Basic Policy on Internal Control Systems

Basic policy on each aspect of the establishment of internal control in accordance with the Companies Act

1. System to ensure that the duties of directors and employees are executed in compliance with laws and Articles of Incorporation

   1. To establish our fundamental principles for corporate ethics and legal compliance, we develop our "Basic Philosophy", "Management Policy", "Code of Conduct" and "Sustainability Basic Policy". We also introduce and thoroughly implement The Orico Group Code, a code of conduct that encompasses compliance and is applicable to all directors and employees at our company and its subsidiaries (hereinafter referred to as "employees").
   2. To enhance compliance within our company and its subsidiaries, we establish a dedicated "Compliance Committee" responsible for deliberating on significant compliance-related matters.
   3. We establish an internal reporting system to monitor and address any illegal or fraudulent activities within our company and its subsidiaries.
   4. To ensure compliance with the Act on the Protection of Personal Information and related guidelines, we establish the "Information Security Basic Policy" and "Personal Information Protection Basic Policy" to create a robust system for managing personal information.
   5. In order to completely cut ties with anti-social forces that pose a threat to the order and safety of society, we establish the "Basic Policy against Anti-social Forces" and dedicate departments to ensure proper management.
   6. To prevent money laundering and the financing of terrorism, we establish the "Basic Policy for Preventing Money Laundering and Terrorist Financing" and set up specialized departments to implement an appropriate management system.
   7. To ensure the adequacy of financial reporting, we establish the "Fundamental Concepts of Corporate Governance" and "Basic Policy on Corporate Governance" to create a system for appropriately disclosing both financial and non-financial information.
   8. To conduct independent internal audits of our company and its subsidiaries, we establish the "Basic Policies on Internal Auditing" and "Internal Audit Regulations," and form Internal Audit Group. Additionally, we establish an "Operational Audit Committee" to deliberate on important matters related to internal audits of our company and its subsidiaries, ensuring the effectiveness of internal audits.

2. System to store and manage information related to the execution of directors' duties.

   We record and preserve minutes of meetings, including those of the Board of Directors, Executive Manageent Meeting, Compliance Committee, Operational Auditing and various committees. We also document memoranda, proposals, contracts, and other relevant materials in accordance with established regulations. These records are stored in written or electronic form for a designated period and can be accessed by directors at their convenience.

3. Regulations and other systems for managing risk of loss

   1. We establish a "Risk Management Basic Policy" to comprehensively understand and manage the diverse risks associated with the company and its subsidiaries. This includes establishing a Risk Management Department responsible for overseeing and managing each specific risk and developing a risk management structure. Furthermore, we set up a Comprehensive Risk Management Committee to deliberate and coordinate on risk-related matters.
   2. To ensure business continuity and effective response during emergencies, we establish the "Business Continuity Management Basic Policy" and develop a framework for minimizing impact and ensuring prompt and efficient recovery of operations.

4. System to ensure the efficient execution of duties by directors

   1. We consolidate a medium-term management plan and establish annual business plans for each fiscal year to realize the goals outlined in the medium-term management plan.
   2. Except for matters specified by laws and important management issues, we delegate the decision-making authority to the President and Representative Director to the fullest extent, while ensuring that the Board of Directors effectively supervises the execution of business operations from an independent and objective standpoint.
   3. We establish the "Executive Management Meeting" as an advisory body to the President and Director, conduct deliberations on significant matters related to business operations, and create a structure for the President and Director to make informed decisions.
   4. We establish the "Board of Directors Regulations", "Allocation of Responsibility Regulations", and "Authority Regulations" to ensure efficient business execution and compliance with procedures.

5. System to ensure proper conduct of operations of the corporate group consisting of the company and its subsidiaries and other relating parties

   1. System for reporting to the company on matters related to the performance of duties by directors and employees of subsidiaries and other relating parties
      • ａ:We establish dedicated departments to oversee the overall management of our subsidiaries and other relating parties, and create specific departments to oversee closely related operations. By fostering collaboration between these departments, we ensure efficient and effective management of our subsidiaries and other relating parties. Furthermore, through the "Group Management Regulations" and other related regulations, we establish criteria for business planning, risk management, compliance, and other essential practices. For significant management matters, the company's approval or reporting is required, which enables necessary supervision and guidance to ensure proper business operations within the corporate group.
      • ｂ:Within our subsidiaries and other relating parties, we establish a system for consulting or reporting to our company regarding significant management matters based on our "Group Management Regulations" and other guidelines.
   2. Regulations and other systems for managing the risk of loss of group companies and other relating parties
      • ａ:Within our group companies and other relating parties, taking into account our management structure, we establish appropriate risk management systems based on the scale, line of business, and significance of various risks.
   3. System to ensure the efficient performance of duties by directors and employees of subsidiaries and other relating parties
      • ａ:Within our group companies and other relating parties, taking into account our management structure, we establish appropriate risk management systems based on the scale, line of business, and significance of various risks.
   4. System to ensure the efficient performance of duties by directors and employees of subsidiaries and other relating parties
      • ａ:Within our subsidiaries and other relating parties, taking into account our management structure, we implement measures to define the authority and responsibilities of directors and employees according to their scale and line of business.

6. Matters concerning employees who should support the duties of the Audit and Supervisory Committee, matters concerning the independence of such employees from directors (excluding directors who are members of the Audit and Supervisory Committee), and matters concerning ensuring the effectiveness of instructions given to the employees of the Audit and Supervisory Committee.

   1. To assist the Audit and Supervisory Committee in its duties, we establish the Audit and SupervisoryCommittee Office, an organization under the direct control of the Audit and SupervisoryCommittee, consisting of dedicated employees.
   2. Our company obtains prior approval from the Audit and Supervisory Committee regarding matters related to the personnel affairs of the employees. Furthermore, the said employees do not receive any instructions regarding their duties from anyone but the Audit and Supervisory Committee, and they follow any instructions given by the Audit and Supervisory Committee.

7. System for directors (excluding directors who are members of the Audit and Supervisory Committee), employees and others to report to the Audit and Supervisory Committee, and system for ensuring that the Audit and Supervisory Committee's audits are conducted effectively

   1. System for directors (excluding directors who are members of the Audit and Supervisory Committee), employees and others to report to the Audit and Supervisory Committee, and system for ensuring that the Audit and Supervisory Committee's audits are conducted effectively
   2. Our company does not subject directors and employees who have reported to the Audit and Supervisory Committee to any unfavorable treatment solely based on their act of reporting.
   3. Directors and employees of our company and its group companies promptly report to the Audit and Supervisory Committees on matters required by laws, regulations, and those deemed necessary for the performance of the Committees' duties.
   4. Our company does not subject directors and employees who have reported to the Audit and Supervisory Committee to any unfavorable treatment solely based on their act of reporting.
   5. Our company establishes a structure where the Audit and Supervisory Committee can receive reports from the internal audit group on audit plans, audit results, and other relevant matters. The Committee may request investigations or provide instructions as deemed necessary.
   6. Our company establishes a structure where the Audit and Supervisory Committee members can attend important meetings such as the "Management Meeting" to confirm the company's current situation and express their opinions when necessary. Additionally, to enhance audits within the corporate group, we establish a framework that allows our Audit and Supervisory Committee to exchange information with the auditors of subsidiaries and other relating parties.