Boji Pharmaceutical: 2025 Internal Control Evaluation Report

Boji Pharmaceutical Technology Co., Ltd.

2025 Internal Control Evaluation Report

All shareholders of Boji Pharmaceutical Technology Co., Ltd.:

The Board of Directors of Boji Pharmaceutical Technology Co., Ltd. (hereinafter referred to as the "Company"), in accordance with the requirements of the "Basic Standards for Enterprise Internal Control", "Guidelines for the Application of Enterprise Internal Control", "Shenzhen Stock Exchange GEM Stock Listing Rules", "Shenzhen Stock Exchange Listed Companies Self-Regulatory Guidelines No. 2 - Standardized Operation of GEM Listed Companies" and other documents (hereinafter referred to as the "Enterprise Internal Control Standardization System"), combined with the company's internal control system and evaluation methods, on the basis of daily supervision and special supervision of internal control, we have carefully carried out self-examination of corporate governance and internal control. The effectiveness of internal controls was evaluated as of December 31, 2025 (the base date for the internal control evaluation report).

The details of the company’s internal control evaluation in 2025 are as follows:

1. Important statement

In accordance with the provisions of the enterprise's internal control normative system, it is the responsibility of the company's board of directors to establish, improve and effectively implement internal control, evaluate its effectiveness, and truthfully disclose the internal control evaluation report. The goal of the company's internal control is to reasonably ensure legal compliance of operation and management, asset safety, authenticity and completeness of financial reports and related information, improve operating efficiency and effectiveness, and promote the realization of development strategies. The company's board of directors, directors and senior managers ensure that there are no false records, misleading statements or major omissions in this report, and bear joint legal responsibility for the authenticity, accuracy and completeness of the report content. Due to the inherent limitations of internal control, it can only provide reasonable assurance for achieving the above objectives. In addition, since changes in circumstances may cause internal controls to become inappropriate, or the degree of compliance with control policies and procedures to be reduced, there is a certain risk in inferring the effectiveness of future internal controls based on the results of internal control evaluations.

The company adheres to the "principles of comprehensiveness, importance, checks and balances, adaptability and cost-effectiveness" in establishing and implementing internal controls, and takes into account the following basic elements: internal environment, control activities, risks and assessments, information and communication, and internal supervision.

2. Conclusion of internal control evaluation

As of December 31, 2025 (the base date of the internal control evaluation report), the company had no major flaws in the internal control of financial reporting. Members of the board of directors believe that the company has maintained effective internal control of financial reporting in all material aspects in accordance with the requirements of the corporate internal control standard system and relevant regulations.

As of the base date of the internal control evaluation report, the company has found no major deficiencies in the internal control of non-financial reporting. There are no factors that affect the conclusion of the internal control effectiveness evaluation between the base date of the internal control evaluation report and the issuance date of the internal control evaluation report.

3. Objectives and principles of company internal control

(1) Objectives of internal control

1. Establish and improve the internal organizational structure that complies with relevant national laws and regulations and modern management requirements, form a scientific decision-making mechanism, execution mechanism and supervision mechanism to ensure the realization of the company's operation and management objectives;

2. Establish an effective risk control system, strengthen risk management, improve operating efficiency and effectiveness, and ensure the safety and integrity of the company's property and the healthy operation of various business activities;

3. Ensure that accounting information is provided in a timely, authentic and complete manner and improve the quality of accounting information.

(2) Principles of internal control

1. Principle of comprehensiveness

Internal control should run through the entire process of decision-making, execution and supervision, covering all businesses and matters of the company and its subsidiaries.

2. Principle of importance

Internal control should be based on comprehensive control and focus on important business matters and high-risk areas.

3. Principle of checks and balances

Internal control should form mutual constraints and mutual supervision in terms of governance structure, institutional setup, distribution of rights and responsibilities, business processes, etc., while taking into account operational efficiency.

4. Principle of adaptability

Internal control should be adapted to the enterprise's operating scale, business scope, competition status and risk level, and should be adjusted in a timely manner as the situation changes.

5. Cost-benefit principle

Internal controls should weigh implementation costs and expected benefits to achieve effective control at an appropriate cost.

4. Introduction to the company’s internal control work

(1) Scope of internal control evaluation

The company determines the main units, businesses and matters as well as high-risk areas included in the evaluation scope in accordance with the risk-oriented principle.

The main units included in the evaluation scope include:

No. Company name Merger structure 1 Boji Medical Technology Co., Ltd. Parent company 2 Guangzhou Boji New Drug Clinical Research Center Co., Ltd. First-level subsidiary 3 Boji Medical Technology (Beijing) Co., Ltd. First-level subsidiary 4 Shanghai Weights Medical Biotechnology Co., Ltd. First-level subsidiary 5 Xinglin Traditional Chinese Medicine Technology (Guangzhou) Co., Ltd. First-level subsidiary 6 Tibet Boji Investment Management Co., Ltd. First-level subsidiary 7 Shanghai Boji Kang Biomedical Technology Co., Ltd. First-level subsidiary 8 Guangzhou Boji Medical Research Co., Ltd. First-level subsidiary 9 Guangdong Guangji Investment Co., Ltd. First-tier subsidiary 10 Shenzhen Borui Pharmaceutical Technology Co., Ltd. First-tier subsidiary 11 Jiangxi Bokang Pharmaceutical Technology Co., Ltd. First-tier subsidiary 12 Henan Boji Traditional Chinese Medicine Research Institute Co., Ltd. First-tier subsidiary 13 Guangdong Yaogu Industrial Park Investment Co., Ltd. First-tier subsidiary 14 Chengdu Boji Pharmaceutical Technology Co., Ltd. First-tier subsidiary 15 Boji Data Technology (Beijing) Co., Ltd. First-tier subsidiary 16 Guangzhou Meiji Pharmaceutical Technology Co., Ltd. First-tier subsidiary 17 Guangzhou Huasheng Pharmaceutical Co., Ltd. First-tier subsidiary 18 Zhaoqing Boji Pharmaceutical Biotechnology Co., Ltd. First-level subsidiary 19 Hong Kong Yonghe Technology Co., Ltd. First-level subsidiary serial number Company name Merger structure 20 Suzhou Xuhui Testing Co., Ltd. First-level subsidiary 21 Guangzhou Boji Juli Technology Co., Ltd. First-level subsidiary 22 Guangzhou Jiutai Pharmaceutical Technology Co., Ltd. First-level subsidiary 23 Henan Kangli Pharmaceutical Biotechnology Co., Ltd. First-level subsidiary 24 Xinxiang Boji Pharmaceutical Technology Co., Ltd. First-level subsidiary 25 Chongqing Boji Pharmaceutical Technology Co., Ltd. First-level subsidiary 26 Guangzhou Boji Polypeptide Technology Co., Ltd. First-tier subsidiary 27 Zhongkang Zhilian (Beijing) Hospital Management Co., Ltd. First-tier subsidiary 28 Ganjiang New District Qingzhikang Pharmaceutical Technology Co., Ltd. Second-tier subsidiary 29 Chongqing Jiacheng Pharmaceutical Technology Co., Ltd. Second-tier subsidiary 30 Chongqing Taiwood Pharmaceutical Technology Co., Ltd. Second-tier subsidiary 31 Shenzhen Ruikang Testing Co., Ltd. Second-tier subsidiary 32 American Humphrey Pharmaceutical Consulting Co., Ltd. Second-tier subsidiary 33 Nanjing Hewo Pharmaceutical Co., Ltd. Second-tier subsidiary 34 Nanjing Hewo Business Consulting Co., Ltd. Third-level subsidiary 35 Bochuang Pharmaceutical Technology Co., Ltd. Third-level subsidiary 36 Xinglin Traditional Chinese Medicine Technology (Guangdong Hengqin) Co., Ltd. Third-level subsidiary 37 Beijing Hanbolai Pharmaceutical Technology Co., Ltd. Third-level subsidiary

The total assets of the units included in the evaluation scope account for 100% of the total assets of the company's consolidated financial statements, and the total operating income accounts for 100% of the total operating income of the company's consolidated financial statements.

The above-mentioned units, businesses, matters and high-risk areas included in the evaluation scope cover the main aspects of the company's operation and management, and there are no major omissions. High-risk areas of focus mainly include: legal person governance structure, organizational structure, raised funds management, external guarantees, related transactions, human resources management, financial reporting, external investment, professional services and collection of drug research and development, clinical research services, preclinical research services, item procurement, financing and investment, internal supervision, information and communication, etc.

(2) Construction of the company’s internal environment

1. Corporate governance structure

In accordance with the requirements of the Company Law, Securities Law and the relevant regulations of the China Securities Regulatory Commission, the company has formulated the Articles of Association, Rules of Procedure for the Shareholders' Meeting, Rules of Procedure for the Board of Directors, and the Working System of the Secretary of the Board of Directors, etc., and has established modern legal person governance for the shareholders' meeting, the Board of Directors and the management. It has continuously improved and standardized the organizational structure of the company's internal control, ensuring that the company's shareholders' meeting, board of directors and other institutions operate in a standardized and effective manner, safeguarding the interests of investors and the company, and clarified the responsibilities of the shareholders' meeting, shareholders, board of directors, directors and senior managers in internal control.

The shareholders' meeting and the board of directors exercise decision-making, executive and supervisory powers respectively in accordance with their duties. The shareholders' meeting enjoys the legal rights stipulated in the law and the company's articles of association, and exercises voting rights on major matters such as the company's operating policies, financing, investment, and profit distribution in accordance with the law.

The board of directors is responsible to the shareholders' meeting and exercises the company's operating decision-making power in accordance with the law. The Board of Directors has established a Strategy Committee, a Remuneration and Appraisal Committee, an Audit Committee, and a Nomination Committee to establish corresponding working systems and formulate rules of procedure for each special committee. Each special committee operates well and the members can perform their duties conscientiously and effectively to ensure the company's stable and healthy development. The company has established a relatively complete and sound "Working Rules for Independent Directors" to play the necessary supervisory role. According to the company's business conditions, it has set up departments such as the Finance Department, Quality Assurance Department, Administrative Human Resources Department, Internal Audit Department, and Board of Directors Office. Each functional department has a clear division of labor, each assumes its own responsibilities, assists each other, restricts each other, and supervises each other.

The company's management is responsible for organizing and implementing the resolutions of the shareholders' meeting and the board of directors' meeting, and presiding over the daily operation and management of the enterprise.

2. Organizational structure

The company has established an organizational structure that meets the company's business scale and operation and management needs in accordance with national laws and regulations and the requirements of regulatory authorities; departments and positions are set up in accordance with the principles of mutual supervision, mutual restraint and coordinated operation.

The separation of business, assets, personnel, organization and finance between the company and the controller:

(1) The independence of the company’s business and assets

The company's main business is to provide preclinical research services, clinical research services, other consulting services, and CDMO services to domestic and foreign pharmaceutical companies and other research institutions for the R&D and production of new drugs and medical devices, covering all stages of drug R&D and production. At the same time, based on the development trend of the new drug market and combining technical expertise and industry experience, the company also conducts some pre-clinical independent research and development business and technological achievement transformation services.

When the company was established, the funds invested by the sponsors into the company were fully in place. At present, the company has an independent drug research system and other assets, and can conduct business independently with the assets it owns. There are no legal disputes or potential disputes about the company's assets. The property rights of the assets with the controlling shareholder, actual controller and other companies controlled by it are clearly defined. There is no illegal occupation of funds, assets and other resources by the controlling shareholder, actual controller and other companies controlled by them. There is no situation where guarantees are provided to shareholders or assets are occupied by shareholders to the detriment of the company's interests.

(2) Institutional and personnel independence

The company has established and improved the shareholders' meeting, board of directors and other institutions in accordance with the law, hired senior management personnel such as general manager, deputy general manager, financial director, board secretary and so on. It has set up pre-clinical research service sector, clinical research service sector, incubator and CDMO according to its own operation and management needs. Segments, project development center, business center, public affairs center, comprehensive management center, internal audit department and subordinate departments, the company's functional departments are fully set up. Each new drug research and development service department performs its own duties and has independent and complete business and independent operation capabilities. Each department independently performs its functions and operates according to its prescribed responsibilities. The company exercises its operational and management powers independently and is independent of the company's controlling shareholders, actual controllers and other companies it controls. There is no confusion among institutions.

The company recruits employees independently, has independent labor, personnel and wage management systems, and implements independent labor, personnel and wage management systems. The company's directors and senior managers are all legally produced in accordance with the provisions of the Company Law and the Articles of Association, and there is no situation where the controlling shareholder makes personnel appointment and removal decisions beyond the company's shareholders' meeting and board of directors.

The company's chairman, general manager, deputy general manager, financial officer, and board secretary do not hold dual positions prohibited by current laws, regulations, and normative documents. The company's financial personnel all work full-time in the company and receive remuneration, and there are no cases where they work part-time or receive remuneration from other companies.

3. Financial independence

The company has an independent financial department with full-time personnel, established an independent accounting system and financial management system, independently makes financial decisions, and implements a strict internal audit system. The company has an independent bank account and does not share bank accounts with shareholder units or any other units or individuals. The company handles tax registration independently and pays taxes independently in accordance with the law. The Company has no monetary funds or other assets occupied by shareholders or other related parties.

(3) Control activities

In order to ensure the effective implementation of internal control in operation and management and the realization of control objectives, the company has established relevant control policies and procedures in aspects such as raised fund management, external guarantees, related transactions, human resources management, information and communication, financial reporting, and internal supervision.

1. Management and control of raised funds

The company has formulated a "Raised Funds Management System" in accordance with the "Company Law", "Securities Law", "Shenzhen Stock Exchange GEM Stock Listing Rules" and relevant regulations promulgated by the China Securities Regulatory Commission and the "Articles of Association" and other laws, regulations and normative documents, which clearly stipulates the storage, approval, use, change and supervision of raised funds.

The company's board of directors office is responsible for the disclosure of information related to the management, use, change and settlement of raised funds; the company's financial department is responsible for the daily management of raised funds, including the opening and management of special accounts, the storage and use of raised funds, ledger management and the cancellation of special raised funds accounts; the company's internal audit department is responsible for regularly inspecting the use of raised funds and reporting the inspection results to the audit committee of the board of directors in a timely manner.

In 2025, the deposit and management of the company's raised funds are in compliance with the "Shenzhen Stock Exchange GEM Stock Listing Rules", "Shenzhen Stock Exchange Self-Regulatory Guidelines for Listed Companies No. 2 - Standardized Operation of GEM Listed Companies" and other relevant laws and regulations and normative documents. There are no violations in the use and disclosure of raised funds.

2. External guarantee management and control

The company strictly follows the relevant provisions of the "Articles of Association" and "External Guarantee Management System", which clearly stipulates the approval procedures for external guarantees, the credit standards of the guaranteed objects, the authority of the shareholders' meeting and the board of directors to approve external guarantees and the accountability system for violations of the approval authority, and the accountability system for review procedures. Based on the approval authority of the shareholders' meeting and the board of directors for external guarantees, the company strictly implements the decision-making and voting procedures for external guarantees, strictly controls the risks of external guarantees, maintains the safety of the company's assets, and protects the legitimate rights and interests of all shareholders.

The company has formulated a guarantee business process, stipulating the evaluation, approval, execution and other control requirements of the guarantee business, and has set up corresponding records to record the execution of each link of the business. It will not provide guarantees for guarantee matters that do not comply with national and company regulations.

3. Related transaction management and control

In order to standardize the company's related transactions, ensure the fairness of the company's related transactions, and safeguard the legitimate rights and interests of the company and all shareholders of the company, in accordance with relevant regulations such as the Company Law, the Securities Law, and the Shenzhen Stock Exchange GEM Stock Listing Rules, the Related Party Transaction Management System has been formulated, which clearly stipulates the content of related transactions, the scope and confirmation standards of related parties, as well as the review procedures for related party transactions, the execution of related party transactions, and the information disclosure of related transactions to ensure that related transactions are "fair, just, open, legal, and reasonable."

A written agreement should be signed for related-party transactions between the company and related parties. The signing of the agreement should follow the principles of equality, voluntariness, equal value and compensation, and the content of the agreement should be clear and specific.

When related transactions occur, we strictly follow the provisions of the Articles of Association, Related Transaction Management System, and Working Rules of Independent Directors, conscientiously perform the decision-making procedures for related transactions, ensure the fairness of transactions, and promptly and fully disclose related transactions. During the reporting period, the company did not have related parties occupying the company's funds for non-operating purposes, and the above-mentioned relevant systems to prevent related parties from occupying funds have been effectively implemented.

4. Information disclosure management and control

In order to ensure that the company discloses true, accurate and complete information, the company strictly abides by the requirements of the Company Law, Securities Law, Information Disclosure Management Measures for Listed Companies, Insider Registration and Management System, Investor Relations Management System and other relevant systems. The company's board of directors leads and manages information disclosure affairs. The company's board of directors office serves as the management department for information disclosure affairs and is specifically responsible for information disclosure and investor relations management.

All information disclosed by the company is approved by the board of directors, ensuring that there are no false, seriously misleading statements or major omissions in the information disclosed, and ensuring that all information users can learn the same information at the same time. The company provides training for insiders of major events such as controlling shareholders, directors, senior managers, etc., to reduce insider trading and stock price manipulation after listing from the source, ensure the fairness of disclosure, and safeguard the interests of investors. In 2025, the company strictly complied with the "Shenzhen Stock Exchange GEM Stock Listing Rules", "Shenzhen Stock Exchange Self-Regulatory Supervision Guidelines for Listed Companies No. 2 - Standardized Operation of GEM Listed Companies" and other relevant laws, regulations, and normative documents. The company fulfilled its information disclosure obligations in a true, accurate, timely, fair and complete manner, without any information leakage, and effectively protected the interests of all small and medium-sized shareholders.

5. Human resources management control

The Remuneration and Assessment Committee, a special working body established by the company's board of directors, is mainly responsible for formulating and reviewing the remuneration plans and assessment standards for the company's directors and senior managers. The committee reports directly to the company's board of directors. The company has established a "Human Resources Allocation System" to clearly stipulate the responsibilities, employee recruitment, probation, appointment and dismissal, transfer, dismissal, handover, rewards and punishments of each functional department of the company to ensure that relevant personnel are competent; it has formulated and implemented a talent training implementation plan to ensure that managers and all employees can effectively perform their duties; the company's existing human resources policies can basically ensure the stability of human resources and the needs of various departments of the company for human resources.

6. Financial reporting management control

In order to ensure the authenticity, accuracy and completeness of the company's financial reports, the company prepares the company's financial reports in strict accordance with the national "Accounting Standards for Business Enterprises". For the company's annual financial report, the company hires an accounting firm to audit the company's annual financial report in accordance with regulations, and the accounting firm issues an audit report to ensure the authenticity, accuracy and completeness of the company's financial reports.

7. Overseas investment management and control

In order to standardize the company's external investment behavior, prevent investment risks, and improve the efficiency of external investment, the company formulated the "Foreign Investment Management System" in accordance with relevant laws and regulations and the "Articles of Association", which clarified the decision-making authority of external investment, the organizational structure of external investment management, and the The decision-making and management procedures of external investment, follow-up daily management of external investment, transfer and recovery of external investment, external investment matter reporting and information disclosure and other major links ensure the legality and compliance of the company's external investment and effectively implement the relevant laws and regulations of the "Company Law" and "Securities Law".

8. Clinical research service management and control

The company has successfully introduced the ISO9001 quality management system and formulated a series of management systems and standards involving clinical research technical services such as quality manual (including quality policy and quality objectives), file management system, training management system, etc. This ensures that the company can carry out corresponding technical service activities in accordance with the established clinical project plan, ensures that the clinical research process is carried out in a safe and efficient manner, and also ensures that the technical services provided comply with relevant national regulatory requirements. The clinical trial-related SOP formulated by the company covers the standard operating procedures for the entire clinical trial process. It clearly stipulates all aspects of clinical research technical services from project establishment to final data handover, as well as the work responsibilities of each functional department and employee in each link. In 2025, employees at all levels of the company will be able to conduct clinical research technical service activities in strict accordance with the above standard operating procedures and management systems, and control measures will be effectively implemented.

9. Preclinical research service management and control

In terms of preclinical research business, the company has formulated systems such as the "Project Management System" and the "Project Quality Control Management System". Clear regulations have been made from project establishment, formulation of research plans, implementation of research plans, summary and analysis of experimental results to application for new drugs. In 2025, all control links of research and development were effectively implemented.

10. CDMO service management control

In terms of CDMO business, the company has established and improved a complete quality management system in accordance with the requirements of the "Good Manufacturing Practice for Drugs", including quality manuals, management procedures, process procedures, quality standards, operating procedures, records, reports and form templates. There are many quality management documents to ensure the quality of project implementation. It has passed on-site inspections and GMP compliance inspections organized by the Drug Evaluation Center of the State Drug Administration many times. The company strictly implements the project management system to ensure the effective operation of the company's projects. In addition, the "Technology Transfer Management Regulations" have been formulated based on business needs to clarify the responsibilities and work content of each department in technology transfer and project verification, effectively improving the efficiency of project implementation. In 2025, all control links of the CDMO business were effectively implemented.

11. Item procurement management and control

The company has formulated the "Purchasing Management System", "Warehouse and Material Management System" and "Finished Product Warehouse Management System" A series of procurement and payment management systems such as the "Management System for Raw Materials, Excipients, Packaging Materials and Traditional Chinese Medicines, Traditional Chinese Medicine Pieces, and Traditional Chinese Medicine Extracts", "Material Procurement Management Regulations", "Material Distribution and Product Shipping Management Regulations", clearly stipulate the material purchase, supplier selection and evaluation, procurement plan, purchase order, implementation of procurement, material acceptance into the warehouse, receipt, return processing, warehousing and other links; the public The procurement system established by the company ensures that the company's inventory is maintained at an appropriate and safe level. The implementation of relevant systems ensures that the materials ordered meet the specifications specified in the purchase order and reduces the occurrence of supplier fraud and other improper behaviors. It also ensures that all materials and related information received are processed and made available to R&D, warehousing and other related departments in a timely manner; ensuring that material procurement is carried out in an orderly manner. In 2025, the departments and personnel involved in procurement and payment will be able to conduct business processing in accordance with the above system regulations, and control measures will be effectively implemented.

12. Financing and investment management control

The "External Investment Management System", "External Guarantee Management System" and "Internal Control System" formulated by the company clearly stipulate the main business activities involved in the financing and investment cycle, such as approval authority, organizational management structure, investment decision-making procedures, investment transfer and recovery, personnel management of external investment, financial management and auditing of external investment; for the financing business. The specific process controls set up ensure that all the company's financing activities are properly authorized and approved, ensuring normal capital turnover, reducing capital costs, and reducing financing risks; the process controls set up for the investment business ensure that the company can establish effective investment decision-making and operation mechanisms, improve the efficiency of capital operations, and ensure the value preservation and appreciation of the company's external investments. In 2025, the control measures in each link can be effectively implemented.

(4) Risk assessment

In order to ensure the company's sustainable, healthy and stable development and ensure the smooth realization of business goals, the company has carried out collection, sorting and identification of risk factors from the aspects of operations, market, compliance and finance based on actual needs, and formulated necessary response strategies for risks to ensure the prevention and effective control of risks.

(5) Information and communication

The company runs OA office software and continuously improves the OA office process. Through the office software, the information required for company management, operation and other aspects is conveyed, which further improves the company's office efficiency. The company has established an IT information department, which is responsible for all company information security management and ensures the safety of information transmission. The company has established a DingTalk communication platform internally to promote communication, mutual collaboration, mutual learning and cooperation between companies.

For investors, in addition to promptly and accurately disclosing major information on the company's production and operations in designated media and websites in accordance with the requirements of regulatory authorities, investors can also learn about the company's operations by directly visiting the company or by visiting the company's official website.

In addition, the company has further improved the company’s “Information Disclosure Management System”, “Information Disclosure Management System”, The "Insider Information Insider Registration and Management System" and other related systems provide full and effective control over the company's information disclosure principles, information disclosure subjects and responsibilities, information disclosure content and disclosure standards, management of information disclosure matters, information communication approval and disclosure procedures, etc., strictly control the transmission of internal information, improve the quality of information disclosure, and avoid major errors in information disclosure.

(6) Internal supervision

According to the "Company Law", "Securities Law" and "Shenzhen Stock Exchange Self-Regulatory Guidelines for Listed Companies" No. 2 - Standardized Operation of GEM Listed Companies" and "Shenzhen Stock Exchange GEM Stock Listing Rules", the company has established an internal audit department and deployed financial professionals. Under the leadership of the Audit Committee of the Board of Directors, it reviews and supervises the financial revenues and expenditures and operating activities of the entire company and its subordinate companies and departments. It promptly discovers defects and shortcomings in internal control, analyzes the nature and causes of problems in detail, proposes rectification plans and supervises their implementation, and reports to the Board of Directors and company management in an appropriate manner in a timely manner.

In addition, the audit department has strengthened its supervision of internal control. In addition to auditing the company's financial revenue and expenditure and operating results, it has also strengthened its audit of monetary funds, raised funds, tax risks and the company's procurement links.

To sum up, the company has gradually improved the above-mentioned internal control system based on its own operating characteristics and strictly complied with the implementation. The company's internal control system in 2025 is relatively sound, reasonable and effective. In all major aspects, there is no situation where the company's property has suffered significant losses due to the loss of control of the internal control system, and the financial statements have been significantly affected and distorted.

5. Basis for internal control evaluation and identification criteria for internal control deficiencies

The company organizes and carries out internal control evaluation work in accordance with the requirements of the enterprise's internal control normative system and in conjunction with the company's internal control-related systems and evaluation methods.

Internal control deficiencies are divided into major deficiencies, important deficiencies and general deficiencies. The company's board of directors referred to the basic specifications and relevant supporting guidelines for the identification of internal control defects, and combined the company's size, operating conditions, industry characteristics, risk levels and other factors to study and determine the internal control defect identification standards applicable to the company. The specific identification standards are as follows:

(1) Standards for identifying deficiencies in internal control over financial reporting

1. Quantitative standards use total profits and total assets as measurement indicators

Losses that may be caused or caused by internal control deficiencies are related to the income statement and are measured in terms of total profits. If the misstatement amount of the financial report that may be caused by the deficiencies alone or together with other deficiencies is less than 2% of the total profits, it is deemed a general deficiency; if it exceeds 2% but less than 4% of the total profits, it is an important deficiency; if it exceeds 4% of the total profits, it is deemed a major deficiency.

If the losses that may be caused or caused by internal control deficiencies are related to the total assets, they are measured by the total assets. If the misstatement amount of the financial report that may be caused by the deficiencies alone or together with other deficiencies is less than 0.5% of the total assets, it is deemed to be a general deficiency; if it exceeds 0.5% but less than 2% of the total assets, it is an important deficiency; if it exceeds 2% of the total assets, it is deemed a major deficiency.

2. The qualitative standards for the evaluation of internal control deficiencies in financial reporting determined by the company are as follows:

(1) Signs of significant deficiencies in internal control over financial reporting include:

① Fraudulent behavior by company directors and senior managers;

②The company corrects the published financial report;

③The CPA discovered that there was a material misstatement in the current financial report, but the internal control failed to detect the misstatement during operation;

④ The company’s audit committee and internal audit institution are ineffective in supervising internal controls.

(2) Signs of important deficiencies in internal control over financial reporting include:

① Failure to select and apply accounting policies in accordance with generally accepted accounting principles;

② Failure to establish anti-fraud procedures and control measures;

③ No corresponding control mechanism has been established or implemented and there are no corresponding compensatory controls for the accounting processing of non-routine or special transactions;

④ There are one or more deficiencies in the control of the period-end financial reporting process and there is no reasonable guarantee that the prepared financial statements achieve true and complete objectives.

(3) Signs of general deficiencies in internal control over financial reporting include: other control deficiencies in addition to the above-mentioned major deficiencies and important deficiencies.

(2) Standards for identifying deficiencies in internal control over non-financial reporting

1. The quantitative standards for the evaluation of internal control deficiencies in non-financial reporting shall be implemented with reference to the quantitative standards for the evaluation of internal control deficiencies in financial reporting.

2. The qualitative standards for the evaluation of non-financial reporting internal control defects determined by the company are based on the degree of impact of the defects on the effectiveness of the business process and the possibility of occurrence. The identification standards are as follows:

(1) Significant deficiencies in internal control over non-financial reporting include: a high likelihood of deficiencies occurring, which will seriously reduce work efficiency or effectiveness, or seriously increase the uncertainty of the results, or cause it to seriously deviate from expected goals; (2) Significant deficiencies in non-financial reporting internal control include: high likelihood of deficiencies occurring, which will seriously Significantly reduce work efficiency or effect, or significantly increase the uncertainty of the effect, or cause it to deviate significantly from the expected goal; (3) General defects in non-financial reporting internal control include: defects are less likely to occur, which will reduce work efficiency or effect, or increase the uncertainty of the effect, or cause it to deviate from the expected goal.

6. Identification and rectification of internal control deficiencies

(1) Identification and rectification of internal control deficiencies in financial reporting

According to the above-mentioned identification standards for internal control deficiencies in financial reporting, the company does not have major deficiencies or important deficiencies in internal control over financial reporting in 2025.

(2) Identification and rectification of internal control deficiencies in non-financial reporting

According to the above-mentioned identification standards of internal control deficiencies in non-financial reporting, no major deficiencies or important deficiencies in the company's internal control over non-financial reporting were found in 2025.

7. Measures taken to improve and perfect internal control

(1) In order to further improve the risk prevention awareness of all employees, especially the company's directors, senior managers and key department heads, the company will continue to strengthen the study of the "Company Law", "Securities Law", "Shenzhen Stock Exchange Self-Regulatory Guidelines for Listed Companies No. 2 - Standardized Operation of GEM Listed Companies" and other laws, regulations and systems related to company operations.

(2) As the company's business continues to develop, the company's management will continue to establish, amend and maintain various controls, and supervise the continued effectiveness of control policies and procedures, so that the company's internal control system can reasonably ensure that it provides reliable data, protects the security of various assets and records, improves operating efficiency, and promotes the realization of the company's operating goals.

8. Description of other major matters related to internal control

The company has no other statements on major matters related to internal control.

Board of Directors of Boji Pharmaceutical Technology Co., Ltd.

April 23, 2026