Risk Management Policy

The Shibuya Group has established risk management committees organized according to their purpose and function to address the various risks faced by the Group.

The Crisis Management Emergency Response Headquarters, headed by the President and CEO, is responsible for responding to unforeseen events that may threaten business activities, such as war, terrorism, and major disasters including large-scale earthquakes in Japan and overseas. If it is determined that a crisis has occurred within the Shibuya Group, the Group will promptly implement an appropriate response framework.

For risks that are reasonably foreseeable in the ordinary course of business activities, the Company maintains various risk management committees organized by purpose and function in areas such as internal controls, product and technical information, management information, and safety. These include the Legal Affairs Committee, the Confidential Information Management Committee, the Credit Management Committee, and the Disaster Countermeasures Committee. Through these committees, the Company works to enhance its internal control system by ensuring compliance with applicable laws and regulations, the Articles of Incorporation, and internal rules by directors and employees, while also strengthening its risk management framework.

Basic Information Security Policy

Shibuya Corporation and the Shibuya Group (the “Company” and the “Group,” respectively) are committed to maintaining, strengthening, and continuously improving information security in accordance with the following policy. The Company and the Group will protect information assets entrusted to them by customers and business partners, as well as their own information assets, from threats such as accidents, disasters, and crime, thereby fulfilling the trust placed in them by customers and society.

1. Information Security Management
   The Company believes that enhancing corporate governance is essential to making transparent, fair, prompt, and decisive decisions while taking into account the perspectives of customers, shareholders, business partners, employees, local communities, and other stakeholders.
   
   In connection with this governance framework, the Company has established an organizational structure for maintaining and improving information security, and strives to continuously develop and enhance its information security management framework.


2. Security Measures for Information Systems
   The Company implements appropriate measures for its information systems to maintain and strengthen information security.
   
   The Company also appropriately monitors its information resources and responds promptly to unauthorized access and other unusual events.


3. Employee Initiatives
   The Company’s employees acquire the knowledge and skills necessary for information security and ensure the effectiveness of the Company’s information security initiatives.


4. Compliance with Legal and Contractual Requirements
   The Company complies with applicable laws, regulations, standards, and contractual obligations related to information security, and meets the expectations of its customers.


5. Response to Violations and Incidents
   In the event of any legal or contractual violations or incidents related to information security, the Company takes appropriate action and works to prevent recurrence.

Risk Management Framework and Business Continuity Plan

For risks that are reasonably foreseeable in the ordinary course of business activities, the Company has established committees as necessary in areas such as technology, information, and disaster response. These committees are responsible for preventing and responding to risks affecting the Company and Group companies.

For unforeseen events that may threaten business activities, such as war, terrorism, and major disasters including large-scale earthquakes in Japan or overseas, the Company has established the Crisis Management Emergency Response Headquarters, headed by the President and CEO. This headquarters is responsible for crisis response and risk management across the Company and Group companies.

As an example of this crisis response framework in action, following the Noto Peninsula Earthquake that occurred on January 1, 2024, the President personally led the response from the day of the earthquake, convening directors and executive officers from relevant departments and issuing instructions on necessary measures.

As a result, with the cooperation of the Company’s business partners, including local general contractors and equipment contractors, the Company promptly carried out emergency restoration work on buildings and repairs to air-conditioning systems. The Company was therefore able to resume near-normal operations by January 4, 2024, the first working day of the year.