Heilongjiang Zhenbaodao Pharmaceutical Co., Ltd. 2025 Internal Control Evaluation Report

Company code: 603567 Company abbreviation: Zhenbaodao

All shareholders of Heilongjiang Zhenbaodao Pharmaceutical Co., Ltd.:

In accordance with the provisions of the "Basic Standards for Enterprise Internal Control" and its supporting guidelines and other internal control regulatory requirements (hereinafter referred to as the Enterprise Internal Control Standard System), combined with the company's (hereinafter referred to as the company's) internal control system and evaluation methods, and on the basis of daily supervision and special supervision of internal control, we evaluated the effectiveness of the company's internal control on December 31, 2025 (the base date of the internal control evaluation report).

1. Important statement

In accordance with the provisions of the enterprise's internal control normative system, it is the responsibility of the company's board of directors to establish, improve and effectively implement internal control, evaluate its effectiveness, and truthfully disclose the internal control evaluation report. The Audit Committee oversees the company's establishment and implementation of internal controls. Managers are responsible for organizing and leading the daily operation of the enterprise's internal controls. The company's board of directors, directors and senior managers guarantee that there are no false records, misleading statements or major omissions in this report, and bear individual and joint legal liability for the authenticity, accuracy and completeness of the report content.

The goal of the company's internal control is to reasonably ensure legal compliance of operation and management, asset safety, authenticity and completeness of financial reports and related information, improve operating efficiency and effectiveness, and promote the realization of development strategies. Due to the inherent limitations of internal control, it can only provide reasonable assurance for achieving the above objectives. In addition, since changes in circumstances may cause internal controls to become inappropriate, or the degree of compliance with control policies and procedures to be reduced, there is a certain risk in inferring the effectiveness of future internal controls based on the results of internal control evaluations.

2. Conclusion of internal control evaluation

1. Whether the company has any major deficiencies in the internal control of financial reporting on the base date of the internal control evaluation report

□Yes √No

2. Conclusion of the evaluation of internal control over financial reporting

√Valid □Invalid

According to the identification of major deficiencies in the company's internal control over financial reporting, there were no major deficiencies in internal control over financial reporting on the base date of the internal control evaluation report. The board of directors believes that the company has maintained effective internal control over financial reporting in all major aspects in accordance with the requirements of the corporate internal control standard system and relevant regulations.

3. Whether significant deficiencies in internal control over non-financial reporting have been discovered

□Yes √No

According to the identification of major deficiencies in the company's internal control over non-financial reporting, the company found no major deficiencies in internal control over non-financial reporting on the base date of the internal control evaluation report.

4. Factors affecting the conclusion of the internal control effectiveness evaluation from the base date of the internal control evaluation report to the issuance date of the internal control evaluation report □ Applicable √ Not applicable

There are no factors that affect the conclusion of the internal control effectiveness evaluation between the base date of the internal control evaluation report and the issuance date of the internal control evaluation report.

5. Whether the internal control audit opinion is consistent with the company’s evaluation conclusion on the effectiveness of internal control over financial reporting

√Yes □No

6. Is the disclosure of major deficiencies in non-financial reporting internal control in the internal control audit report consistent with the disclosure in the company’s internal control evaluation report √ Yes □ No

3. Internal control evaluation work

(1). Scope of internal control evaluation

The company determines the main units, businesses and matters as well as high-risk areas included in the evaluation scope in accordance with the risk-oriented principle.

1. The main units included in the evaluation scope include: the company headquarters and its important subsidiaries

2. Proportion of units included in the evaluation scope:

Indicator proportion (%)

The ratio of the total assets of the units included in the evaluation scope to the total assets of the company's consolidated financial statements is 92.62

The ratio of the total operating income of the units included in the evaluation scope to the total operating income of the company's consolidated financial statements 100.00

3. The main businesses and matters included in the evaluation scope include:

According to the requirements of my country's basic internal control standards and supporting guidelines, combined with the company's operating business characteristics, the scope of this internal control evaluation includes: strategic management, organizational structure management, plan management, budget management, human resources management, sales management, market management, procurement management, business outsourcing, bidding management, fixed asset management, inventory management, intangible asset management, production management, quality management, technology management, information system management, engineering project management, There are 38 cycles in total including R&D management, contract management, EHS safety, environment and health management, financing management, investment management, working capital management, guarantee management, legal affairs management, comprehensive administrative management, corporate culture management, social responsibility management, internal audit management, internal control management, professional ethics compliance and anti-fraud management, financial reporting management, related party transaction management, public relations management, crisis management, information disclosure management, and tax management.

4. High-risk areas of focus include:

Based on risk identification and evaluation, the high-risk areas and core matters covered by this internal control evaluation include: strategic risk, procurement management risk, sales management risk, R&D management risk, production management risk, product quality risk, financial reporting risk, financial and information disclosure risk, contract management risk, financing management risk, human resources risk, asset security risk, etc.

5. The above-mentioned units, businesses, matters and high-risk areas included in the evaluation scope cover the main aspects of the company’s operation and management. Are there any major omissions?

□Yes √No

6. Whether statutory exemptions exist

□Yes √No

7. Other instructions

None

(2). Basis for internal control evaluation and identification standards for internal control deficiencies

The company organizes and carries out internal control evaluation work based on the enterprise's internal control normative system and in conjunction with the company's internal control management and evaluation system.

1. Whether the specific identification standards for internal control deficiencies have been adjusted from previous years

□Yes √No

The company's board of directors distinguished between financial reporting internal control and non-financial reporting internal control based on the company's internal control standard system's identification requirements for major defects, important defects and general defects, combined with company size, industry characteristics, risk preference and risk tolerance and other factors, and studied and determined the specific identification standards for internal control defects applicable to the company, which are consistent with previous years.

2. Standards for identifying deficiencies in internal control over financial reporting

The quantitative standards for the evaluation of internal control deficiencies over financial reporting determined by the company are as follows:

Indicator Name Quantitative Standard for Major Defects Quantitative Standard for Important Defects Quantitative Standard for General Defects Between the most recent fiscal year and less than the most recent fiscal year

greater than the most recent fiscal year

Amount of potential misstatement 1% of total assets in consolidated statements 1% of total assets in consolidated statements

Between 0.5% and 1% (inclusive) 0.5%

Description:

None

The qualitative standards for the evaluation of internal control deficiencies over financial reporting determined by the company are as follows:

Nature of defects Qualitative standards

Material deficiency: A deficiency, alone or in combination with other deficiencies, that results in the inability to timely prevent or detect and correct material misstatements in financial reports. The following situations will be deemed as major defects:

① Directors and senior managers commit fraud and cause significant losses and adverse effects to the enterprise; ② The enterprise corrects major data in the published financial report; ③ The certified public accountant discovers that there is a major misstatement in the current financial report, but the internal control fails to detect the misstatement during operation;

④The audit committee and internal audit institution are ineffective in supervising internal control. Important deficiencies are deficiencies that, alone or together with other deficiencies, cannot be prevented or discovered and corrected in a timely manner in the financial report.

A misstatement that is material but still deserves management's attention.

General deficiencies other internal control deficiencies that do not constitute major deficiencies or important deficiencies. Description:

None

3. Standards for identifying deficiencies in internal control over non-financial reporting

The quantitative standards for the evaluation of non-financial reporting internal control deficiencies determined by the company are as follows:

Indicator Name Quantitative Standard for Major Defects Quantitative Standard for Important Defects Quantitative Standard for General Defects

Greater than the total assets in the consolidated statement. Between the total assets in the consolidated statement. Less than the total assets in the consolidated statement. Direct property losses.

0.5% Between 0.1% and 0.5% (inclusive) 0.1% of the amount explained:

None

The qualitative standards for the evaluation of non-financial reporting internal control deficiencies determined by the company are as follows:

Nature of defects Qualitative standards

Major defects ① Violation of national laws and regulations;

② There is a serious loss of management personnel and technical personnel in key positions;

③ Negative news appears frequently in the media;

④ Lack of institutional control over important business or systematic failure of the system;

⑤The result of the internal control evaluation is that major defects or important defects have not been rectified;

⑥Other situations that have a significant impact on the company.

Important defects: Other circumstances are less severe than major defects in terms of impact and do not cause significant impact. General deficiencies other internal control deficiencies that do not constitute major deficiencies or important deficiencies. Description:

None

(3). Identification and rectification of internal control deficiencies

1. Identification and rectification of internal control deficiencies over financial reporting

1.1. Major defects

Whether the company has any major deficiencies in internal control over financial reporting during the reporting period

□Yes √No

1.2. Important defects

Whether the company has any important deficiencies in internal control over financial reporting during the reporting period

□Yes √No

1.3. General defects

The company's internal control is well implemented. There may be general flaws in the internal control process in daily operations. Since the company's internal control has a dual supervision mechanism of self-evaluation and internal audit, corrective actions will be taken as soon as internal control flaws are discovered and confirmed, so that risks are controllable and will not have a substantial impact on the company's financial reports.

1.4. After the above rectification, on the base date of the internal control evaluation report, does the company have any major deficiencies in the internal control of financial reporting that have not been rectified?

□Yes √No

1.5. After the above rectification, on the base date of the internal control evaluation report, does the company have any important deficiencies in the internal control of financial reporting that have not been rectified?

□Yes √No

2. Identification and rectification of internal control deficiencies in non-financial reporting

2.1. Major defects

Whether the company discovered any major deficiencies in non-financial reporting internal control during the reporting period

□Yes √No

2.2. Important flaws

Whether the company discovered any important deficiencies in non-financial reporting internal control during the reporting period

√Yes □No

According to the above-mentioned identification standards for non-financial reporting internal control deficiencies, the company discovered one important non-financial reporting internal control deficiencies during the reporting period.

within non-financial reports

As of the reporting base date. As of the report issuance date, important deficiencies in departmental control. Defect description. Business area. Defect rectification status/rectification plan.

Whether the rectification has been completed Whether the rectification has been completed

As of the end of December 2025, the controlling shareholder has returned 183.02 million yuan; as of the date of this report, the remaining 50.28 million yuan has been fully returned. At the same time, the controlling shareholder, due to its own demand for funds from the company in December 2025, paid interest on the funds and used the company to advance research and development of 32.951 million yuan.

non-operating funds

Expenses and medicine purchase number Others Measures planned to be taken by the company’s board of directors Yes Yes Occupation

Non-operating measures in the form of funds and other forms: ① The company established a whitelist system for R&D service providers who occupy company funds, and regulated R&D of 233.3 million yuan. Contract milestone payment ratio, sign a breach of contract compensation clause to avoid the recurrence of fund loan; ② Open a special fund account for R&D, focusing on controlling fund payment and payment process; ③ Strengthen the audit department

functions to increase access to large amounts of funds

Dynamic tracking of usage; ④ Practical

Strengthen directors, senior executives and related persons

Training of personnel to improve compliance awareness

awareness; ⑤ Further strengthen the "Risk

"Monitoring and Early Warning Management Measures", set

Research and development of periodic verification of long-term pending accounts

Project current funds; ⑥Establish healthy

Full customer-merchant communication mechanism to block information

Fund management loopholes.

2.3. General defects

The internal control process may have some general defects in daily operation. Since the company's internal control has a dual supervision mechanism of self-evaluation and internal audit, corrective actions will be taken once internal control defects are discovered and confirmed, so that risks are controllable and will not have a substantial impact on the company's financial report.

2.4. After the above rectifications, on the base date of the internal control evaluation report, has the company discovered any major deficiencies in the internal control of non-financial reporting that have not yet been rectified?

□Yes √No

2.5. After the above rectifications, on the base date of the internal control evaluation report, has the company discovered any important deficiencies in the internal control of non-financial reporting that have not yet been rectified?

□Yes √No

4. Description of other major matters related to internal control

1. Rectification of internal control deficiencies in the previous year

□Applicable √Not applicable

2. Internal control operation status this year and improvement directions for the next year

√Applicable □Not applicable

In response to the capital occupation matters that existed in the company's self-examination during the reporting year, the company's board of directors actively urged the management to effectively implement rectification measures, eliminate the adverse effects as soon as possible, continue to strengthen internal audit work, and strengthen capital management and control. Other businesses and matters included in the evaluation scope have improved internal controls and are operating effectively. Information disclosure and financial reports are true and reliable, assets are safe, and the business is legal and compliant, achieving the company's internal control goals. In 2026, the company will make every effort to improve the risk control system and mechanism, strengthen system implementation and supervision and inspection, continue to improve the effectiveness of internal control, and ensure that internal control is consistent with the company's operating scale, business scope and risk level.

3. Description of other significant matters

□Applicable √Not applicable

Chairman (authorized by the board of directors): Yan Jiujiang

Heilongjiang Zhenbaodao Pharmaceutical Co., Ltd. April 30, 2026