Annual Report 2023

146 2023 Annual Report Transport International Holdings Limited CORPORATE GOVERNANCE REPORT Control Activities The Group’s franchised and non-franchised bus services involve well-established business processes. Control activities are built on top-level reviews, segregation of duties and physical controls. Written policies and procedures with defined limits of delegated authority are in place. These policies and procedures include but are not limited to: Annual budgeting and planning processes; Financial and payment authorisation guidelines; Procurement and tendering policies; and IT security policy. Quality Management System As the Group’s franchised operations, KMB and LWB have implemented a quality management system (“QMS”) based on the benchmarks prescribed by the International Organisation for Standardisation (“ISO”). Under ISO requirements, major financial and operational procedures and instructions, including illustrative flow charts, are clearly documented and followed by operations. The Hong Kong Quality Assurance Agency (“HKQAA”) conducts annual independent audits of the QMS to assess its effectiveness, efficiency and conformity. In 2023, no non-conformity in the QMS was noted during the ISO audit of the operations of both KMB and LWB. As of December 2023, both KMB and LWB possessed ISO9001:2015 quality management system certification. In addition, all KMB depots are ISO45001-certified for their occupational health and safety systems and two of KMB’s major bus depots are ISO14001- certified for their environmental management systems. Business Continuity Plan The Group’s flagship subsidiary, KMB, has formulated and documented a Business Continuity Plan (“BCP”) in respect of its key business and IT operations. The BCP is reviewed and updated from time to time according to changes in circumstances. The BCP, which is an integral part of the risk management process, creates a systematic approach for providing effective response that enables the Management to safeguard shareholder values in a crisis by responding promptly and by resuming KMB’s critical business functions at acceptable pre-defined levels. KMB performs walkthrough tests and drills periodically to ensure that the BCP will be able to adequately ensure minimal disruption to key businesses if an unforeseeable event occurs. Information and Communication/Monitoring Activities The Group’s IT systems generate timely data to allow the Management to monitor business operations and thus achieve business objectives. Regular and ad-hoc management and operational meetings are held to facilitate the proper monitoring of the internal control and risk management mechanisms.