Risk Management
Basic Philosophy

Risk Management Promotion System
Risk Management Committee⨋ Management Based on the Risk Management Rules• Members: M anagement meeting
constituent members
and persons nominatedby the chairperson• Roles:
1. Monitor important risks andformulate a control plan
2. Monitor risks reported bysubcommittees and divisions• Convenes: O nce a quarterin principle andadditionally as required

GovernanceRisk Management

The Risk Management Committee meets quarterly, and risks are managed through theRisk Management Division and the subcommittees responsible for various risks.
The Risk Management Committee is attended by the risk management executive,
members of the Management Meeting, chairpersons of each risk management
subcommittee, and the general manager of the Internal Audit Office, with the full-time
auditor also participating as an observer. The president currently serves as the risk
management executive.
The Risk Management Division consists of representatives from each department
and Group company and is responsible for discerning changes in the environment ona daily basis to identify emerging risk factors and managing signs of risk manifestation.
The Risk Management Subcommittees monitor risks from a broader perspective andprovide cross-sectional supervision for risks raised by departments, and they also
consider and implement countermeasures. At each meeting, the Risk Management
Committee monitors and evaluates risks based on review sheets covering various risks
and reports from each risk management division and Risk Management Subcommittee,
and deliberates on how to control key risks identified in the process.

• Chairperson: R isk management
executive (president)

Foundation of Sustainability Management

The Sanki Engineering Group’s Enterprise Risk Management system consists of two pillars. Daily risk management isundertaken by the Risk Management Committee based on the Risk Management Rules, while the Business Continuity
Management System safeguards the effectiveness of business continuity planning in the event of contingencies,
including crisis management.

▍Framework of the Risk Management System (as of June 23, 2023)

Board of Directors
ReportManagement Meeting
ReportInternal Audit Office

ReportRisk Management Committee

Collaboration

ReportRisk auditing
Instructions

Instructions

Committees and Management System

Corporate Ethics Committee

Risk Management Division

Risk Management Subcommittees

All departments and Group
companies:
All offices, headquarters,
centers, business divisions,business departments,branches and branch offices,and Group companies

Customer risk

Overseas risk

Supplier risk

Compliance risk

Labor risk

Climate change risk

Management review of EMS and QMS

Internal Finance Control Committee
Sustainability Committee

Legal risk

Quality risk

Central Safety and Health Committee

Finance risk

Safety risk

BCMS Promotion Committee

Information
security risk

Management(public relations) risk

SANKI REPORT 2023

87︱Foundation of Sustainability Management ︱Governance︱

Risk Management⨋ Roles of the Board of Directors and Internal Audit OfficeCoordination with BCMS

Expanded Risk ManagementCommittee

OutlineFlexibly manage the PDCA cycle of the Business Continuity
Management System (BCMS), which will be operational in fiscal
2022.
Hold an expanded meeting of the Risk Management Committee
by effectively utilizing the Executive Officer Committee toestablish risk management and BCMS across the Group.

Business Continuity Management System (BCMS)
To prepare against risks that could hinder business continuity, we have formulated
and put into place a business continuity plan (BCP) to ensure the safety of all related
persons, including employees, through the integrated efforts of all executives andemployees. In fiscal 2021, we began preparing to establish a BCMS as a mechanism
for the effective maintenance and management of the BCP, and began operating thesystem in fiscal 2022.
Under the BCMS, we laid out an annual plan to periodically review the BCP
through PDCA activities (business impact analysis, education, training, internalaudits, management review, review, and improvement) and by coordinating withrisk management undertaken by the Risk Management Committee. During thereview process, we conduct a business impact analysis, from the perspectives of risk
assessment and impact evaluation, to investigate and analyze the degree to which eachtarget operation will be impacted in the event a risk materializes and to take concretemeasures to strengthen corporate resilience.
Furthermore, to realize a system for rapid business recovery and maintenance,
we formulated risk-specific response guidelines based on the BCP Common Version,
which describes our basic response policy. The guidelines address the seven risksof natural disasters, infectious diseases, industrial accidents, cyberattacks, terrorism,
misconduct, and communication failure. Since fiscal 2023, the scope of the BCMS has88

SANKI REPORT 2023

Governance•B usiness Operation Risks- Common to all construction
businesses• Securing human resources• Increase in materials and laborcosts and delays in delivery ofmaterials and equipment• Overseas business risks• A ccidents and disasters duringconstruction• Unprofitable construction- Facilities Construction Business• O verabundance of planned
projects and response to global
challenges• Increase in property size
- M achinery Systems Business• Decrease in capital investment• Decline in competitiveness- E nvironmental SystemsBusiness• Changes in market conditions• Long-term business risks- R eal Estate Business• Rent fluctuations• Decline in occupancy rate

• Financial and Other Risks- Customer credit risk

- Stock market fluctuations- Interest rate fluctuations- R isks related to litigation, etc.
- Seasonal fluctuations inbusiness performance- L egal violations- W ar, terrorism, and natural
disasters- C limate change- Infectious disease epidemic- Data security breach- System failure

Annual Securities Report forthe 99th Business Term (fromApril 1, 2022 to March 31, 2023)(in Japanese)

https://www.sanki.co.jp/ir/library/doc/
securities_R4-4q.pdf

Natural disasters

Communication failure(earthquakes, typhoons, volcanic
eruptions, tsunami, etc.)

Infectious diseases

Comprehensive Disaster Response Headquarters set up
during a drill

Misconduct(new Influenza strains,
infectious diseases,etc.)(bid-rigging, data
falsification, etc.)
Risks that Hinder
Business Continuity

Industrial accidents

Terrorism and conflicts, etc.

(fatal accidents, etc.)

Cyberattacks

Strengthening Risk Management in Overseas Operations
An Overseas Risk Subcommittee was set up within the Risk Management Committee
to analyze risks and consider countermeasures. To ensure the safety of employees
working outside Japan, we have formulated the Risk Management Manual for Overseas
Operations for the head office and overseas bases as well as the Manual to Ensure
Safety in Foreign Countries for overseas employees, those traveling overseas on
business, and their families. Compliance training sessions for local staff at overseas sites
have been conducted since fiscal 2021 to firmly establish governance across the Group.
In addition, our auditors concurrently serve as auditors of Group companies, and we areworking to improve our Group management system, including at overseas sites.

Initiatives on Information Security
We have established the Information Security Risk Subcommittee within the Risk
Management Committee to control information security measures across theGroup and manage risks. We are taking action to respond quickly to cyber attacks
by deploying information security software and installing software that constantly
monitors the intrusion of malware and other malicious software. In July 2023, werevised our information security measure guidelines regarding precautions for the useof generative AI services. We are also promoting the use of cloud services to addressrisks to construction site data storage involving many companies. In addition, we
provide ongoing training through e-learning on information security for all Company
employees and employees of subcontractors.

Risk Management Manual for
Overseas Operations• Response rules and procedures tobe followed by the head office andoverseas bases in the event of acrisis overseas• Risks to physical well-being and life,
violation of laws and regulations,response to mass media, litigation,etc.
Manual to Ensure Safety
in Foreign Countries• A practical guide on risk avoidanceand emergency response for
employees working overseas• Actions required in the eventof a terrorist attack or disaster,
prevention of damage from crimeand other risks, compliance withanti-corruption and other laws,
personnel/labor management oflocally employed staff, religion, andother related matters

Risk Management

PolicySocialGovernance▍FY2022 Operational Policy for Risk Management

Environment

Foundation of Sustainability Management

Major issues discussed in fiscal 2022 are summarized below.
•R ecognize large-scale communication failures as a new risk and guide the developmentof countermeasures in coordination with the Business Continuity Management System(BCMS)• Reinforce the monitoring of rising materials and equipment costs and delays in delivery• Reinforce the monitoring of work conditions in response to Japan’s revised LaborStandards Act• Guide the development of risk control measures related to specific construction projects
and monitor progress• Coordinate with special discussions on risk governance conducted by the Board ofDirectors• Continue monitoring risks associated with COVID-19

G▍Seven Major Risks that Hinder Business Continuity
Major Business Risks⨋ M ajor Issues Discussed by the Risk Management Committee

Sbeen expanded to include domestic Group companies. In addition, to prepare forcontingencies, we continue to provide BCMS training for directors and employees,
conduct periodic drills, and add to our emergency supplies. In particular, we began
conducting new drills for industrial accidents, cyberattacks, and misconduct, in addition
to drills for natural disasters, to strengthen our response capabilities.

The Risk Management Committee reports on the results of its deliberations to theBoard of Directors, which ensures effective risk governance by verifying the adequacyof the risk management system and the effectiveness of controls over material risks.
The status of risk management at each department is ascertained and verified by
the Internal Audit Office during regular internal audits.

Risk Management Activities

E

Information Security Rules
and Standards• I nformation Security
Management Rules• I nformation System UsageStandards• I nformation Security Risk
Management Standards• I nformation Security RiskCountermeasure Standards

SANKI REPORT 2023

89