JP Morgan Chase 2014 Annual Report Download - page 144

Management’s discussion and analysis
142 JPMorgan Chase & Co./2014 Annual Report
and the calculation generally continues to reflect such
losses even after the issues or business activities giving rise
to the losses have been remediated or reduced.
The LDA is supplemented by both management’s view of
plausible tail risk, which is captured as part of the Scenario
Analysis process, and evaluation of key LOB internal control
metrics (BEICF). The Firm may further supplement such
analysis to incorporate management judgment and
feedback from its bank regulators. For information related
to operational risk RWA, see Regulatory capital on pages
146–153.
Audit alignment
Internal Audit utilizes a risk-based program of audit
coverage to provide an independent assessment of the
design and effectiveness of key controls over the Firm’s
operations, regulatory compliance and reporting. This
includes reviewing the operational risk framework, the
effectiveness of the RCSA process, and the loss data-
collection and reporting activities.
Insurance
One of the ways operational loss is mitigated is through
insurance maintained by the Firm. The Firm purchases
insurance to be in compliance with local laws and
regulations (e.g., workers compensation), as well as to
serve other needs (e.g., property loss and public liability).
Insurance may also be required by third parties with whom
the Firm does business. The insurance purchased is
reviewed and approved by senior management.
Cybersecurity
The Firm devotes significant resources to maintain and
regularly update its systems and processes that are
designed to protect the security of the Firm’s computer
systems, software, networks and other technology assets
against attempts by unauthorized parties to obtain access
to confidential information, destroy data, disrupt or
degrade service, sabotage systems or cause other damage.
In 2014, the Firm spent more than $250 million, and had
approximately 1,000 people focused on cybersecurity
efforts, and these efforts are expected to grow significantly
over the coming years.
Third parties with which the Firm does business or that
facilitate the Firm’s business activities (e.g., vendors,
exchanges, clearing houses, central depositories, and
financial intermediaries) could also be sources of
cybersecurity risk to the Firm, including with respect to
breakdowns or failures of their systems, misconduct by the
employees of such parties, or cyberattacks which could
affect their ability to deliver a product or service to the Firm
or result in lost or compromised information of the Firm or
its clients. In addition, customers with which or whom the
Firm does business can also be sources of cybersecurity risk
to the Firm, particularly when their activities and systems
are beyond the Firm’s own security and control systems.
Customers will generally be responsible for losses incurred
due to their own failure to maintain the security of their
own systems and processes.
The Firm and several other U.S. financial institutions have
experienced significant distributed denial-of-service attacks
from technically sophisticated and well-resourced
unauthorized parties which are intended to disrupt online
banking services. The Firm and its clients are also regularly
targeted by unauthorized parties using malicious code and
viruses.
On September 10, 2014, the Firm disclosed that a
cyberattack against the Firm had occurred. On October 2,
2014, the Firm updated that information and disclosed
that, while user contact information (name, address, phone
number and email address) and internal JPMorgan Chase
information relating to such users had been compromised,
there had been no evidence that account information for
such affected customers -- account numbers, passwords,
user IDs, dates of birth or Social Security numbers -- was
compromised during the attack. The Firm continues to
vigilantly monitor the situation. In addition, as of the
October 2, 2014 announcement, as well as of the date of
this Annual Report, the Firm has not seen any unusual
customer fraud related to this incident. The Firm is
cooperating with government agencies in connection with
their investigation of the incident. The Firm also notified its
customers that they were not liable for unauthorized
transactions in their accounts attributable to this attack that
they promptly alerted the Firm about.
The Firm has established, and continues to establish,
defenses on an ongoing basis to mitigate this and other
possible future attacks. The cyberattacks experienced to
date have not resulted in any material disruption to the
Firm’s operations or had a material adverse effect on the
Firm’s results of operations. The Board of Directors and the
Audit Committee are regularly apprised regarding the
cybersecurity policies and practices of the Firm as well as
the Firm’s efforts regarding this attack and other significant
cybersecurity events.
Cybersecurity attacks, like the one experienced by the Firm,
highlight the need for continued and increased cooperation
among businesses and the government, and the Firm
continues to work with the appropriate government and law
enforcement agencies and other businesses, including the
Firm’s third-party service providers, to continue to enhance
defenses and improve resiliency to cybersecurity threats.
Business and Technology Resiliency
JPMorgan Chase’s global resiliency and crisis management
program is intended to ensure that the Firm has the ability
to recover its critical business functions and supporting
assets (i.e., staff, technology and facilities) in the event of a
business interruption, and to remain in compliance with
global laws and regulations as they relate to resiliency risk.
The program includes corporate governance, awareness and
training, as well as strategic and tactical initiatives aimed to
ensure that risks are properly identified, assessed, and
managed.