IDENTITY

MATERIALITY andSUSTAINABILITY

BUSINESS andSTRATEGIESGOVERNANCE

FINANCIAL INFORMATION /OTHERSInternal controls

Risk management
The JT Group identifies and closely monitors risks that could
affect its operations and implements measures to both prevent them from materializing and minimize their impacts ifthey were to materialize. We have established an integrated

system for identifying and managing all identified risks. Ourrisk management process comprises the following foursteps.

such guidelines to their personnel (defined as employees,directors, etc.; likewise below) and endeavor to increase
compliance effectiveness by conducting various training
programs and other educational activities for their respective personnel.

① Identify risks② Assess risks

Executive Officers assess risks in their respective organizational units probability of materializing and themagnitude of its impact if it were to materialize. They identify material risks that should be prioritizedwith attention and report them to the executive in charge of risk management. Based on such reports, theexecutive in charge of risk management identifies Group-level material risks with the potential to inflict major
losses in terms of attainment of the Group’s management targets and business strategies and reports said risks
to the CEO.

③ F ormulate plansto address risks④ M onitor progressof plans

Executive Officers oversee formulation of plans to address the JT Group’s material risks and submit them tothe executive in charge of risk management and the CEO.
Executive Officers regularly report to the executive in charge of risk management and the CEO on the progressof the plans to address the Group’s material risks.

We have prepared crisis management and disaster responsemanuals in preparation for emergencies. When a crisis or
natural disaster occurs, we set up an emergency project taskforce. We have made advance arrangements to enable concerned organizational units and subsidiaries to swiftly takeappropriate action in close coordination with each other

under the direction of senior executives. Such incidents andpertinent information about them are reported to the Boardof Directors in a timely and appropriate manner.

The JT Group Compliance Committee is headed by theChairperson of the Board and includes external experts askey members. It meets regularly every year. It deliberates
on Group-wide compliance-related matters, including
annual Compliance Action Plans’ implementation status and110

Japan Tobacco Inc. Integrated Report 2022

ReportCompliance Office
Approve initiatives

ReportDivisions in each business & corporate divisions

Group companies

4Please see Risk factors (P. 116) for more on risks facing the JT Group.
* Composed of two internal and three external members

Compliance
We enforce strict compliance. We have instituted a Code ofConduct that mandates that all directors and employees
act in compliance with applicable laws, government
regulations, our Articles of Incorporation and societal
norms pursuant to regulations established by the Board ofDirectors. To ensure fair and effective compliance practices,
we have established the JT Group Compliance Committee
as a deliberative body that reports directly to the Board ofDirectors.

JT Group Compliance Committee*
Supervise/Advise

adoption/revision of compliance-related regulations and ourCode of Conduct, to deeply instill a compliance mindset inemployees. We have also appointed an Executive Officer incharge of compliance to oversee our Legal and Compliance
Division, which implements and promotes a cross-Groupcompliance regime and endeavors to identify compliancedeficiencies. In 2022, the JT Group Compliance Committee
met three times to discuss compliance promotion initiatives,among other matters. The outcomes of its discussions wereincorporated into the 2023 Compliance Action Plan.

Action Plans formulated by the JT Group Compliance
Committee include actions to maintain/enhance compliance programs, address priority compliance issues, conduct
trainings and seminars, operate the internal reporting
system and implement Compliance Promotion Month.

Compliance surveys

Board of Directors
An executive appointed by the CEO to be in charge of risk management (currently the executive officer incharge of corporate governance and compliance) identifies all risks that could affect the JT Group.

Compliance Action Plans

We annually conduct a Group-wide questionnaire survey
to check the status of compliance practices in our Japanese
operations. In 2022, 94.1% of employees completed thesurvey. The survey’s findings are reported to directors andemployees, and are used by concerned organizational units
to reassess their respective compliance plans and formulate
and implement measures to improve compliance.

Internal reporting system (whistle-blowersystem)
Group companies have set up hotlines for their employees
and other parties to report acts suspected of being legal/
regulatory violations and other such concerns. Compliancepromotion departments that receive a report or query via
their hotlines investigate its details and then take action,
including recurrence prevention measures, as needed.
Additionally, JT has set up another hotline apart from theone staffed by its Legal and Compliance Division. The
second hotline is independent from organizational units
involved in operational execution and staffed by Audit &Supervisory Board Members, who investigate the detailsof any reports or queries received via the hotline. JT thentakes action, including recurrence prevention measures, asneeded. JT refers or reports serious problems involving theJT Group to the JT Group Compliance Committee for further
review as needed.

Group companies’ respective organizational units that
promote compliance (e.g., JT’s Legal and Compliance
Division and subsidiaries’ corresponding organizationalunits) distribute the JT Group Code of Conduct and otherJapan Tobacco Inc. Integrated Report 2022

111

IDENTITY

MATERIALITY andSUSTAINABILITY

BUSINESS andSTRATEGIESGOVERNANCE

FINANCIAL INFORMATION /OTHERSInternal controls

Quality control
We are committed to maintaining the public’s trust in ourproducts. To do so, we have implemented quality assurance
systems across all of our businesses.

Tobacco business
For tobacco products, we are building a globally uniform
quality assurance model and making necessary changes
based on this model with the aim of providing high-quality
products.
Our quality assurance activities fundamentally aim to improve quality and rectify deficiencies by providing feedback
to concerned organizational units about quality issues identified based on quality information from markets and related
research. For example, when our RRP (Reduced-Risk Product)
devices are in the development stage, we confirm that they
not only comply with applicable laws and regulations but
also that they meet industry safety standards for electric
products by having them evaluated as needed by external
specialists.
Additionally, in conjunction with measures to strengthen
the tobacco business’s operating model, we established
Quality Assurance in January 2022 as a new organization
independent from the tobacco business’s markets and other

Internal auditing
global operational functions. Quality Assurance endeavors
to provide high-quality products by assuming accountability
for quality assurance activities across the entire value chain
from R&D through procurement, manufacturing, marketing,
distribution and sales based on fair decisions from theconsumer’s* standpoint.

Pharmaceutical businessIn our pharmaceutical business, we are strictly committed
to safety and quality control in compliance with regulations
such as the Pharmaceutical and Medical Device Act andministerial ordinances that govern pharmaceutical quality
and safety.

Processed food businessIn our processed food business, we place utmost priority on
food safety management across the entire value chain fromsourcing ingredients to delivering products to consumers.
We do so under our four-pronged framework, consisting of
the following viewpoints: Food Safety, Food Defense, Food
Quality and Food Communication.

112

Japan Tobacco Inc. Integrated Report 2022

The Division formulates annual internal audit plans subject
to the CEO’s approval. Its head mandatorily reports internal
audit results to the CEO, reports annually to the Board ofDirectors, and may freely and regularly confer with the CEO
and our subsidiaries’ senior-most executives about internal
audit findings, internal controls’ status and risk assessments.

Our subsidiaries may set up their own internal auditingorganizations at their own discretion. Those that have done
so include major subsidiaries JTI, TS Network, Torii andTableMark. Subsidiaries’ internal audit plans are approved
by, and their audit results reported to, their respectivepresidents. JT’s Operational Review and Business Assurance
Division coordinates internal audits with subsidiaries’internal auditing organizations. Subsidiaries’ annual internal
audit plans and their internal audit results are reported to
the Group CEO and our Board of Directors through ourOperational Review and Business Assurance Division. To
increase internal audits’ efficiency and effectiveness, weperiodically hold meetings to improve audit quality throughinformation sharing among internal auditing staff acrossthe Group. We also conduct joint audits with and provide
auditing assistance to subsidiaries as necessary.

*Adult consumers. Minimum legal age for smoking varies in accordance withthe legislation in each country

Internal controls over JT International

Information security
We have established information security regulations toclearly demonstrate our commitment to information security and comprehensively promote information security measures on an ongoing basis. Specifically, we have adopted a
JT Group IT Governance Policy and JT Group Information
Security Standards and mandated and implemented therequired IT risk mitigation measures have been implemented which include, access restrictions, antivirus defenses,education, audits, and monitoring. We strive to manage andsafeguard our IT systems, data and other information assets
in an appropriate manner. We are continuously pursuing initiatives to strengthen our information security with respectto both hardware and software. Hardware-wise, we continually test and improve our key IT systems’ security-related

Our Operational Review and Business Assurance Division
conducts internal audits from an objective standpoint
independent from organizational units involved in operational execution and reports directly to the CEO. It assesses
management and operational systems and the state ofoperational execution across all business activities from thestandpoint of legal compliance and rationality with the aimof safeguarding Company property and increasing operational efficiency. To fulfill its responsibilities, it has unrestricted authority to observe all activities, inspect all records andquestion all personnel on a Group-wide basis.

technologies and operations. Software-wise, we conduct
security-related educational activities globally to promote
proper handling of information assets by all employees. In
2022, 88% of all JT Group company employees attended
security training programs. Additionally, we extended asingle information classification and protection solution
across all our business divisions and established a unified
approach to security operations across the JT Group. We arealso conducting educational activities across the entire JTGroup, having rolled out our internally developed i-secureprogram. The i-secure program’s effectiveness is constantly
being measured by employee behavior metrics. It has been
instrumental in raising employees’ awareness of information
security.

The tobacco business is operated by JTI, a subsidiary ofholding company JT International Group Holding B.V. With
appointees from JT occupying a majority of seats on thelatter’s Board of Directors, JT sets the tobacco business’s
overall strategy. Major decision-making authority and settlement procedures between JT and JTI are prescribed ininternal regulations, most notably our Authority andResponsibility Regulations. From an operational agility
standpoint, JT has delegated a certain degree of authority
to JTI while retaining approval authority over JTI’s budgets
and midterm plans, as well as proposed investments thatexceed a certain materiality threshold. Through such arrangements, JT endeavors to exercise governance over JTI.
JTI has its own internal regulations on delegation of responsibilities and authority called the JTI OperatingGuidelines. JTI delegates authority to its market subunits,

plants and executive officers within the scope of authority
delegated to it by JT.
Additionally, JT’s Audit & Supervisory Board Members
and Operational Review and Business Assurance Division
are authorized to audit JTI. JT’s Audit & Supervisory Board
Members audit JTI as warranted. While JTI’s internal audits
are conducted by its own internal auditing staff, JT’s
Operational Review and Business Assurance Division audits joint JT-JTI operations in coordination with JTI’s internal auditing staff. The results of audits by JTI’s internal auditing staff are reported to the president of JT’s Tobacco
Business Headquarters, who is also chairman of JT
International Group Holding B.V.
Through these arrangements, JT is building an appropriate governance regime.

Japan Tobacco Inc. Integrated Report 2022113