McKesson 2014 Annual Report Download - page 22

McKESSON CORPORATION
19
In addition, because government contracts are subject to specific procurement regulations and a variety of other socio-economic
requirements, we must comply with such requirements. For example, for contracts with the U.S. federal government, with certain
exceptions, we must comply with the Federal Acquisition Regulation, the Truth in Negotiations Act, and the Cost Accounting
Standards. We must also comply with various other government regulations and requirements as well as various statutes related
to employment practices, environmental protection, recordkeeping and accounting. These regulations and requirements affect
how we transact business with our clients and, in some instances, impose additional costs on our business operations. Government
contracts also contain terms that expose us to higher levels of risk and potential liability than non-government contracts.
We also are subject to government audits, investigations, and proceedings. For example, government agencies routinely
review and audit government contractors to determine whether allowable costs are in accordance with applicable government
regulations. These audits can result in adjustments to the amount of contract costs we believe are reimbursable by the agencies
and the amount of our overhead costs allocated to the agencies.
If we violate these rules or regulations, fail to comply with a contractual or other requirement or do not satisfy an audit, a
variety of penalties can be imposed by the government including disallowance of costs claimed, monetary damages and criminal
and civil penalties. In addition, any or all of our government contracts could be terminated or we could be suspended or debarred
from all government contract work. The occurrence of any of these actions could harm our reputation and could have a material
adverse impact on our results of operations.
Our future results could be materially affected by a number of public health issues whether occurring in the United States or
abroad.
Public health issues, whether occurring in the United States or abroad, could disrupt our operations, disrupt the operations of
suppliers or customers, or have a broader adverse impact on consumer spending and confidence levels that would negatively affect
our suppliers and customers. We have developed contingency plans to address infectious disease scenarios and the potential impact
on our operations, and we will continue to update these plans as necessary. However, there can be no assurance that these plans
will be effective in eliminating the negative impact of any such diseases on the Company’s operating results. We may be required
to suspend operations in some or all of our locations, which could have a material adverse impact on our business, financial
condition and results of operations.
We are dependent upon sophisticated information systems. The malfunction, failure or breach of these systems to perform as
designed could have a material adverse impact on our results of operations.
Our business relies on the secure electronic transmission, storage, and hosting of sensitive information, including protected
health information, financial information and other sensitive information relating to our customers, company and workforce. We
also rely on sophisticated information systems in our business to obtain, rapidly process, analyze and manage data to: (1) facilitate
the purchase and distribution of thousands of inventory items from numerous distribution centers; (2) receive, process and ship
orders and handle other product and services on a timely basis; (3) manage the accurate billing and collections for thousands of
customers; and (4) process payments to suppliers. In Europe, Celesio outsources its IT infrastructure to an external service provider.
If these systems are interrupted, damaged or breached by an unforeseen event or actions of a third party, including a cyber attack,
or fail for any extended period of time, it could have a material adverse impact on our results of operations.
Cyber attacks can result from deliberate attacks or unintentional incidents involving unauthorized access to computer systems
or data that could result in the misappropriation or loss of assets or the disclosure of sensitive information, the corruption of data,
or other disruption of business operations. Similarly, denial-of-service or other Internet-based attacks may range from mere
vandalism of electronic systems to systematic theft of sensitive information and intellectual property. Although we actively devote
significant resources to protect and maintain the confidentiality of all information in our possession, preventing all cyber incidents
is inherently difficult. Therefore, any compromise of our electronic systems, including the unauthorized access, use or disclosure
of sensitive information or a significant disruption of our computing assets and networks, would adversely affect our reputation,
our ability to fulfill contractual obligations and could have a material adverse impact on our results of operations. Moreover,
unauthorized access, use, or disclosure of such sensitive information could result in a civil, criminal or regulatory action, including
potential fines and penalties. Any real or perceived compromise of our security or disclosure of sensitive information may also
result in lost revenues by deterring customers from using or purchasing our products and services in the future.