Risk Management

Taking a PDCA Cycle Approach to Risk Management

Risk Management Structure and Risk Management Process

The Shimizu Group annually executes the below risk management process based on the Risk Management Regulations under the leadership of the Risk Management Committee chaired by the President and strives to further improve and strengthen its risk management structure. In addition, recognizing that the relevant risks and issues are wide-ranging, fluid, and volatile, we add new potential risks to our list as necessary and review our risk management structure, response policies, and others.

• Establishing the risk management plan (Plan)

• Implementing risk mitigation measures (Do)
  When a certain risk actually occurs and develops into an incident, we report it to the departments/divisions that are responsible for the risk, respond immediately and appropriately, convene the relevant corporate meetings/committees if necessary, and deliberate on and decide response measures and recurrence preventive measures.
• Monitoring the status of risk management/Taking corrective and improvement measures (Check/Act)
  The Risk Management Committee regularly (twice a year) monitors the status of our risk management with regard to the “key items of risk management” and other risks relevant to various functions of the divisions in the Corporate Headquarters, business divisions, and group companies. The Committee gives instructions on corrective and improvement measures if needed, it strives to respond to newly identified risks, and periodically (twice a year) reports the status of our risk mitigation measures to the Board of Directors.

Risk Management Structure (According to the Risk Management Regulations)

Evaluate the Potential Impact and Likelihood of Occurrence of Each Identified Risk

The Shimizu Group creates and updates the “risk map” with one axis showing the “potential impact on the business” and the other axis showing the “likelihood of occurrence”, based on the risk assessment done by the relevant departments/divisions.
The “potential impact on the business” is assessed from the viewpoints of harm to humans, property damage, reputational damage, monetary loss, and liabilities. The level of impact on our business and operations in case a certain risk materializes and develops into an incident, is comprehensively evaluated from quantitative and qualitative perspectives.
For the “likelihood of occurrence”, the likelihood of a certain risk actually occurring and developing into an incident is evaluated in these categories: an incident which may occur annually, an incident which may occur once in several years, an incident which may occur once in a decade, and an incident we have never experienced before.
When we evaluate various risks, we refer to the past incidents and seek to assess them considering the worst-case scenario for the Company.

Information Security (Basic Policy)

Information Security Policy

Shimizu strives to satisfy its clients through quality construction and relevant services and aims to contribute to the sustainable development of the 21st century society. To fulfill these goals, Shimizu recognizes the importance of utilizing information as efficiently and effectively as possible in order to leverage the company’s full range of available resources. In its use of such information, Shimizu, including its Group companies, are committed to maintaining an appropriate standard for information security.

Information Security Guideline

1. Develop an information security management system that complies with international standards, and continuously maintain and improve upon this system.
2. For all information under our oversight related to business activities, and all related systems that use this information, we clarify the scope and reasons for protection in order to develop solutions for appropriate information management.
3. In order to maintain and continuously improve upon information security, we establish a Corporate Meeting to consistently promote and manage information security throughout the entire company.
4. We work to expand and deepen the understanding and knowledge of information security amongst our employees and affiliates through educational and informative initiatives.
5. By conducting regular audits and assessments regarding information security, we identify and confirm new and emerging risks, as well as assess external environmental changes, in order to continuously manage these risks.

Management and Protection of Personal Information

We established our Privacy Policy in 2005 and are committed to protecting personal information.

Privacy Policy (Guidelines on protection of personal information)

Information Security Initiatives

In accordance with our Information Security Guidelines, we are working to improve our security robustness, including the prevention of information leaks. The details of the revisions are communicated to all relevant parties, and incorporated into the contents of internal training materials.

We are seeking to raise awareness of information security of all our employees, including ensuring that they know how to deal with targeted attack emails. We are also collaborating with business partners for construction projects and continuously working to refine the information security system.

Business Continuity Plan (BCP)

Basic Principles

In recent years, changes in the natural environment such as climate change and global warming have precipitated natural disasters that cannot be responded to with existing practices. We have implemented many measures to counteract various disasters in the past, and have formulated a business continuity plan (BCP) to prepare for the occurrence of critical events of a level which we are unable to respond to with the existing outlines of countermeasures. The plan is revised as needed.
In cases of natural disasters, our mission is to secure the safety of citizens residing in areas affected by the disaster and to preserve the foundation for living and the foundation of society. In our BCP, we focus on promptly preserving our workplace and facilities, supporting the recovery and restoration of the affected areas, and supporting our clients to restart their businesses as quickly as possible.

In order to act promptly under such circumstances, our individual employees must understand their roles and act independently and responsibly. Additionally, we must have a corporate structure which is able to quickly adapt to new situations. In accordance with the points above, our BCP policy is established as below:

BCP Basic Policy

• Prioritize ensuring and confirming the safety of our employees and their families
• Strive to preserve our facilities and job sites where construction is in progress
• Assist recovery work of clients’ facilities (properties constructed by Shimizu)
• Contribute to ensuring the living foundation for society and community
• Create a structure that allows workers that are involved in preservation activities to act independently

Identifying Risks and Estimating Potential Damages

Critical events caused by “extremely severe disasters” such as natural disaster and the like which are highly likely to impact our business activities in wide-ranging areas including disruption/suspension of headquarters functions are identified as risks.

Conducting BCP Drills to Prepare for an Earthquake Directly Beneath the Greater Tokyo Area

As the types of natural disasters become more varied and increase in duration and intensity, we must consider responses to risks that were not foreseen in conventional business continuity planning (BCP). Shimizu also revised its BCP to respond to such new risks, and conducted a company-wide BCP emergency drill on March 11, 2019 based on the scenario of an earthquake directly beneath the Greater Tokyo Area. The scenario of the drill was a magnitude 8 earthquake with a seismic intensity of 7 occurring at 2:00 am under the northern part of Tokyo Bay. In the scenario, the area surrounding the head office suffered catastrophic damage and headquarter functions had become inoperable.

It was determined that establishing an emergency response headquarters at the head office would be impossible in such conditions, so an alternate headquarters was temporarily established at the Kansai Branch in Chuo-ku, Osaka, and directed company-wide response activities until head office functions were restored. As was the case in previous drills, the safety of employees was confirmed and information on damage to Shimizu facilities, job sites, and customer facilities was collected as part of the drill response. A new part of the drill in which the Kansai Branch took over the head office functions of wage payment and processing of customer payments was also conducted until it was handed back to a functioning Tokyo office three days later. We will continue these drills in the future to strengthen our ability to respond in an emergency.

Promoting Disaster Prevention Activities Together with the Community

At the request of Chuo-ku (Tokyo) authorities, our Headquarters Building is designated as a regional disaster center and will provide space to temporarily shelter people who cannot return home. We have a system to operate the regional disaster center in place and are committed to contribute to a disaster prevention system based on the philosophy of “mutual help” together with Chuo-ku and other companies.

Risks Affecting Our Business