Risk Management

Basic Approach

Our group recognizes risk management as one of the important management issues and is working to enhance and strengthen risk management. In line with the changing environment surrounding our group, we also recognize ESG-related risks such as compliance, cybersecurity, supply chain, and human rights/human capital as important management issues. To address this situation, our group has established risk management guidelines that include proactive measures and preparations to prevent emergencies and minimize damage, and we are conducting risk management after identifying risks in order to ensure their reliable implementation. Regarding safety and health and environmental protection activities and business continuity management activities, we are working to strengthen our management system by extracting major risk items based on the frequency of occurrence, impact, and surrounding environment, and clarifying the responsible department, cause, and preventive measures for each.

Governance Structure

Our group has established a Risk Management Committee to discuss responses to significant risk incidents and measures to prevent recurrence. The Risk Management Committee is chaired by the Human Resources Officer and consists of Executive Managing Officers and above, as well as the Audit Committee Secretariat. It shares risk information across the entire group and considers response policies. For incidents that could have a significant impact on corporate value, such as production and business activity suspensions, large-scale losses, serious quality problems, legal violations, and cyberattacks, the Risk Management Committee discusses countermeasures and measures to prevent recurrence. In addition, human rights risks are discussed regularly, and the status of responses is shared with the relevant departments. The status of these activities is reported to the Board of Directors, and important matters concerning risk management are subject to the Board's oversight.

Main roles of the Risk Management Committee

• Discussions on how to respond to serious incidents (quality issues, legal violations, cyberattacks, etc.)
• Regular discussions on human rights risks

In fiscal 2025, 4 meetings were held to discuss individual risks, including responses to receivables with collection concerns, as well as the progress of compliance and human rights initiatives.

Initiatives

Initiatives regarding BCP and Climate-related Risks

We consider risks arising from natural disasters and climate change to be one of our key issues and manage them within the framework of risk management. For these risks, the Risk Management Committee and the Sustainability Meeting are responsible for addressing them according to their nature, and they consider policies and countermeasures. The results are reported to the Board of Directors through the Executive Meeting and are subject to oversight. Furthermore, we continuously review and improve these risks in light of changes in the business environment.

BCP (Business Continuity Plan)

To address the risk of operational disruptions due to natural disasters and other unforeseen events, we have developed a Business Continuity Plan (BCP) and are promoting the strengthening of our crisis management program within our consolidated Mid-Term Management Plan. Furthermore, based on changes in the business environment and past response experiences, we are continuously making improvements, such as considering alternative production systems and strengthening information sharing systems across the entire group. For more detailed information on risk assessment in the supply chain and our efforts to ensure continued supply, please refer to the Supply Chain section.

Climate-related Risks

Regarding climate-related risks, we conduct scenario analysis, identify and assess risks, and manage the progress of countermeasures, primarily through our Sustainability Meeting.

• Risk of reduced sales due to the decline in internal combustion engine vehicle sales:
  The Sustainability Meeting and the Board of Directors discussed and formulated a sales ratio target for products that contribute to decarbonization.
• Risk of increased costs associated with the introduction of renewable energy:
  The Sustainability Working Group gathers information and considers countermeasures.
• Risk of supply chain disruptions due to floods, etc.:
  The Risk Management Committee is promoting the strengthening of BCPs, including those involving suppliers.

Initiatives regarding Cybersecurity

Basic Approach

We recognize risks such as cyberattacks and data breaches as one of our key business challenges, and we are strengthening our response within the framework of risk management. Regarding information security risks, the Risk Management Committee considers policies and countermeasures, and these are reported to the Board of Directors after passing through the Executive Meeting and are subject to their oversight.
Furthermore, in order to appropriately protect confidential and personal information from threats such as cyberattacks, we have established and implemented information security policies and regulations, and are working to strengthen information security through employee training and various measures. We are continuously working to prevent information leaks and intellectual property infringement and to reduce the risk of business disruption.

Governance Structure

At our company, the Risk Management Committee discusses and shares information regarding policies and countermeasures for information security risks, and the Executive General Manager of Corporate Strategy Promotion Headquarters oversees these activities. Under the Executive General Manager of Corporate Strategy Promotion Headquarters, Information Systems Department collaborates with a Security Operations Center (SOC) provided by an external security vendor to address risks such as cyberattacks and internal fraud across the entire group.
In the event of an emergency, we will establish an incident response team in cooperation with external security vendors to ensure the incident is resolved as quickly as possible.

Initiatives

Our activities are based on three pillars: "monitoring and response," "technical countermeasures," and "education and awareness." We implement security measures led by headquarters, thoroughly monitor the global environment, and have established a rapid incident response system to strengthen our response to increasingly sophisticated cyberattacks, internal information leaks, and other security threats.
In the event of a security incident, we promptly report it to Executive General Manager of Corporate Strategy Promotion Headquarters, and conduct investigations, analyses, and countermeasures through the Risk Management Committee, involving external experts, to enable the prompt continuation of business operations.