Risk Management

Basic thinking on risk management

To control various risks that could have severe impacts on corporate management, KITZ carries out risk management in KITZ and each Group member company.

Risk management structure

In the KITZ Group, the executive officer in charge of risk management, who also serves concurrently as a member of the C&C Control Committee, which is chaired by the president, promotes risk management at KITZ and each Group member company based on basic policies decided on by that committee under the supervision of the board of directors.

Risk Management System

Risk analysis and evaluation

In the KITZ Group, the importance of anticipated risks related to business activities (totaling 128 risk items) is judged quantitatively along the two axes of their frequency of occurrence and their impact on management based on the basic policy and evaluation standards for risk evaluation formulated by the C&C Control Committee to identify important risks and key risks. Specifically, risks are graded by each evaluation item under the standards for determining their frequency of occurrence and their impact (consisting of the items of human injury, physical damage, liability, loss of profit, loss of trust, and environmental damage), and each is grouped into one of the four zones of high-damage/high-frequency, low-damage/high-frequency, high-damage/low-frequency, or low-damage/low-frequency based on a four-quadrant risk-mapping scale.

Risk map scale

Risk management implementation flow

Based on the results of risk evaluation by each organization and through the Management Conference, the KITZ Group identifies important risks and key risks that have a particularly high possibility of significantly impacting management among the important risks, chooses whether to address each risk through avoidance, transfer, mitigation, or retention in light of its importance, and drafts and implements necessary countermeasures under the responsibility of the individual executive officers and Group company presidents.

Important risks and key risks thus identified, and countermeasures drafted for them, are shared with the general manager of the Internal Audit Office. The Internal Audit Office evaluates the state of development and operation of risk management from an independent perspective through means that include checking on the progress and results of related countermeasures through business auditing and other activities.

In addition, based on reports on such matters as priority risks identified in the Management Conference and countermeasures drafted for them, as well as the results of evaluation by the Internal Audit Office, the board of directors carries out necessary deliberation and checks on the ultimate results of implementing countermeasures, among other activities involved in final decision-making and oversight on risk management in the Group.

Information security and personal information protection

To minimize the risk of cyber-attacks, information leaks by insiders, business stop due to cyber attacks, and any other disruptions to business continuity, as well as the impacts on customers and business partners, KITZ Group positions information security governance as one of its key management issues, and is continuously taking measures from both value creation through the information utilization and risk management. We have established KITZ Group Information Security and Personal Information Protection Policy and established the Information Security and Personal Information Protection Management Committee, chaired by an executive officer appointed by the president, to promote the policy decisions and initiatives for information security and personal information protection.

Basic Information Security Policy

KITZ Group established and promotes the following basic policies on information security.

Basic Policy for Personal Information Protection

KITZ Group has established and promotes the following basic policies for personal information protection.

Information security and personal information protection organization

Initiatives for Information Security and Personal Information Protection

KITZ Group has established KITZ Group Information Security and Personal Information Protection Policy (hereinafter referred to as the Policy) for all workers in KITZ and the Group companies to minimize the risk of cyber attacks and information leakage by insiders, and is continuously working to ensure information security and the proper handling of personal information.
In addition to the Basic Policy on Information Security and the Personal Information Protection, this policy defines the rules for use of information assets and technical requirements related to information systems, and ensures information security and the personal information protection from various perspectives. We also regularly review this policy in order to respond to recent changes in the environment and risks.
In addition, the Information Security and Personal Information Protection Committee, attended by KITZ and the Group companies, meets annually to share information security incidents and share information security improvement activities, in an effort to continuously improve information security and personal information protection throughout the Group.

Education for information security and personal information protection

KITZ Group provides various educational programs for KITZ and the Group-wide employees to improve each employee’s awareness and knowledge of information security and personal information protection, and manage information appropriately. Specifically, we provide education on such topics as information management education through e-learning, individual education when employees join the company and are promoted to managerial positions, and practical cyber-attack Email training.