Risk Management Risk Management

Risk Management Basic Policy

The Advantest Group will conduct measures to minimize damage should any of the following events occur:

1. If damage is caused to buildings or facilities, or if networks and systems stop functioning, thereby making it difficult to continue our business operations, or if there is the possibility of this type of situation occurring due to a disaster or accident;
2. If there is the danger of one of our executives or employees being killed or injured or their life or physical health is put at risk due to a disaster or accident;
3. If there is an occurrence of scandal or incident that has the potential to become a matter of social concern; or,
4. If any event other than those described above were to occur that could cause a significant impact on the business of the Group or its affiliates due to a disaster or accident.

Risk Management System

In December 2001, Advantest established a Risk Management Group with the Company’s president as its head. The Risk Management Group will convene when any of the above events occur, and will consolidate information flows, evaluate the problem, direct the initial response, and formulate recovery plans. The Group will remain in operation until recovery is complete.

Major Risk

Risks associated with Advantest’s business are shown below.

• Business Risks

Business Continuity Plan

Advantest Corporation established the following basic policy during fiscal 2007 in preparation for large-scale natural disasters. We have devised our business continuity plan based on this policy.

Business Continuity Plan (BCP) — basic policies

• We will place top priority on ensuring human safety should a major disaster strike.
• We will fulfill our responsibility to our stakeholders by ensuring that any impairment to our operations has a minimal adverse impact on our suppliers and other stakeholders.
• We will cooperate with local bodies in regular disaster prevention measures, and if a disaster should strike near any of our locations, we will contribute to local recovery.

After the Great East Japan Earthquake in March 2011, we began reviewing our disaster prevention arrangements. In fiscal 2012, we revised our Business Continuity Plan (BCP) to take into account the possibility of an earthquake directly under Tokyo and flooding along the Tone River, and to ensure the integrity of our supply system even in the event of such disasters. Within the BCP, the following measures are stipulated in line with the basic policy.

Measures Implemented in fiscal 2015

In August 2015, to support the restructuring of the Risk Management Group, the role of the Risk Management Group and the strategies etc. for business continuity planning (BCP) were confirmed. In addition, in accordance with the company’s BCP, initial response training for a scenario assuming that a major earthquake occurs directly under the Tokyo metropolitan region, function-specified restoration work training and review of relevant manuals etc. have been undertaken on a quarterly basis. Based on the results obtaining in this work, Advantest has made adjustments to the initial response plan for a disaster occurring at night or on a weekend or holiday, and has improved IT system readiness for emergency situations. We have also continued to implement safety verification training for employees based in Japan, with the frequency of training being increased to three times per fiscal year (in July, November, and March).
This year, Advantest has also been working to put in place a Business Continuity Management System (BCMS) for the ongoing adjustment of quarterly training and of adjustments to BCM plans etc. based on the results of such training.

Information Security Management Policy

Advantest is fully aware that information we receive from suppliers and information pertaining to our technical and sales operations are important assets; to effectively manage this information we pursue information security practices that include developing regulations, constructing control systems and providing employee training.

Policies and rules relating to information security

Advantest has established an Information Security Basic Policy. Rules are specified in four policies: our Privacy Policy, Confidential Information Management Policy, Education & Incident Management Policy, and IT Security Policy.

Organization of Information Security Management System

Advantest regards implementation of information security controls as a key management issue, and has accordingly assigned the Senior Executive Officer to act as Information Security Officer responsible for such systems on a global basis.

Moreover, we have set up a system that enables our offices in respective countries to autonomously address information security issues. Under this system, Regional Information Security Officers posted in respective countries bring a variety of viewpoints to the table in the course of deliberating on potential information security measures to be applied on a group-wide basis, and also when considering which policies and rules should be adopted, or otherwise revised or abolished.

Specifically, the head of each Group company’s administration division has been assigned to the position of Regional Information Security Officer, responsible for security management in their respective regions. Meanwhile, members from related divisions in respective countries have been tasked with implementing information security measures.

Organization of Advantest Group Information Security management

Information Security Training

Based on the view that the final barrier for information security is “people”, we aim to thoroughly publicize information security policies and related regulations. We administer information security training on each policy — Privacy Policy, Confidential Information Management Policy, Education & Incident Management Policy, and IT Security Policy — to all employees in Japan and overseas.

Going forward, we intend to continue developing more practical content and offering more pragmatic training through learning activities that entail repeated exposure to information security rules and content covering key topics in that regard.

Initiatives for Strengthening Information Security

In fiscal 2011, we adopted a system whereby internal audit divisions perform information security audits, which enables us to conduct more objective rules-based checks and provide feedback to divisions that have been audited.

In updating our rules governing access to information equipment, we dropped requirements stipulating that employees must use encrypted PCs only, and now allow them to use thin client computer platforms through which they can perform work in secure environments without the prospect of leaving traces of data behind after use. Also, we made sure that our uniform Group-wide guidelines for business-related use of smartphones enable our employees to draw on such devices effectively in a business context, and in a manner that facilitates better customer service.

At some point we will gauge the effectiveness of our information security measures and will consider objective criteria based on which we can evaluate our information security system and pinpoint its strengths and weaknesses.

Confidential Information Protection

Our Information Security Basic Policy defines confidential information as that which has been disclosed by clients under contract along with that which is important to the company; moreover, the policy stipulates that such information be handled in accordance with relevant regulations.

Accordingly, we are committed to ensuring that confidential information is not divulged outside the company by ensuring that it is protected through use of adequate controls governing its storage, disclosure and handling, In fiscal 2015, there were no incidents involving the unauthorized disclosure of important confidential information, etc.

Personal Information Protection

We consider the confidentiality of all personal information entrusted to us to be very important, and accordingly we take steps to ensure that such information is properly protected and managed. In fiscal 2015, there were no incidents involving the unauthorized disclosure of important personal information, etc. Also in fiscal 2015, the necessary preparations for the introduction of the “My Number” personal identification number system in Japan were made with respect to internal company regulations, manuals, frameworks and systems.

• Privacy Policy

Our commitment to safeguarding personal information entails posting personal information managers in divisions handling such duties, and furthermore ensuring that those managers properly carry out their duties in regard to overseeing such information.

Furthermore, we perform regular audits of personal information control and use practices in the respective divisions, and make improvements whenever deficiencies are discovered.

In Group companies outside of Japan, Regional Information Security Officers work to protect and manage personal information in accordance with the laws, regulations, and demands of each respective country or region.