business operations, and face similar risks relating to them. While we require regular security assessments from those third parties, we cannot be sure that their information security protocols are sufficient to withstand a cyber-attack or security breach.
Any cyber-attack or other security breach involving the misappropriation or loss of Company assets or those of its customers, or unauthorized disclosure of confidential customer information, could severely damage our reputation, erode confidence in the security of our systems, products and services, expose us to the risk of litigation and liability, disrupt our operations, and have a material adverse effect on our business.
We rely on certain external vendors to provide products and services necessary to maintain our day-to-day operations. These third-party vendors are sources of operational and informational security risk to us, including risks associated with cyber-attacks. If these vendors encounter a cyber-attack, or if we have difficulty communicating with them, we could be exposed to disruption of operations, loss of service or connectivity to customers, reputational damage, and litigation risk that could have a material adverse effect on our business and, in turn, our financial condition and results of operations.
If our information systems were to experience a system failure, our business and reputation could suffer. We rely heavily on communications and information systems to conduct our business. The computer systems and network infrastructure we use could be vulnerable to unforeseen problems. Our operations are dependent upon our ability to minimize service disruptions by protecting our computer equipment, systems, third-party relationships, and network infrastructure from physical damage due to fire, power loss, telecommunications failure or a similar catastrophic event. We have protective measures in place to prevent or limit the effect of the failure or interruption of our information systems and will continue to upgrade our security technology and update procedures to help prevent such events. However, if such failures or interruptions were to occur, they could result in damage to our reputation, a loss of customers, increased regulatory scrutiny, or possible exposure to financial liability, any of which could have a material adverse effect on our financial condition and results of operations.
We are subject to a variety of operational risks, including reputational risk, legal risk, compliance risk, the risk of fraud or theft by employees or outsiders, and the risk of clerical or record-keeping errors, which may adversely affect our business and results of operations. If personal, non-public, confidential or proprietary customer information in our possession were to be mishandled or misused, we could suffer significant regulatory consequences, reputational damage and financial loss. This could occur, for example, if information was erroneously provided to parties who are not permitted to have the information, either by fault of our systems, employees, or counterparties, or where such information is intercepted or otherwise inappropriately taken by third parties.
Because the nature of the financial services business involves a high volume of transactions, certain errors may be repeated or compounded before they are discovered and successfully remediated. Our necessary dependence upon automated systems to record and process transactions and our large transaction volume may further increase the risk that technical flaws or employee tampering or manipulation of those systems could result in losses that are difficult to detect. We also may be subject to disruptions of our operating systems arising from events that are wholly or partially beyond our control (for example, computer viruses or electrical or telecommunications outages, or natural disasters, disease pandemics or other damage to property or physical assets) which may give rise to disruption of service to customers and to financial loss or liability. We are further exposed to the risk that our external vendors may be unable to fulfill their contractual obligations (or will be subject to the same risk of fraud or operational errors by their employees) and to the risk that our (or our vendors’) business continuity and data security efforts might prove to be inadequate.
In addition, the Company is named as a defendant in lawsuits from time-to-time. Even if the case has no basis, there are costs to defend, and the Company may determine that it should settle certain suits even if there is no liability. The costs of lawsuits, whether merited or not, have a negative impact on the Company’s expenses.
The occurrence of any of these risks could result in a diminished ability to operate our business (for example, by requiring us to expend significant resources to correct the defect), as well as potential liability to clients, reputational damage and regulatory intervention, which could adversely affect our business, financial condition and results of operations, perhaps materially.
