Page 310 - THAILAND PRIVILEGE ANNUAL REPORT 2025

8. Internal Control Performance Report
Thailand Privilege Card Co., Ltd. has established an internal control system that is in compliance with
the State Fiscal and Financial Discipline Act B.E. 2561 (2018), the Ministry of Finance’s Regulations on Standards
and Criteria for Internal Control Practices for State Agencies B.E. 2561 (2018), as well as the COSO Internal Control –
Integrated Framework (2013). The internal control system is sufficiently effective and efficient to enable the Company
to achieve its operational objectives successfully. In addition, the Company has established an Internal Control
Establishment and Evaluation Committee, which conducts monitoring and evaluation of the internal control system
four times per year. Based on the annual evaluation conducted in accordance with the five components of internal
control, the summary is as follows:

8.1 Control Environment The overall control environment of the Company reflects appropriate
internal control processes, as outlined below:
• Emphasis is placed on the performance of duties and responsibilities with honesty, integrity,
ethical conduct, and professional ethics, in accordance with the Company’s ethical requirements and internal
regulations, which have been formally communicated to all personnel to ensure consistent compliance throughout
the organization.
• The Company promotes continuous training and development for employees to enhance their
skills and knowledge relevant to their assigned responsibilities, in alignment with the Company’s Training Roadmap,
thereby supporting capacity building and continuous improvement in work performance.
• The Company has established an Internal Control Establishment and Evaluation Committee
to oversee, develop, and improve internal control mechanisms. In addition, the Risk Management and Internal
Control Subcommittee and the Audit Committee provide oversight of internal operations. The organizational
structure and reporting lines are appropriately designed to support the Company’s operational objectives.
• Operational controls are implemented continuously and consistently in accordance with
the established internal control system.

8.2 Risk Assessment
• The Company has clearly defined operational objectives and performance targets at both the
organizational level and activity level, with appropriate resource allocation. Operational plans identify relevant
risk factors, include risk analysis, and establish control measures to prevent or mitigate risks. Such control measures
are formally communicated to all relevant personnel to ensure awareness and consistent implementation.
• Risk assessment is conducted using widely recognized risk management processes, and risks are
addressed through a systematic and structured risk assessment approach.

8.3 Control Activities The Company has established appropriate control activities to reduce risks.
Clear operational guidelines are defined for projects and action plans, enabling effective risk mitigation when
implemented. Control activities are embedded as part of normal operational procedures. Management at all
levels closely supervises and monitors compliance with applicable rules, regulations, and requirements. In addition,
the Company continuously improves and develops information systems to support effective implementation of
control activities in an appropriate manner.

8.4 Information and Communication The Company has an information system supporting operational
activities, along with a structured plan for continuous development of information systems to enhance usability
and ensure suitability for operational needs. The Company maintains adequate, reliable, and timely internal and
external communication systems, enabling systematic and up-to-date data collection and recordkeeping. Continuous
improvements are made to ensure that operations remain modern and responsive to evolving requirements.

8.5 Monitoring Activities Monitoring activities are an integral part of the normal operational processes
carried out by management, supervisors, and responsible personnel. Strengths and weaknesses are analyzed in
order to develop appropriate response plans. Potential future events are forecast and assessed to analyze impacts
and risks. Relevant stakeholders convene regularly to determine appropriate corrective actions, ensuring that risks
can be controlled and mitigated in a timely manner. Monitoring and evaluation are conducted in accordance with
a quarterly review schedule.

308