Cincinnati Financial (CINF) 10-K risk factor changes: FY2023 vs FY2022

United States Securities and Exchange Commission

Washington, D.C. 20549

Form 10-K

| | | | | | |

| --- | --- | --- | --- | --- | --- |

| ☑ | | | ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934. | | |

For the fiscal year ended December 31, 2023.

| | | | | | |

| --- | --- | --- | --- | --- | --- |

| ☐ | | | TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934. | | |

For the transition period from _____________________ to _____________________.

Commission file number 000-04604

Cincinnati Financial Corporation

(Exact name of registrant as specified in its charter)

| | | | | | |

| --- | --- | --- | --- | --- | --- |

| Ohio | | | 31-0746871 | | |

| (State of incorporation) | | | (I.R.S. Employer Identification No.) | | |

6200 S.

Gilmore Road

Fairfield, Ohio 45014-5141

(Address of principal executive offices) (Zip Code)

(513) 870-2000

(Registrant’s telephone number, including area code)

Securities registered pursuant to Section 12(b) of the Act:

| | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

| Title of each class | | | | | | Trading Symbol(s) | | | | | | Name of each exchange on which registered | | |

| Common stock, $2.00 par | | | | | | CINF | | | | | | Nasdaq Global Select Market | | |

Securities registered pursuant to Section 12(g) of the Act:

None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act.

Yes ☑ No ☐

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act.

Yes ☐ No ☑

Indicate by check mark whether the registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports) and (2) has been subject to such filing requirements for the past 90 days.

Yes ☑ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files).

Yes ☑ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or emerging growth company.

Risk Management and Strategy

As discussed further in Item 1, Regulation, Enterprise Risk Management, we manage cybersecurity as part of our overall enterprise risk programs.

As part of this program to keep our systems and data secure and to assist in understanding, assessing, identifying and managing material risks from cybersecurity threats, we take various measures through internal risk management efforts and testing by third-party experts.

Those measures assess our cybersecurity program structure and capabilities and include blocking attempted cyber intrusions, defending against service disruptions, performing frequent vulnerability assessments and maintaining procedures to ensure timely notification of critical cybersecurity incidents and performance of related disclosure controls.

We also have developed procedures and reporting processes when we identify an attempted cyber intrusion to the systems of one of our independent agents.

Additionally, the company uses third-party service providers, or vendors, in the course of conducting its operations.

As such, the company has measures in place to help identify material risks from cybersecurity threats associated with the use of those vendors.

When work with a vendor is evaluated, we consider, among other items, the availability of system and organization controls reports, interactions with our systems, the data involved and its level of sensitivity, the amount of data the vendor will process, where the data will be stored, what they will do with the data and destruction of data.

Once a vendor is approved by the appropriate personnel, expectations regarding incident reporting are established and followed.

We are not aware of having experienced a material cybersecurity incident and we take commercially reasonable measures, described above and below, to monitor and respond to threats to keep our systems and data secure.

However, we acknowledge that administrative, technical and internal accounting controls as well as other preventative actions may be insufficient to prevent security breaches to our systems or those of third parties with whom we do business due to, among other factors, changing technologies as well as criminal and state-sponsored cybercrime and cyber threats.

Further, a material breach of our security or the security of a vendor that results in unauthorized access to our data could expose us to a disruption or challenges relating to our daily operations as well as to data loss, litigation, damages, fines and penalties, significant increases in compliance costs and reputational damage and could affect the company's strategy, results of operations or financial condition.

See Item 1A, Risk Factors, for additional details.

Governance

Cybersecurity matters are an important part of reporting to our board of directors, executive management team, risk committee and disclosure committee.

From a board perspective, the audit committee oversees the company's cybersecurity efforts along with additional oversight from the entire board.

Several members of the audit committee have obtained certifications in cybersecurity oversight.

Each quarter, the chief information officer and chief information security officer report to the audit committee on cybersecurity risks and controls.

Also occurring each quarter, the entire board, and our senior executive team, as appropriate, receives a comprehensive report from the chief risk officer on the status and management of risk and other metrics relative to identified tolerances and limits, risk assessments and risk plans.

Additionally, the chief risk officer has direct access to all members of the board of directors and presents in person at board meetings twice each year.

At the executive management and management levels, the chief information security officer leads the process of assessing and managing material risks from cybersecurity threats.

Our chief information security officer has over 25 years of experience as a technology professional with in-depth knowledge of IT management processes and holds multiple degrees and professional designations, including as a certified information systems security professional (CISSP).

The chief information security officer also works in collaboration with our chief information officer and chief risk officer and is supported by a cross-functional group of qualified and experienced professionals across various committees and functions.

On a quarterly basis, the chief information officer provides a cybersecurity update to the disclosure committee and, on a monthly basis, the information security office team delivers a cybersecurity report to the senior executive team.

Also refer to Item 10, Directors, Executive Officers and Corporate Governance, for additional qualification, experience and responsibility details.

Cincinnati Financial Corporation - 2023 10-K - Page 43

Associates involved in this area stay informed of industry trends and evolving threats using various resources including government authorities, peers, continuous education, industry publications, news outlets and other external parties that provide pertinent information.

We take administrative, technical and internal accounting control measures to protect against cybersecurity incidents, including actions to monitor for, prevent, detect, mitigate and remediate any incidents that occur.

These measures and actions include endpoint controls, multi-factor authentication and general cybersecurity education directed at our workforce and independent agents.

From a monitoring perspective, generally speaking, our information security office associates monitor the environment for threats, events and potential incidents.

Depending on the potential severity of any identified incident, the company's incident response process, modeled after National Institute for Standards and Technology (NIST) frameworks, is initiated.

As part of this process, each incident is evaluated and inventoried by our incident response team and reported to our legal compliance subcommittee for further action.

Depending on severity, certain other internal and external parties may participate in the incident response process from a compliance and financial reporting perspective.

Incidents, regardless of severity, are evaluated and documented and are shared with the audit committee.

In 2023, the audit committee received four updates on matters related to cybersecurity.

The process of evaluating and documenting individual incidents, even when not deemed material, assists in determining how previous incidents have or may reasonably likely have a material effect on the company in the future.

ITEM 2.

Properties

Cincinnati Financial Corporation owns our headquarters building located on 107 acres of land in Fairfield, Ohio.

This building has 1,508,200 square feet of total space.

Obligations

We pay obligations to customers, suppliers and associates in the normal course of our business operations.

Some are contractual obligations that define the amount, circumstances and/or timing of payments.

We have other commitments for business expenditures; such as $223 million we expect to fund for our private equity and real estate investments, however, the amount, circumstances and/or timing of our other commitments are not dictated by contractual arrangements.

Contractual Obligations

At December 31, 2023, we estimated our significant future contractual obligations as follows:

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

| (Dollars in millions) | | | | | | Year | | | | | | Years | | | | | | | | | | | | There- | | | | | | | | |

| Payment due by period | | | | | | 2024 | | | | | | 2025-2028 | | | | | | | | | | | | after | | | | | | Total | | |

| Gross property casualty loss and loss expense payments | | | | | | $ | 2,963 | | | | | $ | 4,742 | | | | | | | | | | | $ | 1,270 | | | | | $ | 8,975 | |

| Gross life policyholder obligations | | | | | | 145 | | | | | | 500 | | | | | | | | | | | | 5,709 | | | | | | 6,354 | | |

| Long-term debt | | | | | | — | | | | | | — | | | | | | | | | | | | 793 | | | | | | 793 | | |

| Interest on long-term debt | | | | | | 52 | | | | | | 193 | | | | | | | | | | | | 126 | | | | | | 371 | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| Profit-sharing commissions | | | | | | 208 | | | | | | — | | | | | | | | | | | | — | | | | | | 208 | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| Other liabilities | | | | | | 123 | | | | | | 83 | | | | | | | | | | | | 1 | | | | | | 207 | | |

| Total | | | | | | $ | 3,491 | | | | | $ | 5,518 | | | | | | | | | | | $ | 7,899 | | | | | $ | 16,908 | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

Liquidity and Capital Resources Outlook

At December 31, 2023, we had $907 million in cash and cash equivalents.

During 2024, our lead insurance subsidiary may pay a maximum of $729 million in dividends to our parent company without regulatory approval.

That strong liquidity and our consistent cash flows give us the flexibility to meet current obligations and commitments while building value by prudently investing where we see potential for both current income and long-term return.

Our cash and cash equivalents provide adequate financial cushion when short-term operating results do not meet our objectives.

A long-term perspective governs our liquidity and capital resources decisions, with the goal of benefiting our policyholders, agents, shareholders and associates over time.

Our underwriting philosophy and initiatives can drive performance to achieve underwriting profit.

Our GAAP combined ratio averaged 94.6% over the five-year period 2019 through 2023, resulting in strong underwriting profits.

In any year, we consider the most likely source of pressure on liquidity would be an unusually high level of catastrophe loss payments within a short period of time.

There could be additional obligations for our insurance operations due to increasing severity or frequency of noncatastrophe claims.

To address the risk of unusually large insurance loss obligations, including catastrophe events, we maintain property casualty reinsurance contracts with highly rated reinsurers, as discussed under 2024 Reinsurance Ceded Programs.

We also monitor the financial condition of our reinsurers because their insolvency could jeopardize a portion of our $651 million reinsurance recoverable asset at December 31, 2023.

Parent-company liquidity could also be constrained by Ohio regulatory requirements that restrict the dividends insurance subsidiaries can pay.

Economic weakness also has the potential to affect our liquidity and capital resources in a number of different ways, including delinquent payments from agencies, defaults on interest payments by fixed-maturity holdings in our portfolio, dividend reductions by holdings in our equity portfolio or declines in the market value of holdings in our portfolio.

Cincinnati Financial Corporation - 2023 10-K - Page 97

Off-Balance-Sheet Arrangements

We do not use any special-purpose financing vehicles or have any undisclosed off-balance-sheet arrangements (as that term is defined in applicable SEC rules) that are reasonably likely to have a current or future material effect on the company’s financial condition, results of operation, liquidity, capital expenditures or capital resources.

Property Casualty Loss and Loss Expense Obligations and Reserves

Our estimate of future gross property casualty loss and loss expense payments of $8.975 billion is lower than loss and loss expense reserves of $9.050 billion reported on our balance sheet at December 31, 2023.

United States Securities and Exchange Commission

Washington, D.C. 20549

Form 10-K

| | | | | | |

| --- | --- | --- | --- | --- | --- |

| ☑ | | | ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934. | | |

For the fiscal year ended December 31, 2022.

| | | | | | |

| --- | --- | --- | --- | --- | --- |

| ☐ | | | TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934. | | |

For the transition period from _____________________ to _____________________.

Commission file number 000-04604

Cincinnati Financial Corporation

(Exact name of registrant as specified in its charter)

| | | | | | |

| --- | --- | --- | --- | --- | --- |

| Ohio | | | 31-0746871 | | |

| (State of incorporation) | | | (I.R.S. Employer Identification No.) | | |

6200 S.

Gilmore Road

Fairfield, Ohio 45014-5141

(Address of principal executive offices) (Zip Code)

(513) 870-2000

(Registrant’s telephone number, including area code)

Securities registered pursuant to Section 12(b) of the Act:

| | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

| Title of each class | | | | | | Trading Symbol(s) | | | | | | Name of each exchange on which registered | | |

| Common stock, $2.00 par | | | | | | CINF | | | | | | Nasdaq Global Select Market | | |

Securities registered pursuant to Section 12(g) of the Act:

None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act.

Yes ☑ No ☐

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act.

Yes ☐ No ☑

Indicate by check mark whether the registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports) and (2) has been subject to such filing requirements for the past 90 days.

Yes ☑ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 if Regulation S-T(§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files).

Yes ☑ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or emerging growth company.