The Company relies on the integrity of its operating systems and employees, and those of third-parties, and certain failures of such systems or error by employees or customers could materially and adversely affect the Company’s operations.
Communications and information systems are essential to conduct the Company’s business, as it uses such systems to manage customer transactions and relationships, the general ledger, and deposits, loans, and investments. However, the computer systems and network infrastructure the Company uses could be vulnerable to unforeseen problems as operations are dependent upon the protection of computer equipment against damage from physical theft, fire, power loss, telecommunications failure, or a similar catastrophic event, as well as from security events.
In addition, the Company outsources certain processing functions to third-party providers. If third-party providers encounter difficulties or if the Company has difficulty in communicating with them, the ability to adequately process and account for customer transactions may be affected and business operations may be adversely impacted. If third-party providers are unable to meet service expectations, experience system or processing failure, or incur disruptions affecting operations, results could adversely impact the Company. While the Company follows certain due diligence procedures in reviewing and vetting its third-parties, it cannot control their actions.
Although the Company has procedures in place to prevent or limit the effects of any of these potential problems and intends to continue to implement security technology and establish operational procedures to prevent such occurrences, technology-related disruptions, failures, and cybersecurity risks are a constant threat, both for the Company and for the third-parties it works with. Therefore, it cannot guarantee that these measures will be successful. Any failure, interruption in, or breach in security of, its computer systems and network infrastructure, as well as those of its customers engaging in internet banking activities or electronic funds transfers, could have a material adverse effect on its financial condition and results of operations.
Similarly, the Company is reliant upon its employees. Such dependencies create risks for potential losses resulting from employee errors, breakdowns in process or control, failures to properly execute change management, negligence, or a number of other factors outside the Company’s control. The Company maintains a system of internal controls and insurance coverage to mitigate operational risks, including data processing system failures and errors, customer or employee fraud, and other disruptions which might impact its business. In addition, the Company’s Internal Audit department routinely reviews operations and high-risk areas for error, deficient controls, and failure to adhere to policy.
Potential legal actions, fines, and civil money penalties could arise as results of an operational deficiency or as a result of noncompliance with applicable regulatory standards, adverse business decisions or their implementation, and customer attrition due to potential negative publicity.
A breach in the security of the Company’s systems could disrupt its businesses, result in the disclosure of confidential information, damage its reputation, and create significant financial and legal exposure for the Company.
Although the Company devotes significant resources to maintain and regularly upgrade systems and processes designed to protect the security of its computer systems, software, networks, and other technology assets, these measures do not provide absolute security. In the past year, a myriad of industries and institutions have reported breaches in the security of their websites or other systems, some of which have involved sophisticated and targeted attacks intended to obtain unauthorized access to confidential information, destroy data, disable or degrade service, or sabotage systems, often through the introduction of computer viruses or malware, cyber-attacks, and other means. In addition, cyber attackers have taken advantage of the pandemic to create campaigns to leverage individuals fears and uncertainties as well as capitalize on the increased number of transactions occurring on digital channels. The implementation of remote working arrangements that use virtual private networks, virtual conferencing services, and telecommunication technologies can increase insider risk, cybersecurity vulnerabilities, and other operational exposures. Industry trends in ransomware, phishing, and other intrusion methods have increased significantly and will continue to pose increased risk.
Threats to security also exist in the processing of customer information through various other third-parties, their personnel, and their use of subcontractors. Advances in computer capabilities, new discoveries in the field of cryptography or other developments could result in a compromise or breach of the algorithms the Company and its third-party service providers use to encrypt and protect customer transaction data. Such cyber incidents may go undetected for a period of time. An inability by our third-party providers, and their third-party providers, known as “supply chain risk,” to anticipate, detect,