Sustainability
Structure of Xtep’s Sustainability Governance
- Board of Directors
The Board bears ultimate responsibility for the overall direction of the Group’s sustainability, sustainable development vision, strategy, goals, performance and reporting. It is supported by the Sustainability Committee in overseeing sustainability-related matters. - Sustainability Committee
The Sustainability Committee is chaired by a NED and its members include two executive directors and one independent non-executive director. The Committee meets at least twice a year and is responsible for advising the Board on the development and implementation of the sustainability objectives, strategies, priorities, and goals. - Sustainability Working Group
Chaired by an Executive Director Ms. Ding Mei Qing, the Sustainability Working Group consists of senior management from various departments and functions, the Head of Sustainability Department oversees sustainability-related matters. The Sustainability Working is tasked with several key responsibilities. These include developing ESG-related goals, policies and work plans for the Sustainability Committee approval. The Sustainability Working Group meets biannually to review and report the ESG progress and for the preparation of the annual ESG report. Additionally, they oversee the implementation of ESG strategies and policies, managing compliance across various functional departments while collaborating on cross-departmental initiatives. The Sustainability Working Group also identifies potential ESG-related risks and opportunities, and it reports these findings to the Sustainability Committee and formulates management policies and plans to address any identified risks. The Sustainability Working Group concurrently functions as the Group’s executive-level Sustainability Committee. All members are senior executives reporting directly to the CEO, with a dual-reporting line to both the Sustainability Committee and the CEO.
Business Ethics
Anti-corruption
The Group upholds a zero-tolerance approach towards corruption, bribery, extortion, fraud and money laundering. An anti-fraud Management system has been established to identify, report, investigate and address fraud risks across operations. Informed by national policies on internal controls, such as the “Basic Norms for Internal Control” and “Guidelines for Application of Enterprise Internal Controls”, we established our “Anti-Corruption Policy”, “Anti-fraud Management System”, and “Code of Integrity”, which set clear expectations for all employees. Risk assessments are conducted to diagnose any vulnerabilities within the critical business operations. For details, please refer to our Anti-fraud Management System.
Internal audit
The Group’s Internal Audit Department is tasked with conducting annual audits, which include assessing the effectiveness of the Group’s risk management and internal control systems. This department regularly reports its findings to the Audit Committee. To ensure the department’s effectiveness, the Board and Audit Committee oversee resource allocation, ensuring that the Risk Management and Internal Audit Department receives adequate budget and staffing to fulfill its responsibilities.
Additionally, training programs are available for qualified employees with expertise in maintaining high internal audit quality. These programs equip them with the skills and capabilities necessary to uphold the highest standards of internal audit performance.
Compliance management
The Group has established preventive, monitoring and control measures to ensure adherence to applicable business operation laws and regulations. During the reporting period, the Group complied with all code provisions and, where appropriate, embraced the best practices recommended in the Corporate Governance Code, with the exception of code provision C.2.1, which pertains to the roles of the chairman and chief executive officer.
Under code provision C.2.1 of the Corporate Governance Code, the roles of chairman and chief executive officer should be separate and should not be performed by the same individual. The Group does not separate the roles of the chairman and the chief executive officer at present. Mr. Ding Shui Po is the chairman and chief executive officer of the Group. He has extensive experience in the sportswear industry and is responsible for the Group’s overall corporate strategies, planning and business management. The Board believes that vesting the roles of chairman and chief executive officer in the same individual is beneficial to the business prospects and management of the Group. The balance of power and authority is ensured by the operation of the Board and senior management, which is comprised of experienced and high-caliber individuals. The Board currently consists of four executive directors, one non-executive director and three independent non-executive directors and has a vital independence element in its composition.
Information security
As a company entrusted with a substantial amount of information, we acknowledge our duty to protect the personal information of our customers and employees. In compliance with relevant laws and regulations, including the Cyber Security Law of the People’s Republic of China, the Data Security Law of the People’s Republic of China, and the Personal Data (Privacy) Ordinance of Hong Kong, the Group continues to enhance our information management security system. We have formulated various policies, which include the Information Security Confidentiality System, Information Security Training Management Standard, Group Information Security Management Policy, and Anti-Virus Management Standard. Together, these policies ensure that customer data is collected, stored, utilized, and protected in a responsible and ethical manner.
The Group fully implements responsible AI management standards and strictly complies with data privacy and cybersecurity rules throughout the application of self-developed and third-party AI tools. The Group clearly defines the scope of AI access, prohibits uploading sensitive data including trade secrets, customer information, internal confidential documents and personal privacy to external AI platforms, and enforces controls such as data desensitization and manual review of AI-generated content. Human participation and intervention are retained for key business decisions to guard against algorithmic bias, data leakage and other risks. In strict accordance with international AI regulatory requirements, we ban the deployment of AI systems prohibited by regulations such as those for manipulation and unauthorized biometric surveillance. A traceable accountability framework is established to ensure transparent and explainable AI deployment, enabling sustainable technological development on a compliant and secure basis.
Risk Management
Xtep attaches great importance to the efficient operation of risk management and internal control systems, with the Board of Directors bearing ultimate responsibility for risk supervision. The Group has established a well-defined risk governance framework and clarified responsibilities under the widely adopted Three Lines of Defense mechanism:
- First Line of Defense: Business Management Teams
As primary frontline risk owners, business teams identify, assess and mitigate operational risks in daily activities, implement risk mitigation and internal control measures, and promptly escalate material risks. - Second Line of Defense: Risk Management and Internal Audit Department
The department develops the Group’s risk management framework and unified risk assessment standards, oversees risk implementation across all business segments, conducts regular risk reviews and monitors changes in risk exposures, proposes rectification plans for control deficiencies, and regularly reports risk management results to the Audit Committee. - Third Line of Defense: Audit Committee
The Audit Committee supervises the work of risk management and internal audit teams. It conducts a comprehensive annual review on the effectiveness of the Group’s risk management and internal control systems covering all material financial, operational and compliance risks, independently evaluates system performance and submits governance improvement proposals to the Board.
The Group manages risks through four standardized procedures: risk identification, risk assessment, risk response, as well as regular risk reporting and ongoing monitoring. We identify risks that may materially impair the Group’s strategy, business, operation and finance, evaluate the probability and potential impact of each risk, prioritize material risks, and adopt targeted measures to avoid or mitigate risks. Risk management outcomes are regularly reported to the Board, Audit Committee and senior management. All identified risks are tracked dynamically, and risk strategies and internal control procedures will be reassessed and updated whenever material shifts occur in internal operations or the external market environment.
The Group fosters enterprise-wide risk culture via regular risk governance training for directors and all employees. Risk review is embedded into the development of new products and services. We conduct risk reviews and ongoing risk exposure assessments through stress testing and scenario analysis to strengthen risk foresight. The Group proactively assesses long-term emerging risks over the next 3 to 5 years, with tailored mitigation strategies formulated and implemented for climate-related risks and other material emerging risks, to continuously enhance the Group’s resilience against uncertainties.
Supply Chain Compliance Management
The Group incorporates standards on business integrity, occupational health and safety, environmental protection and anti-corruption into supplier admission criteria and annual performance reviews. Independent certification auditors carry out on-site assessments for selected suppliers. Through factory audits and annual risk evaluations, potential compliance risks of business partners are identified. The Group rolls out corporate compliance requirements down the supply chain to mitigate operational risks at the source of the value chain. For further information, please refer to the Supplier Social Responsibility Manual.
