Experian 2011 Annual Report Download - page 41

Business review Risks and uncertainties
Risk factors
The following information sets out the risk factors which the Group believes could cause its future results to differ materially from expected
results. However, other factors could also adversely affect the Group’s results and so the factors discussed below should not be considered
to be a complete set of all potential risks and uncertainties.
The Group’s approach to identifying, assessing, managing and reporting risks is formalised in its risk management framework described in
this section. Risks that the Group faces are critically evaluated throughout the year and synthesised in the year’s report. Product/service or
technology obsolescence has been added as a principal risk in recognition of innovation being integral to Experian’s success.
Principal risks
Risk area Potential impact Mitigation strategies
Loss or inappropriate usage
of data
Related strategy:
• Focus on data and analytics
>The Group’s business requires the appropriate
and secure utilisation of consumer and other
sensitive information by its business units or its
third party partners. Internet-based electronic
commerce requires the secure transmission of
confidential information over public networks,
and several of our products are accessed
through the internet. Security breaches in
connection with maintaining data and the
delivery of our products and services could
harm our reputation, business and operating
results. Please refer to the key resources
overview section of this report for further
information on how data is considered to be the
foundation of Experian’s value proposition.
>The Group has established rigorous
information security policies, standards,
procedures, and recruitment and training
schemes, which are embedded throughout
its business operations. The Group also
screens new third party partners carefully
and conducts targeted audits on their
operations. Continued investments
are made in IT security infrastructure,
including the significant use of data and
communications encryption technology.
Dependence upon third
parties to provide data and
certain operational services
Related strategy:
• Focus on data and analytics
• Optimise capital efficiency
>The Group’s business model is dependent
upon third parties to provide data and certain
operational services, the loss of which
could significantly impact the quality of and
demand for our products. Similarly, if one or
more of our outsource providers, including
third parties with whom we have strategic
relationships, were to experience financial or
operational difficulties, their services to us
would suffer or they may no longer be able
to provide services to us at all, significantly
impacting delivery of our products or services.
>The Group’s legal, regulatory and government
affairs departments work closely with
senior management to adopt strategies to
help secure and maintain access to public
and private information. The Group’s
global strategic sourcing department
works closely with senior management
to select and negotiate agreements with
strategic suppliers based on criteria such
as delivery assurance and reliability.
Exposure to legislation or
regulatory reforms
Related strategy:
• Focus on data and analytics
>Legislative, regulatory and judicial systems
in the countries in which the Group operates
are responding to changing societal attitudes
about how commercial entities collect, manage,
aggregate, use, exchange and sell data. Some
proposed changes may adversely affect the
Group’s ability to undertake these activities in
a cost effective manner. The growing ubiquity
of the internet drives public concerns about
how consumer information is collected and
used for marketing, risk management and
fraud detection. These concerns may result
in new laws, regulations and enforcement
practices, or pressure upon industries to adopt
new self-regulation. In addition, the Group is
subject to changes in specific countries’ tax
laws. Our future effective tax rates could be
adversely affected by changes in tax laws.
>The Group’s legal, regulatory and government
affairs departments work closely with senior
management to adopt strategies and educate
lawmakers, regulators, consumer and privacy
advocates, industry trade groups and other
stakeholders in the public policy debate. This
includes negotiating, advocating and promoting
new industry self-regulatory standards, when
appropriate, to address consumer concerns
about privacy and information sharing. In
addition, the Group retains internal and
external tax professionals that monitor the
likelihood of future tax changes. These risks
are generally outside the control of the Group.
Regulatory compliance
Related strategy:
• Focus on data and analytics
>The Group’s businesses must comply with
federal, regional, provincial, state and other
jurisdictional regulations and best practice.
These include rules that authorise and
prescribe credit reporting protocols, as well as
general information privacy, anti-corruption
and information security requirements.
Non-compliance could lead to penalties,
increased prudential requirements, enforced
suspension of operations or, in extreme cases,
withdrawal of authorisations to operate.
>To the best of Experian’s knowledge, the
Group is in compliance with data protection
requirements in each jurisdiction in
which it operates. The Group’s regulatory
compliance departments work closely
with the businesses to adopt strategies to
help ensure compliance with jurisdictional
regulations and identified business ethics
which includes active monitoring of its
collection and use of personal data. Risk based
procedures have been developed to ensure
compliance with the UK Bribery Act 2010.
39