Aoxiang Pharmaceutical 2025 Internal Control Evaluation Report

Company code: 603229 Company abbreviation: Aoxiang Pharmaceutical

Zhejiang Aoxiang Pharmaceutical Co., Ltd.

2025 Internal Control Evaluation Report

All shareholders of Zhejiang Aoxiang Pharmaceutical Co., Ltd.:

In accordance with the provisions of the "Basic Standards for Enterprise Internal Control" and its supporting guidelines and other internal control regulatory requirements (hereinafter referred to as the Enterprise Internal Control Standard System), combined with the company's (hereinafter referred to as the company's) internal control system and evaluation methods, and on the basis of daily supervision and special supervision of internal control, we evaluated the effectiveness of the company's internal control on December 31, 2025 (the base date of the internal control evaluation report).

1. Important statement

In accordance with the provisions of the enterprise's internal control normative system, it is the responsibility of the company's board of directors to establish, improve and effectively implement internal control, evaluate its effectiveness, and truthfully disclose the internal control evaluation report. The Audit Committee oversees the company's establishment and implementation of internal controls. Managers are responsible for organizing and leading the daily operation of the enterprise's internal controls. The company's board of directors, directors and senior managers guarantee that there are no false records, misleading statements or major omissions in this report, and bear individual and joint legal liability for the authenticity, accuracy and completeness of the report content.

The goal of the company's internal control is to reasonably ensure legal compliance of operation and management, asset safety, authenticity and completeness of financial reports and related information, improve operating efficiency and effectiveness, and promote the realization of development strategies. Due to the inherent limitations of internal control, it can only provide reasonable assurance for achieving the above objectives. In addition, since changes in circumstances may cause internal controls to become inappropriate, or the degree of compliance with control policies and procedures to be reduced, there is a certain risk in inferring the effectiveness of future internal controls based on the results of internal control evaluations.

2. Conclusion of internal control evaluation

1. Whether the company has any major deficiencies in the internal control of financial reporting on the base date of the internal control evaluation report

□Yes √No

2. Conclusion of the evaluation of internal control over financial reporting

√Valid □Invalid

According to the identification of major deficiencies in the company's internal control over financial reporting, there were no major deficiencies in internal control over financial reporting on the base date of the internal control evaluation report. The board of directors believes that the company has maintained effective internal control over financial reporting in all major aspects in accordance with the requirements of the corporate internal control standard system and relevant regulations.

3. Whether significant deficiencies in internal control over non-financial reporting have been discovered

□Yes √No

According to the identification of major deficiencies in the company's internal control over non-financial reporting, the company found no major deficiencies in internal control over non-financial reporting on the base date of the internal control evaluation report.

4. Factors affecting the conclusion of the internal control effectiveness evaluation from the base date of the internal control evaluation report to the issuance date of the internal control evaluation report □ Applicable √ Not applicable

There are no factors that affect the conclusion of the internal control effectiveness evaluation between the base date of the internal control evaluation report and the issuance date of the internal control evaluation report.

5. Whether the internal control audit opinion is consistent with the company’s evaluation conclusion on the effectiveness of internal control over financial reporting

√Yes □No

6. Is the disclosure of major deficiencies in non-financial reporting internal control in the internal control audit report consistent with the disclosure in the company’s internal control evaluation report √ Yes □ No

3. Internal control evaluation work

(1). Scope of internal control evaluation

The company determines the main units, businesses and matters as well as high-risk areas included in the evaluation scope in accordance with the risk-oriented principle.

1. The main units included in the evaluation scope include: Zhejiang Aoxiang Pharmaceutical Co., Ltd., Taizhou Aoxiang Technology Co., Ltd., Beijing Aoxiang Kangtai Pharmaceutical Technology Co., Ltd., Aoxiang (Hong Kong) Industrial Co., Ltd., Zhejiang Qizheng Pharmaceutical Co., Ltd., Aoxiang Pharmaceutical (Hangzhou) Co., Ltd.

Co., Ltd., Tsubasa Pharmaceutical Research Institute Co., Ltd.

2. Proportion of units included in the evaluation scope:

Indicator proportion (%)

Ratio of the total assets of the units included in the evaluation scope to the total assets of the company's consolidated financial statements 100 Ratio of the total operating income of the units included in the evaluation scope to the total operating income of the company's consolidated financial statements 100

3. The main businesses and matters included in the evaluation scope include:

Organizational structure, development strategy, human resources, social responsibility, corporate culture, financial activities, procurement business, asset management, sales business, research and development, engineering projects, financial reporting, contract management, information systems, etc.

4. High-risk areas of focus include:

Capital activities, procurement operations, asset management, sales operations, research and development, engineering projects, etc.

5. The above-mentioned units, businesses, matters and high-risk areas included in the evaluation scope cover the main aspects of the company’s operation and management. Are there any major omissions?

□Yes √No

6. Whether statutory exemptions exist

□Yes √No

7. Other instructions

None

(2). Basis for internal control evaluation and identification standards for internal control deficiencies

The company organizes and carries out internal control evaluation work in accordance with relevant regulations such as the corporate internal control standard system and its supporting guidelines.

1. Whether the specific identification standards for internal control deficiencies have been adjusted from previous years

□Yes √No

The company's board of directors distinguished between financial reporting internal control and non-financial reporting internal control based on the company's internal control standard system's identification requirements for major defects, important defects and general defects, combined with company size, industry characteristics, risk preference and risk tolerance and other factors, and studied and determined the specific identification standards for internal control defects applicable to the company, which are consistent with previous years.

2. Standards for identifying deficiencies in internal control over financial reporting

The quantitative standards for the evaluation of internal control deficiencies over financial reporting determined by the company are as follows:

Indicator Name Quantitative Standard for Major Defects Quantitative Standard for Important Defects Quantitative Standard for General Defects Internal control deficiencies may lead to

If it is greater than the operating income, if it is less than the operating income, the loss will be consistent with the profit statement. Defects may lead to errors in the financial statements.

1.5% but less than 3% of 1.5%, the reported amount is greater than 3% of operating income as measured by operating income indicators

Internal control deficiencies may result in or If such deficiencies, alone or in conjunction with other

If it is greater than the total assets, if it is less than the total assets, the loss will be inconsistent with the financial statement errors that may be caused by deficiencies in asset management.

0.5% but less than 1% of 0.5%, the reported amount is greater than 1% of total assets as measured by the total assets index

Description:

None

The qualitative standards for the evaluation of internal control deficiencies over financial reporting determined by the company are as follows:

Nature of defects Qualitative standards

(1) Restate previously published financial statements to reflect the correction of misstatements caused by errors or fraud; major deficiencies (2) The auditor discovered a material misstatement in the company's financial statements for the current period, but the misstatement was not initially discovered by the company's internal control over financial reporting;

(3) The audit committee fails to supervise the company’s external financial reporting and internal control over financial reporting; (4) The compliance supervision function fails, and violations of regulations may have a significant impact on the reliability of financial reports; (5) Any degree of fraud involving senior management is discovered;

(6) Important deficiencies have not been corrected by the management even after a reasonable period of time has elapsed after being reported to the management. Internal control deficiencies involve anti-fraud procedures and controls, internal controls over irregular or non-systematic transactions, and significant deficiencies in comparison with generally accepted accounting standards.

General deficiencies in internal control over the selection and application of accounting policies and internal control over the period-end financial reporting process Other internal control deficiencies that do not constitute a major deficiency or important deficiency

Description:

None

3. Standards for identifying deficiencies in internal control over non-financial reporting

The quantitative standards for the evaluation of non-financial reporting internal control deficiencies determined by the company are as follows:

Indicator Name Quantitative Standard for Major Defects Quantitative Standard for Important Defects Quantitative Standard for General Defects

If it is greater than operating income, if it is less than operating income, the loss will be related to the income statement. Defects may cause financial statement errors.

1.5% but less than 1.5% of 3%, the reported amount is greater than 3% of operating income as measured by operating income indicators

Internal control deficiencies may cause or contribute to

If it is greater than the total assets, if it is less than the total assets, the loss will be related to the asset management deficiencies that may lead to errors in the financial statements.

0.5% but less than 0.5% of 1%, the reported amount is greater than 1% of total assets as measured by the total assets indicator

Description:

None

The qualitative standards for the evaluation of non-financial reporting internal control deficiencies determined by the company are as follows:

Nature of defects Qualitative standards

(1) Serious violation of laws and regulations;

(2) In addition to policy reasons, the company has suffered losses for consecutive years and continued operations have been challenged;

(3) Lack of institutional control over important businesses or systematic failure of the system;

(4) Subsidiaries lack internal control and have scattered management;

major defects

(5) Middle and high-level managers have resigned one after another, or there has been a serious loss of personnel in key positions;

(6) Frequent exposure of negative news in the media;

(7) The results of the internal control evaluation, especially the major or important defects, have not been rectified; (8) The company has been punished by national government departments and has been officially disclosed to the outside world, which has a negative impact on the disclosure of the company's regular reports. Important defects: Except for other circumstances identified as major defects, they are determined according to the degree of impact.

General defects: Except for other situations identified as major defects or important defects, they are determined according to the degree of impact.

Description:

None

(3). Identification and rectification of internal control deficiencies

1. Identification and rectification of internal control deficiencies over financial reporting

1.1. Major defects

Whether the company has any major deficiencies in internal control over financial reporting during the reporting period

□Yes √No

1.2. Important defects

Does the company have any important deficiencies in internal control over financial reporting during the reporting period? Yes √ No

1.3. General defects

None

1.4. After the above rectification, on the base date of the internal control evaluation report, does the company have any major deficiencies in the internal control of financial reporting that have not been rectified?

□Yes √No

1.5. After the above rectification, on the base date of the internal control evaluation report, does the company have any important deficiencies in the internal control of financial reporting that have not been rectified?

□Yes √No

2. Identification and rectification of internal control deficiencies over non-financial reporting 2.1. Major deficiencies

Did the company discover any major deficiencies in non-financial reporting internal control during the reporting period Yes √ No

2.2. Important flaws

Did the company discover any important deficiencies in non-financial reporting internal control during the reporting period Yes √ No

2.3. General defects

None

2.4. After the above rectifications, on the base date of the internal control evaluation report, has the company discovered any major deficiencies in the internal control of non-financial reporting that have not yet been rectified?

□Yes √No

2.5. After the above rectifications, on the base date of the internal control evaluation report, has the company discovered any important deficiencies in the internal control of non-financial reporting that have not yet been rectified?

□Yes √No

4. Description of other major matters related to internal control

1. Rectification of internal control deficiencies in the previous year

□Applicable √Not applicable

2. Internal control operation status this year and improvement direction for the next year □Applicable √Not applicable

3. Description of other significant matters

□Applicable √Not applicable

Chairman (authorized by the board of directors): Zheng Zhiguo Zhejiang Aoxiang Pharmaceutical Co., Ltd.

April 27, 2026