Operational risks and opportunities
For this risk category, the likelihood of occurrence is classified as high (previous year: high) and the potential extent of damage is classified as medium (previous year: medium).
The most significant risks from the regular GRC process and QRP lie particularly in cyber security and new regulatory requirements for IT, in quality problems, and in volatile procurement markets.
Risks from particular events in the Volkswagen Group’s procurement and production network
Particular events beyond our control such as natural disasters, pandemics – currently the spread of the SARS-CoV-2 virus – or other events such as fires, explosions, or the leakage of substances hazardous to health and/or the environment, may result in supply risks in procurement and significantly impair production. As a consequence, bottlenecks or even outages in production may occur, thus preventing the planned volume of production from being achieved.
Supply risks are identified in Procurement through early warning systems and mitigated by applying corresponding measures to safeguard supply and avert future assembly line stoppages caused by suspensions of deliveries. Further methods of counteracting such risks include hygiene concepts, fire protection measures and hazardous goods management, and, where financially viable, ensuring that they are covered by insurance policies.
Due to the uncertainty arising from the further development of the Covid-19 pandemic, there is a risk that looming supply breakdowns may not be recognized early enough and that countermeasures may not be initiated in time to maintain production. Countermeasures to stabilize global production include, for example, observing the spread of infection and the measures taken to contain the pandemic, analyzing the impact on suppliers and supply and transport chains, finding alternatives where suppliers are unavailable and organizing special processes. Vehicle programs and production processes can be adjusted dynamically. As part of the Safe Production Initiative, we have defined hygiene measures to prevent possible chains of infection at essential points of contact between the people working in the network. These measures will be adjusted if necessary and include physical distancing, wearing of protective masks, cleaning and disinfecting, and reorganizing shift models and staggering break times.
Risks and opportunities from Procurement and Components
Concentrating on only a few financially strong suppliers gives rise to the risk of insufficient competition. Current trends in the automotive industry such as e-mobility and automated driving are resulting in an increased need for financing among suppliers, presenting them with considerable challenges. The Volkswagen Group’s procurement risk management system assesses suppliers before they are commissioned to carry out projects and takes risk management into account when awarding contracts.
There is a risk of bottlenecks or disruption in supply, as is currently being seen in the case of semiconductor components. Here, the rapid recovery in demand starting in the fourth quarter of 2020, following the pandemic-induced drop in production and sales volumes in the first half of 2020, and the insufficient market capacity of the semiconductor industry combined with high demand from the consumer, IT and telecommunications industries have led to bottlenecks in supply. We intend to safeguard supplies for our production plants by implementing short-term measures and intensifying relationship management and monitoring across the entire supply chain.
A global economic slowdown exacerbated by trade disputes and especially the consequences of the Covid-19 pandemic is impacting the financial situation of many suppliers. This is also giving rise to risks of bottlenecks or disruption in supply.
Government support measures have stabilized the position of suppliers experiencing financial difficulties as a result of the pandemic. In Germany, for example, new rules on short-time working (Kurzarbeit) and loan support schemes, but also the suspension of the obligation to file for insolvency, have prevented companies from becoming insolvent. Despite the government support measures, the number of suppliers around the world experiencing crises and insolvencies rose significantly in 2020. Specialists in Procurement for restructuring and supply reliability monitor the financial situation of our suppliers continuously and globally, taking targeted measures to counter the risk of possible supply disruptions.
Risks in battery cell production arise particularly from the rising demand for battery cells and the resulting reliance on suppliers, from technological change and from the service life of battery cells. To counter these risks, the Group maintains multiple strategic supplier relationships in order to ensure its supply of batteries in every region.
Demand for resources, possible speculations on the market and current trends in the automotive industry, such as the growing share of electrified vehicles, may affect the availability and prices of certain raw materials. Trends in raw materials and demand are continuously analyzed and assessed on an interdisciplinary basis to enable steps to be taken at an early stage in the event of potential bottlenecks.
Quality problems may necessitate technical intervention involving a substantial financial outlay where costs cannot be passed on to the supplier or can only be passed on to a limited extent. Assuring quality is of fundamental importance especially in the US, Brazilian, Russian, Indian and Chinese markets, for which we develop vehicles specific to the countries and where local manufacturers and suppliers have been established, particularly as it may be very difficult to predict the impact of regulations or official measures. We continuously analyze the conditions specific to each market and adapt quality requirements to their individual needs. We counter the local risks we identify by continuously developing measures and implementing them locally, thereby preventing quality defects in the supply chain from arising.
It is not possible at present to rule out the possibility of a further increase in recalls of various models produced by a variety of manufacturers in which certain airbags manufactured by Takata were installed. This could also affect Volkswagen Group models.
Specialists in Procurement systematically investigate risks resulting from antitrust violations by suppliers and file claims for any losses that may arise.
Production risks
Volatile developments in the global automotive markets, accidents at suppliers and disruptions in the supply chain may cause fluctuations in production volumes affecting both vehicle models and plants. In specific markets we are seeing a trend away from orders for conventional vehicles with combustion engines and towards increased orders for electric vehicles. We use established tools, such as flexible working time models, to address possible risks in terms of fluctuations in the mix of vehicle types. The international production network enables us to respond flexibly at the sites. “Turntable concepts” adjust capacity utilization between production facilities. At multibrand sites, volatility can also be balanced across brands.
Quick changes in customer demand for specific equipment features in our products, and the decreasing predictability of demand, may lead to supply bottlenecks. We minimize this risk, for example, by continuously comparing our available resources against future demand scenarios. If bottlenecks in the supply of materials are indicated, we can introduce countermeasures far enough in advance.
Production capacity is planned several years in advance based on long-term sales planning for all vehicle projects. This involves a degree of risk as it is subject to market momentum and changes in demand. If forecasts are too optimistic, there is a risk that capacity will not be fully utilized. However, forecasts that are too pessimistic pose a risk of undercapacity, as a result of which, it may not be possible to meet customer demand. In the event of short-notice fluctuations in demand beyond the technical capacity that has been installed, Volkswagen or its suppliers may be unable to meet demand that goes beyond the available technical flexibility. We counter such risks by matching demand and capacity at rapid intervals and issuing program scheduling guidelines where necessary.
The diversity of our models is growing, particularly with the current electrification campaign. The growing model diversity and reduction in product life cycles are leading to an increasing number of new vehicle start-ups at our sites worldwide. These involve the use of complex processes and technical systems, meaning there is a risk that a vehicle start-up may be delayed. We address this risk by drawing on experience of past start-ups and identifying weaknesses at an early stage so as to ensure – to the highest degree possible – that production volumes and quality standards are met during our new vehicle start-ups throughout the Group.
In order to generally prevent risks such as disruption to plant operation, downtime, lost output, rejects and reworking, we use the TPM (Total Productive Maintenance) method at our production facilities. TPM is a continuous process that involves the entire workforce. Round-the-clock maintenance of the technical facilities means that they are always operational and guaranteed to function reliably.
Legal changes, for instance in the context of the changeover to the WLTP test procedure, may impact production. For one thing, a temporary reduction in the range causes demand to focus on the available variants. Moreover, gaps in production can occur if model variants have not been approved. These fluctuations necessitate measures to stabilize production, such as the temporary storage of vehicles until official approval.
Risks arising from long-term production
In the case of large projects within the Power Engineering Business Area, risks may arise that are often only identified over the course of the project. They may result in particular from contract drafting errors, inaccurate or incomplete information used in costing, post-contract changes in economic and technical conditions, weaknesses in project management, quality defects and unnoticed product malfunctions in product creation, or poor performance by subcontractors. Most notably, omissions at the start of a project, overshooting of the development budget or timeframe, and legislative changes are usually difficult to correct or compensate for and often entail substantial additional expenses.
We endeavor to identify these risks at an early stage and to take appropriate measures to eliminate or minimize them by constantly optimizing the project control process across all project phases and by using a lessons-learned process and regular project reviews. We can thus reduce risk, particularly during the bidding and planning phase, for large upcoming projects.
Quality risks
Right from the product development stage, we aim to identify and rectify quality problems at the earliest point, so as to avoid delays to the start of production. As we are using an increasing number of modular components as part of our modular toolkit strategy, it is particularly important when malfunctions do occur to identify the cause quickly and eliminate the faults. Nonconformity of internally or externally sourced parts or components may necessitate time-consuming and cost-intensive measures and lead to recalls and therefore to damage to the Volkswagen Group’s image. In addition, the resulting financial impacts may exceed provisions. To meet our customers’ expectations and minimize warranty and ex gratia repair costs, we continuously optimize the processes at our brands with which we can prevent these defects. If quality management is ineffective, there is a risk of losing ISO 9001 and KBA certification. This would lead directly to a loss of type approval from one or more authorities. We counter this risk by continuously training the Group’s system auditors and subjecting our quality management system and process quality to internal audits.
We also check the conformity of series products (conformity of production – CoP) in vehicle production plants as part of system audits with a CoP component. Further risks are associated with discrepancies identified in conformity of production (CoP) measurements and in-service-conformity (ISC) measurements. We have established an effective system for monitoring the conformity of CoP and ISC measurements for manufactured vehicles. To ensure that the results of the CoP and ISC measurements are analyzed systematically, we have defined an IT system throughout the Group as the basis for reporting and implemented it across the organization. This is used for status reporting and documenting the results of the series of measurements.
Vehicle registration and operation criteria are defined and monitored by national and, in some cases, international authorities. Furthermore, several countries have special – and in some cases new – rules aimed at protecting customers in their dealings with vehicle manufacturers. We have established quality processes so that the Volkswagen Group brands and their products fulfill all respective applicable requirements and local authorities receive timely notification of all issues requiring reporting. By doing so, we reduce the risk of customer complaints or other negative consequences.
With increasing technical complexity and the use of the toolkit system in the Group, the demand for high-grade, impeccable-quality supplier components and software is growing. This is lending increasing importance to cyber security. To better monitor and manage the risk of cyber attacks on our vehicles in the future, we are establishing an Automotive Cyber Security Management System in all Group brands and integrating it into the existing quality management system. This will allow us to fulfill the legal requirements of the UNECE regulation that apply from 2021.
The Ausschuss für Produktsicherheit (APS – Product Safety Committee) has been established to mitigate product safety risks. In the event of safety defects, doubts about compliance with legal requirements, or issues relating to the brand or corporate image, the APS examines the matter concerned and decides on how to respond. In this context, the APS is also responsible for managing related inquiries from authorities. The cross-divisional Car Security Board (CSB) provides support in relation to cyber security issues. We also created central units responsible for recording and managing incoming information on APS- and CSB-related topics. These now have an established position within the organization. All incoming reports on APS-related issues are also transferred from the APS mailbox to a central database. Risks may arise in this context from a lack of timely, complete and correct preliminary analysis, reporting and follow-up or from a lack of timely, complete and correct decisions and measures by the APS or CSB.
IT risks
At Volkswagen, a global company geared towards further growth, the information technology (IT) used in all divisions Group-wide is assuming an increasingly important role. IT risks exist in relation to the three protection goals of confidentiality, integrity and availability, and comprise in particular unauthorized access to, modification of and extraction of sensitive electronic corporate or customer data as well as limited systems availability as a consequence of downtime and disasters. Handling data with integrity is a key factor for the correctness and soundness of data , and for the functionality of error-free systems.
There is a risk of cyber attacks, particularly on our digital technology used for our mobility services. The high standards we set for the quality of our products also apply to the way in which we handle our customers’ and employees’ data. Legal regulations including the UNECE (United Nations Economic Commission for Europe) cyber security regulation (R155) are creating requirements for our vehicle and software development. These also have a large impact on our IT systems. We therefore work on an interdisciplinary basis to protect our connected vehicles and mobility services. Our guiding principles are data security, transparency and informational self-determination.
We address the risk of unauthorized access to, modification of, or extraction of corporate and customer data with the use of IT security technologies such as firewall and intrusion prevention systems and a multiple-authentication procedure. Additionally, we increase protection by restricting the allocation of access rights to systems and information and by keeping backup copies of critical data resources. Redundant IT infrastructures allow us to mitigate risks that occur in the event of a systems failure or of a disaster.
We use commercially available technologies to protect our IT landscape, adhering to standards applicable throughout the Company. We future-proof our IT through continual standardization and updates. Continuously increasing automation enhances process reliability and the quality of processing.
The further development and Group-wide use of IT governance processes, particularly the further standardization of the IT risk management process, also help to identify weaknesses at an early stage and to reduce or avoid risks effectively.
Another focus is the continuous enhancement of Group-wide security measures with modern technologies and tools, such as the further expansion of the IT security command center for the early detection of and defense against cyber attacks.
Volkswagen complements these technical measures by systematically raising awareness and providing training for employees.
Risks from media impact
The image of the Volkswagen Group and its brands is one of the most important assets and forms the basis for long-term business success. Our policy and strategic orientation on issues such as integrity, ethics and sustainability are in the public focus. One of the basic principles of running our business is therefore to pay particular attention to compliance with legal requirements and ethical principles. However, we are aware that misconduct or criminal acts by individuals and the resulting reputational damage can never be fully prevented. In addition, media reactions can have a negative effect on the image of the Volkswagen Group and its brands. This impact could be amplified through insufficient communication at times of crisis.