Governance

Underlying YKK APʼs corporate activities is the YKK philosophy ― CYCLE OF GOODNESS^®, which states that "No one prospers without rendering benefit to others." Accordingly, we have consistently made fairness the foundation of all our business activities. In line with this approach, we aim to enhance our corporate governance system with the goal of further increasing corporate value. Based on an organizational system in which the Board of Directors serves as the decision-making and supervisory body and the Audit & Supervisory Board serves as the auditing body, YKK AP has adopted an Operating Officer System to promote the execution of business and operations.

In order to raise awareness of ensuring consistency between sustainably increases in corporate value and paying stable dividends to shareholders, as well as improving business performance, YKK APʼs basic policy is to set compensation for directors in consideration of the companyʼs results and to determine the appropriate level of compensation for each director in accordance with their responsibilities. Specifically, directorsʼ compensation consists of base salary and bonuses.

Compliance in the YKK Group refers to "not only observing laws and regulations and internal rules, but also complying with the social norms expected of us in the course of our corporate activities."
Through our compliance initiatives, we will manage risk appropriately, conduct sound corporate management, and further enhance our corporate value.

The YKK Group Code of Conduct was formulated in 2008 as the code of conduct to be implemented by YKK Group employees around the world. Its foundation is the YKK Philosophy and Management Principle. The Code was revised in FY2021 in light of recent changes in the demands of society and increased importance of sustainability. It applies to all YKK Group corporate officers and employees.
The YKK Group Code of Conduct consists of seven principles and 29 bylaws. These principles and bylaws take into consideration and are compliant with the ten principles of the United Nations Global Compact and the eight fundamental Conventions of the International Labour Organization (ILO), and contribute to achievement of the SDGs as well. We will work to ensure that every one of our employees around the world implements the YKK Group Code of Conduct and to gain the trust of all of our stakeholders.

YKK AP has set out the YKK Global Criteria of Compliance (YGCC), the YKK Groupʼs compliance standards based on the YKK Philosophy and ISO 26000, and is working to instill them at its locations in Japan and overseas.
We regularly carry out YGCC audits such as self-inspection and internal audits, and have standardized monitoring items to improve the effectiveness of the audit process and ensure continuous improvement.

To realize compliance management, we have established a Compliance Committee consisting of five units (Sales, Development and Technology, Manufacturing and Supply, Administration, and Overseas) to strengthen monitoring of compliance with rules, regulations, and guidelines.

The YKK Group implemented the "YKK Group Whistleblowing System" in 2006, operating a system that enables individuals to consult with/report to consultation desks inside and outside the company anonymously regarding behavior that violates laws, work regulations, or internal rules. Efforts are underway to ensure that all users are aware of this system. In addition, the principle of whistleblower protection prohibits the disadvantageous treatment of any individual for making a consultation. In FY2024, 71 consultations and reports were received by the Japan Contact consultation desk.
We are also committed to the mental and physical health of our employees, and have established a consultation service to address workplace environment problems, mental health concerns, and other health issues. Whistleblowing systems have also been established at overseas companies, with systems for consultation and notification put in place.
Furthermore, in July 2023, a new "YKK Group Supplier Reporting Contact Point" was established to provide redress for those involved with the company from human rights violations that may arise in the course of corporate activities.

In order to develop the people and culture that will support sustainable business growth, YKK AP is actively engaged in activities to instill the Management Principle.
In addition to the YKK Philosophy - CYCLE OF GOODNESS^®, and the Management Principle "YKK seeks corporate value of higher significance," the principles covered by our activities to foster the Management Principle includes the Core Values and YKK AP's Purpose, "We Build a Better Society Through Architectural Products."
The Core Values are three basic values compiled by the YKK Group in 2007 through interviews with many employees.
A 2021 project led by young YKK AP employees defined our unique Purpose, or the reason the company exists from the perspective of society, as "We Build a Better Society Through Architectural Products." Through activities to instill these management principles in all employees, we strive to foster a sense of unity throughout the entire company and divisions.
Specific activities in Japan include "Talking Sessions" and the "Core Value Practice Level Check Sheet." At the talking sessions, each division head discusses the management principles with employees in their own words. The sessions are held annually at all of our locations in Japan to raise awareness through communication. In FY2024, talking sessions were held at all of the approximately 2,000 divisions in Japan (Sales, Development, Technology, Manufacturing, and Administrative). In addition, the "Core Value Practice Level Check Sheet" is used during internal interviews to create opportunities for each employee to reflect on their own actions and think about the company's Core Values.
YKK AP's overseas operating companies are also actively engaged in activities to foster the Management Principle. For example, in the U.S.A., "Fundamental Behaviors" have been defined for 25 themes, and examples of employee conduct consistent with each theme are shared with all employees via internal bulletin boards and email. These examples are presented at the beginning of major meetings to encourage more in-depth discussions. In addition, our Taiwanese subsidiary conducts online training sessions on the Management Principle and compliance for all employees.

To realize YKK APʼs management and business strategies and drive sustainable growth, we are working to strengthen risk management based on a "resilient business foundation," as set forth in our materiality. In addition to taking swift and appropriate measures for initial response and recovery, thereby minimizing damage from risks that have arisen, we are working to build a system for anticipating, preventing, and controlling risks in our business.
In order to strengthen the risk management system and establish governance systems for emergencies, we have established various committees under the CRO (Chief Risk Management Officer), including the Quality Committee, Trade Management Committee, BCM Committee, Information Security Committee, and Technical Asset Management Committee. Rules and regulations have been established for each committee and are in operation accordingly.

YKK APʼs risk management promotion structure is based on a three-line model. The five basic units (Sales, Development and Technology, Manufacturing and Supply, Administration, and Overseas) serve as the first line, taking the lead in risk management activities. Risk management departments and committees, which serve as the second line, support the first line with their specialized knowledge and expertise. The Internal Auditing Division, which serves as the third line, audits the effectiveness of the risk management activities of the first and second lines. Furthermore, by allowing self-checks of risk management activities based on the YKK Groupʼs compliance standards, the YKK Global Criteria of Compliance (YGCC), we are clarifying the roles and responsibilities of each person and division in charge of conducting these activities, thereby enhancing their effectiveness.

In FY2024, we reviewed our process for identifying key risks and, in addition to consultations with risk management departments, conducted risk surveys of business divisions and interviews with senior management to identify and analyze risks. In evaluating risks, we determine the level of risk based on the likelihood of occurrence and impact, as well as reputational risks and internal and external factors. This is then used as a basis for discussion and decision-making by the Board of Directors to identify key risks.

For FY2025, we have identified 27 categories of key risks, including system failures, cybersecurity, major natural disasters, product defects, and recalls. We will prioritize the allocation of business resources to these areas and implement measures to develop systems and countermeasures.

We have established five materiality indicators to evaluate the effectiveness of risk management. "Rate of participation in risk-related training" is an indicator (FY2028 target: 95 %) for raising the risk awareness of every employee in order to prevent cyberattacks and phishing emails, which have been on the rise in recent years, as well as misconduct and violations of laws and regulations. "Number of locations that have formulated BCPs" serves as an indicator to confirm whether BCPs are being properly developed and implemented at all Japanese and overseas sites. "Number of serious quality and product liability incidents," "number of serious cyber incidents," and "number of serious violations of laws and regulations" are indicators for showing that our day-to-day efforts are leading to reduced risks.

We are working to acquire the appropriate business continuity capabilities necessary to respond to major emergencies. To this end, we are enhancing our organizational strength through repeated training and preparation to enable rapid initial response and implementation of BCPs based on an all-hazards approach, covering large-scale natural disasters, supply chain disruptions, cyber incidents, and the spread of infectious diseases. The first basic policy is "Prioritize human life, ensure safety, and prevent secondary disasters." In FY2024, based on the scenario of a major earthquake directly under Tokyo or a Nankai Trough earthquake, we conducted joint training exercises involving manufacturing and sales operations across different areas, briefings for sales managers, and training exercises with Kurobe, which will serve as a backup base for the local disaster response headquarters in the event of a disaster in the Tokyo metropolitan area. Measures will be considered for each location to address issues identified during the training, and these will be reflected in BCP revisions and future training. We are also conducting initiatives that involve external contractors such as truck drivers and cafeteria staff in evacuation drills.

YKK AP is engaged in initiatives to protect information assets from various threats to ensure business continuity and minimize damage to the business in the event of an emergency. In recognition of the fact that information security is the most significant risk, we will ensure sustainable growth by strengthening security across our businesses, including domestic, overseas, and affiliated companies, thereby maximizing return on investment and business opportunities.

The Information Security Committee has been established for promoting the information security system at YKK AP. We are implementing company-wide information security measures along two axes: a vertical functional promotion system covering all divisions, and a horizontal specialized subcommittee system to promote measures in each area of specialization.
The function promotion system conducts monitoring activities inside an organization to regularly check compliance with various regulations and the level to which information security training has been absorbed. Through this kind of continuous monitoring, we are working to enhance our information security management system.

In order to ensure the appropriate management and use of customersʼ personal information, YKK AP has established a system of authorized agents for the handling of personal information in Japan. With the aim of preventing leaks of personal information, the system to authorize companies involves training sessions for these companies to improve and enhance their management skills to handle personal information provided to them and the signing of a written agreement.
Monitoring is conducted to verify the effectiveness regarding handling personal information, ensuring that personal information is properly managed.

YKK AP has introduced EDR^*1 company-wide, including at its global locations, as part of its information security measures, thereby enhancing its cyberattack monitoring system. In addition, we have established a system to promptly escalate information security incidents to the Information Security Committee and notify all employees globally. In the unlikely event of an incident, the Information Security Committee will take the lead in implementing swift and appropriate measures in accordance with the risk level of the incident, ensuring that damage is kept to a minimum and preventing recurrence.

YKK AP systematically conducts training aimed at raising awareness of information security and instilling it as a habit among all employees worldwide.
In terms of education within Japan, we conduct e-learning on risks to the company posed by security information leaks and examples of incidents that could arise in everyday situations, as well as twice-yearly targeted email attack drills. Through detailed follow-up based on their learning results, we strive to ensure that all employees acquire accurate information security knowledge and response skills.
We also help improve the IT literacy of all our employees by encouraging them to obtain information security-related certifications.
In addition, to improve business continuity capabilities in emergencies, we conduct annual Business Continuity Plan (BCP) drills based on practical scenarios that simulate system shutdowns caused by cyberattacks, with joint participation from system users and operators.
Furthermore, through WPS (Workplace Security) -based inspections of the work environment in which all employees participate, we are striving to put information security into practice.
We are also working to strengthen information security globally by applying the educational content developed in Japan overseas and implementing unique educational programs tailored to the circumstances of each country.