Operational risk can manifest itself in various ways. Operational risk subcategories include Compliance risk, Conduct risk, Legal risk, and Estimations and Model risk. Refer to pages 157, 158, 159 and 160, respectively for more information on Compliance, Conduct, Legal, and Estimations and Model risk. Details on other select examples of operational risks such as business and technology resiliency, payment fraud and third-party outsourcing, as well as cybersecurity, are provided below.
Firmwide resiliency risk
Disruptions of the Firm’s business and operations can occur due to forces beyond the Firm’s control such as the spread of infectious diseases or pandemics, severe weather, natural disasters, the effects of climate change, power or telecommunications loss, failure of a third party to provide expected services, cyberattacks, civil or political unrest or terrorism. The Firm’s resiliency framework is intended to enable the Firm to prepare for and adapt to changing conditions and withstand and recover from, and address adverse effects on its operations caused by, disruptions that may impact critical business functions and supporting assets, including its staff, technology, data and facilities, as well as those of third-party service providers. The framework includes governance, awareness training, planning and testing of recovery strategies, as well as strategic and tactical initiatives to identify, assess, and manage resiliency risks. The framework operates in accordance with the Firm’s overall approach to Operational Risk Management, including alignment with technology, cybersecurity, data, physical security, crisis management, real estate and outsourcing programs.
Payment fraud risk
Payment fraud risk is the risk of external and internal parties unlawfully obtaining personal monetary benefit through misdirected or otherwise improper payment. The Firm employs various controls for managing payment fraud risk as well as providing employee and client education and awareness trainings.
Third-party outsourcing risk
The Firm‘s Third-Party Oversight (“TPO”) and Inter-affiliates Oversight (“IAO”) frameworks assist the LOBs and Corporate in selecting, documenting, onboarding, monitoring and managing their supplier relationships including services provided by affiliates. The objectives of the TPO framework are to hold suppliers and other third parties to an appropriate standard of operational performance and to mitigate key risks, including data loss and business disruptions. The Corporate Third-Party Oversight group is responsible for Firmwide training, monitoring, reporting and standards with respect to third-party outsourcing risks.
Firmwide resiliency risk
Disruptions of the Firm’s business and operations can occur due to forces beyond the Firm’s control such as the spread of infectious diseases or pandemics, severe weather, natural disasters, the effects of climate change, power or telecommunications loss, failure of a third party to provide expected services, cyberattacks, civil or political unrest or terrorism. The Firm’s resiliency framework is intended to enable the Firm to prepare for and adapt to changing conditions and withstand and recover from, and address adverse effects on its operations caused by, disruptions that may impact critical business functions and supporting assets, including its staff, technology, data and facilities, as well as those of third-party service providers. The framework includes governance, awareness training, planning and testing of recovery strategies, as well as strategic and tactical initiatives to identify, assess, and manage resiliency risks. The framework operates in accordance with the Firm’s overall approach to Operational Risk Management, including alignment with technology, cybersecurity, data, physical security, crisis management, real estate and outsourcing programs.
Payment fraud risk
Payment fraud risk is the risk of external and internal parties unlawfully obtaining personal monetary benefit through misdirected or otherwise improper payment. The Firm employs various controls for managing payment fraud risk as well as providing employee and client education and awareness trainings.
Third-party outsourcing risk
The Firm‘s Third-Party Oversight (“TPO”) and Inter-affiliates Oversight (“IAO”) frameworks assist the LOBs and Corporate in selecting, documenting, onboarding, monitoring and managing their supplier relationships including services provided by affiliates. The objectives of the TPO framework are to hold suppliers and other third parties to an appropriate standard of operational performance and to mitigate key risks, including data loss and business disruptions. The Corporate Third-Party Oversight group is responsible for Firmwide training, monitoring, reporting and standards with respect to third-party outsourcing risks.
JPMorgan Chase & Co./2024 Form 10-K
JPMorgan Chase & Co./2024 Form 10-K
JPMorgan Chase & Co./2024 Form 10-K
JPMorgan Chase & Co./2024 Form 10-K
Cybersecurity risk
Cybersecurity risk is the risk of harm or loss resulting from misuse or abuse of technology or the unauthorized disclosure of data.
Overview
Cybersecurity risk is an important and continuously evolving focus for the Firm. Significant resources are devoted to protecting and enhancing the security of computer systems, software, networks, storage devices, and other technology. The Firm’s security efforts are designed to protect against, among other things, cybersecurity attacks that can result in unauthorized access to confidential information, the destruction of data, disruptions to or degradations of service, the sabotaging of systems or other damage.
The Firm has experienced, and expects that it will continue to experience, a higher volume and complexity of cyber attacks against the backdrop of heightened geopolitical tensions. The Firm has implemented measures and controls reasonably designed to address this evolving environment, including enhanced threat monitoring. In addition, the Firm continues to review and enhance its capabilities to address associated risks, such as those relating to the management of administrative access to systems.
Third parties with which the Firm does business, that facilitate the Firm’s business activities (e.g., vendors, supply chain, exchanges, clearing houses, central depositories, and financial intermediaries) or that the Firm has acquired are also sources of cybersecurity risk to the Firm. Third party incidents such as system breakdowns or failures, misconduct by the employees of such parties, or cyber attacks, including ransomware and supply-chain compromises, could have a material adverse effect on the Firm, including in circumstances in which an affected third party is unable to deliver a product or service to the Firm or where the incident delivers compromised software to the Firm or results in lost or compromised information of the Firm or its clients or customers.
Clients and customers are also sources of cybersecurity risk to the Firm and its information assets, particularly when their activities and systems are beyond the Firm’s own security and control systems. The Firm engages in periodic discussions with its clients, customers and other external parties concerning cybersecurity risks including opportunities to improve cybersecurity.
Risks from cybersecurity threats, including any previous cybersecurity events, have not materially affected the Firm or its business strategy, results of operations or financial condition. Notwithstanding the comprehensive approach that the Firm takes to address cybersecurity risk, the Firm may not be successful in preventing or mitigating a future
cybersecurity incident that could have a material adverse effect on the Firm or its business strategy, results of operations or financial condition.