- Sustainability TOP
- Governance
- Risk Management
Risk Management
Basic Approach
The Isuzu Group manages various risks surrounding its business in a systematic and integrated manner in order to achieve sustainable growth and enhance corporate value. Through risk management initiatives, we will strive to minimize risk, improve operational efficiency, create business opportunities, enhance our competitive advantage, and build relationships of trust with our stakeholders.
Risk Governance Structure
To improve the division of responsibilities and effectiveness of risk management activities throughout the Group, we have established a risk governance structure based on a Group-wide three lines of defense model. Isuzu's divisions and the Group companies in their charge serve as the first line; the Enterprise Risk Management Dept. functions as the second line under the direction and supervision of the Chief Risk Management Officer (CRMO); and the Corporate Audit Dept. serves as the third line. Each line of defense works in cooperation with the others in risk management activities. In order to ensure the effectiveness of risk management activities, the Risk Management Review Meeting is held every month to confirm the status of risk mitigation efforts and incident management of each division and Group company, focusing on Group Priority Risks, and to report the details of the meeting to management.
Risk Management Process
The Isuzu Group comprehensively identifies risks that could affect its business or management, assesses them quantitatively and qualitatively, formulates specific risk mitigation plans, and then promotes implementation and monitoring of the plans. Believing that it is essential for all employees to treat risk management activities as their own responsibility, we also continue to foster a risk culture to achieve sustainable growth and maximize corporate value.
Group Priority Risks
The Isuzu Group prioritizes risk mitigation efforts for risks of particularly high importance in each division of the Company and in each Group company. From the Group-wide perspective, the Group also identifies risks that could affect its business or management as Group Priority Risks and carries out risk mitigation efforts across the organization. Group Priority Risks are identified and selected from the following five perspectives to ensure that no omissions are made:
- Risk identification through risk assessments from each division of the Company and Group companies
- Risk identification through CRMO interviews
- Evaluation of residual risks from the previous fiscal year
- Risk occurrences within the Company or at other companies
- Changes in the external environment, etc.
- *Please refer to the Business and Other Risks section of the Annual Securities Report, which is compiled based on the Group Priority Risks.
Crisis Response
The Isuzu Group has established a structure to comprehensively and promptly identify risk occurrences and implement effective initial responses. If any such risks have the potential to affect the business or management of the Isuzu Group, they are promptly escalated to management, which decides how to respond. Then, under the direction and supervision of the CRMO, a crisis response team is formed, and various countermeasures are implemented to minimize the risk. Furthermore, we analyze the root causes of risk occurrences to verify the effectiveness of our countermeasures. By doing so, we closely integrate the Risk Management Process and the Crisis Management Process, aiming to optimize risk management across the entire Isuzu Group.
Information Security
The Isuzu Group positions information security as one of its key management priorities: it protects the information assets that underpin business activities and supports competitiveness, business continuity, and stakeholder trust. We appropriately manage and protect information assets, including personal information, customer information, business partner information, product development information, and design data, and, in light of the increasingly sophisticated and diverse nature of cyberattacks and other threats, we are working to enhance our cybersecurity resilience.
Management Structure
Under the Group Information Security Policy, the Isuzu Group has established a Group-wide information security management structure and is developing and implementing various regulations, including operational processes. The CRMO is responsible for information security management for the entire Isuzu Group. By assigning information security managers and management personnel to each Isuzu division, the Group implements various information security measures that also cover the Group companies each division has charge of. In addition, the Information Security Management Meeting, hosted by the CRMO, is held on a regular basis. At the meeting, annual activity plans are formulated, the activity status of each division and Group companies is monitored, and instructions for countermeasures are given as necessary. Furthermore, these activities are regularly reported to the Management Meeting and the Board of Directors, and continuous improvement is pursued under the oversight and confirmation of management.
Establishing and Operating a Cybersecurity Resilience Framework
In recent years, cybersecurity has become increasingly important in the automotive industry due to the growing connectivity of vehicles, advances in automated driving technology, greater use of software, and the progress of digital transformation (DX) in plants, logistics, and sales. In light of this environment, through our participation in J-Auto-ISAC*, we track threat and incident information detected within the industry, and by complying with international standards—including the Cybersecurity Management Guidelines set forth by the Ministry of Economy, Trade and Industry, ISO 21434, ISO 27001, NIST SP 800-171, and UN-R155/156, which were adopted by the World Forum for Harmonization of Vehicle Regulations (WP.29) under the United Nations Economic Commission for Europe—we are strengthening cybersecurity across our products, plants, IT systems, and supply chain. In addition, recognizing that it is difficult to completely prevent cyberattacks from occurring, we are working to strengthen cyber resilience, encompassing not only "defense" but also "detection, response, and recovery." When an information security incident occurs, the relevant security divisions, together with each division and Group company, coordinate under the direction of the CRMO to carry out a rapid initial response, working to prevent damage from spreading and to achieve early recovery. Furthermore, after an incident occurs, we conduct a root-cause analysis and work to strengthen the organization's overall response capabilities through the development, implementation, and monitoring of recurrence-prevention measures. For significant incidents, we report to the Management Meeting and the Board of Directors, which confirm the response status and the adequacy of the recurrence-prevention measures.
- *J-Auto-ISAC: Japan Automotive ISAC, a general incorporated association that serves as Japan's automotive cybersecurity organization.
Managing Information Assets
The Isuzu Group appropriately manages personal information, such as customer information and business partner information, in accordance with the personal information protection laws of each country. To ensure that personal information is handled properly, we have put Group regulations in place, and we work to protect it through internal training and regular reviews of the personal information we hold. In addition to personal information, we also treat confidential information—such as product development information, design data, and trade secrets—as important information assets, and work to ensure thorough management appropriate to the nature of each type of information. Specifically, we are working to prevent information leaks and unauthorized use through measures such as establishing internal regulations on the proper handling of information and operating a confidentiality labeling system. Furthermore, in light of the growing importance of information management within the supply chain, we are working to strengthen information management practices with our business partners as well, improving the effectiveness of information asset protection across the Group as a whole.