Voya 2013 Annual Report Download - page 92

internal controls. A loss of such employees could adversely impact our ability to execute key operational
functions and could adversely affect our operational controls, including internal controls over financial reporting.
Interruption or other operational failures in telecommunication, information technology and other
operational systems, or a failure to maintain the security, integrity, confidentiality or privacy of sensitive data
residing on such systems, including as a result of human error, could harm our business.
We are highly dependent on automated and information technology systems to record and process our
internal transactions and transactions involving our customers, as well as to calculate reserves, value invested
assets and complete certain other components of our U.S. GAAP and statutory financial statements. We could
experience a failure of one of these systems, our employees or agents could fail to monitor and implement
enhancements or other modifications to a system in a timely and effective manner, or our employees or agents
could fail to complete all necessary data reconciliation or other conversion controls when implementing a new
software system or implementing modifications to an existing system. Despite the implementation of security
and back-up measures, our information technology systems may be vulnerable to physical or electronic
intrusions, viruses or other attacks, programming errors and similar disruptions. We may also be subject to
disruptions of any of these systems arising from events that are wholly or partially beyond our control (for
example, natural disasters, acts of terrorism, epidemics, computer viruses and electrical/telecommunications
outages). All of these risks are also applicable where we rely on outside vendors to provide services to us and our
customers. The failure of any one of these systems for any reason, or errors made by our employees or agents,
could in each case cause significant interruptions to our operations, which could harm our reputation, adversely
affect our internal control over financial reporting, or have a material adverse effect on our business, results of
operations and financial condition.
In addition, businesses in the United States and in other countries have increasingly become the targets of
“cyberattacks”, “hacking” or similar illegal or unauthorized intrusions into computer systems and networks. Such
events are often highly publicized, result in the theft of significant amounts of information, and cause extensive
damage to the reputation of the targeted business, in addition to leading to significant expenses associated with
investigation, remediation and customer protection measures. Although we have not yet suffered such an incident
of any materiality, we could be the subject of such an attack, and, although we seek to limit our vulnerability to
such events through technological and other means, it is not possible to anticipate all potential forms of
cyberattack or to guarantee our ability to fully defend against all such attacks. In addition, due to the sensitive
nature of much of the financial and similar personal information we maintain, we may be at particular risk for
targeting.
We retain confidential information in our information technology systems, and we rely on industry standard
commercial technologies to maintain the security of those systems. Anyone who is able to circumvent our security
measures and penetrate our information technology systems could access, view, misappropriate, alter, or delete
information in the systems, including personally identifiable customer information and proprietary business
information. Information security risks also exist with respect to the use of portable electronic devices, such as laptops,
which are particularly vulnerable to loss and theft. In addition, an increasing number of jurisdictions require that
customers be notified if a security breach results in the disclosure of personally identifiable customer information. Any
attack or other breach of the security of our information technology systems that compromises information that is
subject to legislative or regulatory privacy protections, or that otherwise results in inappropriate disclosure or use of
personally identifiable customer information could damage our reputation in the marketplace, deter purchases of our
products, subject us to heightened regulatory scrutiny, sanctions, significant civil and criminal liability or other adverse
legal consequences and require us to incur significant technical, legal and other expenses.
Third parties to whom we outsource certain of our functions are also subject to the risks outlined above, any
one of which could result in our incurring substantial costs and other negative consequences, including a material
adverse effect on our business, results of operations and financial condition.
82