KeyBank 2014 Annual Report Download - page 32

Changes in accounting policies, standards, and interpretations could materially affect how we report our
financial condition and results of operations.
The FASB, regulatory agencies, and other bodies that establish accounting standards periodically change the
financial accounting and reporting standards governing the preparation of Key’s financial statements.
Additionally, those bodies that establish and interpret the accounting standards (such as the FASB, SEC, and
banking regulators) may change prior interpretations or positions on how these standards should be applied.
These changes can be difficult to predict and can materially affect how Key records and reports its financial
condition and results of operations. In some cases, Key could be required to retroactively apply a new or revised
standard, resulting in changes to previously reported financial results.
III. Operational Risk
Our information systems may experience an interruption or breach in security.
We rely heavily on communications, information systems (both internal and provided by third parties) and the
Internet to conduct our business. Our business is dependent on our ability to process and monitor large numbers
of daily transactions in compliance with legal, regulatory and internal standards and specifications. In addition, a
significant portion of our operations relies heavily on the secure processing, storage and transmission of personal
and confidential information, such as the personal information of our customers and clients. These risks may
increase in the future as we continue to increase mobile payments and other internet-based product offerings and
expand our internal usage of web-based products and applications.
In the event of a failure, interruption or breach of our information systems, we may be unable to avoid impact to
our customers. Other U.S. financial service institutions and companies have reported breaches, some severe, in
the security of their websites or other systems and several financial institutions, including Key, experienced
significant distributed denial-of-service attacks, some of which involved sophisticated and targeted attacks
intended to disable or degrade service, or sabotage systems. Other potential attacks have attempted to obtain
unauthorized access to confidential information or destroy data, often through the introduction of computer
viruses or malware, phishing, cyberattacks, and other means. To date, none of these efforts has had a material
adverse effect on our business or operations. Such security attacks can originate from a wide variety of sources,
including persons who are involved with organized crime or who may be linked to terrorist organizations or
hostile foreign governments. Those same parties may also attempt to fraudulently induce employees, customers
or other users of our systems to disclose sensitive information in order to gain access to our data or that of our
customers or clients. Our security systems may not be able to protect our information systems from similar
attacks due to the rapid evolution and creation of sophisticated cyberattacks. We are also subject to the risk that
our employees may intercept and transmit unauthorized confidential or proprietary information. An interception,
misuse or mishandling of personal, confidential or proprietary information being sent to or received from a
customer or third party could result in legal liability, remediation costs, regulatory action, and reputational harm.
We rely on third parties to perform significant operational services for us.
Third parties perform significant operational services on our behalf. These third-party vendors are subject to
similar risks as Key relating to cybersecurity, breakdowns or failures of their own systems or employees. One or
more of our vendors may experience a cybersecurity event or operational disruption and, if any such event does
occur, it may not be adequately addressed, either operationally or financially, by the third-party vendor. Certain
of our vendors may have limited indemnification obligations or may not have the financial capacity to satisfy
their indemnification obligations. Financial or operational difficulties of a vendor could also impair our
operations if those difficulties interfere with the vendor’s ability to serve us. Additionally, some of our
outsourcing arrangements are located overseas and, therefore, are subject to risks unique to the regions in which
they operate. If a critical vendor is unable to meet our needs in a timely manner or if the services or products
provided by such a vendor are terminated or otherwise delayed and if we are not able to develop alternative
sources for these services and products quickly and cost-effectively, it could have a material adverse effect on
21