ST Tiansheng: 2025 Internal Control Evaluation Report

Tiansheng Pharmaceutical Group Co., Ltd.

2025 Internal Control Evaluation Report

All shareholders of Tiansheng Pharmaceutical Group Co., Ltd.:

In order to further strengthen and standardize the company's internal control, improve the company's operation and management level and risk prevention capabilities, promote the company's standardized operation and healthy development, and safeguard the legitimate rights and interests of all shareholders and stakeholders, in accordance with the provisions of the "Basic Standards for Enterprise Internal Control" and its supporting guidelines and other internal control regulatory requirements (hereinafter referred to as "Enterprise "Internal Control Standard System"), combined with the "Articles of Association" and other provisions, the company has comprehensively established and improved the internal control system, effectively implemented the requirements of relevant system standards, strengthened the supervision and inspection of the implementation of the internal control system, continuously improved the governance level, promoted the standardized operation of the enterprise, effectively prevented business decision-making and management risks, and ensured the company's stable operation. On the basis of daily supervision and special supervision of internal control, we evaluated the effectiveness of the company's internal control work as of December 31, 2025 (the base date of the internal control evaluation report).

1. Important statement

In accordance with the provisions of the enterprise's internal control normative system, it is the responsibility of the company's board of directors to establish, improve and effectively implement internal control, evaluate its effectiveness, and truthfully disclose the internal control evaluation report. The Audit Committee oversees the establishment and implementation of internal controls by the Board of Directors. Managers are responsible for organizing and leading the daily operation of the enterprise's internal controls. The company's board of directors, directors and senior managers guarantee that there are no false records, misleading statements or major omissions in this report, and bear individual and joint legal liability for the authenticity, accuracy and completeness of the report content.

The goal of the company's internal control is to reasonably ensure legal compliance of operation and management, asset safety, authenticity and completeness of financial reports and related information, improve operating efficiency and effectiveness, and promote the realization of development strategies. Due to the inherent limitations of internal control, it can only provide reasonable assurance for achieving the above objectives. In addition, since changes in circumstances may cause internal controls to become inappropriate, or the degree of compliance with control policies and procedures to be reduced, there is a certain risk in inferring the effectiveness of future internal controls based on the results of internal control evaluations.

2. Conclusion of internal control evaluation

According to the identification of major deficiencies in the company's internal control over financial reporting, there were no major deficiencies in internal control over financial reporting on the base date of the internal control evaluation report. The board of directors believes that the company has maintained effective internal control over financial reporting in all major aspects in accordance with the requirements of the corporate internal control standard system and relevant regulations.

According to the identification of major deficiencies in the company's internal control over non-financial reporting, the company found no major deficiencies in internal control over non-financial reporting on the base date of the internal control evaluation report.

There are no factors that affect the conclusion of the internal control effectiveness evaluation between the base date of the internal control evaluation report and the issuance date of the internal control evaluation report.

3. Internal control evaluation work

(1) Scope of internal control evaluation

The company determines the units, businesses and matters included in the evaluation scope as well as high-risk areas in accordance with the risk-oriented principle. The units included in the evaluation scope include the company and its subsidiaries included in the scope of the consolidated financial statements. The total assets of the units included in the evaluation scope account for 100% of the total assets of the company's consolidated financial statements, and the total operating income accounts for 100% of the total operating income of the company's consolidated financial statements.

1. Main businesses and matters included in the evaluation scope:

Operational management level: governance structure, organizational structure, human resources, corporate culture;

Accounting management level: financial reporting;

Business control level: sales and collection, procurement and payment, production and warehousing, research and development, fixed asset management, engineering project management, monetary fund management, financing, external investment, external guarantee, related transactions, environmental protection, information and communication;

Internal oversight level: internal audit.

High-risk areas of focus include sales management risks, procurement management risks, R&D management risks, capital activity risks, asset management risks, accounting information risks, etc.

2. Implementation of key internal control activities

(1) Management control of wholly-owned and holding subsidiaries

The company has established a management system for wholly-owned and holding subsidiaries, and plans the development and investment direction of subsidiaries in a unified manner to make them obey and serve the company's overall strategic plan. The company strictly manages its wholly-owned subsidiaries, formulates unified financial and administrative personnel systems, and sets up a strict authorization management system. The company provides guidance on major matters, financial management, information management, etc. At the same time, the company implements a comprehensive budget management system for its wholly-owned subsidiaries.

(2) Control of related transactions and external guarantees

Related party transaction control follows the principles of good faith, equality, voluntariness, fairness and openness to ensure that related party transactions do not harm the interests of the company and other shareholders. When carrying out related-party transactions, we should carefully select the transaction parties by understanding the integrity record, credit status, performance ability, etc. of the other party to prevent the company's interests from being occupied or transferred by the controlling shareholder and its related parties. The company's articles of association stipulate the review procedures for related-party transactions and requirements for avoidance of voting: Directors who are related to the enterprise involved in the resolutions of the board of directors meeting may not exercise voting rights on the resolution, nor may they exercise voting rights on behalf of other directors. The board meeting can be held if more than half of the unrelated directors are present, and resolutions made at the board meeting must be passed by more than half of the unrelated directors. If the number of unrelated directors present at the board of directors is less than 3, the matter shall be submitted to the shareholders' meeting for review; before reviewing the related transactions that should be disclosed, the company shall submit relevant materials to the independent directors in a timely manner, and the independent directors shall convene a special meeting and obtain the consent of more than half of all independent directors before submitting the matter to the board of directors for review. The company's external guarantee control will follow the principles of legality, prudence, mutual benefit and safety, and strictly control guarantee risks. The "Articles of Association" clarify the approval authority of the shareholders' meeting and the board of directors regarding external guarantee matters. If the debt guaranteed by the company needs to be extended after maturity and needs to continue to provide guarantees, the company will treat it as a new external guarantee and go through the guarantee approval process again.

(3) Production management

The company has formulated control systems such as the "Production Planning, Procurement and Logistics Management Regulations", "Fixed Asset Management System", "Inventory Management System", "Property Inventory System", "Functional Department Functions and Responsibilities", etc., and has carried out strict control and management of the company's production processes, production job responsibilities, production assessment standards, product quality inspection, safety management and other aspects to ensure the company's product quality and safe production.

(4) Procurement and payment management

The company has formulated the "Production Planning, Procurement and Logistics Management Regulations", "Material Procurement Management System", "Procurement and Payment Management System", "Procurement and Warehouse Management System", "Supplier Safety Management Regulations", The "File Management Measures" and other systems regulate and control the procurement and payment processes. The above systems cover the supplier evaluation procedures, price inquiry and price comparison procedures, procurement contract conclusion, payment of payables, and reconciliation of accounts. They clearly describe the responsibilities and authorities of each position and ensure the separation of incompatible positions. Material procurement is implemented in accordance with the company's annual production plan. The procurement application clarifies key elements such as procurement category, quality level, specifications, quantity, and standards. The purchase requisition record is true and complete. The approval process at all levels in the procurement process is implemented in place. The acceptance and receipt procedures are complete. The procurement department collects invoices in a timely manner and sends them to the finance department. The payment procedures are reasonable. The internal control of the company's procurement and payment during the reporting period is effective.

(5) Sales and collection management

Sales are the core link for a company to achieve profitability, and the cash flow generated by sales collections is the lifeline of a company's ongoing operations. Therefore, the company strictly controls the sales and payment collection processes to ensure timely recovery of payment and minimize bad debt losses. In order to achieve the aforementioned goals, the company has set up corresponding internal control systems based on the characteristics of the sales and collection business processes, such as: combining the annual sales budget, formulating a rolling sales plan in installments, reasonably determining product prices, efficiently organizing production, controlling production progress, ensuring on-time delivery, and ensuring supply. , production and sales plans; strengthen the confirmation of receipts before shipment, strengthen the daily management of receivables for customers with credit lines, collect overdue payments in a timely manner and identify the reasons, make provision for bad debts in accordance with regulations, and write off bad and bad debts must be approved by the company's management. The system clarifies the job responsibilities of each department in the marketing center, and sets the principle of separation and restriction of incompatible positions that handle sales and collection business. Through the above system, the company strictly regulates market requests for goods, credit applications, goods shipments, signing of sales contracts, invoice management, returns and exchanges, collection of accounts receivable, verification management, bad debt write-off, etc., and sorts out and adjusts the system and process based on annual sales to ensure that the sales system meets the requirements of the market and company management. During the reporting period, the company's internal control over sales and collection was effective.

(6) Management and control of major investment and financing

In the "Articles of Association", the company has clarified the approval authority of the shareholders' meeting and the board of directors for major investments and financing, and formulated corresponding review procedures so that the company's investment and financing management follows the principles of legality, prudence, safety and effectiveness, focusing on controlling investment risks and ensuring investment returns. At the same time, we should pay attention to financing efficiency and reasonably arrange necessary external financing.

(7) Major financial decision-making system

The establishment of the company's major financial decision-making system has standardized the company's investment management behavior, effectively exerted its capital operation function, prevented investment risks, ensured the safety and value-added of the company's investments, and improved the return on investment.

(8) Accounting and financial management system

In order to standardize the company's accounting and financial management, strengthen financial supervision, and improve the economic benefits of the enterprise, the company's accounting and financial management and other financial internal control systems have been formulated in accordance with the "Business Accounting Standards" and "Internal Accounting Control Standards" and combined with the company's specific conditions. Operating according to the financial internal control system, it standardizes the planning, execution, control, analysis, prediction and assessment of the company's financial revenue and expenditure, provides the enterprise with true and complete accounting information, and ensures the accuracy and reliability of financial reports.

(9) Personnel management system and salary and welfare security system

In accordance with relevant national laws and regulations and combined with the company's own business characteristics, a series of internal control systems for personnel management have been formulated and improved. At the same time, relevant internal control systems such as salary and benefits have been formulated, which not only improves the survival of the fittest mechanism and enhances employees' competitive awareness, but also protects employees' legitimate rights and interests and relieves employees' worries.

(10) Internal audit system

In order to strengthen the company's internal audit work and establish and improve the company's internal audit system, the "Internal Audit System" and other rules and regulations were formulated in accordance with the relevant national laws and regulations and in conjunction with the company's actual situation. It standardizes the responsibilities and powers of the company's internal audit institutions and personnel, laying the foundation for the company to prevent risks and strengthen management control.

(2) Internal control evaluation work basis and internal control defect identification standards

The company organizes and carries out internal control evaluation work in accordance with the corporate internal control standard system and relevant internal rules and regulations of the company, combined with its own business model.

The company's board of directors differentiated between financial reporting internal control and non-financial reporting internal control based on the company's internal control standard system's identification requirements for major defects, important defects and general defects, combined with factors such as company size, industry characteristics, risk preference and risk tolerance, and studied and determined the specific identification standards for internal control defects applicable to the company. The standards for identifying internal control deficiencies determined by the company are as follows:

1. Standards for identifying deficiencies in internal control over financial reporting

The company divides deficiencies in internal control over financial reporting into major deficiencies, important deficiencies and general deficiencies, and the identification standards adopted directly depend on the importance of misstatements in financial reporting that may be caused by the existence of internal control deficiencies. This importance mainly depends on two factors: (1) Whether the defect has a reasonable possibility of causing the company's internal control to be unable to prevent or detect and correct financial report misstatements in a timely manner. (2) The magnitude of the potential misstatement that the defect may cause alone or together with other deficiencies. If an internal control deficiency, alone or together with other deficiencies, has a reasonable possibility of preventing or detecting and correcting material misstatements in financial reports in a timely manner, the deficiency is deemed to be a material deficiency.

(1) The quantitative standards for the evaluation of internal control deficiencies in financial reporting determined by the company are as follows:

Items of importance General defects Important defects Major defects

3% of total profit ≤ misstatement < profit

Potential misstatement of total profit Misstatement < 3% of total profit Misstatement ≥ 5% of total profit 5% of total profit

0.5% of total assets ≤ misstatement < assets

Potential misstatement of total assets Misstatement < 0.5% of total assets Misstatement ≥ 1% of total assets

1% of the total

Potential misstatement of operating income Misstatement < total operating income 0.5% of total operating income ≤ misstatement < misstatement ≥ total operating income Items of importance General defects Important defects Major defects

0.5% 1% of total operating income 1%

Potential errors in owners’ equity 1% of owners’ equity ≤ misstatement < all misstatements ≥ total owners’ equity

Misstatement <1% of owners’ equity

Report 2% of 2% of total owners’ equity

(2) The qualitative standards for the evaluation of internal control deficiencies in financial reporting determined by the company are as follows:

Types of Defects Qualitative Criteria for Evaluating Defects in Internal Control over Financial Reporting

1. The company’s directors, supervisors and senior managers commit fraud and cause important losses and adverse effects to the company

2. Major deficiencies in internal control over financial reporting that have been discovered and reported to management have not been rectified after a reasonable period of time.

3. Discover significant accounting errors in previous years and correct the disclosed financial reports

major defects

4. The company’s internal control environment is ineffective

5. The certified public accountant discovered that there was a material misstatement in the current financial report, but the misstatement was not discovered during the company's internal control operation.

6. The audit committee and internal audit institution are ineffective in supervising internal control.

7. Failure to select and apply accounting policies in accordance with generally accepted accounting principles

8. Anti-fraud procedures and control measures have not been established or are ineffective

9. There is no corresponding control mechanism established or implemented for the accounting processing of non-routine or special transactions, and there are no corresponding compensatory important defects.

control

4. There are one or more deficiencies in the control of the period-end financial reporting process and there is no reasonable guarantee that the prepared financial statements will achieve true and accurate goals.

General deficiencies: other deficiencies in internal control over financial reporting other than major deficiencies and important deficiencies

2. Standards for identifying deficiencies in internal control over non-financial reporting

(1) The quantitative standards for the evaluation of non-financial reporting internal control deficiencies determined by the company are as follows:

Items of importance General defects Important defects Major defects

3% of total profit ≤ loss < profit

Amount of direct property loss Loss < 3% of total profit Loss ≥ 5% of total profit

5% of total amount

(2) The qualitative standards for the evaluation of non-financial reporting internal control deficiencies determined by the company are as follows:

Types of Defects Qualitative Criteria for Evaluating Defects in Internal Control over Non-Financial Reporting

1. Violation of decision-making procedures and major mistakes in major matters

2. Violate national laws and regulations, be punished by government departments, and have a significant negative impact on the company's regular report disclosures

3. Serious loss of senior managers and senior technical personnel

major defects

4. Negative news frequently appears in the media and is true, causing significant social impact.

5. Lack of institutional control of important business or systematic failure of the system, resulting in significant losses determined according to quantitative standards

6. Major defects in non-financial reporting internal control that have been discovered and reported to management have not been rectified within a reasonable time. Type of defect. Qualitative standard for evaluation of non-financial reporting internal control defects.

7. Major safety production, environmental protection, product quality or service accidents occur

8. The democratic decision-making process exists but is not perfect or there are errors in the decision-making process.

9. Violated national laws and regulations and was punished by government departments, but it did not have a negative impact on the company's regular report disclosures.

10. There are major flaws in the implementation of important business systems

Important flaws

4. Serious loss of business personnel in key positions

5. Negative news appears in the media and affects local areas.

6. Important deficiencies in non-financial reporting internal control that have been discovered and reported to management have not been rectified within a reasonable time.

7. The company’s decision-making process is inefficient, affecting the company’s production and operations.

8. Company employees violate internal rules and cause general losses to the company

General defects 3. Negative news appears in the media, but the impact is not significant

4. There are defects in the company’s general business rules or systems

5. The company’s general defects have not been rectified

(3) Identification and rectification of internal control deficiencies

1. Identification and rectification of internal control deficiencies in financial reporting

According to the above-mentioned identification standards of internal control deficiencies in financial reporting, the company did not have any major deficiencies or important deficiencies in internal control over financial reporting during the reporting period.

2. Identification and rectification of internal control deficiencies in non-financial reporting

According to the above-mentioned identification standards for non-financial reporting internal control deficiencies, the company did not have any major deficiencies or important deficiencies in non-financial reporting internal control during the reporting period.

(4) Supplementary explanation on the identification and rectification of internal control deficiencies from 2017 to 2018

According to the above-mentioned identification standards of internal control defects, the company had 1 major defect in internal control of financial reporting and 1 major defect in internal control of non-financial reporting in 2017-2018. Additional explanation is now provided, the specific situation is as follows:

1. Identification and rectification of internal control deficiencies in financial reporting

Major flaws in financial reports: It is discovered that there were major accounting errors in previous years, and the disclosed financial reports are corrected; and the misstatement is greater than 5% of the total profit.

The company complies with the "Accounting Standards for Business Enterprises No. 28 - Accounting Policies, Changes in Accounting Estimates and Correction of Errors" and "Information Disclosure and Preparation Rules for Companies that Offer Securities to the Public No. 19" No. - Correction and Related Disclosure of Financial Information" relevant regulatory provisions, based on the Chongqing Securities Regulatory Bureau's "Administrative Punishment Decision" ([2025] No. 4), a comprehensive and prudent self-examination of relevant previous accounting matters in 2017 and 2018 was carried out, and in accordance with the requirements of accounting standards, the retrospective restatement method was used to complete accounting corrections and data adjustments for relevant inter-temporal accounting errors. The above matters indicate deficiencies in the company's related control activities.

Rectification status: In response to major accounting errors in previous financial reports, the company has comprehensively carried out self-examination and combing of accounting, completed retrospective adjustments and error corrections in strict accordance with accounting standards, standardized and improved the financial accounting process, strengthened internal control review and control, effectively consolidated the quality of financial statement information, and prevented the recurrence of similar problems. As of the date of disclosure of this report, the company has corrected the previous accounting errors involved in the "Administrative Penalty Decision" and made retrospective adjustments to the financial statements for 2017, 2018 and subsequent years. For details, please refer to the "Company's Special Instructions on Correction of Accounting Errors in the Previous Period"

2. Identification and rectification of internal control deficiencies in non-financial reporting

Major defects: Violation of national laws and regulations, resulting in penalties from government departments, and significant negative impact on the company's regular report disclosures.

On November 7, 2025, the company received the "Administrative Penalty Decision" issued by the Chongqing Securities Regulatory Bureau of the China Securities Regulatory Commission. Based on the penalty results, it was determined that the company had inflated profits in the 2017 and 2018 annual reports, failed to disclose subsidiaries, related parties and related transactions in interim reports and periodic reports as required, violating the Securities Law of the People's Republic of China revised in 2005 (hereinafter referred to as 2005). The provisions of Article 63 of the 2005 Securities Law constitute the illegal conduct mentioned in Article 193, Paragraph 1 of the 2005 Securities Law. Administrative penalties will be imposed on the company and relevant responsible persons.

Rectification measures: As of the date of disclosure of this report, the company has corrected the previous accounting errors involved in the "Administrative Penalty Decision" and made retrospective adjustments to the financial statements for 2017, 2018 and subsequent years. For details, please refer to the "Company's Special Instructions on the Correction of Preliminary Accounting Errors"; organize all directors and senior managers to carry out regulations and warning education, effectively strengthen the directors and senior managers' loyalty obligations, diligence obligations, and compliance awareness, and further strengthen corporate governance and compliance control; "Directors Implement the salary adjustment and stop-payment recourse clauses in the "Remuneration Management System for General Managers and Senior Management", and incorporate compliance performance into performance appraisals; strictly abide by capital market laws and regulations, improve the internal control and governance system, ensure that information disclosure is true, accurate and complete, and effectively safeguard the legitimate rights and interests of listed companies and all investors.

3. Impact on the evaluation during the reporting period

After careful evaluation by the company, the aforementioned historical events did not have a significant material adverse impact on the effectiveness of the daily operation of internal control during the reporting period. The company will continue to deepen the normalization and long-term risk control management of the internal control system and consolidate the financial information compliance management and control capabilities.

4. Description of other major matters related to internal control

During the reporting period, the company had no other major events that affected the effectiveness of internal control.

Tiansheng Pharmaceutical Group Co., Ltd.

April 28, 2026