Morgan Stanley 2014 Annual Report Download - page 31

Although we devote significant resources to maintaining and upgrading our systems and networks with measures
such as intrusion and detection prevention systems, monitoring firewalls to safeguard critical business
applications, and supervising third party providers that have access to our systems, there is no guarantee that
these measures or any other measures can provide absolute security. The increased use of smartphones, tablets
and other mobile devices as well as cloud computing may also heighten these and other operational risks. Like
other financial services firms, we and our third party providers continue to be the subject of attempted
unauthorized access, mishandling or misuse of information, computer viruses or malware, cyber attacks designed
to obtain confidential information, destroy data, disrupt or degrade service, sabotage systems or cause other
damage, denial of service attacks and other events. These threats may derive from human error, fraud or malice
on the part of our employees or third parties, including third party providers, or may result from accidental
technological failure. Additional challenges are posed by external extremist parties, including foreign state
actors, in some circumstances as a means to promote political ends. Any of these parties may also attempt to
fraudulently induce employees, customers, clients, third parties or other users of our systems to disclose sensitive
information in order to gain access to our data or that of our customers or clients. There can be no assurance that
such unauthorized access or cyber incidents will not occur in the future, and they could occur more frequently
and on a more significant scale.
If one or more of these events occur, it could result in a security impact on our systems and jeopardize our or our
clients’, partners’ or counterparties’ personal, confidential, proprietary or other information processed and stored
in, and transmitted through, our and our third party providers’ computer systems. Furthermore, such events could
cause interruptions or malfunctions in our, our clients’, partners’, counterparties’ or third parties’ operations,
which could result in reputational damage with our clients and the market, client dissatisfaction, additional costs
to us (such as repairing systems or adding new personnel or protection technologies), regulatory investigations,
litigation or enforcement or regulatory fines or penalties, all or any of which could adversely affect our business,
financial condition or results of operations.
Given our global footprint and the high volume of transactions we process, the large number of clients, partners
and counterparties with which we do business, and the increasing sophistication of cyber attacks, a cyber attack
could occur without detection for an extended period of time. In addition, we expect that any investigation of a
cyber attack will be inherently unpredictable and it may take time before any investigation is complete and full
and reliable information is available. During such time we may not know the extent of the harm or how best to
remediate it and certain errors or actions may be repeated or compounded before they are discovered and
rectified, all or any of which would further increase the costs and consequences of a cyber attack.
While many of our agreements with partners and third party vendors include indemnification provisions, we may
not be able to recover sufficiently, or at all, under such provisions to adequately offset any losses. In addition,
although we maintain insurance coverage that may, subject to policy terms and conditions, cover certain aspects
of cyber risks, such insurance coverage may be insufficient to cover all losses.
Liquidity and Funding Risk.
Liquidity and funding risk refers to the risk that we will be unable to finance our operations due to a loss of
access to the capital markets or difficulty in liquidating our assets. Liquidity and funding risk also encompasses
our ability to meet our financial obligations without experiencing significant business disruption or reputational
damage that may threaten our viability as a going concern. For more information on how we monitor and manage
liquidity and funding risk, see “Management’s Discussion and Analysis of Financial Condition and Results of
Operations—Liquidity and Capital Resources” in Part II, Item 7.
Liquidity is essential to our businesses and we rely on external sources to finance a significant portion of our
operations.
Liquidity is essential to our businesses. Our liquidity could be negatively affected by our inability to raise
funding in the long-term or short-term debt capital markets or our inability to access the secured lending markets.
27