Travelers 2015 Annual Report Download - page 68

exceeds capacity or a third-party system fails or experiences an interruption. Business interruptions and
failures of controls could also result if our internal systems do not interface with each other as
intended, including as it relates to recently acquired businesses. Business continuity can also be
disrupted by an event, such as a pandemic, that renders large numbers of a workforce unable to work
as needed, particularly at critical locations; for example, our largest location employs about 20% of our
employees. If our business continuity plans did not sufficiently address a business interruption, system
failure or service denial, this could result in a deterioration of our ability to write and process new and
renewal business, provide customer service, pay claims in a timely manner or perform other necessary
business functions.
Our operations rely on the reliable and secure processing, storage and transmission of confidential
and other information in our computer systems and networks. Computer viruses, hackers (including
individuals, organizations or rogue states) and employee or vendor misconduct, and other external
hazards, could expose our data systems to security breaches, cyber-attacks or other disruptions. In
addition, we routinely transmit and receive personal, confidential and proprietary information by e-mail
and other electronic means. While we attempt to develop secure transmission capabilities with third-
party vendors and others with whom we do business, we may be unable to put in place secure
capabilities with all of such vendors and third parties and, in addition, these third parties may not have
appropriate controls in place to protect the confidentiality of the information.
Like other global companies, our computer systems are regularly subject to and will continue to be
the target of computer viruses, malware or other malicious codes, unauthorized access, cyber-attacks or
other computer-related penetrations. While we have experienced threats to our data and systems, to
date, we are not aware that we have experienced a material cyber-security breach. However, over time,
the sophistication of these threats continues to increase. Our administrative and technical controls as
well as other preventative actions we take to reduce the risk of cyber incidents and protect our
information may be insufficient to detect or prevent unauthorized access, other physical and electronic
break-ins, cyber-attacks or other security breaches to our computer systems or those of third parties
with whom we do business. In addition, new technology that could result in greater operational
efficiency may further expose our computer systems to the risk of cyber-attacks.
We have increasingly outsourced certain technology and business process functions to third parties
and may continue to do so in the future. If we do not effectively develop, implement and monitor our
outsourcing relationships, third party providers do not perform as anticipated, we experience
technological or other problems with a transition, or outsourcing relationships relevant to our business
process functions are terminated, we may not realize expected productivity improvements or cost
efficiencies and may experience operational difficulties, increased costs and a loss of business. Our
outsourcing of certain technology and business process functions to third parties may expose us to
increased risk related to data security or service disruptions, which could result in monetary and
reputational damages or harm to our competitive position. In addition to risks caused by third party
providers, our ability to receive services from third party providers outside of the United States might
be impacted by cultural differences, political instability, unanticipated regulatory requirements or public
policy inside or outside of the United States.
The increased risks identified above could expose us to data loss, disruption of service, monetary
and reputational damages, competitive disadvantage and significant increases in compliance costs and
costs to improve the security and resiliency of our computer systems. The compromise of personal,
confidential or proprietary information could also subject us to legal liability or regulatory action under
evolving cyber-security, data protection and privacy laws and regulations enacted by the U.S. federal
and state governments, Canada, the European Union or other jurisdictions or by various regulatory
organizations or exchanges. As a result, our ability to conduct our business and our results of
operations might be materially and adversely affected.
68