Risk Management

Managerial and business risks of the Group include those related to information security, such as handling of personal information and improvement of systems, since it provides services in which it handles important information of companies including business cards and invoices. In addition, there are highly uncertain risks such as rapid technological innovations including generative AI and user behavior change. To these risks, we strive to establish a management system and countermeasures and work to reinforce the management structure to support the rapid growth of the business.
For risks that may have a significant impact on management, the Group stays aware of the probability of their occurrence and establishes a risk management structure and methods to respond to the risks. Furthermore, the Group either prevents them from manifesting themselves or respond to them if they become a reality, in light of changes in the environment surrounding its businesses.

Risks Management

Identification and analysis processes of risks

We make an internal audit plan in accordance with the internal audit regulations, and each department regularly reviews risks in the internal audit process and prepares risk assessment matrix that complies assessment of risks extracted annually and its countermeasure plan. The Internal Auditing Department aggregates data of the risk assessment matrix prepared by each department and reports to the Board of Directors, thereby establishing a system that enables the Company to respond to company-wide risks promptly and comprehensively.

Incident guidelines

In case of any occurrence of incidents related to provision of services such as disasters, accidents, unauthorized access and vulnerability matters, each department has established guidelines on structure, chain of command, judgment criteria and response procedures for incidents. Specifically, incidents are classified from three perspectives of confidentiality, integrity and availability, and a degree of priority is given to responses to each risk. Then a decision-maker for judgment on and responses to incidents at each department is appointed.

Major Risks*1 and Responses

Category Item Description of risks Frequency of occurrence Profit impact
(annual)		 Responses
Information security risk (1) Handling of personal information
  • Unauthorized access from the outside with a malicious intention, and internal leak, loss, alteration or abuse of customer information by intention or negligence
 2 Small
  • Establishment and operation of a personal information protection management system
  • Obtaining Privacy Mark certification
  • Obtaining ISO/IEC 27001, ISO/IEC27017, and ISO/IEC 27701 certifications
  • Registration in the ISMAP-LIU Cloud Service List
  • Requiring all officers and employees to obtain the qualification of Personal Information Protection Specialist
  • Collection of information on new legal regulations in Japan and overseas, and implementation of necessary countermeasures
  • Thorough legal compliance, and safe management of outsourcing contractors
(2) AI
  • Unintended learning or external transmission of personal or confidential information as a result of using AI
  • Impact of misinformation or biased outputs generated by AI on the service quality
 3 Medium
  • Formulation of the Internal Guideline for AI Usage and dissemination of the Guideline across the Group
  • Implementation of AI risks-related training for all officers and employees
(3) Equipment and network stability
  • Obstacles posed to the Group’s equipment and use of network due to natural disasters such as fire and earthquake, external breakage, system failures due to human errors, or any other unanticipated events
 2 Small
  • Distribution of load to multiple servers and regular backups
  • Establishment of a real-time access log check function and a system to immediately give notice of any software failure
  • Recovery training assuming the time of failure occurrence
Service risk (4) Service failures, etc.
  • Occurrence of various bugs in applications, software and systems
  • Detection of any critical bug that poses an obstacle to business operation
  • Delay in response to incidents and insufficient follow-up with existing customers
  • Failures resulting from unexpected cyberattacks
 2 Small
  • Building and maintenance of the highly reliable development structure
  • Formulating and implementing of incident guidelines for services
  • Building of cyber resilience
External environment risk (5) Cloud business
  • Significant downturn in demand for cloud services themselves
  • Introduction of new regulations on Internet use
 2 Small
  • Creation of new value offered
  • Proactive adoption of new technologies such as AI
  • Protection of intellectual property rights through patent acquisition, etc.
  • Promotion of the acquisition of external technologies and know-how through M&A, and capital and business alliances
  • Collection of information on Internet-related legal regulations, etc. as well as extraction of issues and implementation of solutions
(6) Responding to technological innovations
  • Delay in responding to generative AI and other technological innovations, etc.
  • Incurrence of unexpected development expenses, etc.
 4 Medium
(7) Competition
  • Decline in competitiveness of existing services due to the advent of a competitive service or alternative solution using AI
  • Intensified competition due to appearance of any other company’s service with a revolutionary concept
 4 Medium
(8) Natural disasters
  • Delay or suspension of business due to large-scale natural disasters including earthquakes and typhoons
 1 Small
  • Establishment of BCP manual
Investment risk (9) Upfront investments in advertising, promotions, and product development
  • Large increase in expenditures due to changes in the policy and plans for advertising and promotions
  • Losses incurred due to service withdrawal
 2 Small
  • Monitoring of cost-effectiveness of advertising and promotions
  • Monitoring of product development
(10) Investments such as corporate acquisitions and purchase of investment securities
  • Delay in a business plan after an acquisition or investment
  • Impairment losses incurred on investment securities
 3 Medium
  • Implementation of sufficient due diligence for target companies
  • Thorough monitoring and follow-ups for target companies
(11) System infrastructure investments
  • Unexpected additional investment in hardware and software for stable operation of services
 2 Small
  • Thorough monitoring of access from the outside
  • Design of appropriate system infrastructure investment according to the business expansion
Personal risk (12) Establishment of management control system
  • Delay in establishment of the business structure and the internal management structure according to the business size
  • Delay in delivery due to inadequate monitoring of external contractors and an insufficient business structure
 2 Small
  • Thorough development of the internal management structure in line with increases in operations and employees
  • Establishment of an information management system with external contractors
(13) Training and securing human resources
  • Shortfall in excellent human resources
  • Delay in securing sales staff and loss of them
  • Decline in productivity and increase in employee turnover due to inadequate attention to harassment and diversity
 2 Small
  • Recruitment of excellent human resources
  • Improvement of productivity by promoting AI utilization
  • Strengthening of the structure by internally fostering personnel, etc.
  • Development of the working environment
(14) Dependence on specific individuals
  • Occurrence of any event that brings difficulties for Chikahiro Terada, Representative Director, to continue operations
 1 Small
  • Creation of a structure that does not excessively depend on him
  • Mutual information sharing among executives and strengthening of the management organization
Legal risk (15) Laws and regulations
  • Impact of enactment of new privacy-related regulations, laws regulating internet-related business operators, developments in AI-related laws and regulations, and relevant laws, etc. applicable in line with the expansion of the business environment in Japan and overseas
 2 Small
  • Collection of information on legal regulations, etc. as well as extraction of issues and implementation of solutions
(16) Intellectual property right infringement, etc.
  • A claim for damage or injunction request from a third party on the grounds of infringement of patent right or trademark right
  • A third party’s infringement of intellectual property rights held by the Group
 1 Small
  • Implementation of survey on intellectual property right infringement via patent firms
  • Patent applications and registrations
  • Implementation of legal actions
Overseas risk (17) Launching overseas
  • Occurrence of risks specific to overseas that are difficult to address
  • Delay in monetarization of the overseas business
 2 Small
  • Collection of information on regions where the Group has developed its businesses as well as extraction of issues and implementation of solutions
  • Formulation of appropriate business plans
Financial risk (18) Credit
  • Restrictions on financing due to a decline in credit
  • Increasing difficulty in securing settlement funds due to the rapid expansion of credit card services
 2 Small
  • Maintenance of creditworthiness through ongoing dialogue and disclosure of information to capital markets
  • Diversification of funding sources
  • Development of a robust financial base to prepare for the risk of uncollectible receivables
Other (19) Granting incentives
  • Dilution of value of shares held by existing shareholders through exercise of stock options issued*2
 1 Small
  • Design of stock options with adequate consideration of the market environment, impact on existing shareholders, etc.
  1. *1 For each risk’s frequency of occurrence and profit impact, the Internal Auditing Department conducts a company-wide assessment based on risk analysis information collected and aggregated from each department. The frequency of occurrence is assessed on a five-point scale (1: extremely low, 5: extremely high), while the profit impact is assessed by estimating the potential monetary effect on the Company should the risk materialize, and is categorized as small for less than 1 billion yen per year, medium for 1 billion yen or more but less than 3 billion yen per year, and large for 3 billion yen or more per year.
  2. *2 As of July 31, 2026, the number of potentially dilutive shares arising from stock options (including those resolved for issuance by that date) was 3,430,732 shares, equivalent to 2.7% of the total number of issued shares.