BIPROGY Inc.

Cyberattacks such as malware and unauthorized access, as well as human error, could cause information system outages, information leaks, or data tampering, potentially affecting business results through reputational risk and response costs. As the Group handles a large volume of customers' confidential and personal information, this is positioned as the most critical issue in the ICT industry. In response, the Group is strengthening its security infrastructure based on a zero-trust architecture, expanding the monitoring scope of the CSIRT and Group-wide SOC, and conducting periodic assessments using the NIST Cybersecurity Framework.

The rapid advancement of cutting-edge technologies, including generative AI, is causing structural changes in business processes and in system development and operation, and delays in acquiring new technologies, obsolescence of in-house assets, or delays in transforming the business model could lead to a decline in market competitiveness, customer satisfaction, and profitability. There is also a risk that advances in AI technology will accelerate in-house IT development among client companies, altering the man-hour-dependent development model. In response, the Group has established the "AI CoE," a cross-organizational body reporting directly to the CSO, to strengthen AI governance, formulate AI utilization policies, and provide support to promote AI adoption across departments.

Amid intensifying market competition, customer requirements are becoming more sophisticated and projects more complex, increasing the risk that, when problems arise in system development or outsourcing projects, remediation may require greater-than-expected costs and time, resulting in cost overruns or release delays. Safety and security risks are also increasing due to the diversification of products and services handled. In response, the Group conducts feasibility assessments and budget-to-actual management through the "Business Review Committee," performs project health checks to identify issues early, and systematizes and standardizes system development methodologies.

The systems provided by the Group have diversified, ranging from social infrastructure such as finance and electric power to consumer-facing services such as payments and e-commerce. If a major failure occurs due to a system malfunction or cyberattack, the scope of impact could extend beyond customers to consumers at large. This could result in reputational risk and the payment of damages, potentially affecting business results. In response, the Group has established quality targets for unplanned service outage duration, conducts quality assurance reviews during system development, and has put in place a system for rapid information dissemination through an incident management system.

Competition to secure IT talent is intensifying due to heightened international competition, a shrinking labor force from the declining birthrate and aging population, and the advancement of DX. If the Group is unable to secure the necessary talent, this could affect its ability to sustain growth. In addition to technical skills, securing talent capable of fostering innovation and responding to diversifying social issues and customer needs has become a key challenge. In response, the Group is pursuing both new graduate and experienced-hire recruitment, enhancing training and systems, promoting career development centered on ROLES definitions, and working to improve operational productivity and optimize human resource allocation through the use of generative AI.

In procuring hardware, software, and services from domestic and overseas suppliers, changes in a supplier's business strategy, deterioration in its financial condition, changes in product specifications, supply delays, or price revisions could damage social credibility and brand image, potentially affecting business results. There is also a risk that geopolitical risks or tightened economic security-related regulations and export control regulations could delay or halt the supply of products and services from specific regions. In response, the Group continuously conducts periodic supplier reviews and quality control based on its procurement and purchasing guidelines, along with information gathering on geopolitical risk and procurement risk assessments.

If the business environment deteriorates due to geopolitical instability such as tensions in the Middle East, fluctuations in financial and capital markets, worsening economic conditions stemming from U.S. trade policy, restrained IT investment by companies, or intensified competition from new entrants in other industries, this could affect business results and financial condition. In addition, heightened environmental awareness driven by the spread of ESG principles, and tightening of various regulations worldwide or changes in government policy, could also necessitate a review of business strategy. The Group states that it will strive to respond promptly while continuously monitoring developments in the external environment.

As new businesses are created, compliance risks are expected to become more diverse and complex. In addition to labor issues such as excessive working hours and harassment, if deficiencies in data handling arise from the growth of data utilization and service-based businesses, or if serious compliance violations occur, this could damage social credibility, lead to damages claims, and result in reconsideration of business relationships by key clients, potentially affecting business results. In response, the Group has formulated the "Corporate Code of Conduct," the "Group Basic Compliance Policy," and the "Group Code of Conduct for Officers and Employees," and has established a compliance promotion structure.

To enhance customer value and establish new revenue bases, the Group continues to expand global investments and M&A activities with partners possessing advanced technology and expertise, as well as investments in startups and funds. However, investment returns are not always guaranteed, and if there is misalignment in business strategy with partners or if business growth does not proceed as planned, this could affect business results. In response, the Investment Committee and Management Committee carefully examine the validity of the business plan for each investment case, working to minimize investment decision risk.

If the Group's response is insufficient to physical risks such as intensifying extreme weather, droughts, and floods, as well as to tightening environmental regulations and growing disclosure demands from investors amid the transition to a low-carbon economy, this could affect business results through a decline in market competitiveness and reputation. In response, the Group has established the "BIPROGY Group Environmental Policy" and aims to realize a zero-emission society based on its "Long-Term Environmental Vision 2050." It also conducts cross-organizational scenario analysis based on TCFD recommendations and integrates identified climate-related risks into the Group risk management system for ongoing management.