As the environment surrounding the company becomes more complex and diversified, the Ricoh Group positions risk management as an essential initiative in appropriately controlling the various internal and external uncertainties that surround the Group's business and in implementing management strategies and achieving business objectives. And then all Group employees strive to improve risk management.
The Ricoh Group’s risk management systems can be divided into two main levels, as shown in Figure 1 below.
These two levels exist for the purpose of clarifying bodies responsible for risk management so as to facilitate agile decision-making and swift action in response to each level of risk, and together form an integrated risk management system. The management of some risks may be transferred from one level to the other, due to changes in the level of impact caused by environmental changes.
The role of each risk management body is shown on the right-hand side of Figure 1.
The Risk Management Committee was established as an advisory body to the GMC, for the purpose of strengthening risk management processes across the entire Ricoh Group. The committee is chaired by the corporate officer in charge of risk management and has experts from each organization as members to ensure comprehensive coverage of risks and substantial discussions, and to propose to GMC specific risks requiring response or focus in terms of the management of the Ricoh Group. Furthermore, the Company will review and restructure the risk management system in Figures 1 and 2 as necessary, in order to strengthen the effectiveness of risk management across the Ricoh Group.
In FY2020, the committee was held twice in November. We had an intensive discussion about new risks which various changes will bring about, such as changes in work styles due to the spread of COVID-19, changes in the internal environment (transition to a business unit structure, conversion to a digital services company), and the ever-changing international situation. In March 2021, we reconfirmed whether any important risks remain toward shifting to the new structure, but the possibility of unexpected events and management blind spots is not zero. Therefore, from FY2021, we will strengthen monitoring by increasing the frequency of meetings of the Risk Management Committee, identify and address risks at an early stage, and review managerial risks appropriately to flexibly deal with risks.
Management coordinates with each business execution division, selecting a person responsible for risk management from each division (as a rule the manager), as well as a person responsible for the promotion of risk management (in a position to communicate with the manager on a daily basis), in order to further enhance the effectiveness and comprehensiveness of risk management systems. In addition, we are fostering a corporate culture resilient to risks by holding meetings to strengthen coordination for persons in charge of promoting risk management, sharing good examples of risk management activities at each organization, disseminating managerial risks, and holding study sessions and workshops organized by outside professionals for strengthening risk management.
The GMC and Risk Management Committee determine managerial risks based on a comprehensive recognition of risks that exert a significant impact on management, including impact on interested parties, in light of the Company’s management philosophy and business purpose, and are actively involved in countering these risks. (Figure 2: Process of determining managerial risks)
The Ricoh Group is taking various measures to prevent incidents from occurring. For example, it can be used by all officers and employees of the Ricoh Group in Japan (including part-timers, part-time workers, and dispatched laborers) as a contact point for reporting and consulting on regular business audits and compliance violations. Ricoh Group Hot Line Sysetem We have established and are strengthening monitoring. In addition, we have established the Ricoh Group standard "Standard for responding to incidents" for all affiliated companies in Japan and overseas.
In the event of an incident that adversely affects the corporate activities of the Ricoh Group, the president, internal control committee, and disclosure control department of Ricoh Co., Ltd. will promptly treat the incident as a "serious incident" from the outbreak area through the supervising area for each incident. , We have established a system to report to officers, corporate auditors, etc. related to the case, and take measures based on the president's policy and prevent recurrence.
Regarding these serious incidents, we report to the Board of Directors every six months on the outline of the incidents that have occurred in the last six months, their response, measures to prevent recurrence, and changes in the number of incidents by incident category.
In addition, the content of reports of serious incidents and changes and trends in the number of occurrences are used as a reference when reviewing management risks at GMC in the following fiscal year.
The incidents that were reported by 2021 and their countermeasures are shown in the following table. Serious Incidents Affecting Management (GRI Standard 419.1 Violation of Socio-Economic Laws and Regulations) is “0”.
We are continuously disclosing progress reports on " Financial irregularities at Ricoh India," which is a serious incident that has affected management in FY2015.
incident category | FY2019 | FY2020 | FY2021 | |
---|---|---|---|---|
Labor law violation | Substantiated | 2 | 0 | 1 |
Under investigation | 0 | 0 | 0 | |
TTL | 2 | 0 | 1 | |
Professional misconduct | Substantiated | 4 | 12 | 16 |
Under investigation | 0 | 0 | 0 | |
TTL | 4 | 12 | 15 | |
Embezzlement or theft | Substantiated | 12 | 0 | 13 |
Under investigation | 0 | 0 | 0 | |
TTL | 12 | 0 | 13 | |
Corruption | Substantiated | 0 | 0 | 0 |
Under investigation | 0 | 0 | 0 | |
TTL | 0 | 0 | 0 | |
Fraudulent accounting | Substantiated | 2 | 3 | 3 |
Under investigation | 0 | 0 | 0 | |
TTL | 2 | 3 | 3 | |
Harassment | Substantiated | 1 | 1 | 0 |
Under investigation | 0 | 0 | 0 | |
TTL | 1 | 1 | 0 | |
Human rights violation | Substantiated | 0 | 0 | 0 |
Under investigation | 0 | 0 | 0 | |
TTL | 0 | 0 | 0 | |
Others | Substantiated | 4 | 1 | 4 |
Under investigation | 0 | 0 | 0 | |
TTL | 4 | 1 | 4 | |
TTL | Substantiated | 25 | 17 | 37 |
Under investigation | 0 | 0 | 0 | |
TTL | 25 | 17 | 37 |
Incident items that accounted for a high percentage of the total number of incidents in fiscal 2021 are as follows;
“Business Fraud" includes fraud related to documents such as commercial invoices. “Embezzlement or theft" includes theft from inventories and of company equipment. Many of the incidents in these two categories came to the surface as work from home became the norm and internal rules and business processes were adapted to the remote work environment. We have taken strict and appropriate measures to deal with these incidents, and 32 employees have been disciplined in accordance with company regulations. We have also implemented measures to prevent the recurrence of similar incidents, such as installing additional security cameras, enhancing approval processes for order placement and receiving, sharing misconduct cases within the organization, and developing the Code of Ethics education at the workplace.
An independent auditor that Ricoh India appointed in 2015 raised concerns regarding reporting, and delayed the publication of the results until the matter could be concluded. Ricoh India's audit committee, together with its accountants and lawyers in India, undertook an internal investigation which revealed that some employees had falsified accounts. Ricoh India announced its fiscal 2016 results on November 18, 2016.
Ricoh takes the above matter seriously, and will fully cooperate with any continuing oversight by India regulators and courts. Concerning its global systems, it will reflect external expert assessments of the effectiveness of governance and internal controls at overseas subsidiaries in formulating and deploying measures to reinforce internal audits at those subsidiaries and prevent similar incidents from recurring.
The Ricoh Group has created a Business Continuity Plan (BCP) to enable the business to quickly recover and continue and to minimize the degree of damage in the event of an unanticipated disaster or accident.
In addition to the business continuity plan we enforce BCM issues such as implementation, application, education, training, correction and reviews as the coverage of BCPs.
Each Group company establishes BCPs depending on its situation. Overall, the Ricoh Group has formulated a BCP to manage three possible scenarios: new influenza pandemic, a wide-area disaster in Japan including major earthquakes, and a long-term suspension of product supplies.
Currently, the Ricoh Group has two BCPs, one being formulated on the assumption of “New Influenza epidemic” and the other being the “Widespread disaster in Japan, such as major earthquakes.”
The Ricoh Group establishes response systems and execute necessary actions against the risk of a new influenza epidemic, based on the following basic policy.
In order to facilitate Ricoh Group companies around the world to recognize the conditions of outbreak of new influenza, and to respond based on a prescribed action plan, in the event of an outbreak of new influenza the Ricoh Group has established and has been applying the original alert level and criteria of issue. Having experienced the new influenza (A/H1N1) epidemic around the world from 2009 to 2010, the Ricoh Group conducted a review of the alert level in order to enable appropriate responses according to the individual conditions, and has been adopting the current level since FY2011.
The 5-step decision levels are formulated, and each Ricoh Group company implements countermeasures according to each level.
By referring to the phases released by the WHO, the Headquarters of Ricoh conducts a comprehensive study of : (1) the spread of infection, (2) the severity level, and (3) the damage to the Ricoh Group in each region, etc., and make a specific assessment of the alert level in each region.
The following is the overview of the alert levels.
The Ricoh Group has established and is implementing the “Ricoh Group New Influenza Action Guideline.”
The Action Guideline provides operations and activities to be conducted by each department and employee, approved/prohibited actions under each alert level. It also provides necessary preparations and execution items for operations to be continued under the alert level 5.
Ricoh Group companies / Divisions decide the business operations with priority that should be continued even during the pandemic of alert level 5, ensuring that safety of Employees is secured.
As a rule, the Ricoh Group suspends its businesses under the pandemic of alert level 5 and its Employees shall stay at home. Nevertheless, there are business operations whose continuation is considered indispensable in order to meet the strong needs of the society or due to inevitable reasons from the management point of view.
Operations to continuously provide customers who are engaged in public works* with products and services in the following
Basic jobs that must be performed by the Ricoh Group so that it can be sustained as a corporation (Payments of salaries, Payments to its creditors, etc.).
Jobs whose continuation under alert level 5 is regarded to be indispensable by each division, which is registered as such by the approval of the division manager in advance, and for which Response Plan that stipulated has been prepared.
The Ricoh Group has prepared a Response Plan, to continue business under the alert level 5.
Each company and each department has conducted analysis of impacts on the Continuing businesses with the utmost priority and Continuing jobs with priority, and prepared response plans based on the “Ricoh Group New Influenza Action Guideline.”
In order to respond quickly and effectively to widespread natural disasters and accidental disasters in Japan, the Ricoh Group has established the Large Scale Disaster BCP in Japan based on the following basic policy.
For the purpose of facilitating quick, appropriate and wide-ranging response to various disasters likely to occur in widespread regions in Japan (e.g., earthquakes, large-scale flood disasters, volcanic eruptions, nuclear power plant accidents, etc), BCP assumes representative disasters, such as “Tokyo-Epicentered Major Earthquake” and “Nankai Trough Huge Quake” as a basis of its formulation.
After selecting the important functions which the Ricoh Group should address (e.g., disaster prevention, establishment of information infrastructure, sales, production & procurement, etc.) each of these functions establishes BCP according to the following steps.
What and how much is sufficient for BCPs established independently by Ricoh Group companies? Is there any part that is missing or that is unnecessary? Those are the questions we have asked. After participating in a model business project of the Ministry of Economy, Trade and Industry and taking advantage of know-how gained from ISO 22301, the Ricoh Group's unique “Small BCP Establishment Manual” was created in 2014. Each Group company subsequently created the BCPs in accordance with that.
This includes a simple checklist for establishment status, making it possible to grasp the response of each company at a glance.
“Large Scale Disaster Response Manual” for employees was distributed, while at the same time, an e-learning material titled “Major disaster : Preparation in advance and responses to the outbreak – BCP of the Ricoh Group –,” was prepared to educate the outline of BCP that the Ricoh Group has developed and how to respond to disasters.
In addition to the evacuation trainings conducted by each company and business site every year, various types of simulation trainings are provided for specific groups, including “the Group Disaster Task Force”, “the Group Companies Local Disaster Task Force”, “each company and business site of the Ricoh Group”, etc.
In the simulation trainings, Message Board (*) browsing training is also included, which was newly developed as a means of being contacted by the company.