Integrity in Corporate Activities Risk and Crisis Management We are improving risk a risk. Risk management covers risks is placed upon preventing crises before management for crises arising in the business process. For natural they happen. Of the 139 items on the list prevention disasters and fires, the traditional system of potential crises, 25 items have been that has already been established is ap- named as critical in light of their frequen- Risk management forms the back- plied. Risk management does not cover fi- cy (probability) and degree of influence bone of business management. It nancial risks such as exchange risks or en- (importance), which are managed by the will not work properly if divisions terprise risks including those in relation to whole Group. Specific crises, which have are not consistent in the measures sales of businesses, which are managed been standardized and compiled in a man- they take. Therefore, we have es- under other systems. ual to facilitate daily management, are tablished a system covering the covered by the Ricoh Group Standards whole Group, under the leadership Activities of BPRM Subcommittee shared across the Ricoh Group. The em- of Ricohs general affairs division. Overall activities for risk management are ployees carry out self-assessment at their The supervising divisions at supervised and promoted by the general own workplaces for improvements in the Ricohs Head Office are developing affairs division, while the revision of stan- scheme. a risk management system in coop- dards corresponding to respective crises eration with relevant business divi- comes under the Business Process Risk sions and affiliates who are respon- Management Subcommittee (BPRM Sub- sible for implementing measures committee), whose secretariat is the gen- under the system. eral affairs division. Risk Management Classification of Important Crises Scope of Risk Management The Ricoh Groups risk management sys- Ideas of risk management and definitions tem consists of preventing crises before of terms are clarified and shared across they happen, countermeasures at the initial the Group, aiming at smooth operations. stages of a crisis, and a strategy and sys- We define a crisis as an event caused by tem to maintain them. Particular emphasis Mapping Out and Developing Measures for Crisis Prevention Preparation of a List of Crises/Risk Items Preparation of a Crisis Map At CSR Division Importance Select important crises Consider all crises and report them Other Crisis Items to top management Managed by relevant supervising divisions (headquarters function) Crises are selected in the order of priority in drafting preventive measures. [Management of Important Crises] Preventive measures are mapped out and developed in the group. The general affairs division is re- The relevant supervisory divisions Possibility of occurrence sponsible for relevant supervisory are responsible for implementation divisions to take appropriate meas- of preventive measures. ures (headquarters function). Map out preventive measures and develop them in the group Sorting out of risk items Audit conditions for implementing preventive measures Specifying the key item Organize them as Ricoh Group Standards (RGS) Mapping out preventive measures

Integrity in Harmony Concept Respect Harmony Corporate with the of CSR Share- Partner for People with Society Activities Employees Customers Society Environment holders Companies Recent misconducts and not appropriate for Japanese staff mem- Case 3: Loss of Customer Data actions taken bers alone to discuss countermeasures, and changed the details of the measures. Loss of Customer Data at Ricohs Unfortunately, cases of misconduct 2. To avoid misdiagnosing influenza as Sales Division have been reported even after the SARS, inoculation against influenza was When returning important personal data provided establishment of the CSR Division. given, including people going abroad on by customers in June 2003, it became clear that the consigned delivery agent had lost the data in transit In response to this, we organized business. at Haneda Airport. Countermeasure PGs or task forces 3. The Preventive Measure Planning Man- that comply with the Initial Counter- ual for Infectious Disease was revised. Countermeasures Taken measure Standards in Case of a * See page 25. In cooperation with the consigned delivery agent, Crisis, and investigated the causes, we searched the site and even visited the destina- tions of the airplanes that had left the airport during took action to put things right, and Case 2: Bid-Rigging that time period to check. At the same time, rules enforced group standards to pre- and workflows, as well as conditions of manual vent any reoccurrence. Revelation of Bid-Rigging preparation and thoroughness of education were checked, including the reason why a delivery agent Regarding Water Meters was used. Case 1: SARS In July 2003, Ricoh Elemex Corporation was ac- Regarding it as our companys responsibility, we cused by the Japan Fair Trade Commission of apologized to customers for consigning the trans- bid-rigging regarding water meters, which are portation of important data to a third party, report- One Infected One Suspected staple products of the company. This followed One of the employees at Ricoh Electronic Technol- ed on the progress and explained the measures similar cases in 1992 and 1997. taken. At the press conference, the president of the ogy Ltd. (China) was infected with SARS and it be- came clear on May 4, 2003 that another employee company explained the circumstances and causes might have been suspected. The two employees Countermeasures before the of the incident, apologized for losing the data as were isolated and the plant was closed, in accor- Revelation well as for the shortcomings and indefinite parts of dance with the instructions of the Chinese authori- the operational rules, and reported on measures that Ricoh Elemex designated the day when the previ- ties. Nonetheless, it became plain on May 12 that the company was now taking to fulfill our social ac- ous accusation was brought as Compliance Day there was no secondary infection and the plant was countability. and had made efforts to educate employees. The allowed to recommence operations. top manager himself had stressed the importance of compliance and been engaged in education and ac- Review of Countermeasures and Measures Taken before the tivities. Standardization Occurrence 1. With the cooperation of other divisions, A SARS Countermeasure Committee was organ- Review of Countermeasures and processes were analyzed and reviewed, ized, chaired by the Manager of International Mar- Standardization while the manual on handling customer keting Group. Four Project groups were organized 1. As a result of discussions by all the em- information was revised to prevent the under the committee, to ensure the safety of employ- ployees in the Group, it was found that same thing happening again. ees and products, and to maintain business and pub- lic relations. As the top priority was given to the compliance education alone was insuffi- 2. Other sales divisions also reviewed lives of employees of the Group, 15,000 masks, cient and systematic prevention of bid-rig- their schemes, etc. for handling informa- clinical thermometers, disinfectant, mouthwash, and ging was essential. Accordingly, preven- tion provided by customers. other materials were sent to the region, while busi- ness trips to the region were banned. tive measures modeled after those taken in 3. Instructions were given in the name of the sales division of Ricoh, which had led the Ricoh president to Group companies Review of Countermeasures and such efforts, were introduced into Ricoh to take great care in handling personal in- Standardization Elemex. In practice, bidding information formation. Information held and manage- 1. After the plant recommenced opera- is compiled in a database, which is shared ment schemes for such information were tions, circumstances at the site were inves- and checked. The workflow starts with the checked and reviewed, and these were tigated. This investigation revealed that registration of bidding information, which scheduled to cover the entire Group few people in China followed the practice is followed by signing an oath that there is through detailed education, etc. of gargling, and easy-to-use gargle/mouth- no bid-rigging in setting prices and subse- 4. The schedule for implementing the In- wash was desperately needed. In addition, quently, management of the bidding re- formation Security Management System the temperature readings given in the re- sults (evaluation of appropriateness (ISMS) was accelerated, while a division port by the victim were not quite credible through comparison with past data, recent was created to coordinate the Groups ac- and other measuring methods are required. data, etc.) tivities for the management of personal in- It also became clear that there was no 2. These measures have been standardized formation, so that thorough measures can practice of inoculation, and accidents across the Ricoh Group, and introduced be taken. could occur. They also found that it was into the Group companies. * See page 16.