Risk Management
Policy and Basic Approach
Sojitz Group aims to ensure sustainable and sound corporate management practices. To realize these aims, Sojitz recognizes risk as “the possibility that events will occur and affect the achievement of strategy and business objectives.”
The company therefore carefully and comprehensively assesses risks associated with new business ventures or accompanying changes in the business environment, establishes the necessary risk management systems to address these risks and manages these systems appropriately.
Systems and Initiatives
In the enterprise risk management conducted by Sojitz Group, the Internal Control Committee (secretariat: Internal Control Administration Department), which includes the President and CFO as members, collaborates with various internal committees (as shown in the table below) to discuss and formulate policies, oversee and monitor the overall status of risk management implemented by business execution organizations (first and second lines), and issue instructions to relevant parties, and serves as the entity responsible for ensuring the effective functioning of the risk management framework.
In addition, the Internal Audit Department, as the third line of defense, conducts objective verification of the risk management practices implemented by the first and second lines from an independent standpoint. Based on the above, the Internal Control Committee regularly reports on the status of enterprise risk management system to the Management Committee, Board of Directors, and the Audit and Supervisory Committee.
Within Sojitz Group, each department in the first line (business divisions, etc.) and the second line (corporate divisions), comprehensively identifies risks, including those based on future projections, related to the external environment, business strategies, operational processes, and other factors. Risks identified are assessed based on a two-axis evaluation of impact and likelihood of occurrence of risks to determine their importance, and the results are discussed at the Internal Control Committee and reported to the Board of Directors, after which risk response policies are decided.
In accordance with this risk response policy, the first line (business divisions, etc.) exercises autonomous control over risks in business execution, while the second line (corporate) performs routine management tasks related to the risks under its responsibility, as well as providing support and monitoring to the first line and conducting continuous reviews, including PDCA management. The risk management activities conducted by the first line and second line are monitored by the Internal Control Committee, which evaluates their effectiveness based on the significance of the risks, and reports to the Management Committee, Board of Directors, and the Audit and Supervisory Committee.
As part of its enterprise risk management, Sojitz regularly reviews risks through materiality assessments. In particular, the company places a strong emphasis on a risk management approach that takes into account the entire supply chain and is also working to strengthening measures for preventing unauthorized access and cyberattacks. Additionally, by managing business investments with a focus on risk and return, Sojitz prevents the deterioration of the Group's balance sheet and contributes to the maintenance and enhancement of corporate value.
The Major Risk Types and Sojitz Internal Committees
Current as of April 1, 2025
| Committee | Chairperson |
|---|---|
| Internal Control Committee | Representative Director, Senior Managing Executive Officer, CFO, Executive Management of Corporate Departments |
| Compliance Committee | Managing Executive Officer, CCO, CISO COO, Legal Department, Internal Control Administration Department |
| Sustainability Committee | President & CEO |
| Security Trade Control Committee | Representative Director, Senior Managing Executive Officer, CFO, Executive Management of Corporate Departments |
| DX Promotion Committee | President & CEO |
| Quality Management Committee | Executive Officer COO, Risk Management Department |
| Information and IT System Security Committee | Managing Executive Officer, CCO, CISO COO, Legal Department, Internal Control Administration Department |
| Business Continuity Management Working Group | Executive Officer COO, Human Resources Department |
| Disclosure Working Group | Executive Officer COO, PR Department, IR ＆Corporate Sustainability Department |
Measuring and Controlling Risk
In order to manage risk with a dual focus on both safety and profit opportunity, Sojitz measures risk assets within the following four risk types: market risk, business investment risk, credit risk, and country risk. The goals of risk measurement are to 1) manage quantified risk assets in order to keep them within the scope of the company’s strength (total equity), and 2) maximize earnings in line with the level of risk exposure. Risk assets are measured twice yearly and reported to the Board of Directors and the Management Committee. Each business department receives feedback on analysis conducted for factors affecting risk levels, and the business departments utilize the results of these analyses in their ongoing risk management efforts. Sojitz Group’s objective for risk control is to keep the ratio of risk assets to total equity at or below 1.0. Sojitz has maintained this goal ratio since the fiscal year ended March 2010.
Supply Chain Risk Management
Due to recent changes in the external environment and in our business fields, Sojitz takes an approach toward combating specific risks that accounts for the entire supply chain and enact flexible responses to the sudden materialization of risks by measuring the quantitative impact of the given risk event in order to strengthen our corporate resilience. In fiscal year 2024, assumed scenarios were formulated for geopolitical risks and disaster risks, and these scenarios were examined through discussion by the Management Committee and between business and corporate divisions to assess the response measures to be implemented in the event that a risk materializes.
Business Investment Management
Sojitz Group conducts business investments in a wide range of business fields. Business investments entail risks that earnings may not be generated in accordance with business plans, that invested capital may not be recovered, or that losses might be incurred when withdrawing from businesses. Sojitz Group takes steps to prevent and limit losses associated with business investments by establishing business investment standards related to management and withdrawal during the decision-making process or after investments, and management is performed based on these standards.
When conducting new business investments, Sojitz Group evaluates the business plan, including the significance of the initiative and the cash flow plan. In particular, profitability is assessed using the internal rate of return (IRR) as a metric. A hurdle rate is set, and the IRR is compared against this hurdle rate to select projects that can enhance Sojitz Group's shareholder value and generate returns commensurate with the risks. These business investment projects are submitted to the Finance & Investment Deliberation Council, which consists of a chairman and council members appointed by the president. The council analyzes the feasibility of the business plan, visualizes the risks, and determines whether to proceed with the investment.
Conducted business investments are monitored annually, and decisions on whether to continue or withdraw are reported to the Management Committee. Sojitz Group measures whether the Return on Invested Capital (ROIC) and the cash-based ROIC (CROIC) exceed the cost of capital to evaluate the viability of the business. Through these evaluations, Sojitz Group identifies issues early and implements timely and appropriate improvement measures to achieve a turnaround or proceeds with withdrawal. This approach helps prevent the deterioration of the Group's balance sheet and contributes to the maintenance and enhancement of corporate value.
The overview of monitoring and decision-making regarding whether to continue or withdraw is as shown in the diagram below.
Risk Management Training
In order to comprehensively manage risk, Sojitz must not only establish organizational systems and frameworks, but also instill a risk management mindset and foster the necessary skills in each Group employee. Sojitz therefore places an emphasis on risk management-related trainings and provides employees with educational content tailored to current risk management challenges.
As part of efforts to share risk-related knowledge throughout the company, Sojitz also creates videos that feature case studies of specific trading or business investment-related incidents that have occurred at Sojitz Group. In the videos, employees involved in the incident engage in open dialogue with members of the Risk Management Department to discuss their experience and highlight key takeaways. Through this initiative, Sojitz aims to encourage employees to apply the collective knowledge gained through past incidents in their work each day. In fiscal year 2024, 5 case studies were presented, and they were viewed by a large number of employees from both the Business and Corporate divisions.
The risks that trading companies face are constantly evolving. Sojitz therefore reviews and updates the content of its training materials as needed and strives to provide employees with the tools needed to respond to evolving and newly emerging risks.
Addressing Information Security Risk
Policy and Basic Approach
Sojitz has established Information Management Regulations, Sojitz IT Security Policy and other regulations regarding information management and information security measures. Sojitz Group seeks to create an integrated system of information security risk countermeasures and works to ensure that all Group employees appropriately use, manage, and maintain IT assets.
Systems
Sojitz has established the Information and IT System Security Committee, an organization chaired by the Managing Executive Officer, CCO, and CISO. The Information and IT System Security Committee creates Sojitz’s system for managing information security throughout Sojitz Group, deliberates on a wide range of information security-related issues, and makes proposals to management. The committee also monitors adherence to all information security-related regulations and in the event of a violation, centrally manages all relevant information, and ensures that there is a system in place for promptly addressing violations.
Initiatives
Addressing Disaster Risks
Policy and Basic Approach
Sojitz recognizes the importance of maintaining business continuity and ensuring the safety of all Sojitz Group employees, families, and other affiliated parties in the event of a major disaster such as an earthquake, flood, terrorist attack, or pandemic. Sojitz has established the Sojitz Group Basic Crisis Management Policy, which defines Sojitz’s policies and framework for crisis management. Sojitz operates an active system for crisis management at all times in order to ensure that in the event of a disaster, it can maintain the safety of all Sojitz Group employees, families, and other affiliated parties.
Sojitz Group Basic Crisis Management Policy
- Ensure the safety of employees and others (personal safety)
- Ensure the safety of company assets and restart operations as soon as possible (stable supply of business services)
- Support stakeholders and the local community (cooperation and mutual support)
- Strengthen crisis response and raise crisis management awareness (regularly conduct trainings and drills)
Systems
In the event of a crisis, Sojitz has established internal systems and roles based on the Sojitz Group Basic Crisis Management Policy and the Sojitz Crisis Management Guidelines. Sojitz has also established the Business Continuity Management Working Group, an organization chaired by the Human Capital Department COO, which regularly reports to the Management Committee. The working group continuously reviews and implements improvements to all crisis-related measures in order to ensure their effectiveness and respond to changes in the business environment.
Initiatives
Business Continuity Management (BCM) Operations
In order to ensure the effectiveness of business continuity planning (BCP), Sojitz establishes a plan for year-round BCP activities and regularly reviews the plan. Sojitz conducts a range of BCP-related trainings including drills conducted by the Emergency Response Unit, first aid trainings for employees, and evacuation drills. (Trainings are conducted for two differing scenarios: a disaster occurring 1) during working hours and 2) at night on a non-workday.) In addition, Sojitz utilizes a reporting system to confirm the safety of all employees in the event of a disaster and also conducts reporting drills using this system.
Disaster Preparedness and Mitigation
Sojitz has taken steps to ensure that its Tokyo headquarters can continue to perform its functions in the event of an earthquake in the Tokyo metropolitan area, through measures such as equipping its facilities with emergency power generators capable of providing 72 hours of electricity. Sojitz has also stockpiled five days’ worth of food for employees in the event that they are required to shelter at Sojitz offices. The Tokyo Metropolitan Government has recognized Sojitz as a model company for its efforts to prevent the mass movement of employees in the event of a natural disaster.