Sompo Holdings, Inc.

The risk of violations of domestic and international laws and regulations applicable to each business of the Group, misconduct by officers and employees, external criminal acts, and payment of damages arising from litigation. The occurrence of legal violations or scandals could lead to a loss of social trust and credibility, and the impact is assessed as "extremely large." As countermeasures, the Group conducts training on the "SOMPO Group Compliance Code of Conduct" and develops and operates an internal whistleblowing system.

The risk of impairing corporate value due to a gap between the products, services, and business practices provided by the Group and stakeholder expectations. Governance concerning AI utilization and personal data collection may also adversely affect market soundness, and the impact is assessed as "extremely large." The Group works to foster a sound corporate culture through the formulation and dissemination of the "SOMPO Group Compliance Code of Conduct Practical Guidebook" and "SOMPO's Yes."

The risk that cyberattacks cause security breaches at the Group or at agencies/outsourcing partners, resulting in the shutdown of information systems, data destruction, significant information leaks, or supply chain disruption. In addition to investigation and recovery costs and loss of credibility, this may result in violations of laws such as the Personal Information Protection Act and GDPR in various countries. Under the "SOMPO Group Cybersecurity Basic Policy," the Group is working to enhance its response capabilities across the Group through the operation of cyber metrics and the establishment of a Cyber CoE.

The risk that continuation of outsourced operations becomes difficult due to insufficient business execution capability, insolvency, legal violations, improper conduct, or withdrawal of services by important external outsourcing partners, including agencies, leading to payment of damages and reputational damage. In light of the administrative sanctions imposed on the Company and Sompo Japan, the Group is implementing measures under its business improvement plan to establish an effective agency management framework. The Group also continues to work on improving the effectiveness of its internal control systems across the Group.

The risk that insufficient exercise of Group governance functions (including the development and operation of internal control systems) leads to a breakdown of the Company's supervisory function, an inability to achieve strategic targets, deviation from regulations, and reputational damage. Insufficient communication and information sharing between the Company and Group companies are assumed to be the main causes. The Company has strengthened its supervisory framework, including having the Representative Executive Officer concurrently serve as a director of Sompo Japan, and is working to promote the use of the internal whistleblowing system and foster a speak-up culture.

The risk that significant information leaks caused by officers and employees at Group companies (excluding those caused by cyberattacks) result in payment of damages and reputational damage. The Group has established a management framework, including security control measures, based on the "SOMPO Group Basic Policy on Customer Information Management," to prevent significant information leaks. The Group also works to strengthen preventive controls by analyzing specific cases of information leaks and implementing measures to address common issues across the Group.

The risk that failure to achieve "ease of working," "growth of employees and the organization," and "job satisfaction" hinders employees' willingness to take on challenges and strengthen their expertise, preventing the creation of new value and sustainable value creation. This may make it difficult to secure and retain talented personnel, potentially leading to a decline in productivity and corporate competitiveness. The Group addresses this through large-scale investment in human capital utilizing the "SOMPO Talent Fund," the development and operation of a job-based personnel system, and the establishment of a PDCA cycle utilizing engagement surveys.

The risk that underwriting results are affected by the occurrence or increased frequency of massive wind and flood damage (including snow and hail damage) exceeding expectations due to climate change. As wind and flood damage expands, the reinsurance market may harden, and a significant reduction in reinsurance capacity may reduce profit stability. The Group conducts risk assessments utilizing scientific findings from the IPCC and NGFS as well as weather and climate big data, and works to control the impact through product revisions and reviews of underwriting terms.

The risk that heightened geopolitical tensions, resulting in the exchange of sanctions or the occurrence of significant events, spread to the Group in the form of a decline in the value of financial assets, an increase in claims paid, and business interruption. The Group investigates impact scenarios utilizing the knowledge of external experts and verifies financial impacts based on market trends. It has established action manuals and business continuity plans for crisis situations, and strives to maintain an effective crisis response framework through training and self-inspection.

The risk that, in system development incorporating generative AI, intellectual property or privacy infringements and the generation of false information cannot be suppressed, resulting in erroneous decisions or reputational damage. This risk may materialize due to inadequate rules and guidelines or insufficient AI literacy among officers and employees. In addition to formulating and operating the "SOMPO Group AI Governance Basic Policy," the Group addresses this by conducting third-party expert model testing for high-risk systems and mandating AI literacy training.