Risk Management

Basic stance

The Toyota Boshoku group is working to comprehensively reinforce risk management and reduce risks in order to respond swiftly to major risks including management risk, risk in daily operations, risk associated with disasters and accidents, risk arising from the external environment such as global warming and water, and social reputation risk.^*

Risk of losing societal trust

Risk management activities

We have established a global risk management system for the group centered on the Chief Risk Officer (CRO), and carry out more effective risk management activities such as through monitoring of the status of risk response by the Board of Directors.
Businesses, regions, the corporate operation unit and other functions are working together to counter pertinent risks and implement a PDCA (plan-do-check-action) cycle for risk management activities. In order to prevent and minimize damage to the wider Toyota Boshoku group, Toyota Boshoku strives to identify and manage risks in an integrated manner, and share risks within the group.

Risk management initiatives in fiscal 2023

In fiscal 2023, under the global risk management system, we worked to increase opportunities for mutual communication by disclosing and sharing information so that risk management activities can permeate not only in Japan but also in other countries.
In addition, we continuously develop our business continuity plan (BCP) with the aim of improving its effectiveness. We have conducted evacuation drills, stockpiled supplies for local residents, operated information tools (including a safety confirmation system), reviewed our response to and rules concerning COVID-19, and published manuals, among other measures.

The risk management system, and associated activities

Evaluation points for materiality-impacting risks (Impact level)

Materiality	Evaluation points
①As an Interior Space Creator we will contribute to people’s quality of life, creating comfort, safety, and reassurance through innovation	Stable supply
②Using our established technical capability, we will contribute to realize a society with no traffic casualties through providing products that assure safety	Product safety
③Together with our business partners, we will realize MONOZUKURI innovations that minimize environmental stress	Environmental impact
④We will develop people capable of contributing to society, who have diverse values, a challenging spirit and understand the value of strong teamwork	Occupational safety
⑤We will continue to be a company of integrity trusted by all our stakeholders, inheriting our tradition of fairness and moral behavior to the next generation	Compliance

Crisis levels

Level	Countermeasures Headquarters Chief
Level A (Serious crisis)	President (Comprehensive Countermeasures Headquarters)
Level B (Major crisis)	Department with responsibility for said risk(s), chief of headquarters for said region (Countermeasures project)
Level C (Individualized response crisis)	Chief of department with responsibility for individual said risk(s), subsidiary company president (Countermeasures team)

Crisis response system (in case of Crisis Level A)

Main actions taken against significant risks in fiscal 2023

Risk	Main actions taken in FY2023
Earthquakes	Expansion of Emergency Operation Center (EOC), replacement of aging disaster prevention equipment, etc.
Typhoons/heavy rain	Creation and updating of hazard maps for each plant and affiliated company, tree diagnosis, etc.
Production delays and stoppages	Review of inventory of at-risk part numbers Review of production sites for part numbers manufactured only in countries other than Japan, reinforcement of backup cooperation, etc.
Infectious diseases, etc.	Infection prevention measures resulting from discussion at COVID-19 countermeasures meeting Omicron strain-compatible workplace vaccination Update of COVID-19 manual to incorporate government policy Support for both infection prevention and work execution through the introduction of PCR testing equipment and distribution of kits Cooperation and information sharing with Toyota Group companies
Fraud damage	Formulation and implementation of annual action plan for establishing and disseminating recurrence prevention measures
Cyberattacks	Countermeasures to external intrusions, improper system access, computer viruses and internal information leaks Enhancement of company members’ awareness through security training (e-learning, targeted e-mail training)
Country risks (Conflict)	Establishment of countermeasure projects, consultations with relevant departments, etc.

Global priority risks in fiscal 2024

Based on the results of the risk assessment for fiscal 2023, we selected global priority risks for fiscal 2024.

Risk map formulation process

Considering the risk environment surrounding the Toyota Boshoku group, the Chief Risk Officer (CRO) and others selected (drafted) the global priority risks based on:
(ⅰ) results of risk analysis and assessment by the department responsible for risk;
(ⅱ) risks considered important by external organizations, etc.; and
(ⅲ) information on crises that have emerged within the Toyota Boshoku group.
These global priority risks were then discussed and finalized by the Risk Management Promotion Meeting.

4 Global priority risks in fiscal 2024

Earthquakes
Cyberattacks
Country risks (Conflict)
Falsification or concealment of quality/testing data

FY2024 risk map

Confidentiality management and information security

The Toyota Boshoku group considers the appropriate management of confidential information to be a key element of our business activities. We have both created a group-wide Information Security Policy and assembled a global confidential information management system. Additionally, we are working together as one group to systematically and continuously strengthen our information security.
In addition, once a year, the Company and its domestic and overseas consolidated subsidiaries collaborate to inspect the status of information security initiatives using the security guidelines, thereby improving internal systems, rules, education, and technical measures to ensure the same level of security on a global basis. In addition to the establishment of systems, we believe in the importance of education, and regularly conduct activities to raise company members’ security awareness such as through e-Learning training and drills in targeted e-mail.
The security guidelines are based on ISO 27001/27002, NIST (the United States’ National Institute of Standards and Technology) Cybersecurity Framework, the Cybersecurity Management Guidelines of Japan’s Ministry of Economy, Trade and Industry, etc., and are periodically reviewed to ensure they are responsive to changes in the environment.
We also update our confidentiality management rules and related procedures, and have introduced an internal information leak detection system to counter the risk of confidential information leaks.
In addition, we implement measures to counter unauthorized access gained through computer virus infection and other means, including ransomware, which has been on the rise in recent years. As well as our own measures, we have launched activities to raise the level of security measures throughout the supply chain, such as explaining the necessity of security measures and specific measures to our affiliates and suppliers.

Information Security Policy

Structure of activity promotion with consolidated subsidiaries

Specific confidentiality management actions undertaken

●Training of company members

(ⅰ) Carrying out various levels of training, including upon joining the company, upon receiving promotion, etc. (each training once a year)
(ⅱ) Displaying of informational and caution-prompting message upon startup of personal-use PCs (twice a month)
(ⅲ) Carrying out activities designed to improve awareness and understanding during Confidentiality Management Month (October)
(ⅳ) Carrying out e-learning (twice a year) and email training (six times a year) for all company members, including executive officers

●Provisions in line with our security guidelines

① Systematic management planning (preparation of systems and rules, etc.)
② Human resource management planning (training for company members, simulation training, etc.)
③ Technological management planning (improper system access/computer virus countermeasures, restoration measures, security surveillance, etc.)
④ Physical management planning (controlling access to relevant rooms/areas, etc.)
⑤ Preparation of response systems for accidents and hostile acts