Costco 2012 Annual Report Download - page 22

the products we buy comply with all safety standards. While we are subject to governmental inspection
and regulations and work to comply in all material respects with applicable laws and regulations, we
cannot be sure that consumption of our products will not cause a health-related illness or injury in the
future or that we will not be subject to claims, lawsuits or government investigations relating to such
matters resulting in costly product recalls and other liabilities that could adversely affect our business
and results of operations. Even if a product liability claim is unsuccessful or is not fully pursued, the
negative publicity surrounding any assertion that our products caused illness or injury could adversely
affect our reputation with existing and potential members and our corporate and brand image and
these effects could be long term.
If we do not maintain the privacy and security of member-related and business information, we
could damage our reputation with members, incur substantial additional costs and become
subject to litigation.
We receive, retain, and transmit certain personal information about our members. In addition, our
online operations at www.costco.com and www.costco.ca depend upon the secure transmission of
confidential information over public networks, including information permitting cashless payments. A
compromise of our security systems or those of our business partners that results in our members’
personal information being obtained by unauthorized persons could adversely affect our reputation with
our members and others, as well as our operations, results of operations, financial condition and
liquidity, and could result in litigation against us or the imposition of penalties. In addition, a security
breach could require that we expend significant additional resources related to the security of
information systems and could result in a disruption of our operations, particularly our online sales
operations.
Additionally, the use of individually identifiable data by our business and our business associates is
regulated at the international, federal and state levels. Privacy and information security laws and
regulations change, and compliance with them may result in cost increases due to necessary systems
changes and the development of new administrative processes. If we or those with whom we share
information fail to comply with these laws and regulations or experience a data security breach, our
reputation could be damaged, possibly resulting in lost future business, and we could be subjected to
additional legal risk as a result of non-compliance.
Our security measures may be undermined due to the actions of outside parties, employee error,
malfeasance, or otherwise, and, as a result, an unauthorized party may obtain access to our data
systems and misappropriate business and personal information. Because the techniques used to
obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and
may not immediately produce signs of intrusion, we may be unable to anticipate these techniques or to
implement adequate preventative measures. Any such breach or unauthorized access could result in
significant legal and financial exposure, damage to our reputation, and potentially have an adverse
effect on our business.
We rely extensively on computer systems to process transactions, summarize results and
manage our business. Failure to adequately update our systems and disruptions in both our
primary and back-up systems could harm our ability to run our business and adversely affect
our results of operations.
Although we believe that we have independent, redundant primary and secondary computer systems,
given the number of individual transactions we have each year it is important that we maintain
uninterrupted operation of our business-critical computer systems. Our computer systems, including
our back-up systems, are subject to damage or interruption from power outages, computer and
telecommunications failures, computer viruses, internal or external security breaches, catastrophic
events such as fires, earthquakes, tornadoes and hurricanes, and errors by our employees. If our
20