Risk management

The DOWA Group engages in making its risk management more sophisticated to prevent situations that could have a major impact on its business and to prevent or mitigate damage in the unlikely event such a situation comes to pass. In addition, we will continue efforts to enhance and perfect our risk management flow, which involves identifying apparent and potential risks at each operating company, implementing countermeasures, reviewing them, and conducting audits.

We classify risk into four categories: strategic risk, economic risk, operational risk, and hazard risk. Each classification includes scenarios and integrated risk management with reference to COSO and JISQ2001. The status of risk management is mainly overseen by the Corporate Strategy Committee and Business Management Committee for strategic risks and economic risks, while the status of risk management for operational risks and hazard risks is overseen by the Sustainability Committee. In particular, under the umbrella of the Sustainability Committee, the Sustainability Subcommittee, chaired by the director in charge of the Corporate Strategy Dept., has been established to strengthen various sustainability activities, including the promotion of risk management. Matters deemed important are reported to the Sustainability Committee, which is chaired by the President.

Furthermore, any matters deemed important at each committee are reported to the Board of Directors for oversight.
We are a company with a Board of Auditors and appoints external directors and external auditors who monitor and supervise the Company's business operations from an independent and impartial standpoint. Our risk management system is separated from the Board of Auditors.

The Group has established a risk management system based on the Four Lines Model for internal control, modeled on three lines of defense. The Operating subsidiaries responsible for production and other operations (first line) and the Operating companies that oversees them (second line) develop a risk management cycle that includes periodic risk assessments. In contrast, each DOWA Holdings division (third line) as the holding company provides necessary instructions, supervision, and support. Furthermore, the Internal Audit Department of DOWA Holdings (fourth line) conducts internal audits to evaluate the effectiveness of these measures.

Under Medium-term Plan 2024, we established elements required for internal governance as follows and carried out measures to enhance each of these elements.

We established a Basic Policy on Internal Control in fiscal 2022 to clarify the direction to be taken by the Group with regard to internal governance.

Starting from fiscal 2022, we have begun holding presentations and internal education on internal governance and risk management, centering on the management of each Group company and internal governance managers. We have added internal control education to our training for new employees and newly appointed managers starting from fiscal 2023, and in fiscal 2024 we deliberated on expanding the scope of education to directors of Group companies and enhanced training at critical points of Group employees’ careers.

Starting from fiscal 2022, we have begun implementing a Risk Management Plan to identify and evaluate business risks in accordance with the business environment. In accordance with this plan, each Group company identifies and evaluates its business risks once a year and selects priority risks. Additionally, we develop countermeasures for the selected priority risks and incorporate them into the next fiscal year’s budget. A risk assessment conducted in fiscal 2024 identified 241 measures to address significant risks, which were included in the fiscal 2025 budget.
These measures are shared throughout the Group, and are executed with support from each DOWA Holdings department, operating company, and business support company. Furthermore, the Internal Audit Department of DOWA Holdings regularly visits business sites to provide individual feedback, ensuring the continuity of risk management efforts.

We established DOWA Standard Processes to document appropriate operational procedures and judgment standards for handling various apparent and potential risks in our business operations, and have begun activities to standardize and clarify our governance activities. As the Group’s activities span a wide range of operations, we balance the effect of creating definitions with operational workload as we carry out our activities.

We revamped our operational standards regarding key documents including consultation documents and reports on incidents such as environmental, safety, and quality assurance incidents and cyberattacks (issues arising at a stage prior to the occurrence of a serious accident or disaster). To establish operational procedures for these, we introduced an e-workflow system in fiscal 2024 to mitigate the risk of leaks of confidential information and improve the efficiency of these operations.

Working together with the Internal Audit Department of DOWA Holdings, we established a new auditing scheme that incorporates elements such as reviews of the Risk Management Plan in addition to the existing perspectives of J-SOX and legal audits.

In order to avoid or minimize any risks that could affect our ability to conduct business in times of emergency, we have formulated business continuity plans (BCPs) for each region and business location in the event of damaging earthquakes; other natural disasters, such as typhoons and torrential rains, which have been occurring with increasing frequency in recent years; and widespread pandemics. In addition, we regularly conduct drills based on scenario planning for large-scale disasters, such as an earthquake directly under the Tokyo metropolitan area, to prepare for crisis response as an organization. Since the DOWA Group primarily engages in business-to-business transactions, disruptions along the supply chain will have a severe impact on the production and sales activities of customers receiving our services or products. Therefore, through CSR procurement, we regularly confirm with our major suppliers that they have in place a BCP to ensure that we can restore and continue business promptly. Outside experts will conduct a location risk survey at all production sites in Japan, assuming a wide range of natural disasters such as earthquakes, tsunamis, windstorms, floods, and landslides, and based on the results, we are reviewing the BCPs at each site.

The strengthening of information security is positioned as one of the Group’s most important management issues. Under the leadership of management, we are working to address information security risks from both software and hardware perspectives. We established a dedicated team to respond to cybersecurity incidents, and it quickly tackled the issue. We operate to a security system that can centrally monitor the security status of computers used at each of the DOWA Group’s bases. We are also working to systematically improve employees’ understanding of security through methods that include raising awareness through training and study sessions.