Governance
Risk Management Framework
The NEC Group has a company-wide cross-sectional risk management system centered on the Risk Control and Compliance Committee and the CRCO to accurately comprehend and to respond appropriately to both internal and external risks related to NEC Group’s businesses. An overview of this system is shown below.
In NEC Corporation, important matters related to company-wide risk management, including a risk management policy and selection of and response policies to “Priority Risks” that requires countermeasures across the NEC Group, as well as measures to address risks that require company-wide management in response to changes in risk environment during the fiscal year, are discussed at the Risk Control and Compliance Committee and then reported to the Business Strategy Committee and the Board of Directors on a regular basis.
The Company has the CRCO to monitor and address company-wide risks centrally and cross-functionally and to manage possibilities to make losses. The CRCO takes a lead in the company-wide risk management by detecting and analyzing risks that are diversifying and becoming more complex in constantly changing social and business environment, and evaluating impacts, while prioritizing countermeasures and closely collaborating with other chief officers in charge of each risk.
At NEC, we promote management for sustainability under a corporate governance framework that clearly separates oversight and execution.
Identification and Description of Risks
Policy for Risk Identification
The NEC Group refers to the Enterprise Risk Management - Integrated Framework of the Committee of Sponsoring Organizations of the Treadway Commission (COSO), and ISO 31000 which is a standard that provides principles and guidelines for risk management. On this basis, the NEC Group, in order to pursue returns through appropriate risk management, has categorized the risks associated with the NEC Group’s businesses into a Risk Total Picture and has decided on responsible divisions and response policies for each risk. In the Risk Total Picture, integrity is recognized as the foundation of all risk management activities and risks are classified into three categories according to their nature. The Company has developed a response flow in case such risk should materialize, especially in the event of a crisis that threatens the existence of the Company.
Risk Identification Process and Status
Based on a comprehensive list of risks that the NEC Group should be aware of, the CRCO engages in dialogue with the other chief officers in charge of managing each risk and conducts risk assessments. The CRCO creates a risk map that visualizes risk priorities by evaluating impact on a five levels and urgency on three levels taking into consideration changes in the external and internal environment and the status of each risk countermeasure.
Priority Risks and Material Risks
1. Priority Risk
1.1. Provision of Proper Products and Services
The NEC Group offers a wide variety of products, systems, and services, and conducts business in Japan and abroad with a global supply chain. Accordingly, ensuring quality and safety and appropriately managing contracted projects are essential for maintaining customer trust and market competitiveness. Major incidents arising from quality issues or deficiencies in project management, whether within the NEC Group or throughout the supply chain, may affect customers’ business continuity and socially important systems.
Should such incidents occur, product or service recalls, customer compensation, responses to regulatory authorities, and external communications may become necessary. Such incidents could also result in a loss of stakeholder trust and significantly impact corporate value. The operation of systems related to quality, safety, and project management is closely linked to the NEC Group’s business continuity and social reputation. Failure to manage these systems appropriately may therefore constitute a management risk.
2. Significant Risk
2.1. Cybersecurity
As the world becomes increasingly interconnected, cyberattacks are becoming more sophisticated amid the growing use of AI technologies and cloud services across the NEC Group’s business environment. Risks such as information leakage, business disruption, and service delivery interruptions continue to increase due to factors including the commercialization of cyberattacks, such as ransomware, and the growing number of attacks targeting cloud configuration vulnerabilities.
If serious issues arise in the products, systems, or services provided by the NEC Group, they may significantly impact customers’ business continuity and social infrastructure. Furthermore, inadequate responses in areas that require strict information management for economic security may lead directly to administrative action or loss of credibility.
NEC believes that these events could undermine trust in the NEC Group and materially impact corporate value.
Information Security and Cybersecurity (Risk Management)
2.2. Respect for Human Rights
By continuously assessing the actual or potential adverse impacts across the value chain, the NEC Group identifies “New Technology and Human Rights (AI and Human Rights),” “Human Rights Risks Related to Geopolitical Situations and Conflicts,” “Labour in Supply Chains,” and “Employee Health and Safety,” which it considers to have a particularly high impact, as salient human rights issues. In particular, if NEC is considered to be responding inadequately to these salient human rights issues, this could not only result in social criticism but also significantly impact the NEC Group’s social and corporate value through transaction suspensions and reputational damage.
Respect for Human Rights
NEC Group Human Rights Policy
Long-term Risk
Risks Related to Business Continuity and Responses
The Board of Directors is responsible for overseeing the execution of duties by executive officers and directors as well as guiding the direction of management through deliberation of important matters related to the Company’s basic management policy.
The NEC Group has prepared a business continuity plan (BCP) and is promoting business continuity management so that the Company can fulfill its social responsibilities based on the continued stable supply of products and services even when risks materialize in the form of earthquakes, typhoons, or other natural disasters; global pandemics; wars; or terrorist attacks.
Our goal is to be able to continue NEC Corporation’s business to the greatest extent possible, and to restore operations quickly if they are interrupted.
- Ensure the lives and safety of employees, on-site workers, and visitors.
- Promptly restore and establish the business environment so that NEC can fulfill its social responsibilities, including maintaining and restoring mission-critical systems such as communications, public infrastructure, transportation, defense, and financial systems.
- Minimize management damage arising from business interruptions.
1. Business Continuity Management Framework
We will continue to conduct business proactively and flexibly through the following three functions. The status of activity will be reported regularly to the Board of Directors.
- Business Continuity and Disaster Recovery Headquarters
This function is headed by the president and comprises corporate divisions. The headquarters maintains senior management’s decision-making function and prepares an environment that will facilitate the recovery of operations. - Related Division BCP Teams
These teams are formed in each related division. They confirm the safety of NEC Group employees and conduct activities for recovery of business (customer response, gathering information of damage to operations, recovery, logistics, and securing materials, etc.). - Workplace BCP Teams (Bases)
These teams are formed at the workplace and base level. They ensure the safety of workplaces and bases, quickly restore infrastructure, support employees’ lives, assist those who wish to return home, and coordinate with the community.
In addition, outside Japan we have formulated BCPs in response to each country’s risk profile under the Regional Headquarters (RHQ), along with information escalation rules in the case of emergencies.
2. Education, Exercises and Training on Disaster Prevention and Business Continuity
2.1. Education and Web-based Training
NEC and affiliated companies in Japan conduct the following training and drills every year to prepare for large-scale natural disasters with the aim of minimizing damage and resuming operations as quickly as possible.
- Conduct training to review disaster response procedures tailored to different work styles.
- Hold web-based training and workplace discussions to think about how to act during a natural disaster, what can be done beforehand, and the necessary preparations for dealing with a large-scale earthquake.
2.2. Enhancing the Degree of Completion of BCPs
- NEC visualizes the business continuity status for each company and division by using indices such as “organizational state in regular times and at the time of disaster,” “leadership,” “disaster preparedness and business continuity plan,” “support status,” “effective operation,” and “evaluation and improvement.”
- We will evaluate and refine our initiatives to instill a business continuity mindset and disaster preparedness and continue making improvements across the entire NEC Group to enable each division and employee to think and act autonomously during disasters.
3. Response to Large-scale Disasters, Incidents and Accidents, and Infectious Diseases
3.1. Addressing Natural Disaster Risks such as Earthquakes and Storm and Flood Damage
We have constructed a system in which the Company’s internal disaster information sharing system automatically receives disaster information from the Japan Meteorological Agency. This allows us to understand at a glance information regarding the suppliers and other stakeholders located within that range.
Furthermore, we use the latest hazard maps to evaluate risk. Based on these evaluations, we implement countermeasures with due consideration of the balance between the impact of a disaster and cost.
3.2. ISO 22301:2019 Certification Acquisition
We have acquired ISO 22301:2019 certification, mainly in our system maintenance divisions and datacenter operations divisions.
ISO 22301:2019 is an international standard for Business Continuity Management Systems (BCMS).
Moreover, divisions that have not acquired ISO 22301 certification are complying with the international standard as far as possible and have put in place efficient and effective countermeasures to prepare for potential threats to business continuity, including earthquakes, floods, typhoons, and other natural disasters; system faults; pandemics; power outages; and fires.
Risk Management Initiatives
Initiatives to Foster a Risk Culture
1. Internal Feedback Process for Latent Risks
The Risk Control and Compliance Committee and officers exchange and discuss information about latent and emerging risks to enhance the Company’s ability to address risks. We also continuously improve our risk management methodology.
2. Risk Management Evaluation Indicators and Monetary Incentives
NEC Corporation’s Employee Disciplinary Regulations stipulate that employees who cause damage to the Company intentionally or through negligence will be liable for damages in addition to being subject to disciplinary action.
3. Risk Management Training and Education
Each year, NEC conducts training for all employees as part of its risk management training, covering topics such as compliance, the environment, human rights, and information security.
In addition, training is provided for management to enhance awareness and understanding of risk management.
As part of the onboarding process for new outside directors, we conduct training under the theme of our risk management.
4. Confirmation and Reporting of Latent Risks by Employees
Compliance (Whistleblowing System)
We also strive to detect potential risks at an early stage by conducting annual risk assessments that capture insights and concerns at the operational level.