Ameriprise 2012 Annual Report Download - page 49

our systems, networks and data security measures. In addition, the increasing reliance on technology systems and
networks and the occurrence and potential adverse impact of attacks on such systems and networks, both generally and in
the financial services industry, have enhanced government and regulatory scrutiny of the measures taken by companies to
protect against cyber-security threats. As these threats, and government and regulatory oversight of associated risks,
continue to evolve, we may be required to expend additional resources to enhance or expand upon the security measures
we currently maintain.
Despite the measures we have taken and may in the future take to address and mitigate these risks, we cannot assure
that our systems and networks will not be subject to breaches or interference. Any such event may result in operational
disruptions as well as unauthorized access to or the disclosure or loss of our proprietary information or our clients’
personal information, which in turn may result in legal claims, regulatory scrutiny and liability, reputational damage, the
incurrence of costs to eliminate or mitigate further exposure, the loss of clients or advisors or other damage to our
business. In addition, the trend toward broad consumer and general public notification of such incidents could exacerbate
the harm to our business, financial condition or results of operations. Even if we successfully protect our technology
infrastructure and the confidentiality of sensitive data, we may incur significant expenses in connection with our responses
to any such attacks as well as the adoption and maintenance of appropriate security measures. We could also suffer harm
to our business and reputation if attempted security breaches are publicized. We cannot be certain that advances in
criminal capabilities, discovery of new vulnerabilities, attempts to exploit vulnerabilities in our systems, data thefts, physical
system or network break-ins or inappropriate access, or other developments will not compromise or breach the technology
or other security measures protecting the networks and systems used in connection with our business.
Protection from system interruptions and operating errors is important to our business. If we experience a
sustained interruption to our telecommunications or data processing systems, or other failure in operational
execution, it could harm our business.
Operating errors and system or network interruptions could delay and disrupt our ability to develop, deliver or maintain our
products and services, causing harm to our business and reputation and resulting in loss of our advisors, clients or
revenue. Interruptions could be caused by operational failures arising from employee or advisor error or malfeasance,
interference by third parties, including hackers, our implementation of new technology, as well as from our maintenance of
existing technology. Our financial, accounting, data processing or other operating systems and facilities may fail to operate
or report data properly, experience connectivity disruptions or otherwise become disabled as a result of events that are
wholly or partially beyond our control, adversely affecting our ability to process transactions or provide products and
services to our clients. These interruptions can include fires, floods, earthquakes and other natural disasters, power losses,
equipment failures, attacks by third parties, failures of internal or vendor software or systems and other events beyond our
control.
We rely on third-party service providers and vendors for certain communications, technology and business functions, and
we face the risk of operational failure (including, without limitation, failure caused by an inaccuracy, untimeliness or other
deficiency in data reporting), termination or capacity constraints of any of the clearing agents, exchanges, clearing houses
or other third-party service providers that we use to facilitate or are component providers to our securities transactions and
other product manufacturing and distribution activities. These risks are heightened by our deployment in response to both
investor interest and evolution in the financial markets of increasingly sophisticated products, such as those which
incorporate automatic asset re-allocation, long/short trading strategies or multiple portfolios or funds, and business-driven
hedging, compliance and other risk management or investment or financial management strategies. Any such failure,
termination or constraint could adversely impact our ability to effect transactions, service our clients, manage our exposure
to risk, or otherwise achieve desired outcomes. For example, in 2012, our results were unfavorably impacted by a
tax-related item that resulted from our discovery that we had received incomplete data from a third-party service provider
for securities lending activities that resulted in the miscalculation of our dividend received deduction and foreign tax credit,
which resulted in an understatement of taxes payable and an overstatement of reported earnings in prior periods.
Risk management policies and procedures may not be fully effective in identifying or mitigating risk exposure in
all market environments or against all types of risk, including employee and financial advisor misconduct.
We have devoted significant resources to develop our risk management policies and procedures and will continue to do so.
Nonetheless, our policies and procedures to identify, monitor and manage risks may not be fully effective in mitigating our
risk exposure in all market environments or against all types of risk. Many of our methods of managing risk and exposures
are based upon our use of observed historical market behavior or statistics based on historical models. During periods of
market volatility or due to unforeseen events, the historically derived correlations upon which these methods are based
may not be valid. As a result, these methods may not predict future exposures accurately, which could be significantly
greater than what our models indicate. This could cause us to incur investment losses or cause our hedging and other risk
management strategies to be ineffective. Other risk management methods depend upon the evaluation of information
regarding markets, clients, catastrophe occurrence or other matters that are publicly available or otherwise accessible to
us, which may not always be accurate, complete, up-to-date or properly evaluated.
32