Promoting Risk Management

The Isetan Mitsukoshi Group maintains and constructs an independent risk management system for each group company, based on the “Basic Policy on Internal Control System Construction.” To achieve the purpose of Group Risk Management, the Isetan Mitsukoshi Group has set up the “Compliance and Risk Management Promotion Committee” to share the current circumstances on measures against risks, and to encourage the understanding of risks that change with the environment surrounding our Group.

About risk management system

The Group has set up the “Group Risk Management Promotion Committee.” The Committee meets regularly to build a basis for Group-wide risk management.

• As risk management at ordinary times, the Group establishes, implements and improves a variety of  measures for preventing or minimizing the emergence of risks, and for preventing escalation when risks do emerge. The Group establishes plans for dealing with serious risks that may affect corporate value. We implement a Plan-Do-Check-Action cycle through education and training, which can be the basis for improving risk management practice. In the case of an emergency (including a possibility of emergency), the Isetan Mitsukoshi Group obligates a report to the Promotion Committee.
• In the case of a serious emergency that requires group-wide organizational measures, we will take the required measures, such as setting up a headquarters, and cooperating with external organizations.

Specific initiatives taken by the  “Compliance and Risk Management Promotion Committee”

• The Group changed the name of the “Compliance and Risk Management Committee,” which had been positioned as an advisory body to the Management conference from fiscal year 2013 to fiscal year 2017, to the “Compliance and Risk Management Promotion Committee” in fiscal year 2018 to enhance its effectiveness. The Committee continues to address issues, including the selection and review of significant risks that we make serious efforts to tackle. The action of the Committee is used for daily monitoring by,
   · sharing the report on the Plans for risk measures
  · updating recognition of current risks.
   · limiting the impact of risks, such as preventing risks from emerging.
• The President and CEO chairs the “Compliance and Risk Management Promotion Committee,” whose members come from across the Group. The members consist of Department managers appointed by the Chairman. The committee meets twice a year regularly, with auditors attending as observers.
• In fiscal year 2018, the Isetan Mitsukoshi Group decided to expand the Committee to strengthen its risk management. The committee became the largest organization in the Group. We practice consolidate risk management, including deliberation over the selection and direction of measures for reducing risks. (The Chairman appointed 78 department managers as members of the Committee in fiscal year 2019, an increase of 59 people from the previous fiscal year).

Important initiatives for continuing businesses

1.Business continuity plan (BCP)

• The Group has formulated the business continuity plan (BPC) to restore business steadily while minimizing the impact, assuming damage caused by unavoidable, large-scale earthquakes, floods, pandemics that may spread, such as avian influenza and the like as natural disasters whose occurrence is difficult to predict. Moreover, the Group provides periodic training and implements the PDCA cycle across its organization to steadily spur the plan into action and deal with the assumed situations.*）

2.Cyber Risk Management Project

• The Group has formulated the business continuity plan (BPC) to restore business steadily while minimizing the impact, assuming damage caused by unavoidable, large-scale earthquakes, floods, pandemics that may spread, such as avian influenza and the like as natural disasters whose occurrence is difficult to predict. Moreover, the Group provides periodic training and implements the PDCA cycle across its organization to steadily spur the plan into action and deal with the assumed situations.*
• The Group organized the “Cyber Risk Management Project” as a computer security incidents response team (referred to as “CSRIT”) to play an important role in Group IT governance, planning and promoting cyber risk countermeasures, and taking safety measures from manpower, organizational and technological perspectives. The Group positions the CSIRT as a cross-sectional organization in an environment of advancing digitization. The CSIRT organizes original IT system management systems, reviews criteria and other aspects constantly and bolsters cyber risk management systems focused on defense within the Group. The CSIRT works to protect information assets by giving email and other training to employees to counter unauthorized access. Concerning information systems and related information owned and managed by the Group internally, we have formulated standards on measures for handling and managing them and ensuring compliance in “the Regulations on Information Security Management” with the aim of protecting the systems and information from risks including those of accidents, crimes, and negligence.
• Concerning information systems and related information owned and managed by the Group internally, we have formulated standards on measures for handling and managing them and ensuring compliance in the Regulations on Information Security Management with the aim of protecting the systems and information from risks including those of accidents, crimes, and negligence. 

The Isetan Mitsukoshi Group is aware of the following risks in relation to business, etc. that may have a major impact on the decisions of investors.

Risks relating to trends in demand

Demand in the department store business and retail specialty store business, which are our main businesses, can negatively impact the Groups results and financial status due to being greatly impacted by climatic conditions, economic circumstances such as economic fluctuations and consumer trends, and competition with other companies, etc. both domestically and in other countries in which we operate.

Risks relating to international business expansion

With regard to international expansion, we operate department stores in Southeast Asia, China, Taiwan, the USA, and Europe. Items in local currencies including the net sales, expenses, and assets of these stores have been converted to yen in order to create consolidated financial statements, so their value after conversion may be affected by the exchange rate at the time of conversion.
Furthermore, international business expansion carries risks such as the following:

• (1) Unexpected changes to laws and regulations
• (2) Disadvantageous political or financial factors
• (3) Potentially disadvantageous tax systems
• (4) Social disorder due to terrorism, war, or other factors

Risks relating to public regulations

In countries in which we operate, a range of government regulations apply, such as permission to conduct business or invest, and the Group is subject to laws relating to fair trading, consumers, tax, foreign exchange control, the environment, and recycling.
If we are unable to comply with these regulations, it may lead to our activities being curtailed and an increase in costs.

Risks relating to natural disasters and accidents

Department store business and retail specialty store business rely on physical stores for international expansion, and natural disasters and accidents, etc. can have a negative impact on the continued operation of stores.
We have created the Basic Plan on Earthquake Response and a business continuity plan as measures to respond to disasters and accidents, and we are enhancing our capacity to respond in the event of a major earthquake, including initial response and subsequent business continuity.
However, a large earthquake occurring in Tokyo may negatively affect the Groups results and financial status as there is a risk of immense damage to employees and buildings, etc. due to our main stores being concentrated in the Tokyo Metropolitan Area.

Risks relating to commodity exchange

Retail specialty store business conducts transactions aimed at customers (consumers), so if products with defects, such as faulty products and products that cause food poisoning, are sold, we may be subject to public regulation, and we may incur costs from paying damages for product liability or default on obligation, etc.
Furthermore, such an event may negatively affect the Groups financial status, such as by reducing sales due to the loss of trust of consumers.
Also, we conduct transactions with companies, focusing on the out-of-store sales department and other business wholesaling, and if costs arise, such as having to pay damages for product liability or default on obligation, etc., or it becoming impossible to recover accounts receivable due to the insolvency of the other party, and it may negatively affect the Groups results or financial status as the price per sales contract to corporate customers is high.

Risks relating to operating data centers

The Isetan Mitsukoshi Groups systems are mainly controlled by data center computers, and we have taken steps such as installing dual power lines and telecommunications lines, undertaking earthquake-proofing work, and controlling intruders. However, serious damage to facilities due to natural disasters or accidents, etc., damage to telecommunication lines, impediment to power supply, or damage due to an intruder or the negligence of an employee, may negatively affect the Groups results or financial situation as it may impede the work of the Group.
The Group has located its systems at external facilities with highly safe data center specifications in order to mitigate these operational risks.

Risks relating to customer information leaks

The Isetan Mitsukoshi Group retains and processes the personal information of customers, mainly in the department store and retail specialty store business, the credit, finance, and customer organization management business, and the information services business. Management of personal information is conducted in strict adherence to the internal management system; however, if information is leaked externally due to criminal activity, etc. it is conceivable that we would incur costs due to damages payable to individual customers or reduced sales due to loss of public credibility, and this may negatively affect the Groups results or financial situation.