Close
We are aware that major risks may occur, which is why we have established a system that not only prevents the occurrence of such risks, but also takes appropriate measures to deal with them should they occur. In an aim to realize optimal company-wide risk management, we have established the Risk Management Global Policy and introduced Enterprise Risk Management (ERM).
We have established our ERM System with the Representative Director, President & COO as Chief Risk Management Officer responsible for ERM, and Representative Director, Senior Executive, and as we regard risk management issues as important issues for our business strategy, we are taking action to respond to those issues. In addition, a Risk Management Committee has been established under the Management meeting to promote ERM, mainly led by the Risk & Compliance Management Department, which is the department (secretariat) in charge of risk management. Moreover, the Audit & Supervisory Boards and the Internal Audit Department are responsible for auditing the status of ERM promotion. Our Audit & Supervisory Board consists of two full-time Audit & Supervisory Board Members, who are well-versed in all aspects of our business operations and possess advanced information-gathering capabilities, and two outside Audit & Supervisory Board Members, who provide highly independent, objective, and professional perspectives. The Board conducts audits from a position independent of management. The Risk Management Committee reviews the results of company-wide risk assessments and the status of responses to risks, and, following approval by the Management Meeting and the Sustainability Strategy Meeting, regularly reports them to the Board of Directors, thereby working to enhance the effectiveness of risk management.
ONO’s risk management system
In the event that a serious risk does emerge, the Representative Director, President & COO will establish an Emergency Response Committee, as necessary, to take measures to minimize damage and promote a speedy recovery.
Auditors conduct audits every year on our risk management process. In addition, the Risk Management Committee Secretariat reports semiannually to the Audit & Supervisory Boards (including two outside auditors) twice a year on the status of ERM, including risk identification (methods and results), risk assessment (priority rating), responses to major risks, and the results of those responses, among other matters. Furthermore, with regard to internal operational audits, the Risk Management Committee Secretariat shares with the Internal Audit Department the status of operational risk management confirmed by each division and the occurrence of new risks as needed, and this information is reflected in the selection of items for operational audits. The Internal Audit Department regularly reports the results of audits to the Audit & Supervisory Boards.
Outside directors are expected to serve the roles of supervising and advising management.
They are regularly reported on risk management at meetings of the Board of Directors, review the management system, and operation of ERM, and provide advice as needed.
They also regularly exchange opinions with the Risk Management Committee secretariat outside meetings of the Board of Directors. They provide advice on a wide range of ERM topics, based on the experience of corporate executives and professor (business administration), and keep their knowledge up to date on risk management practices.
Our risk management training is conducted annually through a combination of level-specific and theme-specific programs to ensure that all employees understand the importance of risk management and to enhance the effectiveness of our risk prevention activities. In our level-specific training, we provide training programs tailored to the roles and attributes of participants, such as executives and newly appointed managers.
In our theme-specific training, we regularly provide e-learning on the fundamentals of risk management—covering essential knowledge that all business professionals should have—and work to foster a strong corporate culture.
While respecting the autonomy of each group company, we provide advice and guidance on group-wide risk management through means such as periodic reports on business activities and discussions regarding important matters. Since FY2020, we have been expanding our ERM System to our group company in Japan and overseas, and have been using the “Risk Assessment Sheet” in our operations since FY2021. From FY2024, we have expanded the scope of our initiatives to include group companies engaged in businesses other than pharmaceuticals. We are continuously implementing risk management measures tailored to the specific circumstances of each group company, working to strengthen the overall risk management framework across the entire group.
We strive to continuously improve ERM through the following four processes: First, we clarify the purpose of ERM for strengthening our management foundation, the target risks, and preconditions such as common risk evaluation criteria for the entire company (Step 1: Clarification of prerequisites). Next, using potential new risks anticipated in response to changes in the external and internal environment as discussion topics, we conduct risk hearings twice a year with each division and department to identify latent risks and re-evaluate existing risks, and to formulate and update response plans. We also conduct interviews with management to identify key risks that should be managed on a company-wide basis (Step2: Assessment). Each risk is scored based on its likelihood and impact, and then classified as critical, high, medium, or low. Risks rated as high or above are considered particularly important from a management perspective, designated as “company-wide risks” by the Risk Management Committee, and are given priority for countermeasures (Step 3: Mitigation measures). For each company-wide risk, a risk owner is selected for each risk to be responsible for managing those risks, and the progress of response plans is monitored by the Risk Management Committee twice a year. These updates are also reports to the Board of Directors (Step 4: Monitoring). We are working to enhance corporate value through the promotion of these ERM initiatives.
We have established a Business Continuity Plan (BCP) to ensure that, even if our operations are interrupted by natural disasters or accidents, we can quickly recover and resume our business operations. By securing two production sites—Fujiyama Plant and Yamaguchi Plant—and multiple logistics centers across Japan, we are working to mitigate risks and ensure a stable supply of our products. At key locations such as our headquarters, Tokyo Building, each plant, and each research institute, we have implemented disaster countermeasures, including emergency power supply systems and redundant power lines to protect against power outages. In addition, we have installed seismic isolation systems at our headquarters, Tokyo Building, Minase Research Institute, and Yamaguchi Plant to reduce the risks associated with earthquakes. Furthermore, to prepare for large-scale disasters, we have established a system that allows us to respond from both our headquarters and the Tokyo Building, implemented a system to quickly confirm the safety of our employees, and continue to strengthen our response capabilities through improvements to our internal systems and regular training.
The BCM Committee, which is responsible for business continuity management, is working to develop an all-hazards BCP that addresses not only natural disasters and major accidents but also a wide range of potential incidents. Furthermore, we are developing crisis response and business continuity plans on a global scale, including our overseas group companies.
The Ono Pharmaceutical Group's performance may be significantly affected by various business development risks that may arise in the future. The following is a list of major potential risks to the group's business development efforts. However, this is not an exhaustive list of every risk, and risks other than those listed may also exist, which may affect investors' decisions. Furthermore, items regarding future matters in the text were decided on by the Ono Pharmaceutical Group as of the end of FY2025.
Risks are classified into three categories, namely, “Strategic Risk,” “External Risk Factor,” and “Operational Risk(Risks associated with business operations),” and basic policies and priorities for dealing with those risks have been determined.
Based on these three categories, our “major risks” are as follows:
Information assets are very important management resources.
We have established global policies covering both information security and cybersecurity. We strictly protect our information assets, including data related to research and development, etc., and other information such as the personal information of internal and external stakeholders, to prevent leakage and appropriately manage such information. In consideration of the global increase in cyberattacks and security threats, we are also addressing the further strengthening of cybersecurity based on the global standard framework.
We have established Information Security Global Policy and procedures, as well as an information-security-related management system to ensure the effectiveness of these policies and procedures.
Overall responsibility for information security rests with Risk Management officer of Digital Technology (Executive Vice President, Digital Technology). The Risk Management officer of Digital Technology is responsible not only for formulating the ONO Group’s information security management strategy, but also for creating, revising, implementing and managing related policies, etc., and for ensuring that the ONO Group complies with them, while taking into account changes in the environment surrounding Ono Pharmaceutical and the latest trends in relevant laws and regulations, etc. Under the Risk Management officer of Digital Technology, a Head of Information System Department of the Company and the Information Security Department Manager are appointed to perform information security management duties at each division and Group company*.
Initiatives related to information security and cybersecurity are reported and shared at the Board of Directors following the Digital Technology Division meeting and the Risk Management Committee.
As a system for responding to security incidents, we have established ONO-SIRT as a Computer Security Incident Response Team (CSIRT) with the Chief Information Security Officer (Executive Vice President, Digital Technology) at the center, and have built an organization that can cooperate with internal divisions and external parties involved in risk management.
Organizational Structure for Information Security Management
Click here for our Privacy Policy.
Cyber attacks are becoming increasingly sophisticated and complex. In order to respond to these changes in the external environment, we continuously review and improve our measures. Specifically, we incorporate global security frameworks and best practices, consult with external experts, and carry out internal assessments. We have developed an improvement plan to address the issues raised and are implementing ongoing corrective measures. In addition to conducting assessments on security governance and management, we carry out technical measures such as implementing multi-layered defenses, strengthening our global security infrastructure, ensuring strict compliance with policies, and performing regular vulnerability assessments. In particular, with regard to our internet-facing environments, an external organization conducts regular vulnerability assessments of applications and platforms, and we implement countermeasures according to any identified risks.
We have organized a Computer Security Incident Response Team (CSIRT) for the purpose of quickly resolving security incidents and minimizing damage. We collect information on vulnerabilities and threats, issue alerts, and are committed to maintaining and enhancing the overall security level of our group. We are also actively engaged in gathering and sharing information through participation in security organizations and communities.
In addition to implementing multi-layered measures against suspicious e-mails and the downloading of unauthorized programs via websites, which are particularly likely ways that employees will be attacked, we have a system in place to receive reports and inquiries from employees so that they can promptly cooperate with our security team. We also conduct tabletop exercises and simulation training to prepare for security incidents, and are implementing measures to prevent cybersecurity incidents. Given that such incidents may also necessitate a response both from a legal and compliance standpoint, CSIRT works in collaboration with relevant departments under an established incident response system.
In order to prevent security incidents from occurring, it is important to not only implement technical countermeasures but to also raise the security awareness of each and every employee. That is why we conduct the following training to raise awareness:
As part of our company-wide efforts to raise awareness, we have created a website to disseminate information on information security, and periodically publish e-mail magazines. Through these activities, we strive to explain and promote awareness of various information security guidelines and policies among group employees.