_58 2023 UNIVERSAL REGISTRATION DOCUMENT_MICHELIN 2 RISK MANAGEMENT Risk factors specific to Michelin, description and related management systems Risk 4 – Manufacturing business interruption Risk factors This risk is limited to tire production, which involves two main stages. First, semi‑finished products are manufactured for use as components, which are then processed and assembled to produce the finished products corresponding to the different types of tires sold by the Group. Consequently, the risk of business interruption at a semi-finished product facility could be significant, given that its output may be used by several different finished product plants. In either type of production facility, operations could be interrupted by a variety of factors, both external (natural disasters, the impact of climate change or new legislation, geopolitical events) and internal (fires, IT outages, technical failures). Specific nature of the risk Business interruption risk is especially acute in the semi-finished product facilities due to Michelin’s historical manufacturing model, under which semi-finished production is concentrated in certain plants that sometimes supply several different finished product facilities. Governance and risk management response The governance structure in place to address this risk factor is the Materials Steering Committee, described in Risk 2 above. To anticipate this risk, Michelin has set up a specific plan focused on the following four action areas: ● strategically selecting plant locations to limit the probability of the risk occurring; ● prevention, with fire safety programs and technical inspections performed by trained personnel; ● protection, by applying preventive and corrective maintenance policies, multi-sourcing the production of finished and semi‑finished products, and striking the right balance between component insourcing and outsourcing; ● preparing teams to manage crisis situations requiring the deployment of disaster recovery and business continuity plans. Risk 5 – Cyber attack Risk factors Michelin's business relies on state-of-the-art information technology, systems and infrastructure (datacenters, servers and networks). Like any organization using information technology, the Group is exposed to the risk of cyber attacks. These now represent a constant danger and the attacks are becoming increasingly sophisticated. Recent years have seen a sharp upsurge in the number of attacks, especially ransomware and advanced persistent threat (APT) attacks. Changing work practices, including the growing trend towards working from home, are also heightening risk exposure. The potential consequences of a cyber attack include business interruption, threats to personal safety, theft of confidential information, breaches of privacy and ransom demands. Specific nature of the risk Over the past ten years, the Group has extensively overhauled its information technology and systems, building on both legacy assets and those of the successive companies acquired. Its broad geographic footprint and highly diverse business base, product ranges and procedures all make for a complex environment, with the result that its information system has several thousand applications, a thousand or so main servers and around 100 datacenters. The Group’s exposure to digital risks is increasing, due in particular to recent acquisitions, the emerging use of connected technologies and objects by production operators, the swift migration to cloud-based solutions and bring-your-own-device practices in certain countries. Governance and risk management response The cyber attack risk factor is managed by the Data, Digital, IT Governance body, which is chaired by the Group’s General Manager, and co-chaired by the Executive Vice President of Distribution, Services & Solutions, who is a member of the Group Executive Committee. The body is led by the Group Chief Cybersecurity Officer. To deal with the above-described information technology and systems risks, multi-year action plans have been prepared with a focus on the following measures: (i) closely tracking contractual terms and conditions to be able to respond in the event of service provider default, (ii) reinforcing the physical and logical security of IT systems, (iii) systematically reviewing IT continuity needs and putting in place IT recovery plans, and (iv) replacing obsolete components and continuously upgrading information security systems. Penetration tests are very frequently conducted to confirm the security of the Group's IT solutions and data protection systems. In addition, the Group’s Computer Emergency Response Team (CERT) stands ready to intervene at all times across all continents. Lastly, training programs and awareness campaigns are regularly conducted for all Group employees and, in a more targeted manner, for the categories of employees the most exposed to this risk. The Group has also undertaken the process to earn Trusted Information Security Assessment Exchange (TISAX) certification, the gold standard for cybersecurity in the automotive industry, for some of its plants and product development units. By the end of 2023, 17 Michelin facilities had already been certified. TISAX certification is the final step in the process to ensure the highest level of data protection throughout the Group’s value chain.
RkJQdWJsaXNoZXIy NzMxNTcx