Yunnan Baiyao: 2025 Internal Control Self-Evaluation Report

Yunnan Baiyao Group Co., Ltd.

2025 Internal Control Self-Evaluation Report

In accordance with the provisions of the "Basic Standards for Enterprise Internal Control" and its supporting guidelines and other internal control regulatory requirements (hereinafter referred to as the "Enterprise Internal Control Standard System"), combined with the internal control system and evaluation methods of Yunnan Baiyao Group Co., Ltd. (hereinafter referred to as the "Company"), and based on daily supervision and special supervision of internal control, we evaluated the effectiveness of the company's internal control on December 31, 2025 (the base date of the internal control evaluation report).

1. Important statement

In accordance with the provisions of the enterprise's internal control normative system, it is the responsibility of the company's board of directors to establish, improve and effectively implement internal control, evaluate its effectiveness, and truthfully disclose the internal control evaluation report. The Audit Committee oversees the establishment and implementation of internal controls by the Board of Directors. Managers are responsible for organizing and leading the daily operation of the enterprise's internal controls. The company's board of directors, audit committee, directors and senior management personnel guarantee that there are no false records, misleading statements or major omissions in this report, and bear individual and joint legal responsibility for the authenticity, accuracy and completeness of the report content.

The goal of the company's internal control is to reasonably ensure legal compliance of operation and management, asset safety, authenticity and completeness of financial reports and related information, improve operating efficiency and effectiveness, and promote the realization of development strategies. Due to the inherent limitations of internal control, it can only provide reasonable assurance for achieving the above objectives. In addition, since changes in circumstances may cause internal controls to become inappropriate, or the degree of compliance with control policies and procedures to be reduced, there is a certain risk in inferring the effectiveness of future internal controls based on the results of internal control evaluations.

2. Conclusion of internal control evaluation

1. Whether the company has any major deficiencies in the internal control of financial reporting on the base date of the internal control evaluation report

□Yes √No

2. Conclusion of the evaluation of internal control over financial reporting

√Valid □Invalid

According to the identification of major deficiencies in the company's internal control over financial reporting, there were no major deficiencies in internal control over financial reporting on the base date of the internal control evaluation report. The board of directors believes that the company has maintained effective internal control over financial reporting in all material aspects in accordance with the requirements of the corporate internal control standard system and relevant regulations.

3. Whether any major deficiencies in internal control over non-financial reporting have been discovered

□Yes √No

According to the identification of major deficiencies in the company's internal control over non-financial reporting, the company found no major deficiencies in internal control over non-financial reporting on the base date of the internal control evaluation report.

4. Factors that affect the conclusion of the internal control effectiveness evaluation from the base date of the internal control evaluation report to the issuance date of the internal control evaluation report

□Applicable √Not applicable

There are no factors that affect the conclusion of the internal control effectiveness evaluation between the base date of the internal control evaluation report and the issuance date of the internal control evaluation report.

5. Whether the internal control audit opinion is consistent with the company’s evaluation conclusion on the effectiveness of internal control over financial reporting

√Yes □No

6. Whether the disclosure of major defects in non-financial reporting internal control in the internal control audit report is consistent with the disclosure in the company's internal control evaluation report

√Yes □No

3. Internal control evaluation work

(1) Evaluation scope of internal control evaluation work

The company determines the main units, businesses and matters as well as high-risk areas included in the evaluation scope in accordance with the risk-oriented principle.

1. The main units included in the evaluation scope include: Yunnan Baiyao Group Co., Ltd., Yunnan Baiyao Group Health Products Co., Ltd., Yunnan Baiyao Group Traditional Chinese Medicine Resources Co., Ltd., Yunnan Provincial Pharmaceutical Co., Ltd., etc.

2. Proportion of units included in the evaluation scope:

indicator

Proportion (%) The total assets of the units included in the evaluation scope account for the total assets of the company's consolidated financial statements 97.71 The total operating income of the units included in the evaluation scope accounts for the total operating income of the company's consolidated financial statements 98.88

3. The main businesses and matters included in the evaluation scope include:

Five aspects include internal environment, risk assessment, control activities, information and communication, and internal supervision. The internal environment mainly includes: organizational structure, development strategy, human resources, social responsibility, and corporate culture. The company's risk assessment mainly includes: risk identification, risk analysis, and risk response. Control activities mainly include: capital operation management, financing management, investment management, procurement and accounts payable management, fixed asset management, intangible asset management, inventory management, sales and accounts receivable management, research and development, engineering projects, guarantee business, business outsourcing, financial reporting, comprehensive budget, contract management, production management, tax management, etc. Information and communication mainly include: internal and external information communication and transmission, and information systems. Internal supervision mainly includes: internal audit and internal supervision. 4. High-risk areas of focus include:

Capital operation management, investment management, procurement and accounts payable management, inventory management, sales and accounts receivable management, research and development, production management, business outsourcing management, information systems, etc. 5. The units, businesses, matters and high-risk areas included in the evaluation scope mentioned above cover the main aspects of the company's operation and management. Are there any major omissions?

□Yes √No

(2) Internal control evaluation work basis and internal control defect identification standards

The company organizes and carries out internal control evaluation work based on the company's internal control normative system and the company's internal control evaluation management system.

1. Whether the specific identification standards for internal control deficiencies have been adjusted from previous years

□Yes √No

The company's board of directors differentiated between financial reporting internal control and non-financial reporting internal control based on the company's internal control standard system's identification requirements for major defects, important defects and general defects, combined with company size, industry characteristics, risk preference and risk tolerance and other factors, and studied and determined the specific identification standards for internal control defects applicable to the company, which are consistent with previous years.

2. Standards for identifying deficiencies in internal control over financial reporting

Defects in internal control over financial reporting: refers to deficiencies in the design and operation of internal controls that fail to reasonably guarantee the reliability of financial reporting, that is, deficiencies in internal control that fail to prevent or detect and correct misstatements in financial reports in a timely manner.

The quantitative standards for the evaluation of internal control deficiencies over financial reporting determined by the company are as follows:

Indicator name Quantitative standard for major defects Quantitative standard for important defects Quantitative standard for general defects Total profit 3% of total profit ≤ 3% of total profit Misstatement ≥ 5% of total profit Misstatement < 3% of total profit

5%

The qualitative standards for the evaluation of internal control deficiencies over financial reporting determined by the company are as follows:

Nature of defects Qualitative standards

The company's directors, supervisors and senior managers are found to have committed fraud; major internal control deficiencies that have been discovered and reported to management have not been corrected after a reasonable period of time; the control environment is ineffective; the audit committee and internal audit department's supervision of internal control is ineffective; deficiencies that affect earnings trends; major misstatements discovered by external audits were not first discovered by the company; the company corrects its published financial statements.

Corresponding accounting policies were not selected and applied in accordance with generally accepted accounting principles; corresponding controls were not established or corresponding compensatory measures were not implemented for the accounting treatment of extraordinary or special transactions. General defects Defects other than major defects and important defects are classified as general defects.

3. Standards for identifying deficiencies in internal control over non-financial reporting

Non-financial reporting internal control deficiencies: refers to internal control design and operational deficiencies that cannot reasonably guarantee the achievement of other objectives other than financial reporting objectives, including strategic objectives, operating objectives, compliance objectives, etc.

The quantitative standards for the evaluation of non-financial reporting internal control deficiencies determined by the company are as follows:

Indicator name Quantitative standard for major defects Quantitative standard for important defects Quantitative standard for general defects Total profit Misstatement ≥ 5% of total profit 3% of total profit ≤ Misstatement Misstatement < 5% of total profit 3%

The qualitative standards for the evaluation of non-financial reporting internal control deficiencies determined by the company are as follows:

Nature of defects Qualitative standards

Major deficiencies have been officially disclosed to the outside world and have a negative impact on the disclosure of the company's regular reports;

Violated national laws and regulations, causing heavy losses to the company.

Important defects: Punished by national government departments but did not cause any negative impact on the disclosure of the company's regular reports

influence.

General defects: Punished by government departments below the provincial level (including provincial level) but failing to report regularly to the company

The disclosure of the report will have a negative impact.

(3) Identification and rectification of internal control deficiencies

1. Identification and rectification of internal control deficiencies over financial reporting

1.1 Major defects

Whether the company has any major deficiencies in internal control over financial reporting during the reporting period

□Yes √No

1.2 Important defects

Whether the company has any important deficiencies in internal control over financial reporting during the reporting period

□Yes √No

1.3 General defects

The company has established internal control evaluation and internal audit mechanisms. Once general defects that may exist in daily operations are discovered, corrective measures will be taken to make the risks controllable and have no substantial impact on the operation of the company's internal control system.

1.4 After the above rectifications, as of the base date of the internal control evaluation report, does the company have any major deficiencies in the internal control of financial reporting that have not yet been rectified?

□Yes √No

1.5 After the above rectifications, as of the base date of the internal control evaluation report, does the company have any important deficiencies in the internal control of financial reporting that have not been rectified?

□Yes √No

2. Identification and rectification of internal control deficiencies in non-financial reporting

2.1 Major defects

Whether the company discovered any major deficiencies in non-financial reporting internal control during the reporting period

□Yes √No

2.2 Important defects

Whether the company discovered any important deficiencies in non-financial reporting internal control during the reporting period

□Yes √No

2.3 General defects

The company has established internal control evaluation and internal audit mechanisms. Once general defects that may exist in daily operations are discovered, corrective measures will be taken to make the risks controllable and have no substantial impact on the operation of the company's internal control system.

2.4 After the above rectifications, on the base date of the internal control evaluation report, has the company discovered any major deficiencies in non-financial reporting internal controls that have not yet been rectified?

□Yes √No

2.5 After the above rectifications, on the base date of the internal control evaluation report, has the company discovered any important deficiencies in non-financial reporting internal controls that have not yet been rectified?

□Yes √No

4. Conclusion on the effectiveness of internal control

The company's established internal control system does not have major flaws in terms of integrity, compliance, effectiveness, etc. However, due to the inherent limitations of internal control, the continuous changes in the internal environment and macro environment, policies and regulations, the original control activities may be inapplicable or have deviations. In this regard, the company will promptly improve relevant internal controls to provide reasonable guarantee for the authenticity and completeness of financial reports, as well as the realization of the company's strategies and business objectives.

5. Description of other major matters related to internal control

1. Rectification of internal control deficiencies in the previous year

□Applicable √Not applicable

2. Description of other significant matters

□Applicable √Not applicable

Board of Directors of Yunnan Baiyao Group Co., Ltd.

March 31, 2026