Ameriprise 2013 Annual Report Download - page 50

payment requests. Any such breaches or interference by third parties or by our advisors or employees that may occur in
the future could have a material adverse impact on our business, financial condition or results of operations.
We are subject to international, federal and state regulations, and in some cases contractual obligations, that require us to
establish and maintain policies and procedures designed to protect sensitive client, employee, contractor and vendor
information. We have implemented and maintain security measures designed to protect against breaches of security and
other interference with our systems and networks resulting from attacks by third parties, including hackers, and from
employee or advisor error or malfeasance. We also require third-party vendors, who in the provision of services to us are
provided with or process information pertaining to our business or our clients, to meet certain information security
standards. Changes in our client base, the mix of assets under management or administration and business model or
technology platform changes, such as an evolution to accommodate mobile computing, virtual interface and multi-device
functionality may also require corresponding changes in our systems, networks and data security measures. In addition,
the increasing reliance on technology systems and networks and the occurrence and potential adverse impact of attacks
on such systems and networks, both generally and in the financial services industry, have enhanced government and
regulatory scrutiny of the measures taken by companies to protect against cyber-security threats. As these threats, and
government and regulatory oversight of associated risks, continue to evolve, we may be required to expend additional
resources to enhance or expand upon the security measures we currently maintain.
Despite the measures we have taken and may in the future take to address and mitigate cybersecurity and technology
risks, we cannot assure that our systems and networks will not be subject to breaches or interference. Any such event may
result in operational disruptions as well as unauthorized access to or the disclosure or loss of our proprietary information or
our clients’ personal information, which in turn may result in legal claims, regulatory scrutiny and liability, reputational
damage, the incurrence of costs to eliminate or mitigate further exposure, the loss of clients or advisors or other damage
to our business. While we maintain cyber liability insurance that provides both third-party liability and first-party liability
coverages, this insurance may not be sufficient to protect us against all losses. In addition, the trend toward broad
consumer and general public notification of such incidents could exacerbate the harm to our business, financial condition
or results of operations. Even if we successfully protect our technology infrastructure and the confidentiality of sensitive
data, we may incur significant expenses in connection with our responses to any such attacks as well as the adoption and
maintenance of appropriate security measures. We could also suffer harm to our business and reputation if attempted
security breaches are publicized. We cannot be certain that advances in criminal capabilities, discovery of new
vulnerabilities, attempts to exploit vulnerabilities in our systems, data thefts, physical system or network break-ins or
inappropriate access, or other developments will not compromise or breach the technology or other security measures
protecting the networks and systems used in connection with our business.
Protection from system interruptions and operating errors is important to our business. If we experience a
sustained interruption to our telecommunications or data processing systems, or other failure in operational
execution, it could harm our business.
Operating errors and system or network interruptions could delay and disrupt our ability to develop, deliver or maintain our
products and services, causing harm to our business and reputation and resulting in loss of our advisors, clients or
revenue. Interruptions could be caused by operational failures arising from employee or advisor error or malfeasance,
interference by third parties, including hackers, our implementation of new technology, as well as from our maintenance of
existing technology. Our financial, accounting, data processing or other operating systems and facilities may fail to operate
or report data properly, experience connectivity disruptions or otherwise become disabled as a result of events that are
wholly or partially beyond our control, adversely affecting our ability to process transactions or provide products and
services to our clients. These interruptions can include fires, floods, earthquakes and other natural disasters, power losses,
equipment failures, attacks by third parties, failures of internal or vendor software or systems and other events beyond our
control.
We rely on third-party service providers and vendors for certain communications, technology and business functions, and
we face the risk of operational failure (including, without limitation, failure caused by an inaccuracy, untimeliness or other
deficiency in data reporting), termination or capacity constraints of any of the clearing agents, exchanges, clearing houses
or other third-party service providers that we use to facilitate or are component providers to our securities transactions and
other product manufacturing and distribution activities. These risks are heightened by our deployment in response to both
investor interest and evolution in the financial markets of increasingly sophisticated products, such as those which
incorporate automatic asset re-allocation, long/short trading strategies or multiple portfolios or funds, and business-driven
hedging, compliance and other risk management or investment or financial management strategies. Any such failure,
termination or constraint could adversely impact our ability to effect transactions, service our clients, manage our exposure
to risk, or otherwise achieve desired outcomes.
33