True : 9. Internal Control and Connected Transactions

True Corporation Public Company Limited

Annual Report 2023 (Form 56-1 One Report)

9. INTERNAL CONTROLS AND CONNECTED TRANSACTIONS

9.1 Internal control

The Company places great importance on the Internal Control System which is a mechanism to protect and manage risks or other exposures that may occur. The Company developed the Internal Control System in accordance with the International Standard of COSO Internal Control Framework (The Committee of Sponsoring Organizations of the Treadway Commission) and the guidance from the Securities and Exchange Commission, Thailand and adapted as practice guidelines to achieve the objectives of effectiveness and efficiency of operations, the reliability and integrity of financial reporting and the compliance with laws, regulations and policy of the Company's operations.

9.1.1 The information of the Company's Internal Control System Assessment The information of the Company's Internal Control System AssessmentThe information of previous Internal Control System Assessment is as follows:

1. The Management testing of True's key internal control over financial reporting - this test was carried out in 2023 and there was no significant internal control deficiency that may have a material effect to the financial reports. Furthermore, the summary of internal control testing is reported to the Audit Committee at least twice a year.
2. The activities of the Internal Audit Division, which examines the business operation procedures of the Company through an approved internal audit plan (risk-based), highlights any internal control weaknesses and proposes recommendations for corrective actions thereon. The Internal Audit Division reports its findings directly to the Audit Committee, follows up on the progress of any corrective actions with the Management and provides a summary report on the results of such actions to the Audit Committee regularly, at least on a quarterly basis; and
3. Review of internal control matters as identified by the Company's external auditor.
4. • The Company's external auditor has reviewed and assessed the accounting control of True and its subsidiaries. There are no material findings that may have a material effect on its opinion on the financial statements of True and its subsidiaries as of 31 December 2023.
   • The Audit Committee agreed with the opinion of the auditor that the Company's internal controls were sufficient and suitable for the Company's business and capable of safeguarding the Company's assets from undue or unauthorized use by the Management.

Part II

Internal Controls and Connected Transactions

Topic 9 - Page 1

True Corporation Public Company Limited

Annual Report 2023 (Form 56-1 One Report)

9.1.2 The Guideline of Internal Control System in accordance with the International Standard of COSO Internal Control Framework

The Company's internal control system can be summarized in 5 components of the COSO Internal Control framework as follows:

1. Control Environment
   The Board of Directors strives to promote the organization culture by focusing on operating the business with integrity and ethical values, and overseeing the conduct of the Company's business to ensure the compliance with laws and the organization's objectives and goals, including adequate and suitable control environment as follows:
2. • The Board of Directors has established in writing the Corporate Governance Policy, the Code of Conduct and Anti- Corruption Policy and Measure as guideline practices for the Board, management, and employees to carry out duties and responsibilities with integrity and ethical values. The Board of Directors delegates to management to regularly communicate the mentioned policies and code to management and all employees through internal training and various activities.
   • The Board of Directors is independent from management and is responsible to oversee the overall business performance, and there are clear and measurable business goals and strategies as direction for the business plan executions and operations, and regularly follow up the Company's performance.

The Company has established an organizational structure that effectively supports the Management's administration and improves the employees' performance in order to align with the direction. Efficient internal controls have been established such as segregations of duties for check and balance; all employees are held accountable for internal control. The Company has established a clear line of reporting for the organization structure, accountabilities are clearly assigned and levels of authorities are appropriately delegated in line with the organization structure. The Company has also set up clear, appropriate and achievable business goals and communicates these goals to its employees to help guide their performance.

The Company is committed to conducting business the right way. The Code of Conduct has been established and enforced as the Company's ethical standard, which restricts the Company's directors, management, and employees from engaging in any action which may give rise to a conflict of interest with the Company, and

Part II

Internal Controls and Connected Transactions

Topic 9 - Page 2

True Corporation Public Company Limited

Annual Report 2023 (Form 56-1 One Report)

prescribes appropriate conduct towards various internal and external stakeholders, including towards employees, customers, business partners, competitors, and government agencies, and in matters relating to the environment, assets, internal control, accounting, reporting and disclosure, information management, and protection of personal data. Employees may report any violations of the code of conduct directly to the Ethics and Compliance Division. The policies and the code of conduct are guided by fair treatment towards stakeholders and for the long-term benefit of the Company.

1. Risk Assessment
   The Company regularly conducts risk assessment as a foundation of effective risk management. Risks are identified from threat that might give impacts on the Company's business objectives considering from both internal and external risk factors.
   Risk identification and risk assessment are part of risk management procedure, aiming to identify, analyze, and evaluate risks in order to proactively and effectively provide risk mitigation and management that are appropriate for the company's objectives.
   The Company is committed to good corporate governance. As part of its governance responsibilities, it has adopted a methodical approach to enterprise-wide risk management to:
2. • ensure the Company meets its organizational goals;
   • protect the interests of its wide range of stakeholders;
   • raise awareness of the different risks involved in operating the business;
   • protect the brand and reputation of the Company;
   • ensure that the Board discharges its duties to direct strategy, builds value and monitors performance of the organization;
   • ensure that management procedures and controls are in place and are performing adequately;
   • foster corporate social responsibility; and
   • continually improving and protecting the organization from potential threats.

The Company has announced the risk policy framework and procedure, with a revision in a timely manner. Risk management was customized and implemented in accordance with ISO 31000 and COSO 2017 Enterprise Risk Management. The Company must identify, analyze and evaluate then manage potential risks that may impact its business objectives.

Part II

Internal Controls and Connected Transactions

Topic 9 - Page 3

True Corporation Public Company Limited

Annual Report 2023 (Form 56-1 One Report)

Every employee is responsible for managing the risks within his/her areas of responsibility. Heads of business units are responsible for ensuring that risk management is embedded in the strategic actions and in the day-to-day business processes. The management shall conduct risk assessment on regular basis, and are responsible to manage the critical risks. Likewise, the management shall report the significant threats to the Board without undue delay.

1. Control Activities
   The Company has established the control activities that help mitigate risks which may prevent the achievement of objectives to acceptable levels in response to specific risks regarding work processes, complexity, environment and entity-specific characteristics. The Company has developed appropriately established the written policies and manuals for various management matters, including for entering financial, procurement, and general management transactions and periodically reviews to determine their continued relevance.
   The Company has implemented the automated controls of key operating systems and established Corporate Information Security Policies to ensure the appropriateness of controls over information and technology in accordance with the international standard ISO/IEC 27001.The Company has set out a clear and appropriate scope of authority and approval limits for the Management at each level pursuant to the Policy on Delegation of Authority, which has been approved by the Board of Directors. The segregation of duties has been appropriately established. For example, the approval function is segregated from the account and information recording function and separated from the safeguarding of assets function for the purpose of checks and balances.
   The Company has also put in place strict measures for monitoring transactions with major shareholders, directors, executives, and their related persons. These measures are to ensure that transactions are entered into in accordance with the prescribed procedures and approval processes, so as to prevent any conflict of interests and for the best interest of the Company.
2. Information and Communication

Part II

Internal Controls and Connected Transactions

Topic 9 - Page 4

True Corporation Public Company Limited

Annual Report 2023 (Form 56-1 One Report)

The Company places emphasis on information and communication systems to ensure that accurate and sufficient information is communicated to the Board of Directors, the Management, shareholders, and other related people in order to make informed decisions. The Company has also prepared meeting notices and supporting documents, including minutes of the Board of Directors' meetings and shareholders' meetings, and proposed the same to the Board of Directors and shareholders, as the case may be, for consideration in advance of the meetings and in accordance with the law.

The Company has established process and efficient internal communication and information channels that can communicate necessary information to all employees throughout the organization.

The Company provides a separate communication channel to report any clues or complaints, offenses or suspicious behavior that may imply fraud or corruption or misconduct of any persons in the organization for employees and other stakeholders. The information reported is to be kept confidential.

1. Monitoring Activities
   There are clear processes for monitoring the internal control system and reporting any significant control failures or weaknesses together with details of corrective action. These include both ongoing monitoring and periodic evaluation by the Management to ensure the efficiency and effectiveness of the internal control.
   The Company establishes process to oversee the business operations to comply with the business code of conduct and the conflict of interest code.
   In addition, the Management is required to immediately report to the Audit Committee and the Board of Directors cases or suspected cases of fraud, violation of laws, or other misconduct that may have a material adverse effect on the reputation and financial status of the Company.

Part II

Internal Controls and Connected Transactions

Topic 9 - Page 5

True Corporation Public Company Limited

Annual Report 2023 (Form 56-1 One Report)

1. The Board of Directors' Opinion on the Company's Internal Control System
   The board of directors acknowledged the audit committee's opinion regarding the sufficiency of the internal control system and risk management of the Company for the year 2566 and approved the "Internal Control Sufficiency Evaluation Form for the year 2566". The Board concurred with the Audit Committee's opinion that the internal control system and risk management system of the Company and its subsidiaries are sufficient and appropriate for conducting business. There are sufficient personnel to operate the systems efficiently, and there are monitoring systems in place to prevent the misappropriation of assets by the company and its subsidiaries without Management approval. This includes transactions with related parties and potential conflicts of interest, which have been adequately addressed. In this regard, the Company has disclosed the Audit Committee report in Appendix 6.
2. Internal Audit
   Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve the organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.
   The Internal Audit Division is independent from the Management and reports on the internal audit directly to the Audit Committee. The objectives, authorities, duties, and responsibilities of the Internal Audit Division towards the Company, including the role and responsibilities of the Head of Internal Audit Division, are explicitly defined in the Internal Audit Charter. The Internal Audit Division adheres to the guidance of the Institute of Internal Auditors, the Information Systems Audit and Control Association, and the internal audit manual of the Company.
   The Internal Audit Division has developed a flexible annual internal audit plan by taking into account business strategic directions and key corporate risk- based methodology, including any matters raised by senior Management. The annual internal audit plan is reviewed and approved by the Audit Committee and the Board of Director. Apart from implementing the approved annual internal audit plan, the Internal Audit Division also performs any special tasks or projects as requested by the Management and the Audit Committee as appropriate.

Part II

Internal Controls and Connected Transactions

Topic 9 - Page 6

True Corporation Public Company Limited

Annual Report 2023 (Form 56-1 One Report)

According to the approved annual internal audit plan, the Internal Audit Division identifies and reviews potential risks, reviews the adequacy and effectiveness of the internal control system and reports significant internal control weakness and non-compliance issues, and makes recommendations for business improvements to the Management. An appropriate follow-up process is implemented by the Internal Audit Division to ensure that the Management responds to and takes action on the recommendations of the Internal Audit Division and external auditors. The audit findings, progress on any corrective actions taken by the Management, and the status of the Internal Audit Division's activities are directly reported to the Audit Committee on a regular basis.

To ensure the Internal Audit Division's continued conformance to the Institute of Internal Auditors, International Standards for the Professional Practice of Internal Auditing (IIA Standards), internal audit activities as set forth in the Internal Audit Charter, the Internal Audit Division has arranged for a Quality Assurance and Improvement Program (QAIP) of the Division on a regular basis. The assessment result is reported to the Company's Board of Directors and the Audit Committee.

9.1.5 Head of Internal Audit

The Company has appointed Miss Warunya Chenpitayaton as the Head of the Internal Audit. The Head of Internal Audit is suitable to perform such duties for right qualification, and complied with relevant requirements of education, work experience and training.

The appointment, transfer, and dismissal of the Head of Internal Audit shall be approved by the Audit Committee.

Part II

Internal Controls and Connected Transactions

Topic 9 - Page 7

True Corporation Public Company Limited

Annual Report 2022 (Form 56-1 One Report)

9.2 Connected Transactions

True Group carried out the connected transaction for the year ended 31 December 2023, The significant connected transaction are as follows:

Company Name

Charoen Pokphand Group of companies (CPG)

Relationship

CPG Group is a major shareholder of True.

The CPG Group holds total shares equal to 20.95% of the Company's total issued shares (Refer to the list of shareholders as at 27 March 2023).

	for the year
Details of	ended 31
transactions	December 2023
	(Baht million)
-Sales of mobile handset	7,885.42
and accessories
-Office rental and	219.33
related services
-Commission and other	137.70
services
-Activities sponsorship	199.72
-Digital Data Network	589.53
services

Rationale and necessity

True Group has entered into sales of mobile handset and accessories agreement with CP Group. The transactions arose in ordinary course of business that the Company proposed to the third party.

True Group has entered into office rental and related services agreement with CP Group. The transactions arose in ordinary course of business that the Company proposed to the third party. True Group has entered into commission agreement with CP Group. The transactions arose in ordinary course of business that the Company proposed to the third party.

True Group has entered into activities sponsorship agreement with CP Group. The transactions arose in ordinary course of business that the Company proposed to the third party.

True Group has entered into Digital Data Network services agreement with CP Group. The transactions arose in ordinary course of business that the Company proposed to the third party.

Part II

Internal Controls and Connected Transactions

Topic 9 - Page 8

True Corporation Public Company Limited

Annual Report 2022 (Form 56-1 One Report)

Company Name

Part II

		for the year
Relationship	Details of	ended 31
transactions	December 2023
		(Baht million)
	-Mobile services	1,458.95

-Other services

445.55

- Office rental and	1,218.08
related services expense

-Management fee

42.59

-Vehicle rental and	109.91
related services

Internal Controls and Connected Transactions

Rationale and necessity

True Group has entered into mobile services agreement with CP Group. The transactions arose in ordinary course of business that the Company proposed to the third party.

True Group has entered into services agreement with CP Group. The transactions arose in ordinary course of business that the Company proposed to the third party.

The transactions arose in ordinary course of business at the rate of Baht 200 - 220 per square metre per month for rental and Baht 220 - 520 per square metre per month for service. The maturity is normally in the year and is allowed to be renewed.

True Group has entered into management fee agreement with CP Group. The transactions arose in ordinary course of business that the Company proposed to the third party.

True Group has entered into vehicle rental agreement with CP Group. The transactions arose in ordinary course of business at the rate of Baht 15,000 per unit per month. The maturity is normally 3 years.

Topic 9 - Page 9

True Corporation Public Company Limited

Annual Report 2022 (Form 56-1 One Report)

Company Name

		for the year
Relationship	Details of	ended 31
transactions	December 2023
		(Baht million)
	-Training	50.95
	-Commission from refill	933.21
	card and other service
	-Collection agent fee	485.81
	-Advertising and	261.73
	Marketing expenses
	-Equipment installation	64.00
	fee and related services
	-Repair and	1,786.14
	maintenance network

Rationale and necessity

True Group has entered into training agreement with CP Group. The transactions arose in ordinary course of business that the Company proposed to the third party.

True Group has entered into commission agreement with CP Group. The transactions arose in ordinary course of business that the Company proposed to the third party.

True Group has entered into collection agent agreement with CP Group. The transactions arose in ordinary course of business that the Company proposed to the third party.

True Group has entered into advertising and marketing agreement with CP Group. The transactions arose in ordinary course of business that the Company proposed to the third party. True Group has entered into equipment installation fee agreement with CP Group. The transactions arose in ordinary course of business that the Company proposed to the third party. True Group has entered into repair and maintenance network agreement with CP Group. The transactions arose in ordinary course of business that the Company proposed to the third party.

Part II

Internal Controls and Connected Transactions

Topic 9 - Page 10