PNC Bank 2012 Annual Report Download - page 42

more subjectivity and management judgment; valuations may
include inputs and assumptions that are less observable or
require greater estimation. Further, rapidly changing and
unprecedented market conditions in any particular market (e.g.
credit, equity, fixed income, foreign exchange) could
materially impact the valuation of assets as reported within
our consolidated financial statements, and the period-to-period
changes in value could vary significantly.
There are risks resulting from the extensive use of models
in our business.
PNC relies on quantitative models to measure risks and to
estimate certain financial values. Models may be used in such
processes as determining the pricing of various products,
grading loans and extending credit, measuring interest rate and
other market risks, predicting losses, assessing capital
adequacy, and calculating regulatory capital levels, as well as
to estimate the value of financial instruments and balance
sheets items. Poorly designed or implemented models present
the risk that our business decisions based on information
incorporating models will be adversely affected due to the
inadequacy of that information. Also, information we provide
to the public or to our regulators based on poorly designed or
implemented models could be inaccurate or misleading. Some
of the decisions that our regulators make, including those
related to capital distributions to our shareholders, could be
affected adversely due to their perception that the quality of
the models used to generate the relevant information is
insufficient. See the Model Risk Management portion of the
Risk Management section included in Item 7 of this Report.
We are subject to operational risk.
Like all businesses, we are subject to operational risk, which
represents the risk of loss resulting from inadequate or failed
internal processes and systems, human error and external
events. Operational risk also encompasses technology,
compliance and legal risk, which is the risk of loss from
violations of, or noncompliance with, laws, rules, regulations,
prescribed practices or ethical standards, as well as the risk of
our noncompliance with contractual and other obligations. We
are also exposed to operational risk through our outsourcing
arrangements, and the effect that changes in circumstances or
capabilities of our outsourcing vendors can have on our ability
to continue to perform operational functions necessary to our
business. Although we seek to mitigate operational risk
through a system of internal controls which we review and
update, no system of controls, however well designed and
maintained, is infallible. Control weaknesses or failures or
other operational risks could result in charges, increased
operational costs, harm to our reputation or foregone business
opportunities.
We continually encounter technological change and we
could falter in our ability to remain competitive in this
arena.
The financial services industry is continually undergoing rapid
technological change with frequent introductions of new
technology-driven products and services. The effective use of
technology increases efficiency and enables financial
institutions to better serve customers and to reduce costs. Our
continued success depends, in part, upon our ability to address
the needs of our customers by using technology to provide
products and services that satisfy customer demands and
create efficiencies in our operations. We may not be able to
effectively implement new technology-driven products and
services that allow us to remain competitive or be successful
in marketing these products and services to our customers.
Our information systems may experience interruptions or
breaches in security.
We rely heavily on communications and information systems
to conduct our business. Any failure, interruption or breach in
security of these systems could result in disruptions to our
accounting, deposit, loan and other systems, and adversely
affect our customer relationships. While we have policies,
procedures and systems designed to prevent or limit the effect
of these possible events, there remains the risk that such a
failure, interruption or security breach might occur and, if it
does occur, that it might not be sufficiently remediated.
Recently, there have been several well-publicized series of
apparently related denial of service attacks on large financial
services companies, including PNC. In a denial of service
attack, hackers flood commercial websites with
extraordinarily high volumes of traffic, with the goal of
disrupting the ability of commercial enterprises to process
transactions and possibly making their websites unavailable to
customers for extended periods of time. The recent attacks
against PNC resulted in temporary disruptions in customers’
ability to access the corporate website and to perform on-line
banking transactions, although no customer data was lost or
compromised. Furthermore, even if not directed at PNC
specifically, attacks on other entities with whom we do
business or on whom we otherwise rely or attacks on financial
or other institutions important to the overall functioning of the
financial system could adversely affect, directly or indirectly,
aspects of PNC’s business.
In addition, there have been increasing efforts on the part of
third parties to breach data security at financial institutions or
with respect to financial transactions, including through the
use of social engineering schemes such as “phishing.” The
ability of our customers to bank remotely, including online
and through mobile devices, requires secure transmission of
confidential information and increases the risk of data security
breaches.
The PNC Financial Services Group, Inc. – Form 10-K 23