Our Focuses｜Corporate Governance｜Risk Management

  • Our Focuses
  • Corporate Governance
  • Risk Management

Corporate Governance

“Business integrity” is the foundation of the sustainable operation of the enterprise, and it is the highest corporate culture and spirit of Winbond. Winbond is committed to formulating comprehensive corporate governance regulations and management processes, and continuously monitoring and improving processes. With the efforts of all colleagues, Winbond has been ranked in the top 20% since the first TWSE Corporate Governance Evaluation. Moving forward, we will continue to embrace a corporate culture founded on business integrity, establishing a trustworthy and reputable company.

Read Chapter Report Contents
SDGs 17 Partnerships for the Goals
SDGs 13 Climate Action
SDGs 8 Decent Work and Economic Growth

First time selected for the

S&P Global Sustainability Yearbook

Investment and procurement of renewable energ reached a total

380

million kWh

Awarded the 2024 National Sustainable Development Award

National Sustainable Development Award

Risk Management
Board of Directors
Functional Committee
Business Integrity
Productivity and Business Performance
Risk Management
Green Investment
Compliance

Risk Management

Winbond belongs to the semiconductor manufacturing industry. Facing natural disasters, accidents, human-made incidents, changes in international political and economic situations, the emergence of new technologies, and changes in policies and regulations may all cause serious impacts on its operations and finances. Therefore, Winbond established a "Risk Management Committee" under the Board of Directors. This committee is one of the functional committees and organizes existing departments or units responsible for risk to enhance the overall risk management organizational structure. It formulates sound internal management regulations and operating procedures for each unit's scope of responsibility and conducts risk management.


Risk Management Committee Organizational Structure

 

*The Risk Management Team is currently led by Deputy CEO Chan, and its members include the President, Executive Vice President, Vice Presidents, Assistant Vice Presidents, and a total of 13 executive managers. The team is responsible for identifying, assessing, and implementing risk control plans across four major risk scopes and 17 specific risks. They establish both qualitative and quantitative management standards to enhance risk control practices and regularly report risk management outcomes to the Risk Management Committee. The operation status of the Risk Management Committee of the 13th Board of Directors was reported on December 19, 2025.

 

In 2023, Winbond revised the "Risk Management Committee Chapter" and formulated the "Risk Management Policy and Procedures" after receiving approval by the Board of Directors. It actively manages the four major types of risks faced by contemporary enterprises: "strategic," "operational," "financial," and "information security." It develops comprehensive plans and processes for pre-assessment, risk avoidance, loss prevention, and crisis management for various operational activities and regularly reports to the management and governance units to ensure that all corporate risk control goals are achieved. The risk management team should pay attention to the development of international and domestic risk management systems and changes in internal and external operating environments, adjust control mechanisms, report to the Risk Management Committee and the Board of Directors for approval, and enhance the effectiveness of risk management implementation. For details on the operation of the Risk Management Committee, please refer Functional Committee.

 

Winbond's internal audit department is under the Board of Directors. Select audit items and frequency based on risk assessment results. It drafts an audit plan, which, after approval by the Board of Directors, is executed to assess the operational effectiveness of the internal control system. Audit reports are prepared accordingly, and follow-up reports on findings and recommendations are regularly submitted until all findings are resolved. To ensure that relevant units have taken timely and appropriate corrective actions, continuously enhancing the effectiveness of the risk management mechanism.


Internal audit department also ensures that all departments and subsidiaries regularly conduct self-assessments of the implementation of the internal control system. Risk management factors are incorporated into the annual internal control effectiveness verification process to conduct audits on organizational operations and risk management. 2024 self-assessment of the internal control systems and the audit tasks of the internal audit department were completed in January 2025.
 

 

4 Scope of Risk Management

Winbond Risk Management Policy and Procedures

 includes but not limit to: ❶ Risk management objectives. ❷ Risk management organizational structure and responsibilities. ❸ Risk management procedures.

Winbond Risk Management Objectives

Winbond aims to manage various risks that may impact the achievement of company goals through a comprehensive risk management framework. By integrating risk management into operational activities and daily management processes, Winbond aims to achieve the following objectives: ❶ Achieve company goals. ❷ Enhance management efficiency. ❸ Provide reliable information. ❹ Allocate resources effectively.

 

Risk Management Procedures

Winbond's risk management procedures include at least five elements: risk identification, risk analysis, risk assessment, risk response, and supervision and review mechanism. The specific procedures and methods for each element are as follows:

 
 
Risk Identification
 
 
Risk Analysis
 
 
Risk Assessment
 
 
Risk Response
 
 
Supervision
and Review

 

1. Risk Identification

  • Each functional unit and subsidiary should identify the risks of the short-, mid-, and long-term objectives and the business operations based on the company's risk management policies and procedures.

  • Various feasible analysis tools and methods (such as process analysis, scenario analysis, questionnaire surveys, PESTLE analysis, etc.) should be used for risk identification. Risks should be analyzed from both top-down and bottom-up perspectives, considering internal and external risk factors, stakeholder concerns, etc., to comprehensively identify potential risk events that may affect the company's goals or cause losses or adverse impacts.

     

2. Risk Analysis

Each functional unit and subsidiary should analyze the probability and impact of identified risks based on existing control measures, past experiences, industry cases, etc., and calculate the risk value accordingly. 

  • Risk Analysis Measurement Standards: 
    • The risk management team should establish appropriate quantitative or qualitative measurement standards based on the company's risk characteristics as the basis for risk analysis.
    • Qualitative measurement standards refer to expressing the probability and impact of risk events through textual descriptions, while quantitative measurement standards refer to expressing the probability and impact of risk events through specific measurable numerical indicators (such as days, percentages, amounts,
      numbers, etc.).
  • Risk Appetite:
    • The risk management team should develop risk appetite (risk tolerance) and report it to the Risk Management Committee and the Board of Directors for determining the company's acceptable risk threshold. Based on the risk appetite, the risk management team should discuss the corresponding risk levels for each risk value and the response methods for each risk level, serving as the basis for subsequent risk assessment and risk response.

 

3. Risk Assessment

  • Each functional unit and subsidiary should, based on the results of risk analysis, align with the risk appetite approved by the Risk Management Committee and the Board of Directors. They should then plan and execute subsequent risk response measures according to the risk levels.
  • The relevant results of risk analysis and assessment should be accurately documented and reported to the Risk Management Committee.

 

4. Risk Response

  • After assessing business risks, each unit should propose appropriate risk response measures and control operations and report them to the risk management team for review.

 

5. Supervision and Review

  • The risk management team should regularly report the implementation results of risk management procedures to the Risk Management Committee as a reference, and report major risk events to the Risk Management Committee and the Board of Directors, as necessary.

 

In addition, Winbond has incorporated climate change risks into its long-term business operations management. To understand the impact on the environment and operations, Winbond has adopted the Task Force on Climate-related Financial Disclosures (TCFD) framework since 2021. Observing international regulatory trends and market developments, Winbond annually identifies and discloses the financial impacts of climate-related risks and opportunities (including quantitative and qualitative aspects), and proposes review and management strategies. Winbond will continue to monitor the risk impacts brought by climate and strengthen the company's operational capabilities, promote various carbon reduction projects, improve energy efficiency, and steadily move towards sustainable development. In 2024, Winbond also adopted the LEAP methodology of the Taskforce on Nature-related Financial Disclosures (TNFD), organized a cross-departmental working group to identify nature dependencies and impacts, introduced TNFD disclosure guidelines, and published the "2024 Climate and Nature Report". Please refer to Climate Change Management for detailed information.

Risk Analysis Table

Strategic Risks

 

Operational Risks

 

Financial Risks

 

Information Security Risks

 
Risk TypeImpact AssessmentMitigation Measures

Geopolitical conflict risk

  • Heightened tensions between the U.S. and China and cross-strait instability have increased uncertainty for Taiwan’s semiconductor sector. As trade frictions and technology competition escalate, Taiwan has become a focal point for both countries, and cross-strait security has become a key concern for global enterprises. Many international companies are closely monitoring the stability of Taiwan’s supply chain; political uncertainty could disrupt semiconductor production in Taiwan.
  • Against this evolving geopolitical backdrop, Winbond needs to consider a more global footprint and strengthen risk management and contingency capabilities to remain competitive in future market dynamics.
  • Identify wafer foundry and assembly/testing sites outside Taiwan and Mainland China, and establish strategic partnerships to reduce the concentration of manufacturing in Taiwan.
  • Monitor policy directions across jurisdictions and implement localization strategies, including localized product development and manufacturing.
  • Establish a secondary warehousing and distribution center in Southeast Asia to diversify logistics concentration in Taiwan and provide customers with additional response time.
  • Proactively cultivate local suppliers to build shorter, more resilient supply chains.

Technological change

  • Rapid advances in semiconductor technologies and AI applications could widen competitive gaps if the Company falls behind in technological development.
  • The threat landscape for cybersecurity has continued to evolve; disruptions to core systems could lead to operational interruptions and reputational risks.
  • Insufficient progress in digital transformation could reduce R&D and manufacturing efficiency and amplify cost pressures.
  • Advance process and product innovation milestones (e.g., progress in advanced-node DRAM/Flash and Secure Flash adoption of PQC).
  • Modernize and platform core systems through stronger governance to enhance stability, availability, and controllability.
  • Promote Group-wide digital and AI empowerment training, including AI certification and an internal expert network, to accelerate adoption and deployment.
  • Strengthen information security governance and expand ISO 27001 certification coverage to critical production systems to reduce the risk of major information security incidents.
  • Apply AI and automation in manufacturing processes (e.g., yield/defect analysis and automated reporting) to improve process stability.

Product strategy and technology roadmap risk

  • If the Company is unable to effectively execute a customer-centric product strategy and continuously launch upgraded products, application-customized products, and innovative products integrating heterogeneous memory in line with the product roadmap, competitiveness with leading customers and in emerging application markets may weaken.
  • If customer needs are not deeply understood and products with innovative features and superior specifications are not delivered, customer stickiness may decline. Customers may shift to competitors, affecting order sources and long-term partnerships. This could also delay entry into emerging application markets, reduce the effectiveness of R&D and market investments, and negatively affect overall operating performance.
  • Adhere to a customer-centric product strategy and execute the product roadmap by launching product upgrades, application-customized products, and innovative products integrating new technologies and heterogeneous memory to expand business with leading customers, target customers, and emerging applications.
  • Deepen customer insight and deliver innovative features and superior specifications to strengthen customer stickiness based on required capabilities and specifications.

Climate change

  • More frequent extreme weather could increase risks related to water shortages, heat stress, and disasters, potentially constraining production and disrupting supply.
  • Tightening carbon fee/carbon tax regimes and disclosure requirements could increase energy and carbon costs and weaken competitiveness.
  • Customers and financial institutions have raised expectations for decarbonization performance; failure to meet targets could affect order intake and financing terms.
  • The Group has obtained SBTi validation of science-based targets, institutionalizing the decarbonization pathway within governance and tracking mechanisms.
  • All manufacturing fabs achieved UL 2799 Zero Waste to Landfill certification at the highest Platinum level, reducing environmental impacts and operational risks.
  • Increase renewable energy usage and investment deployment to strengthen power resilience and reduce Scope 2 emissions.
  • Implement energy-saving initiatives and process optimization to improve energy efficiency and reduce exposure to carbon costs.
  • Strengthen water stewardship (e.g., water recycling and reuse, alternative water sources, and efficiency management) to reduce the risk of production stoppages from water constraints.
  • Expand climate scenario analysis to subsidiaries and the supply chain, and enhance disclosure quality in alignment with IFRS S2.
Risk TypeImpact AssessmentMitigation Measures

Operational planning and execution

  • Disaster risk: Semiconductor fabs rely on highly precise equipment and cleanroom production, require stable water and power supplies, use costly equipment with long lead times, and are therefore highly sensitive to disasters such as fires, earthquakes, water shortages, and power outages. Semiconductor processes also use multiple flammable gases and chemicals. Taiwan’s seismic conditions and persistent concerns over power and water supply further elevate hazard factors. If such disasters occur, they may cause major damage to buildings and equipment and lead to business interruption; supply disruptions may also result in customer loss.
  • Fire: Establish fire compartments; use non-combustible materials for buildings and equipment as far as practicable; deploy automatic fire protection systems in accordance with international property insurance standards; conduct regular ERT training and drills; and perform periodic maintenance and testing of fire protection systems as planned. In 2025, emergency drills covered scenarios including earthquakes, fires, gas leaks, chemical spills, and earthquake evacuation drills, totaling 229 drill sessions for both employees and non-employees.
  • Earthquake: Apply seismic building design, implement vibration-resistant anchoring for tools, and maintain spare parts inventory.
  • Power outage: Deploy emergency generators and uninterruptible power supply (UPS) systems, and perform periodic maintenance and testing as planned.
  • Water shortage: Maintain backup water storage and continue implementing process water-saving measures.

Product quality management

  • Quality risk: Product failures during customer use may reduce customer satisfaction and damage corporate reputation.
  • Promote Quality Excellence 2.0 (“Do it right the first time,” “precise description,” and “improving customer satisfaction”) to strengthen quality culture and reduce defect rates.
  • In 2025, Winbond (Taiwan) received one Gold, three Silver, and one Bronze awards at the Taiwan Continuous Improvement Awards (TCIA). Award-winning projects covered key topics including yield improvement, defect reduction, and operational decarbonization.

Environment, health and safety

  • Water stewardship: Failure to meet park discharge control standards may result in additional sewerage system usage fees.
  • Install multiple continuous monitoring instruments at effluent discharge points; set stricter internal limits based on discharge control standards and establish recirculation mechanisms.
  • Engage external laboratories to conduct periodic sampling and testing to ensure monitoring effectiveness.
  • In 2025, total water withdrawal at Winbond’s manufacturing fabs was approximately 4,432 megaliters. Water intensity was 143 liters per mask layer. Compared with 2024’s average of 147 liters per mask layer, unit water intensity decreased by approximately 2.7% year-on-year. Winbond will continue to optimize reclaimed water systems and enhance water-use efficiency.
  • Circularity: If opportunities to reuse, recycle, or reduce waste are not continuously pursued, disposal costs may continue to rise.
  • Reduce fab waste generation by minimizing waste, reusing materials where feasible, and increasing recycling rates.
  • Mid- to long-term target: Achieve an annual waste recycling rate of 90% or above at Taiwan fabs by 2030.
  • Major occupational injuries and occupational diseases could affect production continuity.
  • Under EHS management system procedures, Winbond strengthened workplace safety through semiannual internal audits, reviews and updates, and annual external audits and oversight. This approach reduced potential risk factors and supported continuous improvement.In 2025, no occupational disease incidents occurred due to chemical or physical exposure.

Supply chain management

  • Supply chain disruption risk: Suppliers may face increased costs or supply interruptions due to raw material availability, political disruptions, natural disasters, transportation, or other factors. Supply interruptions or delays could postpone shipments, prevent meeting customer lead-time requirements, and result in penalties and reputational damage.
  • Increase internal inventory levels for key raw materials assessed as high risk.
  • Add second or third sources to reduce single-source dependence and constraints.
  • Increase localization to reduce cross-border transportation risks and costs. In 2025, local procurement ratios were 37.3% for Winbond (Taiwan), 30.3% for Nuvoton (Taiwan), and 43.7% for Nuvoton (Japan), each remaining above 30%. Looking ahead, Winbond will continue multi-sourcing for key raw materials, strategically expand localized procurement to production equipment, critical spare parts and components, and evaluate localization feasibility across supply resources to build a more flexible and reliable supply chain system.
  • Enhance digital system development and performance to enable real-time monitoring, early detection, and timely resolution of potential issues.

Global sales & marketing operations risk

As the global semiconductor market changes rapidly, inadequate scale, language capability, or technical familiarity within regional sales locations or Marketing teams could lead to:

  • Delayed customer response: Inability to promptly capture customers’ product roadmaps, lead times, and specification changes, resulting in lost orders.
  • Technical communication gaps: Insufficient Marketing technical capability relative to customers’ application needs could lower product adoption success rates.
  • Regional competitive disadvantage: If competitors maintain stronger FAE/marketing networks locally, Winbond’s visibility in emerging markets could decline.
  • Establish a global customer relationship management (CRM) and market intelligence mechanism.
  • Strengthen regional marketing technical capability (tech-enabled marketing) and set dual-site backup coverage for high-risk countries (e.g., cross-support between responsible sales regions).
  • Adopt a “regional + standardization” risk management model.
  • Strengthen global talent hiring, retention, and cross-border succession planning.

Intellectual property (IP) management

Risks of increased royalty expenses and reputational impact:

  • Competitors may initiate IP claims or litigation against Winbond.
  • Non-Practicing Entities (NPEs) may initiate IP claims/litigation against Winbond.
  • Misappropriation of Winbond’s business secrets by competitors could weaken competitiveness.
  • Encourage and support employees in generating high-value patents.
  • Reinforce awareness of the importance of business secrets and Winbond’s protection measures.
  • Winbond (Taiwan) and Nuvoton (Taiwan) obtained TIPS A-level certification, demonstrating maturity in institutionalized IP governance.

 

Risk TypeImpact AssessmentMitigation Measures

Financial operations

  • Foreign exchange risk: Exchange rate fluctuations during the settlement period for foreign-currency import/export receipts and payments may affect final settlement amounts and create foreign exchange gains or losses.
  • Apply natural hedging by balancing foreign-currency assets and liabilities to reduce net exposure volatility.
  • Use spot or forward FX contracts as needed to mitigate the impact of short-term exchange rate movements on profit or loss.
  • Interest rate risk: Changes in market interest rates may affect borrowing interest expenses and returns on interest-bearing financial assets, resulting in volatility in finance costs and profit or loss.
  • Optimize debt tenor and fixed/floating rate structure to reduce interest-rate impacts on cash flows.
  • Use a placement logic combining time deposits and demand deposits to balance yield and liquidity.

Investment management

  • Investment risk: Strategic and financial investments may face uncertainty in investment returns and impairment risks due to market and valuation fluctuations.
  • If investment deployment is not aligned with mid- to long-term strategy, capital occupation may increase and reduce resource allocation flexibility.
  • Implement rigorous investment decision-making processes, including pre-investment benefit and risk assessments, to reduce decision bias.
  • Conduct regular post-investment monitoring of investee operations and valuation changes to identify impairment indicators early and take management actions.
  • Allocate resources through sustainability strategy-oriented investment themes, including renewable energy investment planning and evaluation of green energy opportunities.
  • Use Board-approved renewable energy investment planning as a governance constraint to ensure major investments align with risk appetite.

Capital management

  • Funds management risk primarily arises from financing decision bias, which may create significant funding shortfalls and lead to credit risk such as the inability to repay borrowings or interest on time.
  • Use Sustainability-Linked Loans to link financing terms with ESG performance, reducing financing costs and strengthening funding access resilience; in 2025, interest expenses decreased by NT$4.28 million.
  • Establish internal periodic tracking and management mechanisms to monitor the achievement of sustainability indicators and feed performance results back into credit terms and fund drawdown arrangements.
  • Participate in sustainable finance through sustainable fixed deposits, with maturities of at least three months, to enhance the stability of cash deployment and support the use of proceeds for green financing purposes.
Risk TypeImpact AssessmentMitigation Measures

Information management

  • Information management risk arises from vulnerabilities and threats across each stage of the data lifecycle, potentially leading to data leakage, compromised data integrity, and reduced data availability. These risks may further result in legal liabilities, financial losses, reputational damage, and reduced competitiveness.
  • People: Provide regular data security awareness training and strengthen employee behavior monitoring. In 2025, information security training reached more than 8,500 participant-times and included 13 information security awareness campaigns throughout the year.
  • Technology: Build multi-layer protection, apply data encryption, implement access control mechanisms, and conduct regular vulnerability scans.
  • Process: Classify and grade data based on purpose, sensitivity, and criticality; store data in different network segments and apply corresponding protection and control measures.

Cybersecurity protection

  • Cybersecurity protection risk originates from external threats (e.g., cyberattacks, malware, supply chain attacks) and internal threats (e.g., human error, malicious behavior, system vulnerabilities). These threats may cause system outages, service interruptions, data corruption, or data theft, resulting in financial losses, legal liabilities, reputational damage, and reduced competitiveness.
  • People: Provide cybersecurity training for all employees, strengthen phishing prevention, and reinforce incident reporting and response.
  • Technology: Enhance system protection, apply security patches, deploy firewalls and intrusion detection, and adopt multi-factor authentication.
  • Process: Establish an information security management system, maintain ISO 27001 certification, and conduct regular security testing.

Data privacy and security

  • Data privacy and security risk stems from failures or improper use in protecting customer privacy, employee personal data, and business secrets (including intellectual property rights) during operations. These risks may lead to leakage or theft of sensitive information and trigger lawsuits arising from privacy regulations and product liability laws, financial penalties, loss of customer trust, and reputational and competitive impacts.
  • Policies and standards: Strictly comply with Winbond’s Privacy Policy and implement the principle that customer data will not be used for secondary purposes. Maintain ISO 27001 information security management system certification and use systematic management and technical controls to protect information assets and business secrets.
  • Oversight and response: Convene annual information security meetings to review management performance. Establish a robust incident reporting process; upon notification, promptly assess scope and severity, isolate affected systems, and formulate countermeasures.

AI applications

  • AI application risk spans technology, operations, governance, compliance, ethics, and strategy. It may lead to unstable model performance, security incidents, decision errors, resource waste, and stalled transformation progress, resulting in financial losses, reputational damage, and reduced competitiveness.
  • Training: Provide professional training for AI developers and users to strengthen awareness of decision risk, privacy protection, and governance risk.
  • Data management: Strengthen data quality controls to ensure accuracy and integrity.
  • Risk assessment: Conduct comprehensive risk assessments and reviews throughout AI system development and deployment.

Emerging Risks

 

Risk TypeRisk DescriptionPotential ImpactsMitigation Measures
 
 
 
 
New forms of AI-enabled cybersecurity risk under smart manufacturing
  • As Winbond advances smart manufacturing and process automation, adversarial-AI-driven cybersecurity risks have become an emerging area of concern for core assets, including proprietary memory IP and the fab operational technology (OT) environment. This risk mainly arises from malicious actors using AI to increase attack sophistication and bypass existing protections.
  • Generative AI may be used to plan targeted attacks to steal critical business secrets (e.g., circuit designs) or manipulate AI models supporting fab automation through data poisoning. In highly automated manufacturing environments, inadequate management could result in abnormal equipment operations, physical asset damage, or yield degradation that is difficult to detect in time, weakening operational stability.
  • Risk of theft and replication of intellectual property: AI-driven espionage activities may accelerate leakage of critical process and technology know-how accumulated by Winbond in niche DRAM/Flash, allowing competitors to replicate products more quickly and eroding Winbond’s technology moat.
  • Risk of smart fab operational disruption: If management systems used in fabs involve AI components, adversarial attacks may cause physical logistics disorder or safety incidents, disrupting stable line operations and leading to production interruptions and major operational impacts.
  • Customer trust and brand reputation risk: If AI-related factors prevent timely detection of process or quality defects and defective chips reach customers, subsequent liabilities and reputational damage could be severe and long-lasting.
  • Winbond implemented dedicated equipment- and network-level cybersecurity management mechanisms for wafer fab operational technology (OT) and aligned its practices with the SEMI E187 semiconductor equipment cybersecurity standard. The Company enforced network segmentation and protection between IT systems and manufacturing equipment networks to mitigate the impact of cybersecurity incidents on stable production line operations.
  • Winbond established a governance framework for AI adoption and digital transformation and, through institutionalized management mechanisms and personnel training, ensured that AI applications in operations and process optimization operated in a controlled and reliable manner within the existing internal control framework.
 
 
 
 
Product manufacturing and compliance risks under the spillover effects of geopolitical tensions
  • As an IDM manufacturer headquartered in Taiwan and focused on niche DRAM and NOR Flash products, Winbond is not a primary target of sanctions related to advanced process technologies or AI semiconductors amid the U.S.–China technology conflict. However, as a memory manufacturer with in-house wafer fabrication capabilities, Winbond is inevitably affected by the spillover effects of geopolitics and the restructuring of the global supply chain.
  • Compared with fabless IC design peers, Winbond continues to rely on critical lithography, etching, and related process equipment provided by suppliers from the United States, Japan, and Europe to sustain its mature and cost-competitive process nodes (such as 25nm and 20nm, with a gradual transition toward 16nm). As the global semiconductor industry moves toward “semiconductor sovereignty” and “de-risking,” standards and compliance requirements are becoming increasingly fragmented. In particular, automotive and industrial customers in Europe and the United States place growing emphasis on supply chain transparency, regulatory compliance, and geopolitical risk management. At the same time, Winbond remains deeply engaged in consumer electronics and communications markets in Greater China, creating operational balancing challenges under a diversified market structure.
  • Against this backdrop, Winbond continues to address an increasingly complex export control and compliance landscape and prudently manage potential policy risks to ensure that future capacity expansion and process upgrade plans, including those at the Kaohsiung Fab, can maintain operational flexibility and long-term competitiveness while remaining compliant with applicable regulations.
  • Constraints on the technology roadmap: As export controls on semiconductor manufacturing equipment (WFE) became increasingly stringent, Winbond’s flexibility to advance toward more advanced process nodes (e.g., below 20 nanometers) may be constrained. Any delay or obstruction in process upgrades would have directly affected the cost structure and technological competitiveness of its core products relative to competitors not subject to similar restrictions.
  • Risks of market segmentation and revenue volatility: Supply chain “decoupling” trends may compel Winbond to maintain parallel “red” and “non-red” supply chain systems, increasing operational complexity and reducing overall efficiency. In practice, the loss of distribution channels with key Chinese module makers due to manufacturing origin or geopolitical concerns, or restrictions imposed by Tier-1 automotive suppliers in Europe and the United States, could result in significant impacts on revenue performance.
  • Amplified risks inherent in the IDM operating model: As a capital-intensive IDM centered on owned wafer fabs, Winbond was highly sensitive to the stability of supplies of critical spare parts and electronic-grade chemicals, which were often concentrated in specific geographic regions. Any supply disruption could immediately affect capacity utilization and, given the high fixed depreciation costs, exert greater pressure on profitability compared with fabless competitors (pure IC design companies).
  • Strategic localization and multi-sourcing: Winbond actively increased the proportion of local procurement in Taiwan to mitigate cross-border logistics risks and the impact of geopolitical tariffs. For critical semiconductor materials that were difficult to localize (such as photoresists and specialty gases), Winbond implemented a stringent second-source policy by qualifying suppliers from geopolitically neutral regions to avoid reliance on any single country.
  • Strategic inventory buffers: For critical spare parts and raw materials, Winbond shifted from a “Just-in-Time (JIT)” model to a “Just-in-Case” approach. The Company maintained higher safety stock levels for items identified as high risk in geopolitical assessments.
  • Export control compliance systems: Winbond established a dedicated trade compliance team to monitor evolving entity lists (U.S./China). The Company used digital supply chain management tools to screen customers and end users to ensure that products did not inadvertently flow to restricted entities, thereby safeguarding Winbond’s access to Western technologies and markets.
  • In-house technological autonomy: Winbond strengthened internal R&D in process integration to reduce reliance on external IP licenses that could be subject to future sanctions.

Establishing a Risk Culture

Aspect of Risk CultureImplementation Status
Risk Management Training for Non-Executive DirectorsWinbond continuously promotes diverse training programs for non-executive directors to enhance their understanding and response capabilities regarding current risk management trends and practical applications. The courses cover topics such as geopolitical risks, compliance and internal controls, information security, sustainable finance, supply chain management, and climate change, and are hosted by external professional institutions. Through systematic training, directors are equipped to grasp the latest trends and challenges, thereby improving decision-making quality and oversight effectiveness in corporate sustainability and risk control.
Risk Management Training for EmployeesTo strengthen employees’ awareness and response capabilities in risk management, Winbond continuously promotes diverse and systematic training programs. Topics include information security, occupational safety and health, internal auditing, environmental risks, natural disaster response, and business continuity management. Real-world cases are incorporated to enhance employees’ ability to identify and manage risks. All full-time employees are required to complete training on information security risks, ethical conduct, and quality management. Specialized courses are also arranged for different functions and departments, such as fire and earthquake response training for manufacturing units, and climate risk and natural capital dependency analysis courses designed for ESG and TCFD disclosure. 
Standardized Implementation of Risk Management in Core BusinessWinbond has established rigorous and standardized risk management procedures across all stages—from new technology or product evaluation, process development, to mass production—to ensure effective risk prevention and control. During the evaluation phase, aspects such as market demand, profitability, technological advantages, IP, and environmental sustainability are comprehensively considered, with potential risks included in the assessment. Development only begins after approval by the General Manager. During process development, teams follow the “New Process Control Procedure” and apply FMEA (Failure Mode and Effects Analysis) to identify and prevent risks, ensuring research outcomes are not compromised. In the mass production phase, adjustments to processes, equipment, and materials undergo FMEA risk assessment and require approval from the PCRB (Process Change Review Board) before implementation. This standardized process ensures product quality and stability, enhancing the company’s competitiveness.
Linking Risk Management Performance to IncentivesWinbond actively integrates risk management with its employee reward system. Through mechanisms such as “Winbond Star,” operational performance bonuses, employee profit sharing, and employee stock ownership trusts, the company closely links employee and managerial rewards to risk management performance and achievement of performance goals. This strengthens accountability culture and risk awareness, promoting the realization of both individual and corporate performance objectives. Employee performance evaluations are tied to the company’s key performance indicators (KPIs), with ESG included as one of the assessment items. By rewarding effective risk control behaviors, employees are encouraged to jointly achieve business performance and ESG-related KPI targets.