Operational risks and opportunities
For this risk category, the likelihood of occurrence is classified as high (previous year: high) and the potential extent of damage is classified as medium (previous year: medium).
The most significant risks from the QRP lie particularly in volatile procurement markets, here primarily in relation to the availability of semiconductors, as well as in cyber security and new regulatory requirements regarding IT, and in quality problems.
Risks from particular events in the Volkswagen Group’s purchasing and production network
Particular events beyond our control such as natural disasters, pandemics – currently the spread of the SARS-CoV-2 virus – or other events such as violent confrontations – such as the current conflict between Russia and Ukraine – fires, explosions, or the leakage of substances hazardous to health and/or the environment, may result in supply risks in purchasing and significantly impair production. As a consequence, bottlenecks or even outages in production may occur, thus preventing the planned volume of production from being achieved.
Supply risks are generally identified in Purchasing through early warning systems and mitigated by applying corresponding measures to safeguard supply and avert future assembly line stoppages caused by suspensions of deliveries. Further methods of counteracting such risks include fire protection measures and hazardous goods management, and, where financially viable, ensuring that they are covered by insurance policies.
Due to the uncertainty arising from the further development of the Covid-19 pandemic and a significant shortage of semiconductor capacity throughout the automotive industry, there is a risk that looming supply breakdowns may not be recognized early enough and that countermeasures may not be initiated in time to maintain production.
Countermeasures to stabilize global production include, for example, observing the spread of infection and the measures taken to contain the pandemic, analyzing the impact on suppliers and supply and transport chains, finding alternatives where suppliers are unavailable and organizing special processes. Vehicle programs and production processes can be adjusted dynamically. As part of the Safe Production Initiative, we have defined hygiene measures to prevent possible chains of infection at essential points of contact between the people working in the network. These measures will be adjusted if necessary and include physical distancing, wearing of protective masks, cleaning and disinfecting, and reorganizing shift models and staggering break times.
Risks and opportunities from Purchasing and Technology
Current trends in the automotive industry such as e-mobility and automated driving are resulting in an increased need for financing among suppliers, presenting them with considerable challenges. These are being exacerbated by the current commodity price situation and the unavailability of semiconductors. The supplier risk management system in Purchasing at the Volkswagen Group evaluates suppliers before they are commissioned to carry out projects. Purchasing takes into account the recommendations of the risk management system.
There is a risk of bottlenecks or disruption in supply, as is currently being seen in the case of semiconductor components. Here, the rapid recovery in demand starting in the fourth quarter of 2020, following the pandemic-induced drop in production and sales volumes in the first half of 2020, and the insufficient market capacity of the semiconductor industry combined with high demand from the consumer, IT and telecommunications industries, led to bottlenecks in supply. We intend to safeguard supplies for our production plants by implementing short-term measures along with the use of our relationship management and monitoring across the entire supply chain.
There is also the risk that the latest developments in the Russia-Ukraine conflict will have a negative impact on the supply chain and lead to supply bottlenecks.
A global economic slowdown exacerbated by trade disputes and especially the consequences of the Covid-19 pandemic, including sharply increased commodity prices, is impacting the financial situation of many suppliers. This is also giving rise to risks of bottlenecks and disruption in supply.
Government support measures have stabilized the position of suppliers experiencing financial difficulties as a result of the pandemic. In Germany, for example, new rules on short-time working (Kurzarbeit) and loan support schemes, but also the suspension of the obligation to file for insolvency, have prevented companies from becoming insolvent. Specialists in Purchasing for restructuring and supply reliability monitor the financial situation of our suppliers continuously and globally, taking targeted measures to counter the risk of possible supply disruptions. Risks in battery cell production arise particularly from the rising demand for battery cells and the resulting reliance on suppliers, from technological change and from the service life of battery cells. Additional risks may arise from the long-term relation to cell manufacturers and the direct responsibility of Volkswagen in the supply chain. To counter these risks, the Volkswagen Group maintains multiple strategic supplier relationships while also increasing its own battery production within the value chain (raw material extraction, cell production).
Commodity risks can be partially mitigated through backward integration of the supply chain. For example, partnerships and long-term supply agreements with commodity suppliers can be used to ensure supply of the relevant material while also achieving competitive prices.
Demand for resources, possible speculations on the market and current trends in the automotive industry, such as the growing share of electrified vehicles, may affect the availability and prices of certain raw materials. Trends in raw materials and demand are continuously analyzed and assessed on an interdisciplinary basis to enable steps to be taken at an early stage in the event of potential bottlenecks.
Quality problems may necessitate technical intervention involving a substantial financial outlay where costs cannot be passed on to the supplier or can only be passed on to a limited extent. Assuring quality is of fundamental importance especially in the US, Brazilian, Russian, Indian and Chinese markets, for which we develop vehicles specific to the countries and where local manufacturers and suppliers have been established, particularly as it may be very difficult to predict the impact of regulations or official measures. We continuously analyze the conditions specific to each market and adapt quality requirements to their individual needs. We counter the local risks we identify by continuously developing measures and implementing them locally, thereby preventing quality defects in the supply chain from arising.
It is not possible at present to rule out the possibility of a further increase in recalls of various models produced by a variety of manufacturers in which certain airbags manufactured by Takata were installed. This could also affect Volkswagen Group models.
Specialists in Purchasing systematically investigate risks resulting from antitrust violations by suppliers and file claims for any losses that may arise.
Risks in the supply chain may also arise in relation to the non-fulfillment of human rights- and environment-related legal due diligence obligations, which may lead to supply shortages. Requirements are compared with existing processes with the help of gap analyses, and processes are developed and implemented to fill in any gaps. In 2021, we introduced a human rights due diligence management system to reduce human rights risks throughout our entire supply chain. An additional management system has been set up to effectively manage the environmental risks in the raw material supply chains.
Production risks
Volatile developments in the global automotive markets, accidents at suppliers and disruptions in the supply chain, such as the semiconductor shortages, may cause fluctuations in production volumes affecting both vehicle models and plants. In specific markets we are seeing a trend away from orders for conventional vehicles with combustion engines and towards increased orders for electric vehicles. We use established tools, such as flexible working time models, to address possible risks related to fluctuations in the mix of vehicle types. The international production network enables us to respond flexibly at the sites. “Turntable concepts” adjust capacity utilization between production facilities. At multibrand sites, volatility can also be balanced across brands.
Sudden changes in customer demand for specific equipment features in our products, and the decreasing predictability of demand, may lead to supply bottlenecks. We minimize this risk, for example, by continuously comparing our available resources against future demand scenarios. If bottlenecks in the supply of materials are indicated, we can introduce countermeasures far enough in advance.
Production capacity is planned several years in advance based on long-term sales planning for all vehicle projects. This involves a degree of risk as it is subject to market momentum and changes in demand. If forecasts are too optimistic, there is a risk that capacity will not be fully utilized. However, forecasts that are too pessimistic pose a risk of undercapacity, as a result of which, it may not be possible to meet customer demand. In the event of short-notice fluctuations in demand beyond the technical capacity that has been installed, Volkswagen or its suppliers may be unable to meet demand that goes beyond the available technical flexibility. We counter such risks by matching demand and capacity at frequent intervals and issuing program scheduling guidelines where necessary.
The diversity of our models, the reduced product life cycles and the use of complex processes and technical systems are associated with a risk that the start of production of a vehicle may be delayed. We address this risk by drawing on experience of past production starts and identifying weaknesses at an early stage so as to ensure – to the highest degree possible – that production volumes and quality standards are met during the start of production of our vehicles throughout the Group.
Legal changes, for instance in the context of the changeover to the WLTP test procedure, may impact production. For one thing, a temporary reduction in the range causes demand to focus on the available variants. Moreover, gaps in production can occur if model variants have not been approved. These fluctuations necessitate measures to stabilize production, such as the temporary storage of vehicles until official approval.
Risks arising from long-term production
In the case of large projects within the Power Engineering Business Area, risks may arise that are often only identified over the course of the project. They may result in particular from contract design errors, inaccurate or incomplete information used in costing, post-contract changes in economic and technical conditions, weaknesses in project management, quality defects and unnoticed product malfunctions in product emergence, or poor performance by subcontractors. Most notably, omissions at the start of a project, overshooting of the development budget or timeframe, and legislative changes are usually difficult to correct or compensate for and often entail substantial additional expenses. The current disproportionate increases in commodity prices and limited availability of semiconductor products may have a detrimental impact on production costs and revenue recognition.
We endeavor to identify these risks at an early stage and to take appropriate measures to eliminate or minimize them by constantly optimizing the project control process across all project phases and by using a lessons-learned process and regular project reviews. We can thus reduce risks, particularly during the bidding and planning phase of large upcoming projects.
Quality risks
We strive to identify and rectify quality problems at an early stage during the development of our products to avoid, among other things, delays to the start of production. As we are using an increasing number of modular components as part of our modular toolkit strategy, it is particularly important when malfunctions do occur to identify the cause quickly and eliminate the faults. Nonconformity of internally or externally sourced parts, components or functions may necessitate time-consuming and cost-intensive measures and lead to recalls and therefore to damage to the Volkswagen Group’s image. In addition, the resulting financial impacts may exceed provisions. To meet our customers’ expectations and minimize warranty and ex gratia repair costs, we continuously optimize the processes at our brands with which we can prevent these defects. If quality management is ineffective, there is a risk of losing ISO 9001 and KBA certification. This would lead directly to a loss of type approval from one or more authorities. We counter this risk by continuously training the Group’s system auditors and subjecting our quality management system and process quality to internal audits.
We also check the conformity of series products (conformity of production – CoP) in vehicle production plants as part of system audits with a CoP component. Further risks are associated with discrepancies identified in conformity of production (CoP) measurements and in-service-conformity (ISC) measurements. We have established an effective system for monitoring the conformity of CoP and ISC measurements for manufactured vehicles. To ensure that the results of the emissions CoP and ISC measurements are analyzed systematically, we have defined an IT system throughout the Group as the basis for reporting and implemented it across the organization. This is used for status reporting and documenting the results of the series of measurements.
Vehicle registration and operation criteria are defined and monitored by national and, in some cases, international authorities. Furthermore, several countries have special – and in some cases new – rules aimed at protecting customers in their dealings with vehicle manufacturers. We have established quality processes so that the Volkswagen Group brands and their products fulfill all respective applicable requirements and local authorities receive timely notification of all issues requiring reporting. By doing so, we reduce the risk of customer complaints or other negative consequences.
With the increasing technical complexity of vehicles due to their internal and external connectivity, and the toolkit systems in use across brands, the quality of the parts and software components supplied must be assured. This is lending ever greater importance to cyber security. To better monitor and manage the risk of cyber attacks on our vehicles in the future, we are establishing an Automotive Cyber Security Management System in all Group brands. Harmonized processes across the Group, such as the car security incident process, enable a fast reaction speed across the brands in the event of an attack so that any weaknesses in our products can be promptly eliminated. The Automotive Cyber Security Management System is an integral part of our quality management system and helps us to take advantage of synergies with already existing structures. This approach has been taken to meet the legal requirements of the UNECE regulation on cyber security, which will apply from mid-2022.
The Ausschuss Produktsicherheit (APS – Product Safety Committee) has been established to comprehensively evaluate and efficiently resolve product safety risks for customers as the product users. In the event of safety defects, doubts about compliance with legal requirements, or issues relating to the brand or corporate image, the APS examines the matter concerned and decides on how to respond. In this context, the APS is also responsible for managing related inquiries from authorities. The cross-divisional Car Security Board (CSB) provides support in relation to cyber security issues. We also created central units and established them within the organization; these are responsible for managing incoming information on APS- and CSB-related topics. In 2021, a universal, transparent management and tracking system was established to follow up on all such information across the Group without employee involvement, right through to the APS decision. In addition, numerous events and training courses were held to improve awareness of safety risks and products’ legal conformity among all employees. These activities aim to avoid risks from a lack of timely, complete and correct reporting and preliminary analysis. The entire APS process is, moreover, subject to regular review in the form of internal and external audits, aimed at reducing to a minimum risks arising from delayed, lacking or erroneous decisions and measures on the part of the APS or CSB.
IT risks
At Volkswagen, a global, software-centric mobility provider, the information technology (IT) used in all business units Group-wide is assuming an ever more important role. IT risks exist in relation to the three protection goals of confidentiality, integrity and availability, and comprise in particular unauthorized access to, modification of and extraction of sensitive electronic corporate or customer data as well as limited systems availability as a consequence of downtime and disasters. Handling data with integrity is a key factor for the accuracy and completeness of data, and for the functionality of error-free systems.
The high standards we set for the quality of our products also apply to the way in which we handle our customers’ and employees’ data. There is a risk of cyber attacks, particularly on our digital services that make use of our mobility offerings. Legal regulations including the UNECE (United Nations Economic Commission for Europe) cyber security regulation (R155) define the requirements made of our vehicle and software development. These also have a large impact on our IT systems. We therefore work on an interdisciplinary basis to protect our connected vehicles and mobility services. Our guiding principles are data security, transparency and informational self-determination.
We address the risk of unauthorized access to, modification of, or extraction of corporate and customer data with the use of IT security technologies such as firewall and intrusion prevention systems and a multiple-authentication procedure. Additionally, we increase protection by restricting the allocation of access rights to systems and information and by keeping backup copies of critical data resources. Redundant IT infrastructures allow us to mitigate risks that occur in the event of a systems failure or disaster.
A newly established committee with members from Information Security, Data Protection, Group Security, Legal Affairs and other stakeholders handles interdisciplinary issues on information security and reports directly to the Group Board of Management. This allows faster and more efficient coordination in challenging situations, thus increasing the overall level of security. A wide range of awareness-raising measures and training courses for employees also helps create and deepen consciousness of information security.
We use commercially available technologies to protect our IT landscape, adhering to standards applicable throughout the Company. We future-proof our IT through continual standardization and updates. Continuously increasing automation enhances process reliability and the quality of processing.
The further development and Group-wide use of IT governance processes, particularly the further standardization of the IT risk management process, also help to identify weaknesses at an early stage and to reduce or avoid risks effectively.
Another focus is the continuous enhancement of Group-wide security measures with modern technologies and tools, such as the further expansion of the IT security command center for the early detection of and defense against cyber attacks.
Volkswagen complements these technical measures by systematically raising awareness and providing training for employees.
Risks from media impact
The image of the Volkswagen Group and its brands is one of the most important assets and forms the basis for long-term business success. Our policy and strategic orientation on issues such as integrity, ethics, sustainability and climate protection are in the public focus. One of the basic principles of running our business is therefore to pay particular attention to compliance with legal requirements and ethical principles. However, we are aware that misconduct or criminal acts by individuals and the resulting reputational damage can never be fully prevented. In addition, media reactions can have a negative effect on the image of the Volkswagen Group and its brands. This impact could be amplified through insufficient communication at times of crisis.