Risk Management
The environment surrounding corporations is changing by the minute, and the related risks are becoming more complicated and diverse. Early detection and promptly taking measures are keys to effectively addressing risks. At SoftBank, we work to mitigate and prevent risks by identifying risks company-wide, building organizational structures to implement preventive measures and executing periodical risk management cycles.
Risk management structure
In order to identify company-wide risks from various angles and prevent the materialization of risks, we have established a management system based on the concept of a three-line model. The first line is where each department in the head office conducts reviews that includes risks when devising various measures and policies on the ground, while also carrying out risk management in their own departments. The second line is where the Risk Management Division, an organization independent from business departments, headed by a the head of the Risk Management Division charged with overseeing risk management, conducts company-wide and comprehensive identification of risks and confirmation of the status of measures taken (conducted twice a year), and reports to the Risk Management Committee. The Risk Management Committee, which includes the President, COO, CFO, etc. as members and in which the Audit & Supervisory Board Members and heads of the relevant departments also participate, determines the level of importance and the risk manager (risk owner) for each risk, gives instructions to take measures, etc. and through the head of the Risk Management Division, reports the status to the Board of Directors. The committee also supervises risks that may have a significant impact on the group with a Director experienced in information security (Representative Director, President & CEO Junichi Miyakawa) playing a central role.
The Internal Audit Office conducts an independent audits the entire risk management system and situation from a position independent from the first and second lines.
In conjunction with this, the head of the Risk Management Division reports the content of reviews by the Risk Management Committee, including the risk identification process, to external (non-executive) directors and auditors who supervise the execution of company operations, and seeks their opinion on risk management methods and points for improvement, etc., which is reflected into measures, etc. for risk management countermeasures.
In addition, we establish a reporting system for subsidiaries and affiliated companies, and conduct periodic checks of business-related risks identified by each subsidiary and affiliated company and countermeasure status, from the standpoint of risk management for the group overall.
- [Notes]
-
- *1Risk trend analysis: A technique where the latest news and public information is analyzed to provide material for identifying risks from new perspectives.
- *2KRI: Key risk indicators
- *The head of the Risk Management Division and the head of the Internal Audit Office independently report on risk management and audits to the Board of Directors based on their respective capacities.
- *We are working to further improve our risk management system through by outside evaluation of risk management by a third-party organization. This includes verification concerning evaluation of our risk management system and risk management process (conducted this fiscal year) in accordance with ISO 31000 (JISQ31000), as well as outside evaluation of risk management through an internal control reporting system as stipulated by the Financial Instruments and Exchange Act and evaluation of internal control (conducted once a year) that complies with SSAE18.
- *1
Risk management methods
When devising various policies and measures, not only are we reviewing potential risks in conjunction with business opportunities, we are also implementing a PDCA cycle, as illustrated below, on a regular basis to identify, select, and assess a wide range of risks for the SoftBank group, through which we are working to uncover, mitigate, and prevent increasingly complex and diverse risks before they occur.
| Plan | The Risk Management Division conducts risk assessments using a risk classification table (compiled from risk scenarios relevant to SoftBank and its subsidiaries and affiliates), interviews with the heads of each division in the company and the management of our principal subsidiaries and affiliates, interviews with each risk owners for the fiscal year, and the Risk Management Committee identifies risks that have a significant impact on the company based both on perspectives from the field and from the perspective of management and appoints risk owners. We do this to conduct a more multifaceted risk analysis aimed at identifying risks from various viewpoints by collecting information by means of providing information beforehand, such as external environment reports that include risks and opportunities, and raising questions that include short-term and medium- to long-term viewpoints. |
|---|---|
| Do | Risk owners review and implement measures, etc. for risks based on those that the Risk Management Committee has determined to have a significant impact on the company. |
| Check | The Risk Management Division monitors the status of measures by risk owners on a monthly basis, and reports to management and the Risk Management Committee. Based on these reports, the Risk Management Committee checks the implementation status, etc. of measures, reviews risks, and checks the necessity, etc. of additional measures. |
| Action | Risk owners examine and implement improvements and additional measures, etc. for any additional measures that are determined to be necessary by the Risk Management Committee. |
Yearly schedule
- [Note]
-
- *“Board of Directors” above includes advance briefings for External Directors and Audit & Supervisory Board Members.
- *
Training, etc.
For our employees, including new recruits, we ensure company-wide awareness on risks that need to be addressed and conduct training on risk management principles, etc. (e-learning, etc.), and have set up an internal consultation desk. We also share the same training materials with our subsidiaries and affiliates, and implement training on an as-needed basis. In addition, we incorporate risk management into competency assessment of employees, including those at the managerial level, which is reflected in remuneration assessments.
For external (non-executive) directors and audit & supervisory board members, we conduct periodic internal and external training, etc. on risk management, compliance, and other issues. To ensure that external directors and external auditors & supervisory board members can offer appropriate advice related to risk management, we provide explanations and opportunities to gain an understanding of risk selection and the status of countermeasures, as well as the results of risk reviews, the details of the group's businesses, and the latest risk-related information, etc., such as recent risk and technology developments, both when they first assume office, and periodically thereafter.
Risk appetite and
stress testing /
sensitivity analysis
We quantify each risk based on risk assessments and interviews with risk owners (those in charge of risks), etc. in terms of likelihood of occurrence (probability) and magnitude of potential effect (impact), and define the risk appetite (risk tolerance). We then obtain approval from the Risk Management Committee formed by those in management, including the president.
Below are examples of risks to the company and risk appetite.
| Risk category | Risk appetite |
|---|---|
| Compliance |
Based on the SoftBank Code of Conduct for all executives and employees, we are working to achieve compliance with a strong sense of ethics and responsibility in our daily work, ensuring thorough compliance with no tolerance for risks that violate compliance such as impropriety, discrimination, and harassment. |
| Intellectual Property and Brands |
The SoftBank Code of Conduct which all executives, employees, and group company personnel must comply with states that “We recognize the importance of intellectual property rights, and will respect the intellectual property rights of others, and promote the appropriate protection and utilization of our own intellectual property rights.” By respecting the intellectual property of others while working to actively create, protect, and utilize intellectual property, we believe that we mitigate risks and can improve corporate value, which will in turn contribute to the industrial development of society at large. |
In terms of financial risks, we conduct sensitivity analysis to foreign exchange rates and the like, and in terms of non-financial risks, we conduct risk analysis related to water stress at key business sites and the like.
Sensitivity analysis (Audited Consolidated Financial Statements)
Risk analysis related to water stress, etc. (Appropriate Use of Water Resources)
Addressing risks
that have significant
impact on the company
We are working to mitigate and prevent risks by selecting those that have a significant impact on our business activities based on the likelihood of occurrence (probability) and the magnitude of potential effect (impact), determining which risks should be prioritized, and implementing countermeasures.
1. Risk related to
management strategy
| Risk items | Typical risk examples | Risk reduction measures |
|---|---|---|
| a. Changes to economic conditions, regulatory or market environments, and competition with other companies | ||
|
|
|
| b. Adapting to technology and business models | ||
|
Risk of the SoftBank group being unable to respond appropriately or in a timely manner to changes in the market such as the emergence of new technologies or business models | Research the newest technology and market trends, conduct verification testing to introduce technically superior services, consider alliances with other companies, etc. |
| c. Leakage or Inappropriate use of information (including privacy information) and inappropriate use of products and services provided by the SoftBank group | ||
|
|
|
| d. Destabilization of the international situation | ||
|
Risk of delays in transportation of telecommunications business equipment and facilities due to regulations and restrictions imposed on aircraft, ships, and so forth by countries in conflict or other countries involved | Monitoring, information gathering, decentralization and diversification of suppliers |
| e. Stable provision of network services | ||
| (a) Telecommunication network failures | Risk of being unable to maintain telecommunications service quality due to increased network traffic or an inability to secure necessary frequency bands | Bolster the telecommunication network based on predictions of future traffic |
| (b) Unpredictable circumstances such as natural disasters | Risk of a natural disaster, pandemic, etc. preventing normal operation of telecommunication networks or information systems | Introduce network redundancy, establish an emergency recovery system, and implement countermeasures for power outages at network centers and base stations |
| f. Corporate acquisition, business alliances, establishment of joint ventures, organizational restructuring within the group | ||
|
Risk of investee companies being unable to perform as expected; risk of business partnerships and joint ventures not producing expected results | Conduct sufficient due diligence when considering each investment to make investment decisions in accordance with the prescribed approval process |
| g. Dependence on other companies' management resources | ||
(a) Outsourcing
|
|
|
(b) Use of other companies' facilities
|
Risk of becoming unable to continue using communication line facilities owned by other operators | Use multiple operators' communication line facilities |
(c) Procurement of various equipment
|
Risk of supply disruptions, delivery delays, etc. in the procurement of telecommunication equipment, etc. | Build networks by procuring equipment from multiple suppliers |
| h. Use of the SoftBank brand | ||
|
Risk that our actions negatively impact the trust or interests of SoftBank Group Corp. and we become unable to use the SoftBank brand | Bolster the system for checking prior to using the brand, release materials related to brand use, and conduct training |
| i. Service interruption or degradation due to related system failure | ||
|
Risk of becoming unable to continuously provide service for customer-facing systems, the PayPay smartphone payment system, etc. due to human error, equipment/system problems, cyber attack by a third party, hacking, or other unauthorized access | Add redundancy to the network and clarify recovery procedures in case of failure or other accidents |
| j. Training and securing human resources | ||
|
|
|
| k. Climate change | ||
|
|
|
2. Risk related to laws,
regulations,
and compliance
| Risk items | Typical risk examples | Risk reduction measures |
|---|---|---|
| a. Laws, regulations, systems, etc. | ||
|
|
|
| b. Lawsuits, etc. | ||
|
Risk of negatively impacting the SoftBank group's corporate image due to infringing upon the rights of a third party | Confirm laws, regulations, systems, and agreement terms on contracts, etc. |
3. Risk related to
finance and accounting
| Risk items | Typical risk examples | Risk reduction measures |
|---|---|---|
| a. Fund procurement | ||
|
Risk of increased fund procurement cost due to rising interest rates, etc. | Build a financial base to hold sufficient funds by diversifying means of fund procurement |
| b. Changes to accounting and tax systems | ||
|
Risk of impact to the SoftBank group's business development, financial condition, and performance due to additional tax burden caused by changes to accounting/tax systems, etc. | Consult with external experts such as tax advisors as necessary |
| c. Impairment loss | ||
|
Risk of impact to the SoftBank group's business development, financial condition, and performance due to impairment loss | Build a system for periodic monitoring |
4. Other
| Risk items | Typical risk examples | Risk reduction measures |
|---|---|---|
| a. Leadership team | ||
|
Risk of impact to the SoftBank group's business development if unforeseen circumstances affect the leadership team | Build an organizational structure that can take over work duties |
| b. Relationship with the parent company | ||
|
|
|
Emerging risks
In addition, SoftBank also reviews risks on a periodic basis to identify and manage emerging risks that can potentially have a substantial impact on the business*1. We consider these identified emerging risks from short-term and medium- to long-term standpoints*2 and take measures to address them.
The emerging risks for FY2024 are as follows.
- [Notes]
-
- *1Risks that do not currently exist or are not recognized, but may appear or change due to changes in the external environment, etc. and can potentially have a substantial impact on the business that requires changes to business strategy or business models.
- *2In general, we consider “medium- to long-term” to be a timeframe of three to five years or longer.
- *1
Protection and security of
personal information and privacy
| Risk definition | Risk of losing credibility and trust in SoftBank due to improper use and management of information assets held by the company, including personal information, resulting in infringement on the privacy of customers (including employees of customers) and employees of the company |
|---|---|
| Typical risk examples |
|
| Impact on business |
SoftBank offers customers in Japan and overseas various products and services that leverage cutting-edge technology from telecommunications business to 5G, AI, IoT, RPA, cloud services, and big data, and as such, we possess a large amount of information assets related to telecommunications and other businesses, such as personal information of customers (both individuals and corporations) and information of business partners including communication terminals and base station equipment. At the same time, there has been in recent years a growing awareness around the world of issues related to managing information, including personal information. Legislation is moving forward, as seen in such examples as the EU's General Data Protection Regulation (GDPR) and China's Personal Information Protection Law as well as discussions on the enactment of federal data privacy laws in the US and movement toward tightening of regulations on personal information protection in Southeast Asian countries. In Japan, revision of the Act on the Protection of Personal Information Protection was followed by revision to the Telecommunications Business Act, and now more than ever before, we are required to engage in information protection that takes the rights and interests of individuals into account and ensure the reliability of telecommunications services, including the handling of user information. In addition, security risks have become more diverse and sophisticated in recent years, including the increasing sophistication of cyberattacks, the increase in relentless attacks by international hacker groups, attacks targeting remote work environments, and internal fraud, with the environment around our business growing tougher year by year. Given these circumstances, in the event of any infringement of the rights of customers (including customers' employees) due to inappropriate management or use of information assets (including personal information) held by the company, or failure to respond appropriately to the wants and needs of society, including customers, trust and confidence in the company may be damaged, making it difficult to retain and acquire customers, and causing our ability to compete to potentially suffer. There is also the possibility of leakage or loss of information due to intentional or negligent actions on the part of our company (including executives and employees as well as contractor personnel involved) or cyberattacks, hacking, computer virus infection, or other unauthorized access by third parties with malicious intent, and a large amount of expense being incurred for repairing security systems. |
| Countermeasures |
Under the leadership of our CDO (Chief Data Officer) and CISO (Chief Information Security Officer), we are working to further strengthen our internal system for managing the information assets (including personal information) held by our company and their security. For example, to protect personal information and respect privacy, in addition to establishing a Privacy Center that presents our efforts to protect personal information, we have formulated guidelines for handling information assets and conduct training for all executives and employees for thorough management of information assets in business and increased employee awareness. In addition, work related to customer information and other confidential information is limited to designated areas, and at SOC (Security Operations Center) or the like within those areas, we maintain and manage security levels through such measures as stronger detection of internal improprieties using AI. In addition to the Telecommunications Business Act that must be complied with when developing business, we pay close attention not only to revisions to laws and regulations concerning personal information protection in Japan and other countries, but also to new risks due to technological advances and changes in social concerns and awareness, and take appropriate measures such as reviewing our internal rules at the proper time, providing additional training, and ensuring greater transparency for our customers. Moreover, while carefully monitoring and researching social and technological trends that pose threats, we proactively adopt AI and other cutting-edge technologies to create a sophisticated security environment and further enhance our security monitoring and immediate response systems. |
Regulatory Risks Related to
AI Technology
| Risk definition | Risk of impeding continuity of operations and business development, loss of social credibility and trust in the company, and economic and financial losses (penalties) due to violation of laws and regulations to be complied with in relation to AI, or being unable to comply with new legislation or regulations, or changes in the operation of government agencies. |
|---|---|
| Typical risk examples |
|
| Impact on business |
In addition to actively utilizing AI in various operations to realize improvements and streamlining, the SoftBank group proposes and sells related products and services to its client companies, etc., and conducts joint development and other initiatives with partner companies, etc. The advent of generative AI* that can be used interactively has particularly boosted the use of AI, and is expected to contribute significantly to business productivity going forward. As such, SoftBank has started the operation of a computing platform for the development of generative AI. We are also working on the development of a domestically produced large language model (LLM) specifically for Japanese by having a subsidiary utilize our computing platform to realize the provision of generative AI services that match Japan's business practices and culture. Meanwhile, the World Economic Forum (WEF) Global Risks Report 2024 ranked “misinformation and disinformation” as a short-term risk, and “adverse outcomes of AI technology” in addition to that as a long-term risk among the ten major risks. The ability to use AI technology without advanced technology or specialized knowledge has made it even easier to spread misinformation and disinformation. This causes not only new confusion and anxiety in society, but also political and economic security concerns that have led some countries to consider regulation. For example, the EU passed a draft regulation on a comprehensive regulatory framework for AI that will be applied in the EU (March 2024). As such, if AI-related service providers violate the law after the law goes into effect, fines will be imposed, and future developments in the EU could affect countries and regions where we operate AI-related businesses. SoftBank utilizes AI, and proposes and sells AI-related products and services to client companies, and conducts development of generative AI based on the SoftBank AI Ethics Policy. However, if laws or regulations that conflict with or are stricter than our AI ethics policy are enacted in the future and we are unable to properly respond thereto, our AI-related business plans may be significantly delayed, which could affect our proposals and sales of AI-related products and services to client companies, etc. Furthermore, if we violate relevant laws and regulations, for example, by leaking confidential or personal information in the use of our generative AI, or by infringing on copyrights of third parties in our use of generated work, we could lose our social credibility and trust, as well as incur economic and financial losses (penalties). Additionally, if our involvement in or response to the formulation of rules for laws and regulations related to AI is delayed, it will affect our strategies, thus hindering the continuity of operations and business development.
|
| Countermeasures |
In light of technological and social developments related to AI around the world, SoftBank formulated the SoftBank AI Ethics Policy in FY2022 to build a system that allows customers to use AI-related services in a safe and sound manner. The AI ethics policy serves as a company-wide guideline on the use and application of AI. It is designed to prevent various problems in connection with the use and application of AI, including regulatory risks related to AI, and to mitigate risks in connection with our business activities. Specifically, it sets forth guidelines across six categories: human-centered principles, respect for fairness, pursuit of transparency and accountability, assurance of safety, protection of privacy and assurance of security, and development of AI human resources and literacy. We are engaged in service development and business operation, including the establishment of an organizational structure aligned with these guidelines. Furthermore, a system is in place to apply this policy to group companies, and as of June 1, 2023, 56 companies have decided to apply it and have established internal rules and guidelines related to AI governance that set forth more specific rules. In order to raise awareness about AI ethics among each and every employee, we showcase efforts related to AI governance on our internal portal site, and provide study sessions and e-learning (for all employees and for employees who deal with AI (including employees involved in the planning, development, procurement, and operation, etc. of AI)). We are also raising the awareness regarding the use and application of AI by sending regular e-newsletters. In addition, we pay close attention to regulatory trends, such as guidelines for AI business operators by relevant government agencies, and update our internal rules accordingly. Finally, we are actively participating in rule formulation by presenting public comments as necessary, and through dialogue with various stakeholders. |
Addressing emergency
In the event of emergency situations such as major disasters, an Emergency Response Headquarters headed by the president will be established, and the departments in charge will collect and analyze information on the impact and damage in their areas of responsibility. An Emergency Response Headquarters will then be established based on the impact and damage, and will take action to rapidly restore the situation.
Emergency response
headquarters structure
Structure based on Disaster
Response Agreements
To assist swift restoration efforts in the event of a major disaster or emergency, SoftBank has signed “Disaster Response Agreements” with Japan's Ministry of Defense and the Japan Coast Guard for the purpose of securing communications and mutually cooperating in a wide range of areas.
As communications are a necessary means of assisting life-saving activities following a disaster, SoftBank provides satellite mobile phones, SoftBank mobile phones and other communication equipment to the Ministry of Defense and the Japan Coast Guard. Furthermore, the Ministry and Coast Guard provides SoftBank with logistics assistance and the ability to use their facilities and equipment so SoftBank can better secure communications and conduct restoration activities in affected areas.
SoftBank will continue to work closely with the Ministry of Defense, Coast Guard and other related institutions in disaster preparedness and carry out its responsibilities to society as a communications carrier.
Emergency operational plans
SoftBank Corp. is working to ensure the provision of stable telecommunications services and to ensure the safety of customers in emergency situations such as natural disasters, terrorist attacks or pandemics.
Disaster operational plan
Japan's Disaster Countermeasures Basic Act was established for the purpose of protecting national land as well as citizens' lives, livelihoods and property, and to maintain social order and secure public welfare in the event of a disaster. The Act's disaster management system stipulates the roles and responsibilities of the national government, local governments and designated public corporations.
Under the Act, SoftBank is designated public corporations as set out by the national government, and thus formulate Disaster operational plans. The company has established systems for disaster prevention and preparedness, and in the case of disasters, respond in accordance with their Disaster operational plans while working closely with relevant government organizations and public corporations.
Civil protection
operational plan
The Law concerning the Measures for Protection of the People in Armed Attack Situations etc. (“the Civil Protection Law”) was formulated with the aim of protecting the lives, health and assets of citizens in the event of an armed attack and minimizing the impact of an armed attack on citizens' lives and on the nation's economy. The Civil Protection Law allocates roles to the national government, prefectural and municipal governments, cities, towns and villages, defines the roles of designated public institutions and delineates an organizational framework for protecting civilians.
SoftBank, which is designated public institutions, has developed a Civil protection operational plan based on the Civil Protection Law. In the event of the threat or occurrence of a terrorist attack, the company will coordinate with other relevant institutions in accordance with the Civil protection operational plan.
New flu strains countermeasure
operational plan
In its Guidelines on Measures against New Flu Strains, the Japanese government sets out strengthened measures to counter new strains of influenza for the purpose of protecting citizens' lives and health, and to minimize any potential impact on daily life and the economy. The Guidelines stipulate the roles and responsibilities of designated public companies and a management system for emergencies.
Under the Guidelines, SoftBank, which is designated public corporation as set out by the national government, is formulating Operational Plans in line with the government's action plan. Incorporating systems for before an outbreak occurs and after an outbreak occurs outside Japan, infection countermeasures and other items into the Operational Plans, SoftBank will work closely with relevant government organizations and public corporations to respond to an outbreak.