Audit Committee

(Extracted from Annual Report 2025)

The Audit Committee, consisting of three Non-Executive Directors, May Wu, Spencer Fung and Martin Murray, assists the Board in discharging its responsibilities for corporate governance and financial reporting. Two of the Committee members are Independent Non-Executive Directors, one of whom, May Wu, is Chairman. All members served for the whole of 2025.

The terms of reference of the Audit Committee follow the guidelines set out by the Hong Kong Institute of Certified Public Accountants and comply with the CG Code. They are available on the Company's website.

The Audit Committee met four times in 2025. Regular attendees at the meetings are the Chief Financial Officer, the Group General Counsel and Company Secretary, the General Manager, Group Finance, the Group Head of Internal Audit, the Director/General Manager, Digital and IT, and the external auditors. The Audit Committee meets at least twice a year with the external auditors, and at least once a year with the Group Head of Internal Audit, in each case without the presence of management. Each meeting receives written reports from the external auditors and GIAD. The external valuer (Cushman & Wakefield Limited) also attended two of the meetings.

The work of the Committee during 2025 included reviews of the following matters:

• the completeness, accuracy and integrity of formal announcements relating to the Group’s performance including the 2024 annual and 2025 interim reports and announcements, with recommendations to the Board for approval
• the Sustainability Report 2024 of the Company
• the Group’s compliance with regulatory and statutory requirements
• the Group’s risk management and internal control systems
• the Group’s risk management processes
• the Group’s cybersecurity and policy and governance mechanisms in relation to AI
• the Group’s ESG matters
• the approval of the 2026 annual internal audit programme and review of progress on the 2025 programme
• periodic reports from GIAD and progress in resolving any matters identified in them
• significant accounting and audit issues
• the Company’s policy regarding connected transactions and the nature of such transactions the relationship with the external auditors as discussed on pages 109 to 110
• the external quality assessment of GIAD
• the Company’s compliance with the CG Code
• the Company’s codes and policies
• the Company’s SD 2050 Strategy and KPIs

In 2026, the Committee has reviewed, and recommended to the Board for approval, the 2025 financial statements.

Assessing the Effectiveness of Risk Management and Internal Control Systems

On behalf of the Board, the Audit Committee reviews annually the continued effectiveness of the Group’s risk management and internal control systems dealing with risk and financial accounting and reporting, the effectiveness and efficiency of operations, compliance with laws and regulations, and risk management functions.

This assessment considers:

• the scope and quality of management’s ongoing monitoring of risks (including ESG risks) and of the risk management and internal control systems, the work and effectiveness of internal audit and the assurances provided by the Chief Financial Officer
• the changes in the nature and extent of significant risks (including ESG risks) since the previous review and the Group’s ability to respond to changes in its business and the external environment
• the extent and frequency with which the results of monitoring are communicated, enabling the Committee to build up a cumulative assessment of the state of control in the Group and the effectiveness with which risk is being managed
• the adequacy of resources (internal and external) for designing, implementing and monitoring the risk management and internal control systems, including staff qualifications and experience, training programmes and budget of the Group’s accounting, internal audit, and financial reporting functions, as well as those relating to the Group’s ESG performance and reporting
• the incidence of any significant control failings or weaknesses that have been identified at any time during the period and the extent to which they have resulted in unforeseen outcomes or contingencies that have had, could have had, or may in the future have, a material impact on the Company’s financial performance or condition
• the effectiveness of the Company’s processes in relation to financial reporting and statutory and regulatory compliance
• areas of risk identified by management
• the relevant information and periodic confirmation provided by management to the Board for monitoring the implementation and effectiveness of risk management and internal control systems
• significant risks reported by GIAD
• work programmes proposed by GIAD and the external auditors
• significant issues arising from internal and external audit reports
• the results of management’s control self-assessment exercise

As a result of the above review, the Board confirms, and management has also confirmed to the Board, that the Group’s risk management and internal control systems are effective and adequate and have complied with the CG Code provisions on risk management and internal control throughout the year and up to the date of this annual report.

In forming its view, the Board considered management confirmations, GIAD’s risk-based assurance and the independent auditor’s communications. The Board is satisfied that the risk management and internal control systems operated effectively to (a) deal with identified risks, (b) safeguard the Group’s assets, (c) reasonably prevent and detect fraud, misconduct and loss, (d) ensure the accuracy of financial reporting, and (e) achieve compliance with applicable laws and regulations.