JAC Group has identified Organisational Resilience as a materiality issue that underpins our value creation. We are committed to establishing and operating a framework that promotes risk management in an organised and continuous manner across the Group.
JAC Group regards risk management as a key initiative that supports the enhancement of corporate value and has established a risk management framework centred on the JAC Group Risk Management Committee. The Committee monitors and reviews risks that could seriously impact management in accordance with the below framework.
Each Group company analyses and assesses a range of risks surrounding its business activities in terms of both likelihood and potential impact on operations, and reports the results of its assessment. Based on the risk assessment results reported by each Group company, the JAC Group Risk Management Committee conducts reviews and identifies key risks that could have a significant impact on the management of the Group as a whole.
For FY2026, through this risk assessment process, the Group identified company-wide key risks including cyberattack risk and business continuity planning (BCP) for natural disasters. For each identified key risk, a responsible Division is appointed to drive risk mitigation measures, and the progress of these measures is continuously monitored.
In addition, the Committee reviews the identified key risks annually, taking into account the status of risk mitigation measures and changes in the business environment.
The status of risk management is reported to the Board of Directors twice a year. With respect to FY2025, the Risk Management Committee reported on the various risk measures undertaken and the results at the Board of Directors meeting held on 12 February 2026.
As digital technologies become increasingly embedded in business operations and cyber threats continue to grow in sophistication, the appropriate protection of information has become a critical management priority for ensuring business continuity and sustaining corporate value. Through its recruitment business, JAC Group handles important information, including personal information and confidential information entrusted to us by our corporate clients and candidates.
The Group is committed to ensuring the confidentiality, integrity, and availability of information, while maintaining robust systems for its appropriate management and protection. We also strive to build trust with our corporate clients and candidates by providing accurate and appropriate information and delivering services that respect the rights and interests of all parties. In handling information, we place particular importance on maintaining its accuracy and reliability, ensuring that information is managed appropriately to prevent misunderstanding or disadvantage.
Under its Information Security Policy, JAC Group continues to strengthen its organisational framework, operational controls, employee education and training, contractor management, incident response capabilities, and continuous improvement efforts. Through these initiatives, the Group is committed to maintaining safe and secure business operations that earn and uphold the trust of its stakeholders.
Specifically, the Group has established the Information Security Management Regulations as its fundamental rules governing information security. In addition, an executive officer responsible for the information security function is appointed as the Information Security Management Officer, and a Computer Security Incident Response Team (CSIRT) has been established to respond to information security incidents. Through these measures, the Group has put in place a comprehensive information security management framework.
The Group has also established the Information Security Incident Management Regulations, which set out the procedures and reporting structure for responding to information security incidents. In the event of an incident, the Computer Security Incident Response Team (CSIRT) promptly consolidates relevant information, assesses the scope and severity of the incident, and reports and escalates the matter to relevant stakeholders, including senior management. Through these measures, the Group works to prevent the spread of damage, identify root causes, and prevent recurrence.
From a business continuity planning (BCP) perspective, the Group has also established response policies and recovery procedures for incidents such as information system failures and cyberattacks, helping to minimise disruption to business operations.
We also provide regular e-learning programmes and phishing simulation exercises to enhance employees’ awareness of information security and strengthen their ability to respond to information security risks.
The Group recognises cyberattack risk as one of its key management risks. Related initiatives are monitored by the Risk Management Committee, and their status is reported regularly to the Board of Directors.
|
Issues |
Countermeasures |
Main measures |
|
Unauthorised external access, delays in countermeasures, and risks to business continuity |
Employee training |
Ongoing implementation of information security e-Learning for all employees |
|
Risk assessment |
Ongoing implementation of “targeted attack email training” |
|
|
Strengthening emergency response and BCP measures |
Annual vulnerability assessments |
1. Compliance with laws and regulations related to information security
2. Organisational structure to ensure information security
3. Establishment of rules and regulations concerning information security management
4. Implementation of education and training for ”related parties” concerned in handling important information assets
5. Information security measures for outsourcing contractors
6. Response to information security incidents
7. Periodic evaluation and continuous improvement
JAC Group recognises large-scale natural disasters, including a major earthquake directly beneath the Tokyo metropolitan area and a Nankai Trough earthquake, as significant business risks that could have a material impact on its operations. Ensuring the health and safety of employees, their families, corporate clients, and candidates is the Group’s top priority. To this end, the Group has established systems and procedures to ensure a swift and appropriate response in the event of a disaster while ensuring business continuity. The Group has developed disaster response manuals and disaster response procedures and has implemented an employee safety confirmation system. The Group also works to geographically diversify the management of its business assets and maintains the information systems necessary to support a transition to remote working when required.
In addition, the Group continuously conducts disaster preparedness e-learning programmes, company-wide disaster drills, and safety confirmation exercises to enhance employees’ awareness of disaster preparedness and strengthen emergency response capabilities. Furthermore, to minimise the impact of major disasters, including earthquakes, on business continuity, the Group continues to develop and review its Business Continuity Plan (BCP). By implementing continuous improvements based on training outcomes and risk assessments, the Group is working to strengthen organisational resilience.