2025 Internal Control Evaluation Report

Company code: 603717 Company abbreviation: Tianyu Biotechnology

Tianyu Biotechnology Co., Ltd.

Annual internal control evaluation report

2025

All shareholders of Tianyu Biotechnology Co., Ltd.:

In accordance with the provisions of the "Basic Standards for Enterprise Internal Control" and its supporting guidelines and other internal control regulatory requirements (hereinafter referred to as the Enterprise Internal Control Standard System), combined with the company's (hereinafter referred to as the company's) internal control system and evaluation methods, and on the basis of daily supervision and special supervision of internal control, we evaluated the effectiveness of the company's internal control on December 31, 2025 (the base date of the internal control evaluation report).

1. Important statement

In accordance with the provisions of the enterprise's internal control normative system, it is the responsibility of the company's board of directors to establish, improve and effectively implement internal control, evaluate its effectiveness, and truthfully disclose the internal control evaluation report. The Audit Committee oversees the company's establishment and implementation of internal controls. Managers are responsible for organizing and leading the daily operation of the enterprise's internal controls. The company's board of directors, directors and senior managers guarantee that there are no false records, misleading statements or major omissions in this report, and bear individual and joint legal liability for the authenticity, accuracy and completeness of the report content.

The goal of the company's internal control is to reasonably ensure legal compliance of operation and management, asset safety, authenticity and completeness of financial reports and related information, improve operating efficiency and effectiveness, and promote the realization of development strategies. Due to the inherent limitations of internal control, it can only provide reasonable assurance for achieving the above objectives. In addition, since changes in circumstances may cause internal controls to become inappropriate, or the degree of compliance with control policies and procedures to be reduced, there is a certain risk in inferring the effectiveness of future internal controls based on the results of internal control evaluations.

2. Conclusion of internal control evaluation

1. Whether the company has any major deficiencies in the internal control of financial reporting on the base date of the internal control evaluation report

□Yes √No

2. Conclusion of the evaluation of internal control over financial reporting

√Valid □Invalid

According to the identification of major deficiencies in the company's internal control over financial reporting, there were no major deficiencies in internal control over financial reporting on the base date of the internal control evaluation report. The board of directors believes that the company has maintained effective internal control over financial reporting in all major aspects in accordance with the requirements of the corporate internal control standard system and relevant regulations.

3. Whether significant deficiencies in internal control over non-financial reporting have been discovered

□Yes √No

According to the identification of major deficiencies in the company's internal control over non-financial reporting, the company found no major deficiencies in internal control over non-financial reporting on the base date of the internal control evaluation report.

4. Factors that affect the conclusion of the internal control effectiveness evaluation from the base date of the internal control evaluation report to the issuance date of the internal control evaluation report

□Applicable √Not applicable

There are no factors that affect the conclusion of the internal control effectiveness evaluation between the base date of the internal control evaluation report and the issuance date of the internal control evaluation report.

5. Whether the internal control audit opinion is consistent with the company’s evaluation conclusion on the effectiveness of internal control over financial reporting

√Yes □No

6. Whether the disclosure of major deficiencies in non-financial reporting internal control in the internal control audit report is consistent with the disclosure in the company’s internal control evaluation report

√Yes □No

3. Internal control evaluation work

(1). Scope of internal control evaluation

The company determines the main units, businesses and matters as well as high-risk areas included in the evaluation scope in accordance with the risk-oriented principle.

1. The main units included in the evaluation scope include: the company's headquarters, branches, wholly-owned subsidiaries and holding subsidiaries included in the scope of consolidated statements.

2. Proportion of units included in the evaluation scope:

Indicator Proportion (%) Ratio of the total assets of the units included in the evaluation scope to the total assets of the company's consolidated financial statements 100 Ratio of the total operating income of the units included in the evaluation scope to the total operating income of the company's consolidated financial statements 100

3. The main businesses and matters included in the evaluation scope include:

Development strategy, organizational structure, internal management, human resources, engineering projects, procurement management, contract management, financial management, fund management, financial reporting, asset management, related transactions, external guarantees, sales business, production business, external investment, information communication, information disclosure, internal supervision, etc.

4. High-risk areas of focus include:

Development strategy, capital management, external investment, related transactions, external guarantees, internal management, engineering projects, sales business, production business, contract management, information disclosure, etc.

5. The above-mentioned units, businesses, matters and high-risk areas included in the evaluation scope cover the main aspects of the company’s operation and management. Are there any major omissions?

□Yes √No

6. Whether statutory exemptions exist

□Yes √No

7. Other instructions

None

(2). Basis for internal control evaluation and identification standards for internal control deficiencies

The company organizes and carries out internal control evaluation work based on the enterprise's internal control normative system and the company's relevant management systems and internal control systems.

1. Whether the specific identification standards for internal control deficiencies have been adjusted from previous years

□Yes √No

The company's board of directors determines major defects, important defects and general defects in accordance with the company's internal control standard system and in conjunction with the company's regulations.

Based on factors such as model, industry characteristics, risk preference and risk tolerance, we distinguish between financial reporting internal control and non-financial reporting internal control, and study and determine the specific identification standards for internal control deficiencies applicable to the company, which are consistent with previous years.

2. Standards for identifying deficiencies in internal control over financial reporting

The quantitative standards for the evaluation of internal control deficiencies over financial reporting determined by the company are as follows:

Indicator Name Quantitative Standard for Major Defects Quantitative Standard for Important Defects Quantitative Standard for General Defects Possible Profits 5% of total profits > Misstatement ≥ Profit

Misstatement ≥ 5% of total profit Misstatement < 3% of total profit Total misstatement 3% of total profit

or may result in misstatement of 1% of operating income ≥ operating income

Misstatement ≥ 1% of operating income Misstatement < 0.5% of operating income Total misstatement 0.5% of operating income

or may result in 1% of total assets > misstatement ≥ capital

Misstatement ≥ 1% of total assets Misstatement < 0.5% of total assets Misstatement of total assets Misstatement 0.5% of total assets

Description:

A major defect refers to a combination of one or more control deficiencies that may cause the enterprise to seriously deviate from the control objectives; an important defect refers to a combination of one or more control deficiencies, the severity and economic consequences of which are lower than major deficiencies, but may still cause the enterprise to deviate from the control objectives; general defects are other deficiencies other than major defects and important defects.

The qualitative standards for the evaluation of internal control deficiencies over financial reporting determined by the company are as follows:

Nature of defects Qualitative standards

① The company's directors, supervisors and senior managers commit fraud and cause significant losses and adverse effects to the company; ② The company corrects the published financial statements;

Major deficiencies ③ The certified public accountant discovered that there was a major misstatement in the current financial report, but the company's internal control failed to detect the misstatement during operation;

④The company’s audit committee and audit department’s supervision of internal controls is ineffective.

① Failure to select and apply accounting policies in accordance with the Accounting Standards for Business Enterprises;

② Failure to establish anti-fraud procedures and control measures;

③ There is no corresponding control mechanism established for the accounting processing of non-routine or special transactions and no corresponding compensation for important deficiencies.

sexual mechanism;

④ There are one or more deficiencies in the control of the period-end financial reporting process and there is no reasonable guarantee that the prepared financial statements will achieve true and accurate goals.

General deficiencies other internal control deficiencies that do not constitute major deficiencies or important deficiencies.

Description:

None

3. Standards for identifying deficiencies in internal control over non-financial reporting

The quantitative standards for the evaluation of non-financial reporting internal control deficiencies determined by the company are as follows:

Indicator name Quantitative standard for major defects Quantitative standard for important defects Quantitative standard for general defects Possible profits Misstatement ≥ 5% of total profit 5% of total profit > Misstatement ≥ profit Misstatement < 3% of total profit Total misstatement 3% of total profit

Or it may lead to misstatement of 1% of operating income > 0.5% of total operating income.

Or may lead to Misstatement of total assets > 1% of total assets ≥ Misstatement of assets ≥ 1% of total assets Misstatement < 0.5% of total assets Misstatement of total assets 0.5% of total assets

Description:

None

The qualitative standards for the evaluation of non-financial reporting internal control defects determined by the company are as follows: Nature of defects Qualitative criteria ① serious violation of national laws and regulations and subject to serious fines or criminal liability; ② unscientific decision-making procedures leading to major mistakes; major defects

③ There is a lack of system for important business or the system is systematically failed, and the management overrides internal control; ④ The result of internal control evaluation is a major defect that has not been rectified. ① The company has been severely punished for violating national laws and regulations;

② Improper decision-making procedures lead to important mistakes;

③ There are defects in important business systems or system processes;

Important flaws

④ Violate the company’s internal rules and regulations and cause losses;

⑤ The result of the internal control evaluation is that important deficiencies have not been rectified; ⑥ There is serious loss of personnel in key positions.

General deficiencies other internal control deficiencies that do not constitute major deficiencies or important deficiencies. Description:

None

(3). Identification and rectification of internal control deficiencies

1. Identification and rectification of internal control deficiencies over financial reporting

1.1. Major defects

Whether the company has any major deficiencies in internal control over financial reporting during the reporting period

□Yes √No

1.2. Important defects

Whether the company has any important deficiencies in internal control over financial reporting during the reporting period

□Yes √No

1.3. General defects

None

1.4. After the above rectification, on the base date of the internal control evaluation report, does the company have any major deficiencies in the internal control of financial reporting that have not been rectified?

□Yes √No

1.5. After the above rectification, on the base date of the internal control evaluation report, does the company have any important deficiencies in the internal control of financial reporting that have not been rectified?

□Yes √No

2. Identification and rectification of internal control deficiencies in non-financial reporting

2.1. Major defects

Whether the company discovered any major deficiencies in non-financial reporting internal control during the reporting period

□Yes √No

2.2. Important flaws

Whether the company discovered any important deficiencies in non-financial reporting internal control during the reporting period

□Yes √No

2.3. General defects

None

2.4. After the above rectifications, on the base date of the internal control evaluation report, has the company discovered any major deficiencies in the internal control of non-financial reporting that have not yet been rectified?

□Yes √No

2.5. After the above rectifications, on the base date of the internal control evaluation report, has the company discovered any important deficiencies in the internal control of non-financial reporting that have not yet been rectified?

□Yes √No

4. Description of other major matters related to internal control

1. Rectification of internal control deficiencies in the previous year

√Applicable □Not applicable

In the previous year, according to the identification standards for internal control defects in financial reporting, the company had 1 major defect in internal control over financial reporting (namely, the 2022-2023 financial statements that had been published in the previous period of correction of accounting errors), and the rectification was completed within the previous year and will continue to be standardized in the long term.

2. Internal control operation status this year and improvement directions for the next year

√Applicable □Not applicable

During the year, the company's internal control management system was generally operating well, and no other major or important flaws in the company's internal control design or implementation were found. In 2026, the company will continue to improve the internal control system, standardize the implementation of the internal control system, strengthen the supervision and inspection of the internal control system, improve the ability to prevent risks, improve the level of corporate governance, and ensure the healthy and sustainable development of the company.

3. Description of other significant matters

□Applicable √Not applicable

Chairman (authorized by the board of directors): Mei Xiaoyang Tianyu Biotechnology Co., Ltd.

April 30, 2026