigate and provide a report to the highest-level executive in charge of the relevant area for further handling. If an employee violates the employee code of ethics, they will be punished in accordance with the relevant rules and regulations, and in serious cases, law enforcement agencies will be notified. If a supplier violates Quanta's employee code of ethics, the partnership will be suspended in accordance with the contract provisions. The annual results of these actions will be reported to the Board of Directors, including details of the investigation and improvement plans. Quanta promises to protect any stakeholder who reports any violations of the employee code of ethics and participates in the investigation process to avoid unfair retaliation or treatment.

2023 Performance Report

  • In 2023, there were 2 cases of employees involved in violations of professional ethics such as corruption, bribery, acceptance of inappropriate gifts related to their duties, insider trading, or actions conflicting with the Company's interests that resulted in punishment.
  • There were also no cases of confirmed anti-competitive behavior (including antitrust and unfair competition) or fines resulting from such behavior.
  • The rate of declaration of interest avoidance by employees in e ach site was 100%.
The two cases mentioned above involve employees who have violated professional ethics. The company has taken disciplinary actions in accordance with internal procedures and has protected its rights in accordance with legal regulations. Additionally, the company is currently reviewing and enhancing its set of control measures.

Strategies and Objectives

Information security is a crucial cornerstone for sustainable development and maintaining core competitiveness in the enterprise. At Quanta, we are committed to enhancing the overall management of information security as our goal. We have established a layered defense framework to enhance overall protection and conduct comprehensive risk monitoring. We will continue to refer to domestic and international trends, international standards, and advice from external professional consultants to allocate appropriate security budgets annually, optimize various protective control measures, strengthen education and training for all personnel, improve security awareness and response capabilities, and safeguard the company's operations and information security.

"Everyone participates, controls risks, and ensures the effective operation of the information security system to protect the normal operation of the company. " is the motto of Quanta's information security strategy.

Quanta's information and communication security policy has three objectives: "Everyone participates and controls risks", "actively prevents, continually improves," and "customer trust, sustainable operation".

  • Everyone participates and controls risks: Establishing an information security management system, determining the functions and responsibilities of information security, and managing information security comprehensively across all processes and staff. According to the characteristics of the company's information security, the requirements of laws and regulations, the risk assessment procedures are established, and the risk acceptance criteria are determined. Conducting regular risk assessment and taking appropriate measures to reduce potential risks.
  • Actively prevents, continually improves: In business operations, emphasis is placed on information security, identifying, and analyzing weaknesses and potential threats in information systems, considering the balance of costs, benefits, and risks, classifying and protecting assets, and protecting information systems at an appropriate cost.
  • Customer trust, sustainable operation: By conducting performance evaluations and continuous improvement, we ensure the effectiveness of the information security management system and achieve the goals of customer trust and sustainable business operation.

Organization

In the first quarter of 2022, the Board of Directors approved the establishment of a Cybersecurity unit and the appointment of a full-time minister. The cybersecurity unit is called the "Information Security Center" and reports directly to the general manager or his designated representative. It is responsible for convening meetings of the Proprietary Information Security Committee (PIS)。The "Information Security Center" has set up the "Information Security Management Department" and the "Information Security Technology Department", responsible for the management of cybersecurity matters within the group. This includes coordinating cybersecurity policies, international cybersecurity standards verification and auditing, implementing and verifying cybersecurity mechanisms, building layered defenses, enhancing cybersecurity levels, and aligning with international standards. The center regularly reports on relevant risks, issues, and management effectiveness.

Organization Chart

To demonstrate the company's good cybersecurity management and strengthen cross-departmental collaboration within the group, the existing PIS committee has been expanded to become the highest guidance unit for group-wide information security. Through biannual committee meetings, monthly meetings of the Information Security Center, and regular and ad hoc project meetings, various information security management policies and measures are continuously promoted. Comprehensive reviews and optimizations of information security policies and cybersecurity measures are conducted at least once a year, and the execution of information security is reported to the board of directors at least once a year. The most recent report was submitted on November 10, 2023.

Organization Chart

Information Security Promotion Goals

In order to evaluate the performance and effectiveness of the information security management system, the company has established several security indicators for the organization, personnel, processes, and technical aspects of information security, strictly examining the implementation of the cybersecurity management. All cybersecurity indicators were controlled and improved and successfully achieved in 2023.

Scroll for more
Aspects Cybersecurity KPI Handling status in 2023
Organization Regular review of the information security management system documents Achieved
Conducting risk assessments regularly Achieved
Personnel All employees sign confidentiality agreements Achieved
Receiving appropriate information security education and training in accordance with regulations Achieved
Technology No audit records that are supposed to be open but are unopened Achieved
Conducting vulnerability scans regularly Achieved
No firewall rules that have not been removed or have inappropriate permissions Achieved
The availability rate of core servers is ≧ 99.98% per month Achieved
The availability rate of the data center infrastructure is ≧99.98% per month Achieved
The availability rate of the external network is ≧95% per month Achieved
Process No unauthorized personnel have access to the production environment Achieved
No unauthorized software installation Achieved
Application system changes are all authorized Achieved
Report of cybersecurity incidents within the specified time according to regulations Achieved
Conducting regular business continuity exercises Achieved
Keeping relevant records for entering and exiting the data center and granting appropriate permissions Achieved
Conducting regular checks on system security-related settings Achieved

Quanta has established four dimensions of information security governance to achieve its vision and goals: establishing a robust security organization, implementing a multi-layered defense technology, optimizing security management processes, and nurturing high-quality security personnel. In response to the increasing security risks, Quanta continuously adjusts its information security direction based on risk management results, as well as the development of information and communication technology and external environmental changes. Quanta aims to establish consistent security standards throughout the company, strike a balance between business and security, and ensure that all employees actively participate in collaborative maintenance to meet the company's security policy requirements.

Establishing a Comprehensive Information Security Organization
Scroll for more
Aspects Direction of Promotion Short-term Focus Long-term Goals
Organization
  • Expansion of the PIS Committee
  • Centralized management of group information security
  • Promote information security risk defenses
  • Enhancing PIS Committee Functionality
  • Deploy dedicated information security personnel overseas
  • Implementing first-line self-inspection and second-line cybersecurity risk supervision.
  • PIS Committee Group Global Cross-Site Information Security Risk Communication
  • Establish an overseas information security office
  • Balancing the division of labor in information security risk management
Personnel
  • Foster Quanta's information security culture
  • Improve security awareness and recognition
  • Establish a comprehensive information security organization, construct multi-layer defense technology, optimize cybersecurity management processes and nurture high-quality cybersecurity personnel.
  • Training in the application of AI information security techniques.
  • Continuously promoting information security courses and conducting social engineering drills.
  • Cultivate a Strong Cybersecurity Culture
  • Effective Utilization of AI in Cybersecurity Technology
  • Reduce Human Errors
Technology
  • Construct multi-layer defense
  • Customer and Product Information Security Requirements
  • Group Weakness Detection
  • Establish a group incident response team
  • Introduction of AI Information Security Technology to Enhance Multi-Layered Defense Capability
  • Information security collaboration for product and customer environment setup
  • Monitor product vulnerabilities and threat intelligence
  • Security vulnerability detection and remediation tracking
  • Strengthening overall emergency response operations and improving incident response and management processes through drills and improvements
  • Promote zero trust framework
  • Proactively support, win customer trust
  • To enhance information security, it is important to strengthen the protection mechanism, establish group-wide information security standards, and simultaneously improve security measures at each location
  • Integrate incident handling resources and consolidate group information security processing capabilities
Process
  • Promotion of ISO 27001 certification work
  • Group Operation Site Information Security Audit
  • Group Information Security Risk Dashboard
  • Including Important Departments, Systems, and Overseas Bases in ISO Scope
  • Implementation of Domestic and International Operation Site Information Security Audit
  • Build an integrated management platform for multiple requirements and standards responses
  • Continuously Promoting ISO Certification, Company Implementing ISO 27001, Information Security Standards Consistency
  • Ensuring that the group's locations are compliant with cybersecurity regulations, and detect and resolve issues early
  • Real-time monitoring of overall operational risks in business, including real-time detection, implementation, and risk management

Constructing an overall information security framework

The company places great importance on maintaining information security. Since 2008, it has been insured for cybersecurity, and in 2009, it developed "Information Security Management Policies" and an "Information Security Risk Management Framework". Since 2020, it has actively aimed to obtain the ISO 27001 certification and has been working to meet the requirements for information security enhancements in 2021. The certification has been acquired in the second quarter of 2022. The main operations are as follows:

Scroll for more
Information Security Governance

Results of cybersecurity control execution

Our company conducts regular internal and external cybersecurity audits and customer audits, and no major deficiencies or incidents that caused customer or company losses have been found. We are able to respond to and control internal and external cybersecurity threats through various control measures.

Scroll for more
Results of cybersecurity control execution

To respect intellectual property rights and protect personal information and customer privacy, Quanta has established the Proprietary Information Security (PIS) Committee. In 2022, the PIS assumed greater responsibilities and, within the existing framework, was reorganized as the top-level advisory unit for group information security, overseeing and coordinating related matters. Through biannual committee meetings, we continuously promote various confidential information protection policies and measures, with the goal of ensuring that Quanta employees and the entire supply chain comply with the company's policies related to the protection of proprietary information.

Confidential Information Protection Policy

To protect proprietary information, the company has established policies and procedures such as "Patent Management Regulations," "Integrity and Ethics Policies", "Privacy Protection Management Procedures," the "Quanta Computer Personal Data Protection Act," "The Five Do Nots for Protecting Confidential Information", and security management measures at each plant. These policies and procedures disclose the company's management systems for confidential information, including intellectual property rights, personal privacy, and access control that may pose a risk to the company's confidential information. After joining the company, employees sign confidentiality agreements to clearly understand their confidentiality obligations. If a project involves proprietary information, the employees and suppliers involved will also sign a confidentiality agreement. Comprehensive policies and management systems are in place to ensure the complete protection of company and customer proprietary information. Personal data is also saved and used according to relevant management procedures.

Implementation

The company promotes and manages relevant policies through the PIS committee and reviews management policies for any necessary adjustments through regular meetings. In addition, the company undergoes periodic audits from customers to comprehensively review whether there are any deficiencies in the implementation of the company's confidential information protection measures. There have been no significant incidents of customer audits or complaints regarding violations of proprietary information protection or privacy infringement or loss of confidential information since 2023.

Filing Complaints and Management

If any matters that may endanger confidential information are found, they can be reported to the company through the Code of Ethics (Headquarters' Independent Window) . Internal colleagues can also file complaints by reporting them to their supervisors or through the channels provided by the Human Resources department. Once a complaint is received, Quanta will assign responsible personnel to handle the situation, and if a violation is confirmed, the company will take appropriate disciplinary action according to its work rules.

Education, Training, and Awareness

In 2023, a total of eight awareness campaigns were conducted. The annual training focus for the year was on information security protection measures, with a completion rate of 100%.

Achievements in 2023

  • The number of confirmed complaints related to customer privacy infringement or loss of customer data was zero.
  • The number of confirmed complaints related to personal data not being saved or used according to relevant management procedures was zero.
  • There were zero incidents of customers complaining directly to the company about violations of confidentiality obligations.