Experian 2016 Annual Report Download - page 18

16
Failure to comply with laws and regulations 1 4 5 6
Risk trend Description Examples of control mitigation
Increasing We hold and manage sensitive consumer
information that exposes us to a range of privacy
and consumer protection laws, regulations
and contractual obligations with which we are
required to comply.
• We maintain a compliance management framework that
includes defined policies, procedures and controls for
Experian employees, business processes and third parties
such as our data resellers.
• We assess the appropriateness of data usage for new and/
or changing products and services.
• We vigorously defend all pending and threatened claims,
employing internal and external counsel to effectively
manage and conclude such proceedings.
• We analyse the causes of claims, to identify any potential
changes we need to make to our business processes and
policies. We maintain insurance coverage, where feasible
and appropriate.
Potential impact Changes from 2015
Non-compliance may result in material litigation
and/or regulatory actions, including class
actions, which could result in civil or criminal
liability or penalties, as well as negative publicity
that harms our reputation.
We face existing regulatory and government investigations
in a number of jurisdictions, as well as new actions and
proceedings resulting from the North America security
incident. During the year ended 31 March 2016, the number
of US class action lawsuits increased, whilst the cost of
defending individual consumer litigation continues to rise year
on year. This is at least in part attributable to greater consumer
awareness and to heightened media coverage of the US
consumer bureau business.
Business conduct risk 1 4 5 6
Risk trend Description Examples of control mitigation
Increasing Our business model strives to create long-term
value for people, businesses and society
through our data assets and innovative
analytics and software solutions. Inappropriate
execution of our business strategies or activities
could adversely affect our clients, consumers
or counterparties.
• We maintain appropriate governance and oversight that
include policies, procedures and controls designed to
safeguard personal data, avoid detriment to consumers,
provide consumer-centric product design and delivery,
and effectively respond to enquiries and complaints.
These activities also support a robust conduct risk
management framework.
• We enforce our Global Code of Conduct, and our
Anti-Corruption and Gifts and Hospitality policies.
Potential impact Changes from 2015
Consumers or clients could receive
inappropriate products or not have access to
appropriate products, resulting in material
loss of business, substantial legal liability,
regulatory enforcement actions or significant
harm to our reputation.
Regulators are increasingly putting public trust and consumer
and investor protection at the centre of their mission
statements and promoting prudent conduct risk management.
New consumer focused laws and changes to existing
regulations continued to be proposed along with heightened
regulatory oversight and reviews in our USA and UK operations.
Strategic report •
Principal risks – identifying
and managing risk continued
Principal risks – identifying and managing risk