E
Environmental Sustainability
S
Social Prosperity
G
Corporate Governance

Risk Management

Safety is the core value of China Airlines and our absolute commitment to customers.

Risk Management

CAL regularly reviews its risk management governance, structure, and processes, adopting a three lines of defense model: the first line (operational units) manages day-to-day risks; the second line (risk management and compliance units) sets standards and monitors compliance; and the third line (independent audit unit) audits and provides recommendations to ensure alignment with the Company’s risk appetite and objectives. This structure clearly defines responsibilities and ensures systematic and structured risk management.

CAL has established a dedicated Sustainability and Risk Management Committee under the Board of Directors, which convenes regularly. The Sustainability and Risk Management Committee assists the Board quarterly in reviewing the formulation, implementation outcomes, and response measures of the company’s risk management strategies. It also requires the responsible units to manage each major category of risk. The Auditor General is the highest risk auditor to assist the Board of Directors in reviewing the Company's risk management strategies, implementation results, and countermeasures, and to require each unit to be responsible for the control of each major type of risk, and the independent audit unit (third line of defense) closely monitors or even assists in advising on all the processes of risk management. Audits of the main risks are carried out annually, depending on their significance and the status of the response. The Risk Management Committee is independent of the business units and is responsible for the promotion of risk management processes and quarterly review of risk tracking implementation status. The responsible supervisor is responsible for the preparation of risk response measures and the actual implementation of risk items. The senior vice president of flight operations, who is the head of the Risk Management Committee, is the highest risk management responsible person (second line of defense), who integrates and supervises all business units in the implementation of the risk management policy promotion of all aspects, and regularly reports to the Corporate Sustainability Committee (chaired by the President) on the results of the control of the different operational risk responsible units (first line of defense).

The Board of Directors serves as the highest governance body for risk management. The Sustainability and Risk Management Committee is composed of directors and independent directors, with an independent director serving as convener and more than half of the members being independent directors. In addition to directly overseeing traditional risks including safety, operational, financial, cybersecurity, and personal data protection risks as well as medium- and long-term strategic risks through the Sustainability and Risk Management Committee, CAL also supervises medium- and long-term strategic risks (including environmental and emerging risks) through the Corporate Sustainability Committee’s Risk Management Team.

Some directors of the Company possess extensive experience in risk management–related industries, including expertise in operational and financial risk management. To continuously strengthen the Board’s risk management capabilities, the Company annually engages external experts and academics to provide directors with six hours of professional training. In May and August 2025, directors attended training sessions entitled “Current Global Economic Conditions and the Implications of the Trump Administration's New Policies” and “Trends in Sustainability Risk Management and Disclosure (Including Anti-Corruption)”. A total of 12 directors participated in the training programs, achieving a participation rate of 80%.

Director Risk management related experience (including operational and financial risk)
Chen, Chih-Yuan Since the late 1990s, he has held several prominent positions, including Director of Wan Hai Lines, Chairman of Yi Chun Express, President of Wan Hai Japan, Director of Wan Hai Shipping Singapore, Chief Executive Officer of New Sincere Transportation, and General Manager of New Speed Transportation. Additionally, he has served as Vice Chairman of TACT for an extended period and is the longest-serving Director of CAL. He has the extensive experience in land, sea, and air transportation necessary to direct all essential operations of the Company in accordance with the Group's risk and crisis management policies.
He has served as chairman, vice chairman, and director for several publicly listed companies in Taiwan and Singapore in industries such as property insurance, semiconductors, optoelectronics, paper, venture capital, and tourism hotels. He has also been invited to serve as one of the few foreign independent directors for a Singaporean government-owned enterprise. He has extensive involvement across various industries and possesses comprehensive capabilities and experience in risk management.
Ting, Kwang-Hung He is currently the Chairman of Phu Yung An Corporation and the President of Phu My Hung Holdings Group. He has accumulated 27 years of industrial operation and risk management practice and experience, including industrial strategy, operation (including data security), finance (including climate change), market (including finance) and legal affairs. In 2017, on behalf of Taiwan enterprises, he shared with the international community his successful experience in building infrastructure, power plants, processing and export zones, and townships in Vietnam at APEC. He was also appointed as a visiting professor at the College of Management of National Taiwan Normal University to cultivate industrial elites.
Chen, Maun-Jen Everpar Enterprise Corp., which he founded, is one of the nation's leading companies in environmental protection, mobility pollution prevention management, planning, and legislation, consistently ranking first in the industry in terms of scale and reputation.
Particularly, the company has established a high-quality corporate culture characterized by internal harmony and external integrity, ensuring quality control for government administration. It directly supervises and manages business development, market planning, and channel management. At the same time, it is also responsible for overseeing risk assessment, hedging action planning, and execution in the aforementioned operational areas. The Company operates steadily and has invested in the largest domestic vehicle testing centers to conduct quality testing for domestic automobile manufacturers and import car dealers. It is the most authoritative certification for testing quality in the country and is also the largest vehicle testing company domestically.

Risk Governance and Structure of CAL


Assist the Board of Directors in reviewing the risk management strategies of the Company at group level Responsible for reviewing the Company’s risk control hierarchy and managing the operational risk of all business units Highest Governance Body Risk Supervision Risk Control Oversee, direct and audit key risks Oversee/Direct Oversee/Direct Report on a regular basis Oversee/Direct Report on a regular basis Report on a regular basis Report on risk control results for each unit of authority and responsibility Review the implementation of risk tracking Report on the status of risk control and policy implementation Risk Management Sustainability & Risk Management Committee Corporate Safety Office Finance Division Information Security And Personal Data Protection Division Information Management Division Corporate Development Office Corporate Sustainability Committee Corporate Safety Committee Information Security And Personal Data Protection Committee Corporate Environmental Committee General Audit Office Risk Management Team Board of Directors

Enterprise Risk Management Model and Procedure

CCAL’s risk management framework is primarily based on Enterprise Risk Management (ERM) principles, with reference to ISO 31000 guidelines, to ensure the accurate identification, measurement, supervision, and control of risks. CAL adopts a multi-level structure to manage overall risks while emphasizing inter-risk correlations to reduce potential impacts and support sustainable operations. Risk management follows the principle of materiality, identifying both traditional and mid- to long-term strategic risks. CAL assesses the potential impact of risk events and formulates contingency plans through four key steps: event identification, risk analysis, risk assessment, and risk control. These are regularly reviewed at quarterly meetings of the Board’s Sustainability & Risk Management Committee and the Corporate Sustainability Committee.

Materiality analysis results are integrated into the risk management mechanism, ensuring that the interconnections between traditional risks, strategic risks, and sustainability issues are addressed. This process helps incorporate potential impacts on the economy, environment, and people (including human rights) into enterprise risk identification and control. In 2025, CAL identified three key sustainability risks:

  • Rising costs of low-carbon transition,(related to the materiality assessment of Fleet Development and Innovation, driven by increasingly stringent regulations and decarbonization requirements, resulting in increased operating costs).
  • Inadequate maintenance quality and safety management,(related to the materiality assessment of Flight Safety Management, representing a critical operational risk affecting personnel safety and operational performance).
  • Improper customer information management and cybersecurity protection.(related to the materiality assessment of Information Security, posing significant operational and compliance risks to data protection and system stability).

The results of the materiality assessment are integrated into CAL’s risk management process, and these risks are rigorously monitored and managed through established objectives, action plans, and corresponding mitigation measures.

Risk Definitions 01 Traditional Risks Mid-term/Long-term Strategic Risks Emerging Risks Environmental Risks Corporate Development Office Corporate Development Office Safety Risks Business Risks Financial Risks Information Security & Personal Data Risks Corporate Safety Office Corporate Development Office Finance Division Information Management Division Data Security & Personal Information Management Division
Traditional Risks Results of the Materiality Analysis of Sustainability Issues The Sustainability & Risk Management Committee supervises cross- sectional traditional risk and reports to the Board Each working group of the Corporate Sustainability Committee identifies the material themes, evaluates the correlation with traditional risks and mid-term / long-term strategic risks, and presents them to the Corporate Sustainability Committee. The Corporate Sustainability Committee and Board of Directors Sustainability & Risk Management Committee supervise strategic risk and reports to the Board Mid-term / Long-term Strategic Risks 02 Risk Identification & Correlation Bottom-up Risk Identification Top-down Risk Identification Identifying the most impact risk incorporate governance level and confirming the risk correlation Identifying the most impact risk incorporate governance level and confirming the risk correlation

Traditional Risks

Traditional risks refer to short-term risk incidents that have an impact on business operations for less than one year. Traditional risks are divided into safety, operational, financial, personal information, and information security, and are managed with the goals of mitigating risks, strengthening resilience to crises, protecting stakeholders’ interests, and enhancing corporate sustainability.

Safety and Security Risk Management

Safety is the foundation of the aviation industry. Customer trust can only be earned by having an outstanding record of flight safety. Based on the Safety Management System (SMS) and the procedures for safety risk management, the Corporate Safety Office reviews and evaluates internal and external operational risks with respect to flight operations, maintenance, cabin services, and ground operations, then proposes corrective measures.

Business Operational Risk Management

The Corporate Development Office analyzes potential events that may affect CAL 's operations and proposes specific response plans to mitigate the impact on our strategic execution direction and annual business plan. For instance, when CAL undertakes the preparation for deploying a new terminal, relevant departments must adhere to operational procedures, conduct risk assessments, and incorporate risk standards into the development of products and services to ensure that new terminal operations comply with civil aviation regulations and Company standards.

Financial Risk Management

An unexpected turn of events in the economic and financial world, both at home and abroad, can affect a company’s operating results. In particular, interest rates, exchange rates, inflation, and fuel represent the principal costs for airlines; these costs are very sensitive to trends in the international economy and can become quite volatile. Therefore, the Finance Division employs financial hedging instruments to confine the major costs listed above to preset limits and to monitor financial risks on a regular basis. The Division is also responsible for developing relevant strategies and measures to fulfill the objectives of finance-related risk management.

Information Security and Personal Data Risk Management

In accordance with international standards, CAL has strengthened information security and personal data protection by implementing classification management, response mechanisms, and regular drills to reduce risks and enhance overall protection capabilities.

Mid-term / Long-term Strategic Risks

Mid-term/long-term strategic risks refer to risk incidents that have a strategic or structural impact on business operations for more than one year, and which cannot be solved in a short period of time. CAL reviews and analyzes its market position and collects industry information, such as internal and external forecasts on market trends and competitor dynamics, every three to five years, then conducts SWOT analysis, and accordingly develops the company vision, mission, and mid-term/long-term strategies.


Environmental Risk Management

CAL recognizes the direct impact and importance of the climate issue on the aviation industry. In addition to supporting and responding to the initiatives of the International Civil Aviation Organization (ICAO), the International Air Transport Association (IATA), and the Civil Aviation Administration to promote voluntary carbon reduction by setting up three major milestones for corporate flight and ground operations, we established an inter-unit working group for the TCFD in 2019, and managed climate-related risks and opportunities through our Corporate Sustainability Committee and Environmental Committee. In 2022, we formulated and published the "Forest and Biodiversity Conservation Commitment" signed by the Chairman and the President, and in 2023, we further utilized tools such as the Biodiversity Risk Analysis Tool, the TNFD, the Natural Capital Protocol, and the Natural Target Network based on Science, to identify the impacts, dependencies, risks, and opportunities on biodiversity of our own and upstream and downstream operations, and to develop a response strategy and corresponding management targets and indicators. In addition, we have set two additional objectives for the sustainable development of biodiversity conservation. In 2024, we further integrated considerations of natural and climate-related issues into the scope of TCFD. In 2025, we also aligned with the government’s regulatory roadmap by incorporating IFRS sustainability disclosure compliance into our operations. Key outcomes are reported annually to the Board of Directors for oversight and governance, enabling proactive risk management and opportunity identification, while strengthening our carbon management practices and enhancing climate resilience.


Emerging Risk Management

Emerging risks are those that have not yet fully manifested or been widely recognized. Due to their high level of uncertainty, they may change over time or as a result of technological, regulatory, social, or environmental factors, significantly impacting the operations, finances, or reputation of CAL. Although emerging risks have not yet fully manifested, their potential impact could be significant. Therefore, the airline must regularly assess, monitor, and address these risks; otherwise, the inability to respond promptly to emergencies may threaten the operations and safety of the airline. Emerging risks have the following characteristics

  • the risk is new or its significance is increasing markedly
  • the potential impact of the risk is long-term and may be unknown, possibly already affecting CAL,
  • the potential impact of the risk is significant and could severely affect the Com- pany's operations
  • the risk is external, caused by events outside the Company
  • the risk has a specific impact on the Company, rather than affecting the entire industry uniformly
  • the risk should be publicly disclosed

The Global Risks Report published by the World Economic Forum (WEF) every January divides risks into five categories of critical risks, namely economic, environmental, geopolitical, social, and technological risks. New risk categories arising from the rapid development of emerging technologies, climate, demographic changes, information security, and cyber attacks have in- creased, along with gradually increasing likelihoods of such risk incidents. Therefore, CAL has incorporated these identified emerging risks within the scope of risk management, reviews emerging risks on a regular basis, and develops countermeasures.

Risk Identification Analysis and Evaluation Risk Management Risk Report
Identify potential risks that may impact the organization's objectives, which are the responsibility of the operational risk management unit (first line of defense).
Identify emerging or previously unaddressed risks that are growing in significance but lack sufficient knowledge or preparedness.		 Assess the likelihood and impact of risks, and determine their priority, to be monitored and evaluated by Risk Management and Compliance Oversight (the second line of defense).
The potential impact of risk analysis is significant and could severely affect the operations of CAL. The risk is classified as external, caused by events outside the Company. The assessment of the risk's impact is specific to CAL, rather than applicable to the entire industry.		 Develop and implement strategies to reduce or eliminate the impact of risks. This process is executed by the operational risk responsibility unit (first line of defense) and supervised by risk management and compliance oversight (second line of defense). Regularly report on risk management activities and results, and disclose them publicly to ensure transparency and continuous improvement. This process is overseen by an independent audit unit (the third line of defense) and is supervised by the Corporate Sustainability Committee - Risk Management Group for medium- and long-term strategic risks.

Regulatory Compliance

Internal regulations and code of conduct

In order to establish a comprehensive corporate governance system and to build a corporate culture that values integrity, CAL has established the CAL Corporate Governance Principles, Board Directors' Code of Ethical Conduct, Executives Code of Ethical Conduct, China Airlines Ltd. Procedure for Handling Material Inside Information, Sustainable Development Best Practice Principles, Ethical Corporate Management Best Practices Principles, and Procedures for Ethical Management and Guidelines for Conduct.