Capital One 2013 Annual Report Download - page 47

Similar to other large corporations, we are exposed to operational risk that can manifest itself in many ways, such
as errors related to failed or inadequate processes, inaccurate models, faulty or disabled computer systems, fraud
by employees or persons outside of our company and exposure to external events. In addition, we are heavily
dependent on the strength and capability of our technology systems which we use to manage our internal
financial and other systems, interface with our customers and develop and implement effective marketing
campaigns. We also depend on models to measure risks, estimate certain financial values, determine pricing on
certain products, assess capital adequacy and calculate regulatory capital levels. If we implement or design our
models poorly or use inaccurate assumptions in our models, business decisions based on the output of the models
may be adversely affected. Moreover, information we disclose to investors and our regulators based on poorly
designed or implemented models could be inaccurate. Some decisions our regulators make, including those
related to our capital distribution plans, may be adversely impacted if they perceive the quality of our models to
be insufficient.
Our ability to develop and deliver new products that meet the needs of our existing customers and attract new
ones and to run our business in compliance with applicable laws and regulations depends on the functionality and
reliability of our operational and technology systems. Any disruptions, failures or inaccuracies of our operational
and technology systems and models, including those associated with improvements or modifications to such
systems and models, could cause us to be unable to market and manage our products and services, manage our
risk or to report our financial results in a timely and accurate manner, all of which could have a negative impact
on our results of operations.
In some cases, we outsource the maintenance and development of operational and technological functionality to
third parties. These third parties may experience errors or disruptions that could adversely impact us and over
which we may have limited control. Any increase in the amount of our infrastructure that we outsource to third
parties may increase our exposure to these risks.
In addition, our ongoing investments in infrastructure, which may be necessary to maintain a competitive
business, integrate acquisitions and establish scalable operations, may increase our expenses. Further, as our
business develops, changes or expands, additional expenses can arise as a result of a reevaluation of business
strategies, management of outsourced services, asset purchases or other acquisitions, structural reorganization,
compliance with new laws or regulations or the integration of newly acquired businesses. As cybersecurity
threats continue to evolve, we may also be required to expend significant additional resources to continue to
modify or strengthen our protective security measures, investigate and remediate any vulnerabilities of our
information systems and infrastructure or invest in new technology designed to mitigate security risks. If we are
unable to successfully manage our expenses, our financial results will be negatively affected.
We Could Incur Increased Costs or Reductions In Revenue Or Suffer Reputational Damage And Business
Disruptions In the Event Of The Theft, Loss or Misuse Of Information, Including As A Result Of A Cyber-
Attack.
Our products and services involve the gathering, storage and transmission of sensitive information regarding our
customers and their accounts. Our ability to provide such products and services, many of which are web-based,
relies upon the management and safeguarding of information, software, methodologies and business secrets. To
provide these products and services, we use information systems and infrastructure that we and third party
service providers operate. We also have arrangements in place with retail partners and other third parties where
we share and receive information about their customers who are or may become our customers. As a financial
institution, we also are subject to and examined for compliance with an array of data protection laws, regulations
and guidance, as well as to our own internal privacy and information security policies and programs. If our
information systems or infrastructure experience a significant disruption or breach, it could lead, depending on
the nature of the disruption or breach, to unauthorized access to personal or confidential information of our
customers in our possession or unauthorized access to our proprietary information, software, methodologies and
business secrets. In addition, if our partners, retailers or other market participants experience a disruption or
27