Kangmei Pharmaceutical 2025 Internal Control Evaluation Report

Company code: 600518 Company abbreviation: Kangmei Pharmaceutical

Kangmei Pharmaceutical Co., Ltd.

2025 Internal Control Evaluation Report

All shareholders of Kangmei Pharmaceutical Co., Ltd.:

In accordance with the provisions of the "Basic Standards for Enterprise Internal Control" and its supporting guidelines and other internal control regulatory requirements (hereinafter referred to as the Enterprise Internal Control Standard System), combined with the company's (hereinafter referred to as the company's) internal control system and evaluation methods, and on the basis of daily supervision and special supervision of internal control, we evaluated the effectiveness of the company's internal control on December 31, 2025 (the base date of the internal control evaluation report).

1. Important statement

In accordance with the provisions of the enterprise's internal control normative system, it is the responsibility of the company's board of directors to establish, improve and effectively implement internal control, evaluate its effectiveness, and truthfully disclose the internal control evaluation report. The Audit Committee oversees the company's establishment and implementation of internal controls. Managers are responsible for organizing and leading the daily operation of the enterprise's internal controls. The company's board of directors, directors and senior managers guarantee that there are no false records, misleading statements or major omissions in this report, and bear individual and joint legal liability for the authenticity, accuracy and completeness of the report content.

The goal of the company's internal control is to reasonably ensure legal compliance of operation and management, asset safety, authenticity and completeness of financial reports and related information, improve operating efficiency and effectiveness, and promote the realization of development strategies. Due to the inherent limitations of internal control, it can only provide reasonable assurance for achieving the above objectives. In addition, since changes in circumstances may cause internal controls to become inappropriate, or the degree of compliance with control policies and procedures to be reduced, there is a certain risk in inferring the effectiveness of future internal controls based on the results of internal control evaluations.

2. Conclusion of internal control evaluation

1. Whether the company has any major deficiencies in the internal control of financial reporting on the base date of the internal control evaluation report

□Yes √No

2. Conclusion of the evaluation of internal control over financial reporting

√Valid □Invalid

According to the identification of major deficiencies in the company's internal control over financial reporting, there were no major deficiencies in internal control over financial reporting on the base date of the internal control evaluation report. The board of directors believes that the company has maintained effective internal control over financial reporting in all major aspects in accordance with the requirements of the corporate internal control standard system and relevant regulations.

3. Whether significant deficiencies in internal control over non-financial reporting have been discovered

□Yes √No

According to the identification of major deficiencies in the company's internal control over non-financial reporting, the company found no major deficiencies in internal control over non-financial reporting on the base date of the internal control evaluation report.

4. Factors that affect the conclusion of the internal control effectiveness evaluation from the base date of the internal control evaluation report to the issuance date of the internal control evaluation report

□Applicable √Not applicable

There are no factors that affect the conclusion of the internal control effectiveness evaluation between the base date of the internal control evaluation report and the issuance date of the internal control evaluation report.

5. Whether the internal control audit opinion is consistent with the company’s evaluation conclusion on the effectiveness of internal control over financial reporting

√Yes □No

6. Whether the disclosure of major deficiencies in non-financial reporting internal control in the internal control audit report is consistent with the disclosure in the company’s internal control evaluation report

√Yes □No

3. Internal control evaluation work

(1). Scope of internal control evaluation

The company determines the main units, businesses and matters as well as high-risk areas included in the evaluation scope in accordance with the risk-oriented principle.

1. The main units included in the evaluation scope include: (1) Kangmei Pharmaceutical Co., Ltd. headquarters; (2) Kangmei Smart Pharmacy (Yunnan) Co., Ltd.; (3) Kangmei Traditional Chinese Medicine Center (Guangdong) Co., Ltd.; (4) Kangmei (Puning) Traditional Chinese Medicine City Commercial Management Co., Ltd. (5) Guangdong Kangmei Traditional Chinese Medicine Center (Guangdong) Co., Ltd. Kangmei Pharmaceutical Co., Ltd.; (6) Kangmei (Shenzhen) E-Commerce Co., Ltd.; (7) Guangdong Kangmeitong Information Service Co., Ltd.; (8) Kangmei Traditional Chinese Medicine City (Puning) Co., Ltd.; (9) Kangmei Times (Guangdong) Development Co., Ltd.; (10) Kangmei Pharmacy Chain Co., Ltd. Company; (11) Kangmei (Puning) Hospital Investment Management Co., Ltd.; (12) Shanghai Kangfeng Pharmaceutical Co., Ltd.; (13) Kangmei Health Industry Investment Co., Ltd.; (14) Kangmei Gansu Western Traditional Chinese Medicine City Co., Ltd.; (15) Kangmei (Shenzhen) Pharmaceutical Co., Ltd.; ( 16) Kangmei Chinese Medicine City (Qinghai) Co., Ltd.; (17) Guangdong Kangmei Xinao Pharmaceutical Co., Ltd.; (18) Shanghai Detang Chinese Medicine Co., Ltd.; (19) Kangmei Huada Gene Technology Co., Ltd.; (20) Chengdu Kangmei Pharmaceutical Co., Ltd.; (21) Kangmei Tengwangge ( Sichuan) Pharmaceutical Co., Ltd.; (22) Kangmei Baoning (Sichuan) Pharmaceutical Co., Ltd.; (23) Kangmei (Jieyang) Pharmaceutical Co., Ltd.; (24) Chongqing Ruitai Pharmaceutical Co., Ltd.; (25) Kangmei Xinkaihe (Jilin) Pharmaceutical Co., Ltd.; (26) Guangdong Kangmei Guanxian Pharmaceutical Co., Ltd.; (27) Guangdong Huayuan Shite Tiande Pharmaceutical Co., Ltd.; (28) Shanghai Meifeng Food Co., Ltd.; (29) Shanghai Jinxiang Food Co., Ltd.; (30) Kangmei (Huilai) Traditional Chinese Medicine Cultivation Co., Ltd.; (31) Guangdong Kangmei Logistics Co., Ltd.; ( 32) Beijing Kangmei Pharmaceutical Co., Ltd.; (33) Beijing Kangmei Kanglai Pharmaceutical Co., Ltd.; (34) Kangmei (Bozhou) Huatuo International Traditional Chinese Medicine City Commercial Co., Ltd.; (35) Kangmei (Bozhou) Century Sinopharm Co., Ltd.; (36) Bozhou New World Trading Co., Ltd.; (37) Kangmei (Bozhou) Huatuo International Chinese Medicine City Co., Ltd.; (38) Kangmei Gansu Pharmaceutical Co., Ltd.; (39) Kangmei (Bozhou) Supply Chain Co., Ltd.; (40) Qinghai Kangmei Traditional Chinese Medicine City Business Management Co., Ltd.; (41) Kangmei Pharmaceutical (Hong Kong) Co., Ltd.

2. Proportion of units included in the evaluation scope:

Indicator proportion (%)

Ratio of the total assets of the units included in the evaluation scope to the total assets of the company's consolidated financial statements 99.65 Ratio of the total operating income of the units included in the evaluation scope to the total operating income of the company's consolidated financial statements 99.95

3. The main businesses and matters included in the evaluation scope include:

Organizational structure, development strategy, human resources, social responsibility, corporate culture, financial activities, procurement business, asset management, sales business, research and development, engineering projects, financial reports, comprehensive budget, contract management, internal information transmission, information systems, etc.

4. High-risk areas of focus include:

Development strategy management, human resources management, seal management, capital activity management, procurement business management, asset management, inventory management, sales business management, engineering project management, contract management, investment management, research and development management, related transaction management, information system management, etc.

5. The above-mentioned units, businesses, matters and high-risk areas included in the evaluation scope cover the main aspects of the company’s operation and management. Are there any major omissions?

□Yes √No

6. Whether statutory exemptions exist

□Yes √No

7. Other instructions

Kangmei (Yulin) Traditional Chinese Medicine Industrial Park Co., Ltd., Kangmei Traditional Chinese Medicine City (Yulin) Co., Ltd., Kangmei Traditional Chinese Medicine Data Information Service Co., Ltd., Kangmei (Guangdong) Traditional Chinese Medicine Trading Center Co., Ltd., Shenzhen Qianhai Kangmei International Supply Chain Management Co., Ltd., Kangmei (Beijing) Pharmaceutical Research Institute Co., Ltd., Guangdong Kangmei Pharmaceutical Research Institute Co., Ltd., Kangmei Health Industry Co., Ltd., Guangdong Kangmei Smart Pharmacy Co., Ltd., Kangmei Pharmaceutical (Kunming) Germplasm Resources Co., Ltd. and other enterprises have small business scales. According to the principle of importance, the above-mentioned enterprises are not included in the scope of this internal control evaluation.

(2). Basis for internal control evaluation and identification standards for internal control deficiencies

The company organizes and carries out internal control evaluation work in accordance with the enterprise's internal control normative system and other relevant regulations.

1. Whether the specific identification standards for internal control deficiencies have been adjusted from previous years

□Yes √No

The company's board of directors determines major defects, important defects and general defects in accordance with the company's internal control standard system and in conjunction with the company's regulations.

Based on factors such as model, industry characteristics, risk preference and risk tolerance, we distinguish between financial reporting internal control and non-financial reporting internal control, and study and determine the specific identification standards for internal control deficiencies applicable to the company, which are consistent with previous years.

2. Standards for identifying deficiencies in internal control over financial reporting

The quantitative standards for the evaluation of internal control deficiencies over financial reporting determined by the company are as follows:

Indicator Name Quantitative Standard for Major Defects Quantitative Standard for Important Defects Quantitative Standard for General Defects

Misstatement ≥ 5% of total profit 3% of total profit ≤ Misstatement < profit Misstatement < 3% of total profit ○1 Total profit potential

5% of total amount

Misstatement

Misstatement ≥ 1% of total assets 0.5% of total assets ≤ Misstatement < Misstatement < 0.5% of total assets ○2 Potential of total assets

1% of total assets

Misstatement

Misstatement ≥ 0.3% of total operating income ≤ Misstatement ＜ ○3 of total operating income Potential operating income

0.5% reported <0.5% of total operating income 0.3%

Misstatement

Misstatement ≥ 0.5% of total owners’ equity Misstatement < ○4 of total owners’ equity Potential owners’ equity

1% ≤misstatement＜total owners’ equity 0.5%

1% of misstatements

Description:

The final defect rating is: MIN (①, ②, ③, ④)

The qualitative standards for the evaluation of internal control deficiencies over financial reporting determined by the company are as follows:

Nature of defects Qualitative standards

Major deficiencies: (1) Fraud by directors, supervisors and senior managers; (2) Corrections to published financial reports (non-text typos); (3) External audits found significant misstatements in the current financial statements, but internal controls failed to detect the misstatements during operation; (4) Ineffective supervision of financial internal controls by the internal audit function; (5) Other deficiencies that may affect the correct judgment of statement users (measured by senior management).

Important deficiencies: (1) Accounting policies are not selected and applied in accordance with generally accepted accounting principles; (2) Anti-fraud procedures and control measures are not established; (3) Corresponding control mechanisms are not established or implemented and there are no corresponding compensatory controls for the accounting treatment of non-routine or special transactions; (4) There are one or more deficiencies in the control of the period-end financial reporting process and there is no reasonable guarantee that the prepared financial statements achieve true and complete objectives.

General deficiencies are other control deficiencies that are not major deficiencies and important deficiencies.

Description:

None.

3. Standards for identifying deficiencies in internal control over non-financial reporting

The quantitative standards for the evaluation of non-financial reporting internal control deficiencies determined by the company are as follows:

Indicator name Quantitative standard for major defects Quantitative standard for important defects Quantitative standard for general defects Direct property loss Amount of more than 50,000 yuan 20,000 yuan to 50,000 yuan (inclusive) Less than 20,000 yuan (inclusive)

Description:

None.

The qualitative standards for the evaluation of non-financial reporting internal control deficiencies determined by the company are as follows:

Nature of defects Qualitative standards

Major deficiencies: (1) Violation of national laws and regulations and penalties; (2) Serious loss of middle- and senior-level managers and senior technical personnel; (3) Lack of institutional control of important businesses or systematic system failure; (4) Frequent negative news in the media, involving a wide range of areas; (5) Major mistakes in decision-making procedures; (6) Major flaws in internal control have not been rectified.

Important deficiencies: (1) Violation of internal rules, resulting in losses; (2) Serious loss of business personnel in key positions; (3) Defects in important business system controls or systems; (4) Negative news in the media, involving local areas; (5) General errors caused by decision-making procedures; (6) Important deficiencies in internal control have not been rectified.

General defects: (1) Violation of internal rules, but no losses were caused; (2) Severe loss of business personnel in general positions; (3) Defects in general business system controls or systems; (4) Negative news in the media, but little impact; (5) Inefficient decision-making procedures; (6) General defects in internal control have not been rectified.

Description:

None.

(3). Identification and rectification of internal control deficiencies

1. Identification and rectification of internal control deficiencies over financial reporting

1.1. Major defects

Did the company have any major deficiencies in internal control over financial reporting during the reporting period Yes √ No

1.2. Important defects

Does the company have any important deficiencies in internal control over financial reporting during the reporting period? Yes √ No

1.3. General defects

In response to the general deficiencies in internal control discovered during the reporting period, the company carefully analyzed the reasons, required all relevant units (departments) to formulate corresponding rectification measures, and immediately carried out rectifications to make the risks controllable.

1.4. After the above rectification, on the base date of the internal control evaluation report, does the company have any major deficiencies in the internal control of financial reporting that have not been rectified?

□Yes √No

1.5. After the above rectification, on the base date of the internal control evaluation report, does the company have any important deficiencies in the internal control of financial reporting that have not been rectified?

□Yes √No

2. Identification and rectification of internal control deficiencies in non-financial reporting

2.1. Major defects

Whether the company discovered any major deficiencies in non-financial reporting internal control during the reporting period

□Yes √No

2.2. Important flaws

Whether the company discovered any important deficiencies in non-financial reporting internal control during the reporting period

□Yes √No

2.3. General defects

The company's evaluation found that there were general deficiencies in contract management, sales operations, asset management, etc., but these did not affect the achievement of control objectives. In response to the general deficiencies in internal control discovered during the reporting period, the company carefully analyzed the causes and required all relevant units (departments) to formulate corresponding rectification measures and rectification plans and clarify rectification responsibilities. Problems in the internal control system require revision and improvement, and problems in the implementation of internal control require strengthening management and standardizing operations.

2.4. After the above rectifications, on the base date of the internal control evaluation report, has the company discovered any major deficiencies in the internal control of non-financial reporting that have not yet been rectified?

□Yes √No

2.5. After the above rectifications, on the base date of the internal control evaluation report, has the company discovered any important deficiencies in the internal control of non-financial reporting that have not yet been rectified?

□Yes √No

4. Description of other major matters related to internal control

1. Rectification of internal control deficiencies in the previous year

√Applicable □Not applicable

No major defects or important defects in the company's internal control over financial and non-financial reporting were found during the previous reporting period. Addresses general deficiencies in internal controls identified during the previous year. The company designated a defect rectification coordinating department to immediately analyze the causes of each defect one by one and formulate targeted rectification measures, identify the responsible units, and require rapid advancement and implementation of rectification. Through the rapid response, active cooperation and mutual coordination of all units of the company, defect rectification measures have been basically implemented or compensatory measures have been taken to reduce risks, and the defects have been eliminated.

2. Internal control operation status this year and improvement directions for the next year

√Applicable □Not applicable

During the reporting period, the company established internal controls on the businesses and matters included in the evaluation scope and implemented them effectively. However, it was also found that there was still room for improvement in contract management, sales management, asset management, etc. In 2026, the company will follow the requirements of the "Basic Standards for Corporate Internal Control" and supporting guidelines, based on the company's strategic planning and business development needs, and focusing on the rectification of internal control deficiencies, continue to improve the construction of the internal control system, strengthen the internal control awareness of all employees, improve the level of information management and control, continuously consolidate the effectiveness of internal control, and ensure the company's sustainable and healthy development.

3. Description of other significant matters

□Applicable √Not applicable

Chairman (authorized by the board of directors): Lai Zhijian Kangmei Pharmaceutical Co., Ltd.

April 16, 2026