Risk Management

We identify, analyze, and assess various risks surrounding our business based on future projections and changes in the internal and external environment, and implement measures to avoid, mitigate, transfer, or acknowledge, etc., related to these risks. In addition, by monitoring the situation, we promote risk management in accordance with the following principles with the goal of appropriately managing risks and supporting the management of the Group.

The Progress and Future Vision of ERM

• Involve all management personnel and employees
• Recognize risks linked to business goals and promote them as an organization-wide activity
• Review risks and risk response plans, taking into account the organization’s purpose, mission, and goals, as well as internal and external conditions
• Continuously improve based on evaluation of the effectiveness of our initiatives and feedback from stakeholders

The JX Advanced Metals Group regards enterprise risk management (ERM*) as an essential element in achieving our long-term vision. We are committed to continuous improvement to enhance the effectiveness of our ERM practices.
We first established our risk management system in 2015 and focused on operational risks. In 2019, the formulation of Long-Term Vision 2040 prompted the transition to a risk management approach that supports the achievement of this vision. We shifted from traditional risk management activities to the implementation of ERM, referencing ISO 31000. We then worked to strengthen risk management capabilities to enhance corporate value in preparation for our listing on the Tokyo Stock Exchange, and continue to aim for alignment of ERM with management strategy.

• *A system or process to ensure that risk management is implemented in an organized, systematic, effective, and continuous manner in order to increase the certainty of achieving the organization’s objectives and goals.

Under the ERM framework, the JX Advanced Metals Group determines material risks, approves response plans for each material risk, and monitors these plans, at the JX Advanced Metals Executive Council. In addition, the Risk Management Office is responsible for the overall risk management for both the Company and the Group, and implements ERM.

Risk is defined as “any and all uncertainty that could have an impact on the management of JX Advanced Metals Group companies.” Here, to achieve risk management that is linked to our long-term vision, medium-term management plan, and business plan, we classify risks into management risks and business risks. Among management risks and business risks, risks that we determine will have a significant impact on the Group’s management, and that should be addressed on a company-wide basis, are designated as material risks by the Executive Council. Material risks include risks related to technology, business continuity, and geopolitical risks. The department responsible for these material risks takes the lead in implementing risk responses. In addition, the Executive Council monitors the status of these actions.

We conduct an annual business risk identification survey when formulating our management plan. This survey requires the organizations responsible for each risk (including subordinate organizations, business sites, and group companies under supervisory divisions), to identify, analyze, and evaluate risks that may hinder the achievement of business targets. Risks assessed as higher in priority (ranked based on impact and likelihood of occurrence) are reported to the respective risk supervisory divisions, which consolidate the results for submission to the Risk Management Office. The responsible organizations, acting as risk owners, mitigate or transfer identified risks throughout the year, and take appropriate risk response measures. To confirm risk status, we conduct semiannual monitoring to track changes, review progress, and evaluate the effectiveness of countermeasures.
We analyze reported risks across 45 categories based on impact and likelihood of occurrence, and report the results to management in the form of a risk map (heat map). This process visualizes material risks, clarifies priorities, and provides management with risk information that supports effective decision-making. Through this framework, we advance risk management aligned with our management strategy, support the achievement of business targets, and ensure accountability to stakeholders.

We begin identifying and addressing material risks when formulating medium-term management plans. The process involves the participation of key members of the Group’s management, such as the general managers of corporate and business divisions, as well as the president and vice presidents. This ensures that management’s perception of a risk is correctly reflected as a material risk.

Our approach to risk is to select and implement an appropriate response (transfer, mitigation, retention, or avoidance) to the relevant risk based on the results of risk assessment. For risks that could pose a serious impact on our business operations despite risk reduction measures, we utilize insurance as a means of risk transfer. We are working with relevant departments to optimize insurance on a global basis by reviewing the results of our surveys on insurance policies held by the Group in Japan and overseas and enhancing the effectiveness of insurance for the Group.

In advancing ERM, we utilize the Risk Management Society's ("RIMS^*") maturity model. This model defines the status for each pillar, such as Strategy Alignment, at various tiers. These are compared to the Group’s ERM status to assess maturity.
After setting the desired goals, we regularly conduct a gap analysis between the defined state at each tier and the current state of our group's ERM. This helps us identify the challenges we face in reaching the next tier. By implementing measures to resolve these challenges, we can achieve more effective ERM.

• *Based in New York, this is the world's largest risk management organization, with more than 9,000 risk management professionals as members worldwide.

Based on the results of the maturity assessment, we have identified the dissemination of ERM activities throughout the Group and the development of risk-sensitive personnel as the two key elements to promote for achieving a more effective ERM. Specifically, through our outreach efforts, we aim to deepen under-standing among all officers and other employees in our group regarding the importance of ERM and its connection to our management strategy by consistently highlighting these points. Additionally, through personnel development, we aim for individuals at various levels and roles to acquire the knowledge and skills necessary for effective risk management.
We incorporate and implement these elements into actual activities by ensuring risk management functions as a company-wide initiative. To this end, we develop processes and strengthen collaboration with the organizations responsible for each risk. The organizations responsible for each risk and the Risk Management Office communicate with each other through reviews and interviews conducted during various initiatives, including the business risk identification survey and monitoring activities. These bodies collaborate to refine risk information and develop effective countermeasures.
Ultimately, the goal is for employees at all levels in each organization within the Group to fulfill the risk management roles required by their positions and to operate the ERM system autonomously.

We regularly publish Risk Management Newsletter, an in-house newsletter dedicated to risk management, with the aim of making risk management accessible to each employee and promoting its dissemination throughout the Group. For example, we feature articles such as, "What does the president consider risk management?" in which we interview the president. There are also articles regarding the latest trends in global risk, as well as those featuring good examples of how risk is handled within the Group.
Risks are not limited to Japan, but exist everywhere in any business organization, regardless of its size or location. To this end, in fiscal 2023, we also began publishing an English version of the newsletter to promote risk management among employees in all regions.
We conduct reader surveys twice a year to continuously monitor the level of dissemination, and we develop our initiatives based on the feedback received from these surveys.

(2) Member Skill Set

The Risk Management Office is committed to improving the competence of our members. Specifically, we have established our own skill sets of the skills and knowledge required to perform risk management tasks, and visualize the status of acquisition of these skills for our office members. Each member conducts a self-assessment during the performance evaluation period and, through discussions with their supervisor, works on improving their individual capabilities.
In the future, we will establish and develop skill sets not only for Risk Management Office members, but also for risk management promotion managers and promoters assigned to each business division, group company, and plant in an effort to broadly support the development of risk management talent.

Within the Group, we are working to implement risk management linked to our long-term vision, medium-term plan, and business plan by establishing three categories of risk: business risks, management risks, and material risks.

Material risks will be identified and risk responses initiated in conjunction with the timing of the medium-term management plan, according to the following steps. The process involves the participation of key members of the Group’s management, such as the general managers of corporate and business divisions, as well as the president and vice presidents. This ensures that management’s perception of a risk is correctly reflected as a material risk.

Risk scenarios are developed for all material risks. Risk scenarios are documented descriptions that outline the causes of risks manifesting and the potential effects on the Group if these risks were to materialize. The benefits of developing risk scenarios are as follows.
(1) Risk response includes activities to prevent risks before they occur and activities to minimize the impact if they do occur. The more clearly we define causes in risk scenarios, the easier it is to identify the most appropriate actions to take.
(2) By verbalizing risks and their impacts in detail as risk scenarios, we can correctly identify risks and ensure a unified recognition of these risks by all members of the Group, especially management. All risk scenarios will be finalized through discussions between the president and vice presidents.
Risk scenarios should not be created once and left unchanged; they need to be revised in response to changes in the internal and external environment. Instead of thinking about revising scenarios after change occurs, we are focused on using our imaginations to prepare for what if scenarios, and striving to embed this mindset within the organization.

The Group has formulated business continuity plans (BCP) to minimize damage and achieve early recovery in the event of business interruption due to a major earthquake.
From fiscal 2020, we have taken this to a higher level and have begun working toward the establishment of an all-hazard BCP called a resource-based BCP.
This is not a BCP for individual events, such as earthquakes or floods, but one that focuses on resource contingencies (facilities, raw materials, materials, etc.) that are likely to disrupt business activities during emergencies, and organizes relevant disaster mitigation and recovery measures.
We also conduct regular assessments of disaster risks at major business sites, including those overseas. This information aids in making decisions related to preventive measures and capital investments to mitigate potential damages. Through these initiatives, we aim to strengthen our BCP.
We continue efforts to improve initial response through efficient and reliable means of information sharing in the event of a natural disaster.
In fiscal 2024, we conducted joint training exercises across our head office, Hitachi Works, Isohara Works, and Kurami Works. The exercises served as initial emergency response drills assuming damage to the head office and covered (1) establishing and operating an emergency response headquarters at alternate offices and plants , (2) confirming the safety of personnel, (3) assessing internal and external damage to the company, and (4) sharing this information and handing over the emergency response headquarters back to the head office after recovery. The scenarios for these drills were kept confidential in advance. Moving forward, we will continue to enhance the effectiveness of our BCP through regular training sessions, as we work on establishing business continuity management.

Information Security Initiatives

The Group has taken steps to build an information security management system (ISMS) in compliance with ISO 27001 from the three perspectives of strengthening information security compliance, increasing customer trust, and leveraging information internally and externally.
In fiscal 2024, we conducted information security risk assessments, internal audits, rank-based training, and supplier management in each department in accordance with plans approved by the Information Security Supervisory Manager. To solidify information security measures and awareness within the Group, we are extending their application to Group companies, in addition to the head office and business sites.
In efforts to upgrade information security further under the leadership of the Information Security Supervisory Manager, we will incorporate the cyber security measures implemented by the IT Department. At the same time, we pursue continuous improvement in accordance with ISMS to contribute to the realization of our long-term vision of becoming a technology-based company.

Reference

Strengthening DX Infrastructure (Zero Trust Network)