KPMG Consulting Announces "Resilience Survey 2026" (Preliminary Report)

KPMG Consulting Co., Ltd. (Headquarters: Chiyoda-ku, Tokyo; Representatives: Minoru Seki, Atsushi Taguchi, Masahiko Chinono; hereinafter, KPMG Consulting) today announced the "Resilience Survey 2026" (Preliminary Report), a report summarizing the results of a survey on the initiatives of Japanese companies regarding resilience (the ability of companies to overcome crises and achieve further growth) and business continuity planning (BCP).

In recent years, the risks that companies must address have become increasingly complex, including the intensification of natural disasters, the sophistication of cyberattacks, and the increase in economic security and geopolitical risks. In such situations, more advanced risk response is required, going beyond traditional BCP formulation.

This survey, the sixth conducted since 2024, targets listed and unlisted companies in Japan and is based on results obtained from March to April 2026. It summarizes two themes: "Status of Business Continuity Promotion Systems in Japanese Companies" and "Status of Operational Resilience Initiatives."

The full text of this report can be downloaded from here.

"Resilience Survey 2026 Preliminary Report"

[Key Survey Findings]

Theme 1: Status of Business Continuity Promotion Systems in Japanese Companies

● BCP Formulation Status

Over 90% of companies have formulated BCPs, reaching the highest level since the survey began in 2008.

● Recognition and Response Status to Risks That Could Cause Business Stoppage

While 98.3% recognize cyberattacks as a risk, BCP response remains at 56.0%. Regarding economic security-related crises, 75.4% recognize them as risks, but BCP response remains at 28.1%.

● Status of Alternative Site Preparation

79.3% of companies with sales of 500 billion yen or more have prepared two or more alternative sites.

● System Risk Countermeasures Status

The majority of companies are implementing risk countermeasures for their systems. 39.1% of companies have implemented system redundancy, such as preparing alternative environments in case of system failures, limited to highly critical systems.

Theme 2: Status of Operational Resilience Initiatives in Japanese Companies

● Status of Operational Resilience Initiatives

60% of financial institutions responded that they are "in the process of implementing." While 40% of companies have a company-wide framework established and operational, challenges remain in establishing mechanisms for continuous improvement, operational integration, and company-wide deployment.

● Operational Challenges in Operational Resilience

88.2% of companies have identified critical business resources, showing steady progress. On the other hand, operational challenges in ensuring the effectiveness of operational resilience, such as the high management burden of keeping information up-to-date and the inability to grasp the end-to-end flow of operations that span multiple departments, have yet to be resolved.

● Operational Resilience Assurance [Collaboration with Existing Activities]

In the financial industry, collaboration and integration with BCP/BCM are most advanced at 70.6%, while cybersecurity risk management remains at 29.4%.

● Establishment of Common Guidelines for Operational Resilience

Due to the lack of advanced case studies and benchmark information, there are areas where individual company judgment is difficult. Expectations for common guidelines, indicators, best practices, and exercise templates for verification reach 69.2%.

Theme 1: Status of Business Continuity Promotion Systems in Japanese Companies

[BCP Formulation Status]

The BCP formulation rate reached 92.9% (an increase of 5 points year-on-year), the highest level since the survey began in 2008. The formulation rate continues to rise, suggesting that BCPs are becoming a standard framework for corporate management.

[Recognition and Response Status to Risks That Could Cause Business Stoppage]

Risks recognized as potentially leading to business stoppage, but not adequately addressed by existing BCPs, include "cyberattacks (including information leaks)" (42.2%), "economic security-related crises" (47.4%), and "unavailability of essential AI" (43.1%). The current situation indicates insufficient response to these risks, which have increased in importance in recent years.

[Status of Alternative Site Preparation]

Regarding alternative sites, 67% of companies have prepared them, combining "redundant operations in normal times, operating at two or more sites" (37%) and "preparing alternative sites that operate only in emergencies" (30%). This figure reaches 79.3% for companies with sales of 500 billion yen or more, showing a difference based on company size.

The locations of alternative sites are primarily domestic, with "Kinki" (43.3%) being the most common, followed by "Kanto" (20.9%) and "Chubu" (16.4%). Some companies have also established alternative sites overseas, confirming a trend towards dispersed locations both domestically and internationally.

[System Risk Countermeasures Status]

As system countermeasures for the continuity of priority products, services, and operations, 55.9% of companies responded that they "have system redundancy," and 54.3% responded that they "store critical data in remote locations." This trend was particularly strong among companies with sales of 500 billion yen or more.

Theme 2: Status of Operational Resilience Initiatives in Japanese Companies

[Status of Operational Resilience Initiatives]

In the financial industry, where initiatives are leading, 60% of responding companies answered "in the process of implementing," with 40% of those having "a company-wide framework established and operational," indicating steady progress in establishing systems. In contrast, in the non-financial industry, 72% responded "not implementing" or "unknown/not aware," indicating that system establishment is still in progress compared to the financial industry.

[Operational Challenges in Operational Resilience]

In the financial industry, 88.2% of responding companies have identified business resources linked to critical operations, but challenges such as increased management burden and lack of understanding of end-to-end business flows are observed. In the non-financial industry, only 48.8% of companies have identified them, with relatively limited initiatives.

[Operational Resilience Assurance (Collaboration with Existing Activities)]

In the financial industry, collaboration and integration with BCP/BCM are advancing at 70.6%, while cybersecurity risk management remains at 29.4%. In the non-financial industry, 54.4% responded "not collaborating/integrating," accounting for more than half. Operational resilience and existing risk management are interrelated, and it is important to collaborate and integrate both activities.

[Establishment of Common Guidelines for Operational Resilience]

In both the financial and non-financial industries, there is high expectation for "sharing best practices and advanced case studies," "providing industry-wide common concepts and interpretation guidelines," and "providing common scenario examples and exercise templates," indicating a strong demand for the establishment of common guidelines and best practices that can serve as a basis for practical work.

KPMG Consulting plans to release "Resilience Survey 2026" with added commentary in addition to the "Preliminary Report."

Materials for the "Preliminary Report" can be downloaded from the link below.

"Resilience Survey 2026 Preliminary Report"

About KPMG Consulting

KPMG Consulting is a comprehensive consulting firm that supports the transformation of companies and organizations by combining industry expertise with five areas: strategy, business transformation, technology/digital, risk consulting, and business innovation. Consultants with extensive experience and skills collaborate among the 10 professional firms that make up KPMG Japan, and leverage KPMG's global network to provide support for the realization of enhanced corporate value.