Experian 2012 Annual Report Download - page 27

25
Governance Financial statementsBusiness reviewBusiness overview
Risk factors
The following information sets out the
risk factors which we believe could cause
our future results to differ materially from
expected results. However, other factors
could also adversely affect our results and so
the risks discussed below should not
be considered to be a complete set of all
potential risks and uncertainties.
Our approach to identifying, assessing,
managing and reporting risks is formalised
in the risk management framework
described in this section. Risks that we face
are critically evaluated throughout the
year and synthesised in the year’s report.
Exposure to consolidation among clients
and markets has been removed as a risk
due to a stabilisation of the financial services
industry and Experian’s reduced exposure
to financial services as a percentage of
global revenue.
Principal risks
Increasing risk _ No change
>
Risk and impact Mitigation Change
From 2011
Commentary
Loss or inappropriate usage of data
Our business requires the appropriate and
secure utilisation of consumer and other sensitive
information by its business units or its third party
partners. Internet-based electronic commerce
requires the secure transmission of confidential
information over public networks, and several of
our products are accessed through the internet.
Security breaches in connection with maintaining
data and the delivery of our products and services
could harm our reputation, business and operating
results.
We have established rigorous information security
policies, standards, procedures, and recruitment
and training schemes, which are embedded
throughout our business operations. We also
screen new third party partners carefully and
conduct targeted audits on their operations.
Continued investments are made in IT security
infrastructure, including the significant use of data
and communications encryption technology.
_We maintain an awareness of security breaches
throughout our industry and enhance our risk
strategies accordingly. The evolving risk landscape
requires continual improvement and refinement of
our information security operations to help ensure
the safety and protection of our environment.
Related global strategy:
•Focus on data and analytics
Further information:
• Corporate responsibility section –
Use and protect data properly
Dependence upon third parties to provide data and certain operational services
Our business model is dependent upon third
parties to provide data and certain operational
services, the loss of which could significantly
impact the quality of and demand for our
products. Similarly, if one or more of our outsource
providers, including third parties with whom we
have strategic relationships, were to experience
financial or operational difficulties, their services
to us would suffer or they may no longer be able to
provide services to us at all, significantly impacting
delivery of our products or services.
Our legal, regulatory and government affairs
functions work closely with senior management
to adopt strategies to help secure and maintain
access to public and private information. Our global
strategic sourcing function works closely with senior
management to select and negotiate agreements
with strategic suppliers based on criteria such as
delivery assurance and reliability. A diverse network
of strategic suppliers and vendors is maintained in
order to minimise potential disruptions.
_Related global strategy:
•Focus on data and analytics
•Optimise capital efficiency
Exposure to legislation or regulatory reforms
Legislative, regulatory and judicial systems in the
countries in which we operate are responding to
changing societal attitudes about how commercial
entities collect, use and maintain consumer data.
In particular, the growing ubiquity of the internet
drives public concerns about how consumer
information is collected and used for marketing,
risk management and fraud detection purposes.
These concerns may result in new laws, regulations
and enforcement practices, or pressure upon
industries to adopt new self-regulation. Some
proposed changes may adversely affect our ability
to undertake these activities in a cost-effective
manner. Separately, we are subject to changes in
specific countries’ tax laws. Our future effective
tax rates may be adversely affected by changes in
tax laws.
Our legal, regulatory and government affairs functions
work closely with senior management to adopt
strategies and educate lawmakers, regulators,
consumer and privacy advocates, industry trade
groups and other stakeholders in the public policy
debate. This includes advocating for robust,
responsible sharing of commercial consumer data.
It also includes negotiating with lawmakers and
policymakers, directly and through trade groups
and external consultants, to ensure proposed
legal requirements reflect standards that are both
workable for us and responsive to consumers.
Finally, it includes advocating and promoting new
industry self-regulatory standards, when appropriate,
to address consumer concerns about privacy and
information sharing. We also retain internal and
external tax professionals that monitor the likelihood
of future tax changes. These risks are generally
outside our control.
_We continue to monitor and engage key
stakeholders on several topics including:
understanding the priorities of the newly established
US Consumer Financial Protection Agency, the
proposed US data security standards, the proposed
EU Data Protection Directive, and the potential
adoption of positive credit data repositories in
various European and Asian countries.
Related global strategy:
•Focus on data and analytics
Further information:
•Financial statement note 15 for a discussion of
tax charges and rates
Regulatory compliance
Our businesses must comply with federal,
regional, provincial, state and other jurisdictional
regulations and best practice. These include
rules that authorise and prescribe credit reporting
protocols, as well as general information
privacy, anti-corruption and information
security requirements. Non-compliance could
lead to fines/penalties, increased prudential
requirements, enforced suspension of operations
or, in extreme cases, withdrawal of authorisations
to operate.
To the best of Experian’s knowledge, we are in
compliance with data protection requirements in
each jurisdiction in which we operate. Our regulatory
compliance departments work closely with the
businesses to identify and adopt strategies to help
ensure compliance with jurisdictional regulations
and identified business ethics which include active
monitoring of our collection and use of personal data.
Adequate procedures have been implemented to
address requirements under the UK Bribery Act 2010.
>
Regulatory compliance risk continues to increase
as a result of heightened oversight and enforcement
of existing financial laws and new regulations,
such as the Wall Street Reform and Consumer
Protection Act of 2010 and the UK Bribery Act 2010.
The regulatory compliance function has actively
participated in the evaluation and integration of
acquired businesses within our emerging Latin
America and Asia Pacific markets to deploy the
fundamentals of our compliance programme.
Related global strategy:
•Focus on data and analytics
Further information:
• Corporate responsibility section –
Use and protect data properly