KeyBank 2014 Annual Report Download - page 33

our business. Additionally, regulatory guidance adopted by federal banking regulators in 2013 related to how
banks select, engage and manage their outside vendors may affect the circumstances and conditions under which
we work with third parties and the cost of managing such relationships.
We are subject to claims and litigation.
From time to time, customers, vendors or other parties may make claims and take legal action against us. We
maintain reserves for certain claims when deemed appropriate based upon our assessment that a loss is probable,
consistent with applicable accounting guidance. At any given time we have a variety of legal actions asserted
against us in various stages of litigation. Resolution of a legal action can often take years. Whether any particular
claims and legal actions are founded or unfounded, if such claims and legal actions are not resolved in our favor,
they may result in significant financial liability and adversely affect how the market perceives us and our
products and services as well as impact customer demand for those products and services.
We are also involved, from time to time, in other reviews, investigations and proceedings (both formal and
informal) by governmental and self-regulatory agencies regarding our business, including, among other things,
accounting and operational matters, certain of which may result in adverse judgments, settlements, fines,
penalties, injunctions or other relief. The number and risk of these investigations and proceedings has increased
in recent years with regard to many firms in the financial services industry due to legal changes to the consumer
protection laws provided for by the Dodd-Frank Act and the creation of the CFPB.
There have also been a number of highly publicized legal claims against financial institutions involving fraud or
misconduct by employees, and we run the risk that employee misconduct could occur. It is not always possible to
deter or prevent employee misconduct, and the precautions we take to prevent and detect this activity may not be
effective in all cases.
We are subject to operational risk.
We are subject to operational risk, which represents the risk of loss resulting from human error, inadequate or
failed internal processes and systems, and external events. Operational risk includes the risk of fraud by
employees, clerical and record-keeping errors, nonperformance by vendors, threats to cybersecurity, and
computer/telecommunications malfunctions. Operational risk also encompasses compliance and legal risk, which
is the risk of loss from violations of, or noncompliance with, laws, rules, regulations, prescribed practices or
ethical standards, as well as the risk of our noncompliance with contractual and other obligations. We are also
exposed to operational risk through our outsourcing arrangements, and the effect that changes in circumstances
or capabilities of our outsourcing vendors can have on our ability to continue to perform operational functions
necessary to our business, such as certain loan processing functions. For example, breakdowns or failures of our
vendors’ systems or employees could be a source of operational risk to us. Resulting losses from operational risk
could take the form of explicit charges, increased operational costs, harm to our reputation, inability to secure
insurance, litigation, regulatory intervention or sanctions or foregone business opportunities.
Our controls and procedures may fail or be circumvented, and our methods of reducing risk exposure may
not be effective.
We regularly review and update our internal controls, disclosure controls and procedures, and corporate
governance policies and procedures. We also maintain an ERM program designed to identify, measure, monitor,
report and analyze our risks. Any system of controls and any system to reduce risk exposure, however well
designed and operated, is based in part on certain assumptions and can provide only reasonable, not absolute,
assurances that the objectives of the system are met. Additionally, instruments, systems and strategies used to
hedge or otherwise manage exposure to various types of market compliance, credit, liquidity, operational and
business risks and enterprise-wide risk could be less effective than anticipated. As a result, we may not be able to
effectively mitigate our risk exposures in particular market environments or against particular types of risk.
22