Zhejiang Hisun Pharmaceutical Co., Ltd. 2025 Internal Control Evaluation Report

Company code: 600267 Company abbreviation: Hisun Pharmaceutical

All shareholders of Zhejiang Hisun Pharmaceutical Co., Ltd.:

In accordance with the provisions of the "Basic Standards for Enterprise Internal Control" and its supporting guidelines and other internal control regulatory requirements (hereinafter referred to as the Enterprise Internal Control Standard System), combined with the company's (hereinafter referred to as the company's) internal control system and evaluation methods, and on the basis of daily supervision and special supervision of internal control, we evaluated the effectiveness of the company's internal control on December 31, 2025 (the base date of the internal control evaluation report).

1. Important statement

In accordance with the provisions of the enterprise's internal control normative system, it is the responsibility of the company's board of directors to establish, improve and effectively implement internal control, evaluate its effectiveness, and truthfully disclose the internal control evaluation report. The Audit Committee oversees the company's establishment and implementation of internal controls. Managers are responsible for organizing and leading the daily operation of the enterprise's internal controls. The company's board of directors, directors and senior managers guarantee that there are no false records, misleading statements or major omissions in this report, and bear individual and joint legal liability for the authenticity, accuracy and completeness of the report content.

The goal of the company's internal control is to reasonably ensure legal compliance of operation and management, asset safety, authenticity and completeness of financial reports and related information, improve operating efficiency and effectiveness, and promote the realization of development strategies. Due to the inherent limitations of internal control, it can only provide reasonable assurance for achieving the above objectives. In addition, since changes in circumstances may cause internal controls to become inappropriate, or the degree of compliance with control policies and procedures to be reduced, there is a certain risk in inferring the effectiveness of future internal controls based on the results of internal control evaluations.

2. Conclusion of internal control evaluation

1. Whether the company has any major deficiencies in the internal control of financial reporting on the base date of the internal control evaluation report

□Yes √No

2. Conclusion of the evaluation of internal control over financial reporting

√Valid □Invalid

According to the identification of major deficiencies in the company's internal control over financial reporting, there were no major deficiencies in internal control over financial reporting on the base date of the internal control evaluation report. The board of directors believes that the company has maintained effective internal control over financial reporting in all major aspects in accordance with the requirements of the corporate internal control standard system and relevant regulations.

3. Whether significant deficiencies in internal control over non-financial reporting have been discovered

□Yes √No

According to the identification of major deficiencies in the company's internal control over non-financial reporting, the company found no major deficiencies in internal control over non-financial reporting on the base date of the internal control evaluation report.

4. Factors that affect the conclusion of the internal control effectiveness evaluation from the base date of the internal control evaluation report to the issuance date of the internal control evaluation report

□Applicable √Not applicable

There are no factors that affect the conclusion of the internal control effectiveness evaluation between the base date of the internal control evaluation report and the issuance date of the internal control evaluation report.

5. Whether the internal control audit opinion is consistent with the company’s evaluation conclusion on the effectiveness of internal control over financial reporting

√Yes □No

6. Whether the disclosure of major deficiencies in non-financial reporting internal control in the internal control audit report is consistent with the disclosure in the company’s internal control evaluation report

√Yes □No

3. Internal control evaluation work

(1). Scope of internal control evaluation

The company determines the main units, businesses and matters as well as high-risk areas included in the evaluation scope in accordance with the risk-oriented principle.

1. The main units included in the evaluation scope include: Zhejiang Hisun Pharmaceutical Co., Ltd. and Hisun Pharmaceutical (Hangzhou) Co., Ltd., Hanhui Pharmaceutical Co., Ltd., Zhejiang Pharmaceutical Industry Co., Ltd. and many other subsidiaries.

2. Proportion of units included in the evaluation scope:

Indicator proportion (%)

The ratio of the total assets of the units included in the evaluation scope to the total assets of the company's consolidated financial statements 87.49

The total operating income of the units included in the evaluation scope accounts for the operating income of the company's consolidated financial statements

91.55

ratio of total

3. The main businesses and matters included in the evaluation scope include:

The company has included all aspects of the internal control system into the scope of this year’s evaluation. The details are as follows:

(1) Internal environment: governance structure, organizational structure, development strategy, human resources, social responsibility, corporate culture, subsidiary management and other modules.

(2) Control activities: financial activities (including working capital, financing management, investment management), procurement business, asset management (including inventory management, fixed assets, intangible assets), sales business, research and development, engineering projects, guarantee business, financial reporting and other modules.

(3) Control means: comprehensive budget, contract management, internal information transmission (information confidentiality, file management, seal management, document issuance management, etc.), information system, internal supervision and other modules.

4. High-risk areas of focus include:

Based on the company's internal management needs and actual business development, internal information transmission, internal supervision, sales business, procurement business, research and development, subsidiary management and other modules are regarded as high-risk areas of focus.

5. The above-mentioned units, businesses, matters and high-risk areas included in the evaluation scope cover the main aspects of the company’s operation and management. Are there any major omissions?

□Yes √No

6. Whether statutory exemptions exist

□Yes √No

7. Other instructions

None.

(2). Basis for internal control evaluation and identification standards for internal control deficiencies

The company organizes and carries out internal control evaluation work in accordance with the company's internal control standard system and the requirements of laws and regulations such as the "Company Law of the People's Republic of China" and "Self-Discipline Supervision Guidelines for Listed Companies of the Shanghai Stock Exchange", and in accordance with the company's internal control management manual, SOP processes and various internally issued regulations, methods and rules.

1. Whether the specific identification standards for internal control deficiencies have been adjusted from previous years

□Yes √No

The company's board of directors distinguished between financial reporting internal control and non-financial reporting internal control based on the company's internal control standard system's identification requirements for major defects, important defects and general defects, combined with company size, industry characteristics, risk preference and risk tolerance and other factors, and studied and determined the specific identification standards for internal control defects applicable to the company, which are consistent with previous years.

2. Standards for identifying deficiencies in internal control over financial reporting

The quantitative standards for the evaluation of internal control deficiencies over financial reporting determined by the company are as follows:

Indicator name Quantitative standard for major defects Quantitative standard for important defects Quantitative standard for general defects Potential misstatements in financial statements Possibility of misstatements in financial statements Possible misstatements in financial statements The scope of possible misstatements in financial statements is greater than insignificant and the amount of potential misstatements in the income statement is greater than insignificant or the amount of potential misstatements in the income statement is greater than the final amount. The amount of potential misstatements is between 5% of the company's net profit in the most recent fiscal year. 1% of the net profit in the statement or RMB 20 million; RMB 5 million; or potential misstatement in the asset and balance sheet. The amount of potential misstatement in the balance sheet is greater than or less than 1% of the net assets in the company's consolidated statement or RMB 100 million in the company's consolidated statement for the most recent fiscal year. 50 million yuan.

Description:

None.

The qualitative standards for the evaluation of internal control deficiencies over financial reporting determined by the company are as follows:

Nature of defects Qualitative standards

major defects (1) Restate previously published financial statements to reflect the correction of misstatements caused by errors or fraud; (2) The auditor discovers a material misstatement of the company's financial statements for the current period, but the misstatement was not initially discovered by the company's internal control over financial reporting; (3) The audit committee's review of the company's external financial reporting and financial reporting The supervision of internal control fails; (4) the compliance supervision function fails, and violations of regulations may have a significant impact on the reliability of financial reports; (5) any degree of fraud involving senior management is discovered; (6) the management still fails to correct important deficiencies after a reasonable period of time after reporting to the management.

Important deficiencies Internal control deficiencies related to anti-fraud procedures and controls, internal controls over irregular or unsystematic transactions, internal controls over the selection and application of accounting policies against generally accepted accounting principles, and internal controls over the period-end financial reporting process.

General deficiencies other internal control deficiencies that do not constitute major deficiencies or important deficiencies.

Description:

None.

3. Standards for identifying deficiencies in internal control over non-financial reporting

The quantitative standards for the evaluation of non-financial reporting internal control deficiencies determined by the company are as follows:

Indicator Name Quantitative Standard for Major Defects Quantitative Standard for Important Defects Quantitative Standard for General Defects Directly caused losses of RMB 10 million (including RMB 5 million (including RMB 10 million) and above. RMB 5 million) - RMB 1,000

Ten thousand yuan.

Description:

None.

The qualitative standards for the evaluation of non-financial reporting internal control deficiencies determined by the company are as follows:

Nature of defects Qualitative standards

Major defects (1) Serious violation of laws and regulations;

(2) In addition to policy reasons, the company has suffered losses for consecutive years and its continued operation has been challenged;

(3) Lack of institutional control over important businesses or systematic failure of the system;

(4) The merger, acquisition and reorganization failed, and the operations of the newly expanded subordinate units were unsustainable;

(5) Subsidiaries lack internal control and have scattered management;

(6) Middle and high-level managers have resigned one after another, or there has been a serious loss of personnel in key positions;

(7) Frequent exposure of negative news in the media;

(8) The results of internal control evaluation, especially major or important defects that have not been rectified;

(9) The company has been punished by national government departments and has been officially disclosed to the outside world, which has had a negative impact on the disclosure of the company's regular reports.

Important deficiencies: Penalties from provincial and above government departments and other circumstances, but did not have a negative impact on the company's regular report disclosures.

General defects: Penalties from government departments below the provincial level and other circumstances, but they do not have a negative impact on the company's regular report disclosures.

Description:

None.

(3). Identification and rectification of internal control deficiencies

1. Identification and rectification of internal control deficiencies over financial reporting

1.1. Major defects

Whether the company has any major deficiencies in internal control over financial reporting during the reporting period

□Yes √No

1.2. Important defects

Whether the company has any important deficiencies in internal control over financial reporting during the reporting period

□Yes √No

1.3. General defects

According to the above-mentioned identification standards of the company's internal control deficiencies, the company did not have any major deficiencies or important deficiencies in the internal control of financial reporting during the reporting period. The company's internal control system may have a small number of general defects in daily operation. Since the company's internal supervision department is supervising and reviewing in real time, corrective measures will be taken as soon as general defects in internal control are discovered and confirmed to make the risks controllable and will not have a substantial impact on the operation of the company's internal control system.

1.4. After the above rectification, on the base date of the internal control evaluation report, does the company have any major deficiencies in the internal control of financial reporting that have not been rectified?

□Yes √No

1.5. After the above rectification, on the base date of the internal control evaluation report, does the company have any important deficiencies in the internal control of financial reporting that have not been rectified?

□Yes √No

2. Identification and rectification of internal control deficiencies in non-financial reporting

2.1. Major defects

Whether the company discovered any major deficiencies in non-financial reporting internal control during the reporting period

□Yes √No

2.2. Important flaws

Whether the company discovered any important deficiencies in non-financial reporting internal control during the reporting period

□Yes √No

2.3. General defects

According to the above-mentioned identification standards of the company's internal control deficiencies, the company had no major deficiencies or important deficiencies in non-financial reporting internal control during the reporting period. The company's internal control system may have a small number of general defects in daily operation. Since the company's audit department is supervising and reviewing in real time, corrective measures will be taken as soon as general defects in internal control are discovered and confirmed to make the risks controllable and have no substantial impact on the operation of the company's internal control system.

2.4. After the above rectifications, on the base date of the internal control evaluation report, has the company discovered any major deficiencies in the internal control of non-financial reporting that have not yet been rectified?

□Yes √No

2.5. After the above rectifications, on the base date of the internal control evaluation report, has the company discovered any important deficiencies in the internal control of non-financial reporting that have not yet been rectified?

□Yes √No

4. Description of other major matters related to internal control

1. Rectification of internal control deficiencies in the previous year

□Applicable √Not applicable

2. Internal control operation status this year and improvement directions for the next year

√Applicable □Not applicable

In 2025, the company strictly complied with relevant laws, regulations and regulatory provisions on internal control, continued to improve the internal control management system, consolidated internal control management responsibilities at all levels, and focused on high-risk areas such as R&D, production, sales, and compliance management in the pharmaceutical industry, and solidly promoted the implementation of internal control systems, normalized internal control self-inspections, special supervision and inspections, and compliance promotion for all employees. The overall operation of the internal control system is standardized and effective. During the reporting period, the company paid close attention to the details of internal control implementation, strengthened daily supervision and risk prevention and control, and promptly investigated and rectified various management omissions. No major or important defects in financial reports and non-financial reports were found. A small number of general defects have been rectified and closed-loop management has been completed. The internal control defense line of operational compliance, asset safety, and financial information is true and complete, and the level of internal control management has been steadily improved.

In 2026, the company will combine the weak links in internal control operations and daily management and control shortcomings in 2025, focus on the core goals of "repairing weaknesses, strengthening execution, improving efficiency, and preventing risks", continue to optimize and improve the internal control management system, and promote internal control management to be deeper and more solid. Focus on the latest regulatory policy changes in the pharmaceutical industry, the company's core business layout and operation development plan, refine and improve the internal control system details in key links such as R&D, production, sales, and finance, fill in process control loopholes, and ensure that the system is adapted to the actual business and consistent with regulatory requirements; strengthen daily supervision, special inspections and penetrating management and control of internal control, and consolidate various departments and subsidiaries The main responsibility of internal control is to improve the long-term closed-loop mechanism of defect inspection, rectification, review and review; deepen the hierarchical classification and practical-oriented internal control compliance training, covering front-line business and grassroots management positions, strengthen the internal control compliance awareness and job execution ability of all employees, continue to consolidate the foundation of internal control management, comprehensively prevent operating and compliance risks, and provide solid internal control guarantee for the company's high-quality and stable development.

3. Description of other significant matters

□Applicable √Not applicable

Chairman (authorized by the board of directors): Xiao Weihong Zhejiang Hisun Pharmaceutical Co., Ltd.

April 3, 2026