SK bioscience operates the Enterprise Risk Management (ERM) system to manage financial and non-financial risks that may arise from business activities in an integrated manner. The primary goal of the ERM is to minimize the likelihood of risks materializing and negatively impacting the business. To achieve this, risk factors related to our business are selected as priority management tasks and managed intensively. We prioritize a long-term perspective in ERM operations to effectively respond to risks that dynamically change based on the internal and external business environment.

리스크 식별 - 측정 - 관리 - 평가로 이어지는 프로세스 정립

리스크 식별&측정을 통한 체계적 리스크 기반 마련

• 리스크 식별

  리스크의 정의 (oiep)

  조직의 목표(objective) 달성에 영향(impact)을 끼치는 사건(events)의 발생 가능성(probability)

  이미 발생한 사건과의 구별

  사건은 이미 발생하였으므로 리스크가 아님

  적절한 사후 대응이 최선의 관리(Management)

  식별, 측정가능성

  식별과 측정이 가능해야 리스크 관리 가능

• 리스크 측정

  리스크 측정

  발생가능성 및 영향도를 기준으로 - Risk level 측정 (High/Medium/Low) - High Risk부터 중점관리과제로 관리

  영향도,중점관리과제,발생가능성

• 리스크 관리활동 및 관리효과 평가

  현재 Risk Level 평가

  각 과제별로 수행한 리스크 관리활동을 기반으로 현재 Risk Level을 평가

  영향도,중점관리과제,발생가능성, 관리전/후 : 평가/의견 구성요소별 평가 및 의견

• 향후 진행 계획 수립

  향후 관리 주체 설정

  각 과제의 리스크 영향도, 발생가능성 및 현재 Risk level을 고려하여 - 전사 차원에서의 계속 관리 또는 - 현업부서에서의 관리 여부 결정

  ERM 계속 관리

  현업부서 관리

  향후 계획 수립

  각 과제별 관리주체가 기존 계획 대비 미비점을 분석하고 신규 계획을 주도적으로 수립하여 이행

SK bioscience reviews and supervises financial, ethics, and compliance risks by the Audit Committee, and non-financial risks such as climate change and human rights by the ESG Committee. Major risks are reported and approved by the Board of Directors to enhance the risk management system.

In the second half of 2024, we will appoint two Chief Risk Officers (CROs) to oversee financial and non-financial risk management respectively, to advance our comprehensive risk management capabilities across the entire Company. This will facilitate cross-functional collaboration on interrelated risks across the business and strengthen our ability to respond proactively. In addition, we will routinize risk-related reporting to the Board of Directors from 2025 to further strengthen the Board's oversight function.

정보보호 총괄 임원

• 기술보안

  정보보호 책임자 (CISO)

  정보보호관리자

• 개인정보보안

  개인정보보호 책임자 (CPO)

  개인정보보호관리자

• 물리보안

  본사 물리보안 책임자

  본사 물리보안 관리자

  물리보안

  L HOUSE 물리보안 책임자

  L HOUSE 물리보안 관리자

SK bioscience complies with domestic and international tax policies and regulations and faithfully fulfills its obligations to file tax returns and pay taxes. We do not transfer income to other countries to exploit differences in tax laws or loopholes in the international tax system. Moreover, we ensure that taxable income is allocated consistently with the value created in each country where we conduct business activities. To proactively manage tax risks, we seek advice on taxes from external tax experts. For major tax issues, we consult tax authorities in advance and carry out tax-related activities based on authoritative interpretations obtained during these consultations.

We evaluate and manage tax risks that may arise due to ongoing changes in tax policies, as well as those associated with our business activities, including new growth investments. Recognizing the complexity of tax laws and differences in interpretation, we understand that it is impossible to eliminate all tax risks entirely. Therefore, our focus lies in preemptive identification and management of uncertain tax issues. To proactively prevent such risks, we continuously monitor domestic and international tax laws, as well as tax trends in each country, and cooperate and communicate with tax experts.

When it comes to transactions between related parties, SK bioscience observes the arm’s length principle aligned with the OECD Transfer Pricing Guidelines and the laws of each country. For transfer pricing transactions with related parties abroad, we will prepare a Base Erosion and Profit Shifting (BEPS) report and a transfer pricing report with an external tax expert if necessary. We will also oversee the implementation of transparent tax strategies such as the prevention of tax evasion and income transfer. In addition, we will analyze in advance the calculation of effective tax rates by country and whether additional taxes will be incurred in connection with the implementation of the Global Minimum Tax, and manage appropriate response procedures if necessary.

IDT Biologika (hereinafter IDT) Business Continuity Management (BCM) ensures the continuity of operations by identifying potential risks, preparing for emergencies, and improving recovery times. It focuses on critical business processes and addresses the impact of risks, such as disruptions to these processes or the loss of essential resources.

The IDT BCM follows the ISO 22301 standard, which is based on the PDCA (Plan-Do-Check-Act) cycle. This cycle is divided into four phases: planning (Plan), implementation (Do), monitoring (Check), and corrective action (Act). In the event of an emergency, structured plans are developed, and employees are trained to handle possible situations. With this approach, IDT is equipped with both preventive and reactive measures to manage internal or external incidents effectively.

Information Security Management System

Starting with the revision of security-related policies, SK bioscience has designated a Chief Information Security Officer (CISO) and established an information security management system centered on a dedicated information protection team.

The Company’s information protection-related policies and procedures are continuously updated in accordance with compliance regulations and changes in the internal work environment. In accordance with the Personal Information Protection Act and related enforcement regulations, we have established and operate an internal management plan that reflects the standards for measures to ensure the safety of personal information. In addition, we transparently disclose our privacy policy on our website.

In 2023, we appointed individuals in charge of security for each department who are tasked with disseminating regular security training and checkpoints within their respective departments, to manage information protection issues. In 2024, SK bioscience continues to pursue information security enhancement activities, including further strengthening security capabilities to respond to the changing IT/OT environment and perfecting asset protection systems in the cloud environment.

To prevent and respond to cybersecurity incidents, SK bioscience conducts regular inspections of major systems and strengthens the security review process upon the introduction of new solutions. In addition, we conduct simulated phishing every half year to diagnose vulnerabilities and establish safe business systems through continuous management. At each simulation training, we send a total of two warning emails to employees who had their computers infected with malware and carry out PC scans and checks. In addition, we conduct DDoS simulation training in the second half of each year to check the detection and blocking abilities of our security systems and the availability of security equipment by conducting three simulated attacks consisting of prevalent and new attack types.

DDoS Simulation Training Procedure

1. 공격장비 방어장비 구성
2. DDoS 훈련대상 선정
3. 공격 유형 설정
4. 1차, 2차, 3차 공격 시도
5. 탐지 및 차단 결과 확인

SK bioscience’s company-wide IT system is kept safe from internal and external threats such as information leakage through remote control services provided by a professional security company.

To raise security awareness among all employees and prevent internal information leaks, we designate an annual 'Company-wide Security Day' to conduct self-inspections on life security, document security, and work devices, and impose penalties on security violators to prevent recurrence. We also share malicious/phishing email trends and new security threat cases with employees every month via the Company notice board, and continue our efforts to establish a security culture.

In addition, we regularly provide privacy and information security training to our employees, new hires, and business partners, and our training programs are updated annually to reflect the latest security issues. This allows us to provide customized security training by role and continuously strengthen our employees' security capabilities.