Operational risks and opportunities

The most significant risks from the regular GRC process and QRP lie particularly in the area of cyber security and new regulatory requirements for IT, in quality problems as well as in volatile commodity markets.

Procurement risks and opportunities

Current trends in the automotive industry such as e-mobility and automated driving are resulting in an increased need for financing among suppliers. The Volkswagen Group’s procurement risk management system assesses suppliers before they are commissioned to carry out projects. Among other things, Procurement takes into consideration the risk of insufficient competition if it concentrates on a few financially strong suppliers when awarding contracts.

Weakening growth in the global economy, the ongoing trade disputes and shifts in customer demand – especially the technological shift toward e-mobility – along with the resulting changes in call-offs from suppliers are posing challenges for us.

The changed circumstances have restricted suppliers’ financing opportunities and increased general uncertainty, particularly in areas where existing technologies are becoming obsolete and alternative technologies are gaining in importance. The number of crises and insolvencies among suppliers worldwide increased in 2019. Specialists in restructuring and supply reliability in procurement continuously monitor the financial situation of our suppliers all over the world and take targeted measures to avoid supply bottlenecks. Potential resource shortages, possible speculations on the market as well as current trends in the automotive industry, such as the growing share of electrified vehicles, may also affect the availability and prices of certain raw materials. The raw material and demand trend was continuously analyzed and assessed on an interdisciplinary basis over the reporting year to enable steps to be taken at an early stage in the event of potential bottlenecks.

Quality problems may necessitate technical intervention involving a considerable financial outlay where costs cannot be passed on to the supplier or can only be passed on to a limited extent. It is not possible at present to rule out the possibility of a further increase in recalls of various models produced by different manufacturers in which certain airbags manufactured by Takata were installed. This could also affect Volkswagen Group models.

In addition to financial difficulties, supply risks may arise, for example, as a result of fires or accidents at suppliers. Epidemics such as the current spread of the coronavirus may also cause bottlenecks. Supply risks are identified without delay in procurement through early warning systems and mitigated immediately by applying derived measures. Additional measures were taken to safeguard supply and avert future assembly line stoppages caused by suspensions of deliveries.

Specialists in procurement systematically investigate risks resulting from antitrust violations by suppliers and file claims for any damages that arise.

Production risks

Volatile developments in the global automotive markets, accidents at suppliers and disruption in the supply chain caused production volumes of some vehicle models to fluctuate at some plants. In specific markets, we also continued to record a trend away from orders for diesel vehicles and toward increased orders for vehicles with petrol engines. We address such fluctuations using tried-and-tested tools, such as flexible working time models. The design of the production network enables us to respond dynamically to varying changes in demand at the sites. “Turntable concepts” even out capacity utilization between production facilities. At multibrand sites, volatile demand can also be smoothed across brands.

Legal changes, for instance in the context of the changeover to the WLTP test procedure, may impact production. For one thing, a temporary reduction in the range causes demand to focus on the available variants. Moreover, gaps in production can occur if model variants have not been approved. These fluctuations necessitate measures to stabilize production, such as the temporary storage of vehicles until official approval.

Short-term changes in customer demand for specific equipment features in our products, and the decreasing predictability of demand, may lead to supply bottlenecks. We minimize this risk, for example, by continuously comparing our available resources against future demand scenarios. If bottlenecks in the supply of materials are indicated, we can introduce countermeasures far enough in advance.

Production capacity is planned several years in advance for each vehicle project on the basis of expected sales trends. These are subject to market changes and generally entail a degree of uncertainty. If forecasts are too optimistic, there is a risk that capacity will not be fully utilized. However, forecasts that are too pessimistic pose a risk of undercapacity, as a result of which, it may not be possible to meet customer demand. Volkswagen or its major suppliers may be unable to sufficiently adjust production capacity in the event of increased fluctuation in demand that goes beyond the available technical flexibility.

The range of our models is growing, particularly with the upcoming electrification offensive, while at the same time, product life cycles are becoming shorter; the number of new vehicle start-ups at our sites worldwide is therefore increasing. The processes and technical systems we use for this are complex and there is thus a risk that vehicle deliveries may be delayed. We address this risk by drawing on experience of past start-ups and identifying weaknesses at an early stage so as to ensure – to the highest degree possible – that production volumes and quality standards are met during our new vehicle start-ups throughout the Group.

In order to prevent downtime, lost output, rejects and reworking in general, we use the TPM (Total Productive Maintenance) method at our production facilities. TPM is a continuous process that involves the entire workforce. Round-the-clock maintenance of the technical facilities means that they are always operational and guaranteed to function reliably.

Particular events beyond our control such as natural disasters, epidemics – currently the spread of the coronavirus – or other events such as fires, explosions, or the leakage of substances hazardous to health and/or the environment, may adversely affect production to a significant extent. As a consequence, bottlenecks or even outages may occur, thus preventing the planned volume of production from being achieved. We address such risks with, among other things, fire protection measures and hazardous goods management, and, where financially viable, ensure that they are covered by insurance policies.

Risks arising from long-term production

In the case of large projects within the Power Engineering Business Area, risks may arise that are often only identified over the course of the project. They may result in particular from contract drafting errors, inaccurate or incomplete information used in costing, post-contract changes in economic and technical conditions, weaknesses in project management, or poor performance by subcontractors. Most notably, omissions or errors made at the start of a project are usually difficult to compensate for or correct, and often entail substantial additional expenses.

We endeavor to identify these risks at an even earlier stage and to take appropriate measures to eliminate or minimize them before they occur by constantly optimizing the project control process across all project phases and by using a lessons-learned process and regular project reviews. We can thus further reduce risk, particularly during the bidding and planning phase, for large upcoming projects.

Quality risks

Right from the product development stage, we aim to identify and rectify quality problems at the earliest point, so as to avoid delays to the start of production. As we are using an increasing number of modular components as part of our modular toolkit strategy, it is particularly important when malfunctions do occur to identify the cause quickly and eliminate the malfunctions. Nonconformity of internally or externally sourced parts or components may necessitate time-consuming and cost-intensive measures and lead to recalls and therefore to damage to the Volkswagen Group’s image. In addition, the resulting financial impacts may exceed provisions. To meet our customers’ expectations and minimize warranty and ex gratia repair costs, we continuously optimize the processes at our brands with which we can prevent these defects.

Increasing technical complexity and the use of the toolkit system in the Group mean that the need for high-grade supplier components and software of impeccable quality is rising. For the future management of cyber security, which is becoming an increasingly important area, we are establishing an Automotive Cyber Security Management System (ACSMS) in all brands and integrating it into the existing quality management system. This will allow us to fulfill the legal requirements that will apply from 2021.

Assuring quality is of fundamental importance especially in the US, Brazilian, Russian, Indian and Chinese markets, for which we develop vehicles specific to the countries and where local manufacturers and suppliers have been established, particularly as it may be very difficult to predict the impact of regulations or official measures. We continuously analyze the conditions specific to each market and adapt quality requirements to their individual needs. We counter the local risks we identify by continuously developing measures and implementing them locally, thereby effectively preventing quality defects from arising.

Vehicle registration and operation criteria are defined and monitored by national and, in some cases, international authorities. Furthermore, several countries have special – and in some cases new – rules aimed at protecting customers in their dealings with vehicle manufacturers. We have established quality processes to ensure that the Volkswagen Group brands and their products fulfill all respective applicable requirements and that local authorities receive timely notification of all issues requiring reporting. By doing so, we reduce the risk of customer complaints or other negative consequences.

IT risks

At Volkswagen, a global company geared towards further growth, the information technology (IT) used in all divisions Group-wide is assuming an increasingly important role. IT risks exist in relation to the three protection goals of confidentiality, integrity and availability, and comprise in particular unauthorized access to, modification of and extraction of sensitive electronic corporate or customer data as well as limited systems availability as a consequence of downtime and disasters. Handling data with integrity ensures that data is correct and uncorrupted, and that systems function without error.

The high standards we set for the quality of our products also apply to the way in which we handle our customers’ and employees’ data. In particular, the digital technology used for our mobility services must be protected against cyber attacks. New legal regulations including the future UNECE (United Nations Economic Commission for Europe) cyber security regulation (WP.29) are creating new requirements for our vehicle and software development. These have an equally large impact on our IT systems. We therefore work on an interdisciplinary basis to protect our connected vehicles and mobility services. Our guiding principles are data security, transparency and informational self-determination.

We address the risk of unauthorized access to, modification of, or extraction of corporate and customer data with the use of IT security technologies (e.g. firewall and intrusion prevention systems) and a multiple-authentication procedure. Additionally, we increase protection by restricting the allocation of access rights to systems and information and by keeping backup copies of critical data resources. Redundant IT infrastructures protect us against risks that occur in the event of a systems failure or natural or other disasters.

We use commercially available technologies to protect our IT landscape, adhering to standards applicable throughout the Company. We future-proof our IT through continual standardization and updates. Continuously increasing automation enhances process reliability and the quality of processing.

The further development and Group-wide use of IT governance processes, particularly the further standardization of the IT risk management process, also help to identify weaknesses at an early stage and to reduce or avoid risks effectively.

Another focus is the continuous enhancement of Group-wide security measures with modern technologies and tools, such as the further expansion of the IT security command center for the early detection of and defense against cyber attacks.

Volkswagen complements these technical measures by systematically raising awareness and providing training for employees.

Risks from media impact

The image of the Volkswagen Group and its brands is one of the most important assets and forms the basis for long-term business success. Our policy and strategic orientation on issues such as integrity, ethics and sustainability is in the public focus. One of the basic principles of running our business is therefore to pay particular attention to compliance with legal requirements and ethical principles. However, we are aware that misconduct or criminal acts by individuals and the resulting reputational damage can never be fully prevented. In addition, media reactions can have a negative effect on the image of the Volkswagen Group and its brands. This impact could be amplified through insufficient crisis communication.