The Toyota Boshoku group is working to comprehensively reinforce risk management and reduce risks in order to respond swiftly to major risks including management risk, risk in daily operations, risk associated with disasters and accidents, risk arising from the external environment such as global warming and water, and social reputation risk.*
- Risk of losing societal trust
Risk management activities
We have established a global risk management system for the group centered on the Chief Risk Officer (CRO), and carry out more effective risk management activities such as through monitoring of the status of risk response by the Board of Directors.
Businesses, regions, the corporate operation unit and other functions are working together to counter pertinent risks and implement a PDCA (plan-do-check-action) cycle for risk management activities. In order to prevent and minimize damage to the wider Toyota Boshoku group, Toyota Boshoku strives to identify and manage risks in an integrated manner, and share risks within the group.
Risk management initiatives in fiscal 2023
In fiscal 2023, under the global risk management system, we worked to increase opportunities for mutual communication by disclosing and sharing information so that risk management activities can permeate not only in Japan but also in other countries.
In addition, we continuously develop our business continuity plan (BCP) with the aim of improving its effectiveness. We have conducted evacuation drills, stockpiled supplies for local residents, operated information tools (including a safety confirmation system), reviewed our response to and rules concerning COVID-19, and published manuals, among other measures.
The risk management system, and associated activities
Evaluation points for materiality-impacting risks (Impact level)
|Level||Countermeasures Headquarters Chief|
(Comprehensive Countermeasures Headquarters)
|Department with responsibility for said risk(s), chief of headquarters for said region
(Individualized response crisis)
|Chief of department with responsibility for individual said risk(s), subsidiary company president
Crisis response system (in case of Crisis Level A)
Main actions taken against significant risks in fiscal 2023
|Risk||Main actions taken in FY2023|
|Production delays and stoppages||
|Infectious diseases, etc.||
|Country risks (Conflict)||
Global priority risks in fiscal 2024
Based on the results of the risk assessment for fiscal 2023, we selected global priority risks for fiscal 2024.
Risk map formulation process
Considering the risk environment surrounding the Toyota Boshoku group, the Chief Risk Officer (CRO) and others selected (drafted) the global priority risks based on:
(ⅰ) results of risk analysis and assessment by the department responsible for risk;
(ⅱ) risks considered important by external organizations, etc.; and
(ⅲ) information on crises that have emerged within the Toyota Boshoku group.
These global priority risks were then discussed and finalized by the Risk Management Promotion Meeting.
4 Global priority risks in fiscal 2024
- Country risks (Conflict)
- Falsification or concealment of quality/testing data
FY2024 risk map
Confidentiality management and information security
The Toyota Boshoku group considers the appropriate management of confidential information to be a key element of our business activities. We have both created a group-wide Information Security Policy and assembled a global confidential information management system. Additionally, we are working together as one group to systematically and continuously strengthen our information security.
In addition, once a year, the Company and its domestic and overseas consolidated subsidiaries collaborate to inspect the status of information security initiatives using the security guidelines, thereby improving internal systems, rules, education, and technical measures to ensure the same level of security on a global basis. In addition to the establishment of systems, we believe in the importance of education, and regularly conduct activities to raise company members’ security awareness such as through e-Learning training and drills in targeted e-mail.
The security guidelines are based on ISO 27001/27002, NIST (the United States’ National Institute of Standards and Technology) Cybersecurity Framework, the Cybersecurity Management Guidelines of Japan’s Ministry of Economy, Trade and Industry, etc., and are periodically reviewed to ensure they are responsive to changes in the environment.
We also update our confidentiality management rules and related procedures, and have introduced an internal information leak detection system to counter the risk of confidential information leaks.
In addition, we implement measures to counter unauthorized access gained through computer virus infection and other means, including ransomware, which has been on the rise in recent years. As well as our own measures, we have launched activities to raise the level of security measures throughout the supply chain, such as explaining the necessity of security measures and specific measures to our affiliates and suppliers.
Structure of activity promotion with consolidated subsidiaries
Specific confidentiality management actions undertaken
●Training of company members
(ⅰ) Carrying out various levels of training, including upon joining the company, upon receiving promotion, etc. (each training once a year)
(ⅱ) Displaying of informational and caution-prompting message upon startup of personal-use PCs (twice a month)
(ⅲ) Carrying out activities designed to improve awareness and understanding during Confidentiality Management Month (October)
(ⅳ) Carrying out e-learning (twice a year) and email training (six times a year) for all company members, including executive officers
●Provisions in line with our security guidelines
① Systematic management planning (preparation of systems and rules, etc.)
② Human resource management planning (training for company members, simulation training, etc.)
③ Technological management planning (improper system access/computer virus countermeasures, restoration measures, security surveillance, etc.)
④ Physical management planning (controlling access to relevant rooms/areas, etc.)
⑤ Preparation of response systems for accidents and hostile acts