The Group defines risk as "the influence of uncertainty about our objectives and the possibility to influence the achievement of our strategy and business goals when an event occurs."

We classify recognized risks as follows based on their type (strategic or pure) and factor (internal or external) and quantify them by risk factors based on the probability of occurrence and the degree of impact to select "priority risk" which exceeds the reference point. We also prioritize risks based on the assessment points and focus on discussing countermeasures against them.

In Japan, we have BCPs mainly assuming large-scale natural disasters that threaten our business continuity.

Previously, in order to enhance the effectiveness of BCPs, we had conducted a disaster prevention headquarter training systematically in several sites every year, assuming a large-scale earthquake hit. But in FY2021, after reviewing the existing initial response manual, we conducted initial response training for 16 Group companies.

In FY2022, 18 domestic group companies conducted danger prediction training (KYT) and three companies conducted trainings for initial response assuming an earthquake. We also conducted a company-wide BCP trainings by disaster response HQ to share issues related to disaster countermeasures. In addition, we held BCP seminars by external lecturers to improve the skills of BCP staff as part of our efforts to ensure the effectiveness of BCP, which led to the improvement of initial response.
In FY2023, a disaster response HQ was convened at the head office using the scenario of a Nankai Trough earthquake^*, and the training simulated initial response actions from the moment the earthquake occurs through the day of the event.

In overseas, we send a BCP Caravan from Japan to our major sites in North America, Europe, China, and other parts of Asia to establish and develop risk management system.

In addition, we gather information on developments such as large-scale-disasters, terrorism, etc., from information sources such as the Foreign Ministry as well as major communications companies, to alert our staff stationed or traveling overseas of imminent dangers. At the same time, we have instituted emergency contact systems based on the information from our overseas locations.

In FY2022, we proceeded with the translation of various manuals on business continuity in the event of a disaster, etc. into English, and also supported the formulation of an "Emergency Response Manual" requested by customers as a part of the BCP Caravan at our group company Flyjac Logistics Pvt. Ltd. (India). In the China area, we conducted local hearings and investigations before proceeding with the formulation of an "Emergency Response Manual" considering recent geopolitical risks.
In FY2023, we supported the formulation of an "Emergency Response Manual" at four sites in the Asia region. In the China area we conducted local hearings and investigations and compiled an "Emergency Evacuation Manual." In Indonesia, we conducted training sessions (reading practice) to check whether the formulated "Emergency Response Manual" (action plan) would function. We have brushed up the manual by compiling opinions of training participants. At each site, we are working to create workplaces where fires do not occur by conducting fire patrols in the same way as in Japan.

We provide various types of education in order to broaden understanding in employees of the importance of business continuity.

In FY2023, in addition to the e-learning conducted for all employees each year and pre-departure training for employees posted overseas, we conducted BCP training to new employees during their new employment training.

To prepare for disasters such as large-scale earthquakes that are predicted to occur in the future as well as the torrential rains and typhoons that occur every year, we have compiled a collection of natural disaster countermeasures for each of its offices. These are based on lessons learned from past natural disasters and are organized into themes such as "equipment," "stockpiles," and "evacuation."

We have been conducting initiatives linked to VC activities to raise employees' awareness of risk management.

In FY2022, we implemented dialogue sessions on the topics of safety, quality and risk, and held dialogue to make BCP feel more familiar to employees, in addition to reflecting comments from employees obtained through VC activities in various educational materials, and distributing information on good examples within the company.
In FY2023, we conducted e-learning on fire prevention KYT, and a total of approximately 70,000 employees underwent education that was held a total of 54 times.

As part of our efforts to prevent information leakage and maintain a high level of security through revision of internal rules in response to changes in social conditions and the status of overseas personal information protection, and checking the management and operational status of personal information protection and information security, we participate in the Japan Electronics and Information Technology Industries Association, and collect information on external trends and collaborate with external experts, etc.

We are also striving to further strengthen governance across our group, taking ongoing measures, such as checking the status of personal information protection and information security operations and conducting risk assessments once a year. In addition, working on education and simulation trainings for targeted threat emails for all employees, responses to GDPR^* in EU and other relevant laws in other countries, and personal information protection in Japan and overseas.

Furthermore, we also ask contractors who are our business partners to implement self-inspections on the status of personal information and information security initiatives, and evaluate the inspection results in our company in an effort to mitigate risk.

Training is aimed at improving security awareness and response capabilities, and it is given to all employees, including executives and partner company employees.

In addition to e-learning on basic knowledge of personal information protection and information security, we also conduct hands-on training to help employees learn how to conduct appropriate initial response in the event of a security incident such as a cyber attack. From FY2023, we have also been conducting high-level training on cyber attacks for overseas Group companies, assuming greater sophistication and diversification of cyber attacks, and have trained more than 13,000 employees.