Suntory Group strives to understand and analyze the risks to the Group as a whole and take measures to resolve the issues so that we may continue our business operations and contribute to society.
Promotion Structure
In order to strengthen risk management across the entire Group, including our overseas Group companies, Suntory Group has established the Global Risk Management Committee (GRMC), chaired by the Chief Risk Officer at Suntory Holdings Limited and with a membership comprising the Representative Director, President & Chief Executive Officer and the Directors of each of the Group companies’ divisions and of key operating companies. In addition, we have established risk management committees and risk management teams at each of our operating companies.
The GRMC collaborates with the committees and teams at each of our business units to assess risks, implement countermeasures, and establish crisis management frameworks within the Group. It regularly reports its findings and activities to the Board of Directors, which in turn monitors these activities and evaluates their effectiveness to ensure accountability to all stakeholders, including our customers.
To further enhance risk management, Suntory Group conducts internal audits on risks and countermeasures regularly.
For more information, see Corporate Governance.
Enterprise Risk Management (ERM)
The risks surrounding companies are becoming more diverse and complex due to the globalization and informatization of the economy and growing public awareness of corporate social responsibility. Under the GRMC, Suntory Group conducts annual risk assessments for the entire Group. This assessment includes not only business risks but also environmental challenges, such as climate change, and social issues, such as human rights. The identified risks are assessed based on two axes: “risk exposure” (probability of occurrence x magnitude of impact) and “preparedness level” (degree of readiness) to identify significant risks to the Group as a whole. The GRMC designates personnel who will be responsible for risks identified as significant, then formulates, implements, and monitors countermeasures.
Our Initiatives
Establishing Infrastructure for Crises Response
The risks companies face are becoming ever more complex, diverse and significant, and the enhancement of risk management is a necessity in management. Therefore, it becomes especially important to establish a Business Continuity Plan (BCP) based on the estimation of potential damage in case of crises. Suntory Group has developed a manual on initial responses to risks and crises for all Group companies. We aim to minimize impact and damage in case of contingencies through timely information sharing and decision-making in the event a major crisis occurs to maintain trust from society.
Business Continuity Plan (BCP) Formulation and Implementation
In recent years, the world has faced a spate of risks posing a threat to continued socioeconomic activity, including both natural disasters (such as major earthquakes, flooding and landslides caused by hurricanes/typhoons and torrential rainfall, heavy snow, and volcanic eruptions), cyberattacks, and the spread of infectious diseases. Suntory Group has formulated a Business Continuity Plan (BCP) that will enable us to continue doing business as much as possible without interruption in the event of a disaster, to securely provide high quality products and services to customers, thus fulfilling our responsibilities to provide supplies. The plan we have formulated goes beyond manufacturing at Suntory Group plants to include raw materials procurement and distribution as well as sales activities. We have taken steps to be able to decentralize our head office functions and infrastructure in an emergency and continue to strengthen our response structure to cope with contingencies.
Large-scale Natural Disaster Measures
Disaster Response Systems
In the event of a large-scale disaster, we provide a quick initial response by setting up a Disaster Response Headquarters, mainly consisting of the General Affairs Departments of Suntory Holdings Limited and Suntory Beverage & Food Limited, to oversee the entire Suntory Group, and placing emergency response teams for each department under its control. The Disaster Response Headquarters’ initial response will begin with confirming the safety of employees and their families and collecting and organizing information on damage inflicted by the disaster. It oversees the restoration of office functions, restoration of information systems, and the arrangement of relief supplies, which will be carried out according to the response policies of each department involved. The Disaster Response Headquarters will also restore production operations and support customers and local communities. These systems and procedures are posted on the intranet so that employees can review them at any time. We have regularly reviewed our disaster response manuals, enhanced communication means and disaster supplies, and strengthened our disaster preparedness system, including those of Group companies. The Disaster Response Headquarters will also have a remote response system in place to ensure a prompt and appropriate initial response in the event of an emergency.
Establishment of Safety Confirmation System and Emergency Drills
In preparation for natural disasters such as major earthquakes in Japan, we have in place a system that utilizes mobile phones, PCs, and other devices, to confirm the whereabouts and safety of employees.
We conduct safety confirmation drills twice a year and work to raise awareness to ensure that the system operates smoothly.
We conduct regular disaster prevention drills based on the scenario of a major earthquake and drills focusing on how to get home from work on foot. We also regularly disseminate information on disaster prevention and mitigation and hold study sessions. In addition, we have implemented a safety confirmation system for expatriates and their accompanying families, enabling swift verification of their safety in the event of an emergency overseas.
Disaster Countermeasures Headquarters Training
Measures Against Infectious Diseases
Since the H1N1 influenza pandemic in 2009, we have been taking measures to avoid the disruption of business operations by creating a manual on response processes during a pandemic based on our Influenza Prevention Manual, disseminating information among employees, clarifying the reporting system during a pandemic, and strengthening measures to prevent the spread of infection.
Tightening Information Security
We are tightening information security systems in the entire Group to respond to information security risks, which are one of the most serious risks in operations. Global security policies were also formulated to enhance informational security at a global level.
Strengthening Information Security Systems
Suntory Group has established governance through preservation and systems for information assets by defining the Suntory Group’s Basic Principles for Governance of Information Security based on the growing needs of society that demand even stricter management of corporate information security.
In response to the risk of information leaks on social media (such as Instagram, Facebook, X, and Line), we have formulated the Suntory Group’s Social Media Policy, which stipulates rules for using social media. We are reinforcing the awareness of each and every employee in the handling of information while advancing the information management of the entire Group based on these policies.
Suntory Group Information Security Basic Policy
Our information assets are a source of Suntory Group’s competitiveness. During our strategic usage and application of these assets, we must be worthy of our customers’ trust and fulfil our corporate social responsibility. Thus, we have identified the appropriate safeguarding of information assets as an important management challenge, and have instituted the following basic policy, which promotes information security governance.
-
・By maintaining a chain of responsibility for information security and by formulating and enforcing rules on the handling of information, we will strive for appropriate management as one corporate group.
-
・By specifying how the information assets in our possession should be handled in accordance with their importance and any risks, we will strive for their secure and proper use and their appropriate safeguarding.
-
・We will conduct the ongoing education and training of our Directors, all employees, and other personnel, and we will commit to awareness-raising regarding this issue and ensure full compliance with rules related to information security.
-
・We will strive to prevent information security incidents, and in the unlikely event that such an incident occurs, we will swiftly take action to recover and implement corrective measures.
-
・While complying with laws and regulations in every country we operate in related to information assets, we will continuously improve and enhance the above-mentioned information security policies.
Enhancing Human Resource and Legal Management
We have established rules and regulations for the correct use of information systems and the management of confidential information, and we are raising awareness of that information via our intranet. Moreover, we are raising Group awareness to the fullest at each Group Company in Japan through the following measures:
-
-Improving information management systems that are based on vulnerability analysis
-
-Introducing e-learning and study sessions to increase awareness of the importance of information security and the handling of information
-
-Establishing rules related to using social media and raise awareness among employees
-
-Conducting training related to targeted email attacks that are growing year after year
-
-Working with members under the guidance of risk management control supervisors and leaders at each company to improve IT literacy
In 2016, Suntory put in place the Computer Security Incident Response Team (CSIRT) as a specialized organization to response to computer security incidents to prevent informational security incidents and strengthen its response in times of disasters as a Group.
Enhancing Physical and Technological Management
In preparation for the risks of information leaks, unauthorized access, and intrusions, we are working to prevent the occurrence and minimize the impact if an incident does occur through technological countermeasures at our offices and in our information systems, threat monitoring, and employee education and training.
Initiatives for Minimizing Social Media Risks
Individuals can now easily distribute information with the rise in popularity of social media. However, we see instances when negative information spreads widely through social media and damages corporate value. Suntory Group is conducting activities to make employees more sensitive to social media risks (promote the effective use of various awareness-raising tools) by formulating various standards and guidelines for use of social media, discovering risks as early as possible, and launching response systems to lessen the social media risks.
Social media risk seminar framework
Response to the My Number System
We have put in place measures to properly manage personal information safely at each Group Company as deemed necessary for identifiable personal information (My Number System) introduced in Japan in 2016. We have confirmed that our subcontractors have put these measures in place as well.
Protecting Customers’ Personal Information
Each company in Suntory Group stores personal information of many customers such as of those that applied for sales promotion campaigns and customers ordering health and wellness foods. Suntory Group works to safeguard personal information of the entire Group according to the Act on the Protection of Personal Information and guidelines to protect important customer information.
Employee Education on Personal Information Protection
We hold e-learning for all employees in the Group to disseminate the importance of personal information protection. We conduct more focused information security education in departments that directly handle personal information.
Information Management of Mail-order Customers
Information of mail-order customers at Suntory Wellness Ltd. are centrally managed in a dedicated closed system at communication management center in which access is strictly managed using a finger vein recognition system.
Finger vein recognition system
Initiatives on Intellectual Property Rights
The importance of intellectual property is increasing along with the rising social awareness on intellectual property rights and recent movement on the government’s measures and programs for the same. Suntory Group has established the Intellectual Property Department mainly focusing on patents as well as the Trademark Department focusing on trademarks and our corporate brand “Suntory,” as divisions supervising our intellectual property rights.
Utilization of Intellectual Property
Suntory Group acquires and utilizes the outcome of research and development and design activities in connection with our products, services and technologies as intellectual property and promotes our corporate activities to continuously provide highly value-added products unique to Suntory Group that embody our Yatte Minahare spirit. In addition, based on our founding spirit of “Giving Back to Society,” we proactively utilize such intellectual property in our sustainability activities and collaborative activities with various stakeholders for cohabitating in our society and solving social problems. Throughout such utilization of intellectual property, we strive to maximize the brand value of “Suntory” as well as our products and services. We implement an incentive scheme based on our Invention Regulations to promote and utilize employee inventions.
Respecting Intellectual Property of Others
While utilizing intellectual properties, we collect information upon working closely with the site of research and development, designing and marketing activities in order not to infringe upon intellectual properties owned by others. For example, upon adopting new technologies, we survey whether or not there is a patent owned by others in connection with such. Furthermore, when adopting a new product name, we determine whether or not it is registered as a trademark owned by others. We sometimes collaborate with experts to judge whether our use of new technologies and names are legally correct and appropriate.
