As the first line of defense of the companywide risk management structure, the TOPPAN Group operating companies identify risks that could have a significant impact on each business and consider countermeasures. Next, as the second line of defense, the corporate function divisions within TOPPAN Holdings assess the frequency and potential severity of the risks, and examine the adequacy and effectiveness of the countermeasures formulated. Midway through each fiscal year, the second line reviews the progress of the countermeasures formulated at the beginning of the fiscal year and revises them as necessary, taking into account the latest risk-related trends. As the third line of defense, the Management Audit Office, analyzes and evaluates whether the first and second lines are functioning adequately. The results of the analysis and evaluation are reported to the representative directors, the Board of Directors, and the Audit & Supervisory Board.

Through the above process, risks that could exert severe adverse impacts on management are defined as “significant risks." These risks are reviewed annually by the Risk Management Working Group (led by the Director in charge of Risk Management; attended by persons in charge of risk management at the responsible head office divisions; and administrated by the Compliance Department in the Legal Division), one of the Corporate ESG Projects established under the Sustainability Promotion Committee (chaired by the President & Representative Director), and approved by the Sustainability Promotion Committee. The consideration of "significant risks" takes into account the group’s response to the “material issues” it has selected, the results of risk assessments at each operating company, social conditions, and the possibility of risks materializing from a medium to long-term perspective.

The Risk Management Working Group regularly reports activity results to the Sustainability Promotion Committee. The committee members discuss risk management independently and objectively, in cooperation with the TOPPAN Group ESG Management Promotion Committee, which includes independent external directors.

Under the leadership of the Director in charge of Risk Management, the Risk Management Working Group manages risks from a position independent from the business divisions within the Group.

Under the direction of the Chief Risk Officer (Director) in charge of the GRC Division, which was established on April 1, 2024 as the department in charge of risk management, we are currently examining and reviewing ways to further strengthen the companywide risk management structure, including the aforementioned risk management procedures and the structure of the bodies for discussing risk management.

First line (operating companies)

The operating companies of the TOPPAN Group consist of subsidiaries that have business divisions for each type of business, and subsidiaries that do not have a business division system. In either case, the operating companies are composed of departments and divisions in direct contact with customers, such as manufacturing and sales (Line 1), and administrative departments such as business strategy, accounting, legal affairs and general affairs (Line 1.5). Each department and division carries out its business based on the risk management plan formulated by the division in charge at the head office. The responsibility for risk management rests with the representative director of each subsidiary, or with the heads of business divisions for subsidiaries that have adopted the business division system. It is noted that generally, the administrative departments support the work of the first line, therefore they are described as Line 1.5 in the risk management structure.

Second line (TOPPAN Holdings corporate function divisions)

Corporate function divisions are administrative departments such as corporate planning, finance, legal affairs, and human resources. For routine risk management, they annually instruct operating companies to conduct a risk assessment, and verify progress at mid-term of the fiscal year. In addition, the divisions annually select significant risks for the TOPPAN Group, develop response plans, and implement thorough management. The risks selected and corresponding countermeasures are reported to the Sustainability Promotion Committee and the Board of Directors. When an incident is reported by an operating company, the division in charge of risk management in the second line (the responsible head office divisions) handles it. If the impact of the incident is significant, the Crisis Management Committee is convened.

Third line (Management Audit Office)

The Management Audit Office is responsible for conducting internal audits to analyze and evaluate whether the first and second lines are functioning adequately. Specifically, the office conducts operational audits to check for issues in the mechanisms for the prevention of misconduct and for compliance with relevant laws, regulations, and in-house rules. The office also performs management audits, focusing on processes to verify and evaluate alignment with management objectives, and whether sufficient and adequate risk control is implemented. The audit results are reported to the representative directors, the Board of Directors, and the Audit & Supervisory Board.