We are aware that major risks may occur, which is why we have established a system that not only prevents the occurrence of such risks, but also takes appropriate measures to deal with them should they occur. In an aim to realize optimal company-wide risk management, we have established the Risk Management Global Policy and introduced Enterprise Risk Management (ERM).
We have established our ERM System with the Representative Director, President & COO as Chief Risk Management Officer responsible for ERM, and Representative Director, Executive Vice President / Executive Director, Corporate Strategy & Planning as Head Risk Management Officer, and as we regard risk management issues as important issues for our business strategy, we are taking action to respond to those issues. In addition, a Risk Management Committee has been established under the Management meeting to promote ERM, mainly led by the Risk & Compliance Management Department, which is the department (secretariat) in charge of risk management. Moreover, the Audit & Supervisory Boards and the Internal Audit Department are responsible for auditing the status of ERM promotion. Our Audit & Supervisory Board consists of two full-time Audit & Supervisory Board Members, who are well-versed in all aspects of our business operations and possess advanced information-gathering capabilities, and two outside Audit & Supervisory Board Members, who provide highly independent, objective, and professional perspectives. The Board conducts audits from a position independent of management. The Risk Management Committee also regularly reports the results of company-wide risk assessments and the status of responses to risks to the Board of Directors in an effort to improve the effectiveness of risk management.
ONO’s risk management system
In the event that a serious risk does emerge, the Representative Director, President & COO will establish an Emergency Response Committee, as necessary, to take measures to minimize damage and promote a speedy recovery.
Auditors conduct audits every year on our risk management process. In addition, the Risk Management Committee Secretariat reports semiannually to the Audit & Supervisory Boards (including two outside auditors) twice a year on the status of ERM, including risk identification (methods and results), risk assessment (priority rating), responses to major risks, and the results of those responses, among other matters. Furthermore, with regard to internal operational audits, the Risk Management Committee Secretariat shares with the Internal Audit Department the status of operational risk management confirmed by each division and the occurrence of new risks as needed, and this information is reflected in the selection of items for operational audits. The Internal Audit Department regularly reports the results of audits to the Audit & Supervisory Boards.
Outside directors are expected to serve the roles of supervising and advising management.
They are regularly reported on risk management at meetings of the Board of Directors, review the management system, and operation of ERM, and provide advice as needed.
They also regularly exchange opinions with the Risk Management Committee secretariat outside meetings of the Board of Directors. They provide advice on a wide range of ERM topics, based on the experience of corporate executives and professor (business administration), and keep their knowledge up to date on risk management practices.
Our training on risk management is conducted through a combination of level-specific and theme-specific training to ensure that all employees understand the importance of risk management and to enhance the effectiveness of our risk prevention activities. In our level-specific training, we provide training programs tailored to the roles and attributes of participants, such as executives and newly appointed managers.
In our theme-specific training, we regularly conduct e-learning twice a year, in the first and second halves of the year, on the basics of compliance, which is basic information that every employee should know as a member of society. This is done in an effort to foster a corporate culture within the company.
While respecting the autonomy of each group company, we provide advice and guidance on group-wide risk management through means such as periodic reports on business activities and discussions regarding important matters. Since FY2020, we have been expanding our ERM System to our group company in Japan and overseas, and have been using the “Risk Assessment Sheet” in our operations since FY2021. From FY2024, we have expanded the scope of our initiatives to include group companies engaged in businesses other than pharmaceuticals. We are continuously implementing risk management measures tailored to the specific circumstances of each group company, working to strengthen the overall risk management framework across the entire group.
We strive to continuously improve ERM through the following four processes: First, we clarify the purpose of ERM for strengthening our management foundation, the target risks, and preconditions such as common risk evaluation criteria for the entire company (Step 1). Next, we conduct semiannual risk hearings with each division and department twice a year to identify potential risks and reassess existing risks, and formulate and update plans for dealing with those risks. We also conduct interviews with management to identify key risks that should be managed on a company-wide basis (Step2). Each risk is scored based on its likelihood and impact, and then classified as critical, high, medium, or low. Risks rated as high or above are considered particularly important from a management perspective, designated as “company-wide risks” by the Risk Management Committee, and are given priority for countermeasures(Step 3). For each company-wide risk, a risk owner is selected for each risk to be responsible for managing those risks, and the progress of response plans is monitored by the Risk Management Committee twice a year. These updates are also reports to the Board of Directors (Step 4). We are working to enhance corporate value through the promotion of these ERM initiatives.
We have established a Business Continuity Plan (BCP) to ensure that, even if our operations are interrupted by natural disasters or accidents, we can quickly recover and resume our business operations. By securing two production sites—Fujiyama Plant and Yamaguchi Plant—and multiple logistics centers across Japan, we are working to mitigate risks and ensure a stable supply of our products. At key locations such as our headquarters, Tokyo Building, each plant, and each research institute, we have implemented disaster countermeasures, including emergency power supply systems and redundant power lines to protect against power outages. In addition, we have installed seismic isolation systems at our headquarters, Tokyo Building, Minase Research Institute, and Yamaguchi Plant to reduce the risks associated with earthquakes. Furthermore, to prepare for large-scale disasters, we have established a system that allows us to respond from both our headquarters and the Tokyo Building, implemented a system to quickly confirm the safety of our employees, and continue to strengthen our response capabilities through improvements to our internal systems and regular training.
The BCM Committee, which is responsible for business continuity management, is working to develop an all-hazards BCP that addresses not only natural disasters and major accidents but also a wide range of potential incidents. Furthermore, we are developing crisis response and business continuity plans on a global scale, including our overseas group companies.
The Ono Pharmaceutical Group's performance may be significantly affected by various business development risks that may arise in the future. The following is a list of major potential risks to the group's business development efforts. However, this is not an exhaustive list of every risk, and risks other than those listed may also exist, which may affect investors' decisions. Furthermore, items regarding future matters in the text were decided on by the Ono Pharmaceutical Group as of the end of FY2024.
Risks are classified into three categories, namely, “Strategic Risk,” “External Risk Factor,” and “Operational Risk(Risks associated with business operations),” and basic policies and priorities for dealing with those risks have been determined. The basic policy for responding to each risk classification is as follows:
Based on these three categories, our “major risks” are as follows:
Information assets are very important management resources.
We established a global policy on information security to protect information resources strictly, including data related to research and development and the personal information of internal and external stakeholders, and to manage the information appropriately. In consideration of the global increase in cyberattacks and security threats, we are also addressing the further strengthening of cybersecurity based on the global standard framework.
We have established Information Security Global Policy and procedures, as well as an information-security-related management system to ensure the effectiveness of these policies and procedures.
Overall responsibility for information security rests with Risk Management officer of Digital Technology (Executive Director of Digital Technology). The Risk Management officer of Digital Technology is responsible not only for formulating the ONO Group’s information security management strategy, but also for creating, revising, implementing and managing related policies, etc., and for ensuring that the ONO Group complies with them, while taking into account changes in the environment surrounding Ono Pharmaceutical and the latest trends in relevant laws and regulations, etc. Under the Risk Management officer of Digital Technology, a Head of Information System Department of the Company and the Information Security Department Manager are appointed to perform information security management duties at each division and Group company*.
Initiatives related to information security and cybersecurity are reported and shared at the Board of Directors following the Digital Technology Division meeting and the Risk Management Committee.
Organizational Structure for Information Security Management
Click here for our Privacy Policy.
Cyberattacks are becoming increasingly sophisticated and complex, so in response to these changes in the external environment, we continuously review and improve measures to address this issue. Some specific examples of such measures include implementing multi-layered defenses, strengthening our global security infrastructure, thoroughly enforcing policies, and conducting periodic vulnerability assessments.
We have organized a Computer Security Incident Response Team (CSIRT) for the purpose of quickly resolving security incidents and minimizing damage. The CSIRT strives to maintain and improve the security level of the entire group by collecting vulnerability and threat information and issuing alerts. In addition to conducting regular incident response training, the CSIRT also actively collects and shares information by participating in security organizations and communities.
In order to prevent security incidents from occurring, it is important to not only implement technical countermeasures but to also raise the security awareness of each and every employee. That is why we regularly educate our employees on information security and conduct e-mail training on a global basis. We have also established a website to disseminate information related to information security, and are making efforts to explain and inform our employees about various guidelines and rules on information security.