What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2022-08-03 compared with 2021-08-04 · 57 added, 50 removed, 116 unchanged (48% of the section changed)

4 unchanged sentences

You should refer to the description of the qualifications and limitations on forward-looking statements in the first paragraph under Management’s Discussion and Analysis of Financial Condition and Results of Operations included in this Annual Report on Form 10-K.

The level of importance of each of the following risks may vary from time to time, and any of these risks may have a materially adverse effect on our business, results of operations, financial condition or reputation.

Business—Competition" of this Form 10-K for a discussion of the competitive environment in the markets in which we operate.

Many risks affect more than one category, and the risks are not in order of significance or probability of occurrence because they have been grouped by categories.

The risks described below are not the only risks we face and the occurrence of any of the following risks or other risks not presently known to us or that we currently believe to be immaterial could have a materially adverse effect on our business, results of operations, financial condition or reputation.

LEGAL AND COMPLIANCE RISKS

4 unchanged sentences

In addition, changes in laws or regulations, or changes in the interpretation of laws or regulations by a regulatory authority, may decrease our revenues and earnings and may require us to change the manner in which we conduct some aspects of our business.

For example, a change in regulations either decreasing the amount of taxes to be withheld or allowing less time to remit taxes to government authorities would adversely impact average client balances and, thereby, adversely impact interest income from investing client funds before such funds are remitted to the applicable taxing authorities.

For example, a change in regulations either decreasing the amount of taxes to be

withheld or allowing less time to remit taxes to government authorities would adversely impact average client balances and, thereby, adversely impact interest income from investing client funds before such funds are remitted to the applicable taxing authorities.

Changes in U.S.

tax laws, regulations or rulings or the interpretation thereof could adversely affect our effective tax rate and our net income.

Changes in laws that govern the co-employment arrangement between a professional employer organization and its worksite employees may require us to change the manner in which we conduct some aspects of our PEO business.

Health care reform under the Affordable Care Act, related state laws, and the regulations thereunder, as well as the uncertainty surrounding the Affordable Care Act, have the potential to further impact the demand for our health care compliance solutions.

We are unable to determine the additional impact that any of this will have on our PEO business, our ability to attract and retain PEO clients or demand for our health care compliance solutions.

or foreign tax laws, regulations or rulings or the interpretation thereof could adversely affect our effective tax rate and our net income.

Changes in laws, or interpretations thereof, that govern the co-employment arrangement between a professional employer organization and its worksite employees may require us to change the manner in which we conduct some aspects of our PEO business.

In addition, changes in the manner in which health and welfare plans sponsored by PEOs or the TotalSource Health and Welfare Plan, in particular, are regulated could adversely impact the demand for our PEO offering.

Our Wisely offerings and potentially other future offerings in the payments and/or consumer space may subject us to additional laws and regulations, some of which may not be uniform and may require us to modify or restrict our offerings and decrease our potential revenue and earnings.

Failure to comply with anti-corruption laws and regulations, economic and trade sanctions, anti-money laundering laws and regulations, and similar laws could have a materially adverse effect on our reputation, results of operations or financial condition, or have other adverse consequences

2 unchanged sentences

We operate our business around the world, including in numerous developing economies where companies and government officials are more likely to engage in business practices that are prohibited by domestic and foreign laws and regulations, including the United States Foreign Corrupt Practices Act and the U.K.

Bribery Act 2010.

Such laws generally prohibit improper payments or offers of payments to foreign government officials and leaders of political parties and, in some cases, to other persons, for the purpose of obtaining or retaining business.

3 unchanged sentences

and a number of other countries in which we operate are subject to anti-money laundering laws and regulations, including, for example, The Bank Secrecy Act of 1970, as amended by the USA PATRIOT Act of 2001 (the “BSA”).

Among other things, the BSA requires certain financial institutions, including banks and money services businesses (such as national trust banks and providers of prepaid access like us), to develop and implement risk-based anti-money laundering programs, report large cash transactions and suspicious activity, and maintain transaction records.

We have registered our payroll card

business as a provider of prepaid access, and registered our ADP Trust Bank with the Treasury Department’s Financial Crimes Enforcement Network (FinCEN).

Among other things, the BSA requires certain financial institutions,

including banks and money services businesses (such as national trust banks and providers of prepaid access like us), to develop and implement risk-based anti-money laundering programs, report large cash transactions and suspicious activity, and maintain transaction records.

We have registered our payroll card business as a provider of prepaid access, and registered our ADP Trust Bank with the Treasury Department’s Financial Crimes Enforcement Network (FinCEN).

We have implemented policies and procedures to monitor and address compliance with applicable anti-corruption, economic and trade sanctions and anti-money laundering laws and regulations, and we regularly review, upgrade and enhance our policies and procedures.

7 unchanged sentences

These laws, which are not uniform, generally do one or more of the following:

regulate the collection, storage, hosting, transfer (including in some cases, the transfer outside the country of collection), processing, disclosure, use, security and retention and destruction of personal information;

regulate the collection, storage, hosting, transfer (including in some cases, the transfer outside the country of collection), processing, disclosure, use, security and

retention and destruction of personal information;

require notice to individuals of privacy practices;

1 unchanged sentence

and regulate the use or disclosure of personal information for secondary purposes such as marketing.

Under certain circumstances, some of these

laws require us to provide notification to affected individuals, clients, data protection authorities and/or other regulators in the event of a data breach.

Under certain circumstances, some of these laws require us to provide notification to affected individuals, clients, data protection authorities and/or other regulators in the event of a data breach.

In many cases, these laws apply not only to third-party transactions, but also to transfers of information among the Company and its subsidiaries.

1 unchanged sentence

As part of our overall data protection compliance program in connection with the GDPR, we implemented Binding Corporate Rules (“BCRs”) as both a data processor and data controller, which permits us to process and transfer personal data across borders in compliance with EU data protection laws.

We believe that providing insights from data, including artificial intelligence and machine learning, will become increasingly important to the value that our solutions and services deliver to our customers.

However, the ability to provide data-driven insights may be constrained by current or future regulatory requirements or ethical considerations that could restrict or impose burdensome and costly requirements on our ability to leverage data in innovative ways.

We believe that providing insights from data, including artificial intelligence (AI) and machine learning (ML), will become increasingly important to the value that our solutions and services deliver to our customers.

However, the ability to provide data-driven insights may be constrained by current or future regulatory requirements or ethical considerations, including our own published, guiding ethical principles regarding AI and ML, that could restrict or impose burdensome and costly requirements on our ability to leverage data in innovative ways.

Complying with privacy, data protection and cyber security laws and requirements, including the enhanced obligations imposed by the GDPR, our BCRs and the CCPA and CPRA, may result in significant costs to our business and require us to amend certain of our business practices.

5 unchanged sentences

Our ability to compete and our success depend, in part, upon our intellectual property.

We rely on patent, copyright, trade secret and trademark laws, and

confidentiality or license agreements with our employees, customers, vendors, partners and others to protect our intellectual property rights.

We rely on patent, copyright, trade secret and trademark laws, and confidentiality or license agreements with our employees, customers, vendors, partners and others to protect our intellectual property rights.

We may need to devote significant resources, including cybersecurity resources, to monitoring our intellectual property rights.

9 unchanged sentences

We may also be obligated to indemnify our customers, vendors or partners in connection with any such claim or litigation.

Even if we were to prevail in such a dispute, any litigation regarding our intellectual property could be costly and time-consuming.

Even if we were to prevail in such a dispute, any litigation could be costly and time-consuming.

SECURITY AND TECHNOLOGY RISKS

Our businesses collect, host, store, transfer, process, disclose, use, secure and retain and dispose of personal and business information, and collect, hold and transmit client funds, and a security or privacy breach may damage or disrupt our businesses, result in the disclosure of confidential information, damage our reputation, increase our costs, cause losses and materially adversely affect our results of operations

staff, including payroll information, health care information, personal and business financial data, social security numbers and their foreign equivalents, bank account numbers, tax information and other sensitive personal and business information.

We also collect significant amounts of funds from the accounts of our clients and transmit them to their employees, taxing authorities and others.

In connection with our business, we collect, host, store, transfer, process, disclose, use, secure and retain and dispose of large amounts of personal and business information about our clients, employees of our clients, our vendors and our employees, contractors and temporary staff, including payroll information, health care information, personal and business financial data, social security numbers and their foreign equivalents, bank account numbers, tax information and other sensitive personal and business information.

We also collect significant amounts of funds from the accounts of our clients and transmit them to their employees, taxing authorities and other third parties.

We are focused on ensuring that we safeguard and protect personal and business information and client funds, and we devote significant resources to maintain and regularly update our systems and processes.

Nonetheless, the global environment continues to grow increasingly hostile as attacks on information technology systems continue to grow in frequency, complexity and sophistication, and we are regularly targeted by unauthorized parties using malicious tactics, code and viruses.

Certain of these malicious parties may be state-sponsored and supported by significant financial and technological resources.

Certain of these malicious parties may be state-sponsored and/or supported by significant financial and technological resources.

Although this is a global problem, it may affect our businesses more than other businesses because malevolent parties (including our personnel) may focus on the amount and type of personal and business information that our businesses collect, host, store, transfer, process, disclose, use, secure and retain and dispose of, and the client funds that we collect and transmit.

We have programs and processes in place to prevent, detect and respond to data or cyber security incidents.

We have programs and processes in place to prevent, detect and respond to data or cybersecurity incidents.

However, because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently, are increasingly more complex and sophisticated and may be difficult to detect for long periods of time, we may be unable or fail to anticipate these techniques or implement adequate or timely preventive or responsive measures.

Our ability to address cyber security incidents may also depend on the timing and nature of assistance that may be provided from relevant governmental or law enforcement agencies.

Our ability to address data or cybersecurity incidents may also depend on the timing and nature of assistance that may be provided from relevant governmental or law enforcement agencies.

Hardware, software, applications or services that we develop or procure from third parties, or are required by third parties such as foreign governments to install on our systems, may contain defects in design or manufacture or other problems that could (or, in respect of third-party software, may be designed to) compromise the confidentiality, integrity or availability of data or our systems.

Unauthorized parties also attempt to gain access to our systems or facilities, or those of third parties with whom we do business, through fraud, trickery, or other methods of deceiving these third parties or our personnel, including phishing and other social engineering techniques whereby attackers use end-user behaviors to distribute computer viruses and malware into our systems or otherwise compromise the confidentiality, integrity or availability of data on our systems.

As these threats continue to evolve and increase, we continue to invest significant resources, and may be required to invest

significant additional resources, to modify and enhance our information security and controls and to investigate and remediate any security vulnerabilities.

In addition, while our operating environments are designed to safeguard and protect personal and business information, we may not have the ability to monitor the implementation or effectiveness of any safeguards by our clients, vendors or partners and, in any event, third parties may be able to circumvent those security measures.

Information obtained by malevolent parties resulting from successful attacks against our clients, vendors, partners or other third parties may, in turn, be used to attack our information technology systems.

Any cyberattack, unauthorized intrusion, malicious software infiltration, network disruption, denial of service, corruption of data, theft of non-public or other sensitive information, or similar act by a malevolent party (including our personnel), or inadvertent acts or inactions by our vendors, partners or personnel, could result in the loss, disclosure or misuse of confidential personal or business information or the theft of client or ADP funds, and could have a materially adverse effect on our business or results of operations or that of our clients, result in liability, litigation, regulatory investigations and sanctions or a loss of confidence in our ability to serve clients, or cause current or potential clients to choose another service provider.

computer viruses and malware into our systems or otherwise compromise the confidentiality, integrity or availability of data or our systems.

As these threats continue to evolve and increase, we continue to invest significant resources, and may be required to invest significant additional resources, to modify and enhance our information security and controls and to investigate and remediate any security vulnerabilities.

In addition, while our operating environments are designed to safeguard and protect confidential personal and business information, we may not have the ability to monitor the implementation or effectiveness of any safeguards by our clients, vendors or partners and, in any event, third parties may be able to circumvent those security measures.

Information obtained by malevolent parties (including our personnel) resulting from successful attacks against our clients, vendors, partners or other third parties may, in turn, be used to attack our information technology systems.

Any cyberattack, unauthorized intrusion, malicious software infiltration, network disruption, denial of service, corruption of data, ransomware attack, theft of non-public or other sensitive information, or similar act by a malevolent party (including our personnel), or inadvertent acts or inactions by our vendors, partners or personnel, could result in the loss, disclosure or misuse of confidential personal or business information or the theft of client or ADP funds, and could have a materially adverse effect on our business or results of operations or that of our clients, result in liability, litigation, regulatory investigations and sanctions or a loss of confidence in our ability to serve clients, or cause current or potential clients to choose another service provider.

As the global environment continues to grow increasingly hostile, the security of our operating environment is ever more important to our clients and potential clients.

As a result, the breach or perceived breach of our security systems could result in a loss of confidence by our clients or potential clients and cause them to choose another service provider, which could have a materially adverse effect on our business.

Although we believe that we maintain a robust program of information security and controls and none of the data or cyber security incidents that we have encountered to date have materially impacted us, a data or cyber security incident could have a materially adverse effect on our business, results of operations, financial condition and reputation.

Although we believe that we maintain a robust program of information security and controls and none of the data or cybersecurity incidents that we have encountered to date have materially impacted us, a data or cyber security incident could have a materially adverse effect on our business, results of operations, financial condition and reputation.

While ADP maintains insurance coverage that, subject to policy terms and conditions and a significant self-insured retention, is designed to address losses or claims that may arise in connection with certain aspects of data and cyber risks, such insurance coverage may be insufficient to cover all losses or all types of claims that may arise in the continually evolving area of data and cyber risk.

1 unchanged sentence

Many of our businesses are highly dependent on our ability to process, on a daily basis, a large number of complicated transactions.

We rely heavily on our payroll, financial,

accounting, and other data processing systems.

We rely heavily on our payroll, financial, accounting, and other data processing systems.

We need to properly manage our systems, applications and solutions, and any upgrades, enhancements and expansions we may undertake from time to time, in order to ensure they properly support our businesses.

If any of these systems, applications or solutions fails to operate properly or becomes disabled even for a brief period of time, whether due to malevolent acts, errors, defects or any other factor(s), we could suffer financial loss, a disruption of our businesses, liability to clients, loss of clients, regulatory intervention or damage to our reputation, any of which could have a materially adverse effect on our results of operation or financial condition.

From time to time, these systems, applications or solutions fail to operate properly or become disabled.

Any such failure or disablement, even for a brief period of time, whether due to malevolent acts, errors, defects or any other factor(s), could result in financial loss, a disruption of our businesses, liability to clients, loss of clients, regulatory intervention or damage to our reputation, any of which could have a materially adverse effect on our results of operation or financial condition.

We have disaster recovery, business continuity, and crisis management plans and procedures designed to protect our businesses against a multitude of events, including natural disasters, military or terrorist actions, power or communication failures, or similar events.

Despite our preparations, our plans and procedures may not be successful in preventing or mitigating the loss of client data, service interruptions, disruptions to our operations, or damage to our important facilities.

A disruption of the data centers or cloud-computing services that we utilize could have a materially adverse effect on our business

We host our applications and serve our clients with data centers that we operate, and with data centers that are operated, and cloud-computing services that are provided, by third-party vendors.

If any of these data centers or cloud-computing services fails, becomes disabled or is disrupted, even for a limited period of time, our businesses could be disrupted and we could suffer financial loss, liability to clients, loss of clients, regulatory intervention or damage to our reputation, any of which could have a material adverse effect on our results of operation or financial condition.

In addition, our third-party vendors may cease providing data center facilities or cloud-computing services, elect to not renew their agreements with us on commercially reasonable terms or at all, breach their agreements with us or fail to satisfy our expectations, which could disrupt our operations and require us to incur costs which could materially adversely affect our results of operation or financial condition.

Despite our preparations, our plans and procedures may not be successful in preventing or mitigating the loss of client data or funds, service interruptions, disruptions to our operations, or damage to our important facilities.

In addition, the severity of the failure or disablement may require us to replace or rebuild the affected system(s), application(s) or solution(s) and we may be unable to do so before it materially adversely affects our business.

A disruption of the data centers or cloud-computing or other technology services or systems that we utilize could have a materially adverse effect on our business

We host our applications and serve our clients with data centers that we operate, and with data centers that are operated, and cloud-computing and other technology services and systems that are provided, by third-party vendors.

These data centers or cloud-computing and other technology services and systems have (and, in the future, may) failed, become disabled or been disrupted.

Any failure, disablement or disruption, even for a limited period of time, could disrupt our businesses and we could suffer financial loss, liability to clients, loss of clients, regulatory intervention or damage to our reputation, any of which could have a material adverse effect on our results of operation or financial condition.

In addition, our third-party vendors may cease providing data center facilities or cloud-computing or other technology services or systems, elect to not renew their agreements with us on commercially reasonable terms or at all, breach their agreements with us or fail to satisfy our expectations, which could disrupt our operations and require us to incur costs which could materially adversely affect our results of operation or financial condition.

BUSINESS AND INDUSTRY RISKS

1 unchanged sentence

Our businesses operate in industries that are subject to rapid technological advances and changing client needs and preferences.

In order to remain competitive and responsive to client demands, we continually upgrade, enhance, and expand our technology, solutions and

In order to remain competitive and responsive to client demands, we continually upgrade, enhance, and expand our technology, solutions and services.

If we fail to respond successfully to technology challenges and client needs and preferences, the demand for our solutions and services may diminish.

8 unchanged sentences

These initiatives, or our failure to successfully manage them, could result in unintended consequences or unforeseen costs, including distraction of our management and employees, attrition, inability to attract or retain key personnel, and reduced employee productivity, which could adversely affect our business, financial condition, and results of operations.

A major natural disaster or catastrophic event could have a materially adverse effect on our business, financial condition and results of operations, or have other adverse consequences

Our business, financial condition, results of operations, access to capital markets and borrowing costs may be adversely affected by a major natural disaster or catastrophic event, including civil unrest, geopolitical instability, war, terrorist attack, pandemics or other (actual or threatened) public health emergencies such as the recent COVID-19 outbreak, or other events beyond our control, and measures taken in response thereto.

A major natural disaster or catastrophic event could have a materially adverse effect on our business, financial

condition and results of operations, or have other adverse consequences

Our business, financial condition, results of operations, access to capital markets and borrowing costs may be adversely affected by a major natural disaster or catastrophic event, including civil unrest, geopolitical instability, war, terrorist attack, pandemics or other (actual or threatened) public health emergencies such as the COVID-19 outbreak, or other events beyond our control, and measures taken in response thereto.

The COVID-19 outbreak created, and such other events may create, significant volatility and uncertainty and economic and financial market disruption.

9 unchanged sentences

Our business is also impacted by employment levels across our clients, as we have varied contracts throughout our business that blend base fees and per-employee fees.

The COVID-19 outbreak had a significant impact on our clients and, as a result, negatively impacted our revenue and new business bookings.

Our bookings were also adversely affected by the impact of the outbreak on the buying behavior of our clients and prospects, coupled with the inability of our sales force to engage with clients and prospects on an in-person basis and instead primarily leveraging virtual interactions.

The COVID-outbreak pandemic may also have long-term effects on the nature of the office environment and remote working, which may present operational and workplace culture challenges that may adversely affect our business.

The COVID-19 outbreak may have long-term effects on the nature of the office environment and remote working, which may present operational and workplace culture challenges that may adversely affect our business.

Political, economic and social factors may materially adversely affect our business and financial results

Trade, monetary and fiscal policies, and political and economic conditions may substantially change, and credit markets may experience periods of constriction and volatility.

When there is a slowdown in the economy, employment levels and interest rates may decrease with a corresponding impact on our businesses.

A slowdown in the economy or other negative changes, including in employment levels, the level of interest rates or the level of inflation, may have a negative impact on our businesses.

In addition, as our operating costs increase due to inflationary pressure or otherwise, we may not be able to offset these increases by corresponding price increases for our products and solutions.

Clients may react to worsening conditions by reducing their spending on HCM services or renegotiating their contracts with us, which may adversely affect our business and financial results.

11 unchanged sentences

We publicly share certain information about our environmental, social and governance (“ESG”) initiatives.

We may face increased scrutiny related to these activities, including from the investment community, and our failure to achieve progress in these areas on a timely basis, if at all, could impact our reputation, business, including employee retention, and growth.

We may face increased scrutiny related to our ESG initiatives and any related targets, including from the investment community.

In addition, our ability to achieve certain ESG initiatives and targets may depend on the actions or continuing requirements of governmental entities (e.g., our paperless initiatives may depend on whether certain states continue to require employers to offer employees to be paid via paper check or to obtain

employee consent to be paid electronically instead of via paper check).

Our failure to achieve progress in these and other ESG areas on a timely basis, or at all, could impact our reputation, business, including employee retention, and growth.

Change in our credit ratings could adversely impact our operations and lower our profitability

The major credit rating agencies periodically evaluate our creditworthiness and have given us strong, investment-grade long-term debt ratings and high commercial paper ratings.

Failure to maintain high credit ratings on long-term and short-term debt could increase our cost of borrowing, reduce our ability to obtain intra-day borrowing required

by our Employer Services business, and adversely impact our results of operations.

Failure to maintain high credit ratings on long-term and short-term debt could increase our cost of borrowing, reduce our ability to obtain intra-day borrowing required by our Employer Services business, and adversely impact our results of operations.

Our business could be negatively impacted as a result of actions by activist stockholders or others

4 unchanged sentences

We may be unable to attract and retain qualified personnel

Our ability to grow and provide our clients with competitive services is partially dependent on our ability to attract and retain highly motivated people with the skills to serve our clients and reflecting diverse perspectives and the diversity of our communities and clients.

Competition for skilled employees in the outsourcing and other markets in which we operate is intense and, if we are unable to attract and retain highly skilled, motivated and diverse personnel, results of our operations and culture may suffer.

Our ability to grow and provide our clients with competitive services is, to an important degree, dependent on our ability to attract and retain highly skilled and motivated people reflecting diverse perspectives and the diversity of our communities and clients.

Competition for skilled employees in the outsourcing and other markets in which we operate is increasingly intense, making it more difficult and expensive to attract and retain highly skilled, motivated and diverse personnel.

If we are unable to attract and retain highly skilled, motivated and diverse personnel, results of our operations and culture may suffer.

Unresolved Staff Comments

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors