Business Risks

Olympus Corporation applies the regulations in Note (31) listed in Form 2 of the “Cabinet Office Order on Disclosure of Corporate Affairs” following amendment in accordance with the “Cabinet Office Order Partially Amending the Cabinet Office Order on Disclosure of Corporate Affairs” (Cabinet Office Order No. 3 of January 31, 2019).

The business performance of Olympus Group may be materially affected by various risks (uncertainties) that could occur in the future. Olympus Group has established a comprehensive global Enterprise Risk Management framework to facilitate the attainment of its strategic business objectives, which encompass, among other aspects, Olympus’ corporate philosophy and Guiding Principles. The Enterprise Risk Management structure implemented by Olympus Group is based on and operates in accordance with the Company’s formalized “Policy of Risk Management & Crisis Response.” Olympus Group is undertaking Enterprise Risk Management from the perspective of both opportunities and threats. Opportunities are seized through active and appropriate risk taking, leading to sustainable growth and value creation for Olympus Group. Threats are identified, prioritized, and addressed to ensure the achievement of business objectives and to prevent non-compliance.

The global organizational design integrates the five functions, Risk & Controls, Compliance, Third-Party Risk Management, Information Security and Privacy, to deliver a holistic view on risks Olympus-wide under the “Aligned Assurance” concept. These functions form the Global Risk Assurance and Compliance (RAC) function under Global Legal, Risk and Compliance function (LRC) reporting into the Global General Counsel (GGC) as executive officer. The Global Chief Compliance Officer (GCCO) maintains regular reporting to the CEO, the Audit Committee, and the Board of Directors (BoD) while he or she continues to attend applicable Group Executive Committee (GEC) meetings.

The elements of the enhanced Enterprise Risk Management System are:

A global Risk & Controls organization embedded in the LRC function,
An enhanced global Enterprise Risk Management methodology and approach, and
A globally harmonized Enterprise Risk Management process

Those three elements aim to ensure a streamlined Enterprise Risk Management program that feeds into business and financial planning and safeguards the achievement of Olympus’ business objectives and its company strategy by supporting informed decision making. Further building on the global Enterprise Risk Management Portfolio, Olympus conducted Risk Assessments with all relevant functions during the fiscal year, to validate and update Olympus’ regional and global Risk Portfolio.

Enterprise Risk Management Organizational Setup

Olympus Group has established a committee structure on both a global and regional level, the Global and Regional Risk Assurance and Compliance Committees (G-RACC and R-RACC, collectively the “RACCs”). The objectives of the RACCs are to establish, implement and manage a framework for addressing enterprise risk and complying with applicable policies, laws, and regulations. Recommendations, guidance, and significant risks are regularly reported to the Olympus GEC, the Board of Directors, and the Audit Committee for ongoing monitoring.

Olympus Group also identified and collaboratively nominated Risk Owners, i.e., Global Division and Function Heads, Regional Division and Function Heads, and respective Risk Coordinators responsible for managing risks. Each Risk Owner is accountable to execute the necessary measures (organizational structure, process preparation, treatment measures, etc.) in their designated area of risk.

Figure: Enterprise Risk Management Organizational Chart

Enterprise Risk Management Methodology and Approach

Olympus Group has established a global Enterprise Risk Management Methodology and Approach which includes five Risk Categories (1. Strategic (incl. External), 2. Operations & Product, 3. Financial, 4. Governance, and 5. IT & Digital) and corresponding Risk Sub-Categories.

Table: Enterprise Risk Management Risk Categories

Olympus Group bases the risk assessments on three Risk Evaluation Criteria (1. Exposure, 2. Vulnerability, 3. Velocity) to evaluate and demonstrate how risks might reasonably affect the achievement of Olympus’ business objectives and company strategy:

Exposure which is determined by likelihood and impact. The likelihood indicates the probability of a risk materializing, while the impact assesses the severity of the consequences if a risk does materialize. Likelihood and impact levels are defined as quantitative (financial) or qualitative criteria.
Vulnerability which refers to how well the organization is prepared to manage a risk if it occurs.
Velocity which indicates how fast Olympus Corporation would be affected by a risk after it occurs.

Figure: Enterprise Risk Management Risk Evaluation Method

Based on the three dimensions, Olympus Group actively identifies, mitigates, and monitors risks. Mitigation measures are regularly reviewed and tested for effectiveness. Olympus Group utilizes a “3D Risk Matrix” to effectively visualize and manage risks. This matrix combines Risk Exposure levels with assessed Vulnerability and incorporates Risk Velocity. The 3D Risk Matrix is divided into four quadrants, each providing specific guidance on appropriate risk response strategies. Olympus Group has implemented an enhanced IT system featuring integrated databases and visual dashboards (ERM IT system) to enable more effective and data driven risk-based decision making. During the fiscal year ended March 31, 2026, the ERM IT system has been upgraded with in-house design and tested artificial intelligence tools to optimize the risk portfolio completeness, while simultaneously structuring, categorizing, and standardizing risk descriptions to enhance clarity and comprehension.

Enterprise Risk Management Process

The main components of the Enterprise Risk Management Process are:

Risk Assessment to identify, analyze, and evaluate risks.
Risk Treatment to mitigate risk, coordinate and execute Risk Management Activities.
Risk Monitoring to design and implement monitoring procedures on risks and evaluate effectiveness of Risk Treatment activities.
Risk Reporting to aggregate and evaluate risk and mitigating measures and report to relevant stakeholders regularly. Risk Reporting is developed and deployed internally as part of the annual plan.

The Enterprise Risk Management Process is based on the strong collaboration between the Risk & Controls Function and the Divisions/Business Functions following the principle of the Three Lines Model. Risk & Controls is responsible for providing, maintaining, and developing Enterprise Risk Management Methodology and operational guidance. Risk management is further enhanced through close partnership with the Legal Function, which fulfills an important role across a range of risk domains.

Figure: Enterprise Risk Management Process

Macroeconomic Business Environment

From April 2025 onward, the global economy has remained resilient but continues to face significant uncertainty. GDP growth momentum varies across regions, with advanced economies experiencing relatively subdued expansion compared to emerging markets.

Inflationary pressures remain volatile due to renewed geopolitical tensions and energy price fluctuations. In particular, recent conflicts in the Middle East have contributed to rising energy costs and increased inflation expectations, posing challenges for monetary policy and economic stability.

Geopolitical tensions continue to represent a major risk to the global macroeconomic environment. Ongoing geopolitical conflicts, as well as persistent trade frictions between major economies are contributing to supply chain disruptions, trade fragmentation, and policy uncertainty. In addition, the increasing use of tariffs and industrial policies is reshaping global trade patterns and investment decisions.

Technological advancements, particularly in artificial intelligence, digitalization, and automation, are driving productivity gains and supporting economic growth. At the same time, these developments introduce new risks, including cybersecurity threats, data privacy concerns, and potential market imbalances associated with rapid technology investment cycles.

Climate change and sustainability remain key global priorities. Governments and companies are accelerating efforts to reduce carbon emissions and transition to low-carbon economies. However, this transition requires substantial capital investment and may lead to structural shifts and disruptions in certain industries.

Industry-specific Business Environment

In addition to the macroeconomic conditions described above, the MedTech sector continues to be influenced by industry-specific regulatory, technological, and demographic factors.

Healthcare systems worldwide are undergoing continuous reform aimed at improving efficiency, controlling costs, and enhancing patient outcomes. At the same time, regulatory requirements for medical devices continue to evolve, increasing the complexity and cost of product development and market access.

The demand for advanced healthcare solutions is rising, driven primarily by aging populations in developed countries and expanding healthcare access in emerging markets. This trend is creating growth opportunities but also increasing pressure on healthcare systems to balance cost efficiency with quality of care.

Technological innovation in areas such as minimally invasive procedures, digital health, robotics, and AI-enabled diagnostics is accelerating however with increased competition. These developments are fundamentally reshaping the competitive landscape and increasing the pace of innovation.

Infection prevention, reprocessing requirements, and patient safety standards continue to become more complex, requiring ongoing investment in compliance and product innovation. In addition, supply chain resilience and localization strategies have become more important in response to recent global disruptions.

Furthermore, competition for skilled talent remains strong across the MedTech industry. Demographic changes and evolving workforce expectations are contributing to higher turnover rates and increasing the importance of attracting, developing, and retaining highly qualified personnel.

These risk assessments are conducted based on publicly available information published by international organizations, governmental institutions, and industry associations, as well as the Group’s business operations and past experience.

Olympus Group’s Risk State for the Fiscal Year Ended March 31, 2026

Based on Olympus Group’s global Risk Assessment performed in the fiscal year ended March 31, 2026, risks impacting Olympus Group have been identified, evaluated, and prioritized.

Risks designated as “Improve” in the 3D-Risk Matrix have been prioritized for Risk Treatment. For the risks in the “Test” quadrant controls are in place. Routine audits should ensure that the existing controls are designed well and operate effectively. Risks located in the “Monitor” quadrant are subject to periodic re-evaluation to ensure that their Risk Exposure is still at an acceptable level or to initiate additional Risk Treatment where necessary.

Olympus Group reports the following top risks per Risk Category:

Risk Category	“Strategy (incl. External)”
Type	Opportunity and Threat
Trend	Unchanged →
Risk Scenarios	The “Strategy” Risk Category includes Force Majeure, Planning & Resource Allocation, Growth Strategy, Business Development & Investment, Communication & Stakeholder Management, Market Dynamics, and Major Projects & Programs. The highest rated risks relate to operational dependencies, competitive dynamics, and the ability to anticipate and respond to market developments. Geopolitical tensions have been categorized as having Top Risk status, threatening supply chains through military conflicts and trade wars that increase costs and create compliance risks from rapidly changing sanctions regimes. In major markets, the market environment is changing significantly due to the implementation of protective measures for domestic industries and other factors. Earnings may be adversely affected due to factors such as fluctuations in tariffs and preferential treatment for domestic suppliers. Intensifying competition across key markets may impact the Group’s ability to sustain its market position and profitability, particularly in areas characterized by rapid technological advancement and pricing pressure. Insufficient depth or timeliness of market intelligence, as well as misjudgment of market trends, customer needs, or competitor actions, may impair strategic decision-making and the ability to maintain competitive positioning. M&A activities present both opportunities and threats, requiring rigorous due diligence and structured integration processes. Insufficient risk mitigation may adversely affect business execution, performance, and financial position through goodwill impairment or related expenses.
Risk Treatment	To address risks arising from intensifying competition, the Olympus Group advances initiatives to enhance innovation effectiveness and accelerate product development cycles. In China, we are making progress with preparations for local manufacturing, and in the United States, while monitoring the situation regarding tariffs, we are working closely with industry associations, with the safety and health of patients as our top priority. To mitigate risks related to insufficient or untimely market intelligence, the Olympus Group strengthens its market and competitive intelligence capabilities by aligning activities with the strategic importance of business units. This includes the development of standardized and partially automated analyses, with a focus on the timely delivery of actionable insights. To address risks arising related to market position and customer needs, the Olympus Group undertakes innovation through both in-house development and external technology acquisition via M&A and strategic alliances; as well as targeting high-value-added products such as those that may be used in an Intelligent Endoscopy Ecosystem. To minimize risks associated with M&A activities, the Olympus Group engages in the continuous refinement of M&A processes and systems to improve target selection, due diligence, and post-acquisition integration effectiveness.
Connection with company strategy and policies:	Innovation driven growth, Simplicity, and Accountability

Risk Category	“Operations & Product”
Type	Opportunity and Threat
Trend	Increasing ↑
Risk Scenarios	The “Operations & Product” Risk Category includes Manufacturing & Repair, End-to-End Supply Chain, Research & Development, Sales, Marketing & Service, Quality, Physical Assets, as well as People & HR. Risks relate to operational continuity, supplier dependencies, and the transformation of products and operating models. Continuation of remediation activities associated with the FDA warning letters may require significant resource allocation, process enhancements and system improvements across Manufacturing, Quality, Supply Chain Management, and R&D functions. Disruptions to critical operational infrastructure or logistics networks, particularly where dependencies are concentrated, may adversely affect product availability, business continuity, and the ability to serve customers and patients. Heightened geopolitical tensions, including those in the Middle East, the expansion of sanctions, and instability in logistics networks and energy supply may disrupt the procurement of raw materials and components. In particular, shortages or supply constraints of critical raw materials, including semiconductors, could result in production delays or adjustments and may impact product supply. Potential disruptions to manufacturing operations, including downtime of production sites, may result in delays in production and impact the Group’s ability to meet customer demand. Insufficient transparency regarding dependencies on single or sole source suppliers, as well as supplier disruptions, may adversely affect the stability and resilience of the supply chain. Security breaches or disruptions at third-party service providers may impact critical operations, data integrity, and service continuity. In the event of a crisis, suppliers may not recover within required timeframes, potentially resulting in material shortages and disruptions to production. The increasing adoption of digital technologies and artificial intelligence in products and services may require adjustments to the operating model, organizational capabilities, and governance structures. Failure to effectively manage this transformation may impact competitiveness and operational effectiveness.
Risk Treatment	To mitigate risks related to manufacturing disruptions, the Group enhances operational resilience through a range of measures, including the implementation of business continuity plans, the establishment of safety stocks for critical materials and finished goods, and the safeguarding of key production capabilities and equipment. To address risks related to supplier dependencies, the Group strengthens supply chain resilience by increasing transparency on supplier structures and reducing reliance on single or sole sources. This includes targeted initiatives to diversify sourcing and the establishment of appropriate safety-stock levels for critical materials. To mitigate risks related to disruptions of critical operational infrastructure and logistics networks, the Group identifies key dependencies and critical locations and implements a structured Business Continuity Management (BCM) framework. This includes the development and continuous enhancement of Business Continuity Plans, as well as the strengthening of crisis management capabilities and organizational readiness. To mitigate risks associated with third-party security, the Group implements a structured third-party risk management approach, including dedicated governance within the risk and compliance framework to assess, monitor, and manage external security risks. To address risks related to supplier recovery in crisis situations, the Group enhances supply chain visibility and conducts regular assessments of supplier resilience and business continuity capabilities. In addition, safety stock strategies for critical raw materials are implemented to reduce potential supply disruptions. To mitigate risks related to digitalization and the adoption of artificial intelligence, the Group advances its digital transformation by strengthening governance structures, enhancing technology development processes, and investing in digital capabilities and talent. This includes the establishment of appropriate oversight mechanisms and the standardization of development and governance frameworks.
Connection with company strategy and policies:	Innovation driven growth, Simplicity, and Accountability

Risk Category	“Financial”
Type	Opportunity and Threat
Trend	Unchanged →
Risk Scenarios	The “Financial” Risk Category includes Accounting & Reporting, Capital Structure, Liquidity & Credit, Revenue Cycle and Tax. The overall risk exposure in this category remains limited compared to other risk categories, reflecting the Group’s stable financial position and effective risk management practices. Foreign currency exchange rate fluctuations may present significant exposure. The Group hedges against foreign currency-denominated transactions, but business performance can potentially be adversely affected by a strong yen and positively affected by a weak yen. Financing risks could emerge from financial market volatility affecting access to capital and borrowing, and from company performance influencing borrowing costs. Deteriorating company performance and changes in the financial market environment potentially narrow financing options. Tax burden may increase through changes in applicable tax laws or interpretations across global jurisdictions. Deferred tax asset valuations may require reassessment due to changing business conditions or organizational restructuring. Credit risks from customers and suppliers may further impact financial stability.
Risk Treatment	The Group maintains a robust financial risk management framework, including structured planning and monitoring processes, centralized treasury activities, and appropriate controls to manage liquidity, foreign exchange, and other financial risks. These measures support financial stability and enable timely responses to potential changes in the financial environment. To mitigate risks related to foreign currency fluctuations, the Group utilizes derivative instruments including forward exchange contracts and currency swaps to manage exchange fluctuations, complemented by global cash pooling to reduce foreign currency exposure. To reduce financial market volatility risks, the Group diversifies funding methods such as public bonds to optimize financing costs, coupled with fixed interest rate policies for long-term debt to minimize interest rate volatility. To address tax risks, the Group proactively monitors and responds to tax legislation changes across jurisdictions, with appropriate adjustments to intra-group transaction rules and close profitability management to optimize deferred tax asset positions.
Connection with company strategy and policies:	Simplicity and Accountability

Risk Category	“Governance”
Type	Opportunity and Threat
Trend	Increasing ↑
Risk Scenarios	The “Governance” Risk Category includes Compliance, Regulatory, Legal, Culture, Data Privacy, Corporate Governance, Resilience Governance (Governance Framework for Business Continuity, Emergency and Crisis Response) and Third-Party Risk Management. Risks related to regulatory compliance, interactions with regulatory authorities, and the effectiveness of governance and control frameworks are proactively managed: Potential non-compliance with applicable laws and regulations may result in delays in product commercialization, restrictions on market access, litigation or other regulatory actions. Incomplete or delayed resolution of the FDA warning letters and/or a failure to address FDA observations to the satisfaction of the FDA could result in regulatory actions and potentially impact product supply. Inadequate management of third-party risks may expose the Group to operational disruptions, compliance risks, and potential legal or reputational impacts.
Risk Treatment	To mitigate risks related to regulatory non-compliance, the Group enhances its compliance framework by strengthening global processes, policies, monitoring activities, training programs and controls. To address regulatory and quality risks from the FDA warning letters, the Group implemented a structured remediation program to address the FDA warning letters. On June 24, 2025 (U.S. time), the FDA published import alerts for certain medical devices manufactured at the company’s Aizu facility in Fukushima, Japan. This action prevents the import of the specified devices into the U.S. until further notice. The devices affected include certain bronchoscopes, laparoscopes, ureterorenoscopes, and automated endoscope reprocessors. We are addressing the FDA’s concerns promptly and ensuring that our products meet the highest quality standards. In late 2025, the FDA conducted inspections at eight Olympus facilities in the U.S., Europe, and Japan, thereby providing an opportunity to review our ongoing operational and quality improvements. Certain inspections resulted in FDA observations. Many relate to activities that predate our recent changes, while others reflect areas where we need to further advance the maturity, consistency, and integration of our quality systems and processes. We are addressing these findings through a coordinated, enterprise-wide approach. Actions underway include a risk-based review of our product portfolio that prioritizes patient safety, continued global harmonization of quality systems, and targeted strengthening of our quality and regulatory teams. The inspection results remain an open matter with the FDA — we are in direct communication with the Agency regarding the proactive nature of the actions we are taking. To address risks associated with third-party management, the Group enhances its third-party risk management framework through continuous improvement of governance structures, operating models, and compliance processes. This includes strengthening risk assessment methodologies, increasing transparency, and ensuring consistent application of compliance standards across third parties.
Connection with company strategy and policies:	Innovation driven growth, Simplicity, and Accountability

Risk Category	“IT & Digital”
Type	Opportunity and Threat
Trend	Increasing ↑
Risk Scenarios	The “IT & Digital” Risk Category includes IT Security & Cyber, IT Applications, IT Governance, IT Infrastructure & Services, and Digital Enablement. Potential risks relate to cybersecurity threats, the resilience of IT systems, and the governance of digital environments. The increasing frequency and sophistication of cybersecurity threats may result in unauthorized access to systems, data breaches, or disruptions to critical operations. The aging or obsolescence of IT infrastructure and applications, including end-of-life or end-of-support systems, may increase the risk of operational disruptions, system failures, and security vulnerabilities. Insufficient governance and management of decentralized or non-standard IT solutions may increase exposure to security vulnerabilities, data inconsistencies, and compliance risks. Disruptions or failures of critical enterprise systems may adversely affect core business processes, including manufacturing and supply chain operations.
Risk Treatment	To mitigate cybersecurity risks, the Group implements a comprehensive information security program, including continuous monitoring, threat detection, and the strengthening of preventive and responsive security measures across the IT landscape. To address risks related to aging IT infrastructure and applications, the Group advances structured lifecycle management, including the prioritization of system upgrades, replacements, and migrations to ensure operational stability and security. To mitigate risks associated with decentralized IT environments, the Group strengthens governance by integrating non-standard IT activities into centralized structures and enhancing oversight, standardization, and security controls across the organization. To address risks related to critical system disruptions, the Group enhances IT resilience through the development of recovery and continuity plans, as well as the implementation of measures to safeguard system availability and support business continuity.
Connection with company strategy and policies:	Innovation driven growth, Simplicity, and Accountability

May 22, 2026 Updated

Tokyo Stock Exchange

Stock Quote