What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-02-20 compared with 2024-02-29 · 29 added, 31 removed, 276 unchanged (18% of the section changed)

22 unchanged sentences

Our ability to secure new engagements and hire qualified consultants as employees depends heavily on our overall reputation as well as the individual reputations of our employee consultants and principal non-employee experts.

Additionally, failure to comply with governmental, regulatory and legal requirements or with our company-wide policies could lead to

governmental or legal proceedings that could expose us to significant liabilities and damage our reputation.

Because we obtain a majority of our revenues from new engagements with existing clients, any client that is dissatisfied with our performance on a single matter could seriously impair our ability to secure new engagements.

44 unchanged sentences

Accordingly, the termination or significant reduction in the scope of a single large engagement could reduce our utilization and have an immediate adverse impact on our revenues and results of operations.

Information, technology systems or service failures, or a cybersecurity attack or other compromise of our or our client's confidential or proprietary information, could have a material adverse effect on our reputation, business and results of operations

We rely upon our information and technology infrastructure and systems to operate, manage and run our business and to provide services to our clients.

Information, technology systems or service failures, or a cybersecurity incident or other compromise of our or our client's confidential or proprietary information, as well as any violation of data protection laws, could have a material adverse effect on our reputation, business and results of operations

We rely upon our information and technology infrastructure and systems, including from third parties, to operate, manage and run our business and to provide services to our clients.

This includes infrastructure and systems for receiving, storing, hosting, analyzing, transmitting and securing our and our clients' sensitive, confidential or proprietary information, including, but not limited to, health and other personally-identifiable information and commercial, financial and consumer data.

Our ability to secure and maintain the confidentiality and integrity of this information is critical to our reputation and the success of our businesses.

We must comply with applicable U.S.

and foreign privacy laws and regulations, including the strict General Data Privacy Regulation ("GDPR") in the European Union, laws that adopt the GDPR as a model (such as Brazil's General Law for the Protection of Privacy), and U.S.

Our ability to secure and maintain the confidentiality, integrity and availability of both these systems and this information is critical to our reputation and the success of our businesses.

Our information and technology systems may be affected by or subject to events that are out of our control, including, but not limited to, the possibility of disruptions or outages or cybersecurity incidents which continue to evolve (including from emerging technologies such as AI) and pose a constant risk.

Examples of these events include malicious attacks, unauthorized system intrusions by unknown third parties, viruses, malicious software, ransomware, worms, insider threats, failures in our or our third party hosting sites’ (whether hosted offsite or in the cloud) information and technology systems, unavailability of backup restoration, disruptions in the Internet or electricity grids, natural disasters, and terrorism.

Any of these events could disrupt our or our client’s business operations or cause us or our clients to incur unanticipated losses, including the costs of investigating and remediating any such event and any fines/settlements related thereto, as well as reputational damage, any of which could have a material adverse effect on our business and results of operations.

In the past we have experienced, and we anticipate we will continue to experience cybersecurity threats to our systems.

In addition, our or our clients' sensitive, confidential or proprietary information could be compromised, corrupted, or lost whether intentionally or unintentionally, by various causes such as an inadvertent disclosure or cybersecurity incident (as described above).

This client information could be compromised or corrupted because of groups that include without limitation our employees, outside consultants, vendors, or rogue third-party "hackers" or enterprises (including nation-state sponsored groups).

Any unauthorized access, corruption, or loss of clients’ information could result in our suffering claims, fines, damages, losses or reputational damage, any of which could have a material adverse effect on our business and results of operations.

Further, we also must comply with applicable U.S.

and foreign privacy laws and regulations, including the General Data Privacy Regulation ("GDPR") in the European Union and its United Kingdom equivalent, laws that adopt the GDPR as a model

(such as Brazil's General Law for the Protection of Privacy), and U.S.

state and federal laws such as the California Consumer Protection Act, and these laws are becoming increasingly complex and vary by jurisdiction.

In addition to directly applying, our clients impose contractual obligations regarding compliance with these laws.

The costs of complying with these laws and any fines resulting from lack of compliance, and the other costs of protecting our and our clients' confidential information, could have a material effect on our financial results.

In addition, our information and technology systems may be affected by or subject to events that are out of our control, including, but not limited to, cybersecurity or other malicious attacks, which continue to evolve and pose a constant risk, unauthorized system intrusions by unknown third parties, viruses, malicious software, worms, failures in our or our third party hosting sites' (whether hosted offsite or in the cloud) information and technology systems, disruptions in the Internet or electricity grids, natural disasters, and terrorism.

Any of these events could disrupt our or our client's business operations or cause us or our clients to incur unanticipated losses, including the costs of investigating and remediating any such event and any fines related thereto, as well as reputational damage, any of which could have a material adverse effect on our business and results of operations.

In addition, our or our clients' sensitive, confidential or proprietary information could be compromised or corrupted, whether intentionally or unintentionally, by our employees, outside consultants, vendors, or rogue third-party "hackers" or enterprises.

A breach or compromise of the security of our information technology systems or infrastructure, or our processes for securing sensitive, confidential or proprietary information, whether due to a cybersecurity attack or otherwise, could result

in the loss or misuse of this information.

Any such loss or misuse could result in our suffering claims, fines, damages, losses or reputational damage, any of which could have a material adverse effect on our business and results of operations.

Although we have insurance intended to provide coverage for cybersecurity incidents, data protective violations, and similar concepts, the level of coverage may not be sufficient for the event or the event may be outside of the policy’s coverage.

Potential conflicts of interests may preclude us from accepting some engagements

43 unchanged sentences

Increasing scrutiny and changing expectations from governmental organizations, investors, clients and our colleagues with respect to our ESG-related practices and those of our clients may impose additional costs on us or expose us to new or additional risks

There is increased regulation and focus, including under the European Union’s Corporate Sustainability Reporting Directive and from other governmental organizations, and our investors, clients and employees, on ESG issues such as environmental stewardship, climate change, diversity and inclusion, racial justice and workplace culture conduct.

There is varied regulation and focus on ESG matters across different jurisdictions, and stakeholder views and priorities regarding these matters continue to evolve and sometimes diverge.

The European Union’s Corporate Sustainability Reporting Directive and from other governmental organizations, and our investors, clients and employees, maintain interest in ESG issues such as environmental stewardship, climate change, and workforce development.

How these various stakeholders evaluate and prioritize different ESG initiatives may shift over time in ways that are difficult to predict.

We continue to evaluate existing, new and proposed governmental requirements, and to monitor, report and assess policies and practices that we believe will align with our client, investor and other third-party imposed ESG-related standards and expectations.

For example, organizations that provide information to investors on corporate governance and related matters have developed ratings processes for evaluating companies on their approach to ESG matters, and unfavorable ratings of the Company may lead to negative investor sentiment, stock price fluctuations and the diversion of investment to other companies.

For example, organizations that provide information to investors on corporate governance and related matters have developed ratings processes for evaluating companies on their approach to ESG matters, and their evolving methodologies and assessments may lead to negative investor sentiment, stock price fluctuations and the diversion of investment to other companies.

If our ESG practices do not meet evolving rules and regulations or investor or other stakeholder expectations and standards (or if we are viewed in a negative light based on positions we do or do not take or work we do or do not perform for certain clients or industries), then our reputation, our ability to attract or retain employee consultants and non-employee experts, and our ability to attract new engagements and clients could be negatively impacted, as could our attractiveness as an investment, service provider, business partner or acquirer.

Similarly, our failure or perceived failure to pursue or fulfill our current or future goals, targets and objectives or to satisfy various reporting standards within the timelines we announce, or at all, could also have similar negative impacts.

Additionally, the relative importance that different stakeholders place on various ESG initiatives may conflict, making it difficult to satisfy all stakeholder expectations.

Similarly, our failure or perceived failure to

pursue or fulfill our current or future goals, targets and objectives or to satisfy various reporting standards within the timelines we announce, or at all, could also have similar negative impacts.

Our revenues, operating results and cash flows are likely to fluctuate

times, the geographic locations of our clients or where the services are rendered, the length of billing and collection cycles, hiring, business and capital expenditures, share repurchases, dividends, debt repayments, and other general economic factors.

We experience fluctuations in our revenues, operating results and cash flows and expect that they will continue to occur in the future due to factors that are either within or outside of our control, including, but not limited to, the timing and duration of our client engagements, utilization of our employee consultants, the types of engagements we are working on at different times, the geographic locations of our clients or where the services are rendered, the length of billing and collection cycles, hiring, business and capital expenditures, severity of insurance claims, share repurchases, dividends, debt repayments, and other general economic factors.

We may also experience future fluctuations in our cash flows from operations because of increases in employee compensation, including changes to our incentive compensation structure and the timing of incentive payments, which we generally pay during the first quarter of each year, or hiring or retention payments or bonuses which are paid throughout the year.

25 unchanged sentences

From time to time, we are required to adopt new or revised accounting standards issued by recognized authoritative bodies, including the Financial Accounting Standards Board and the Securities and Exchange Commission.

A change in accounting standards or practices may adversely affect our reported financial results or the way we conduct our business.

A change in accounting standards or practices may adversely affect our reported

financial results or the way we conduct our business.

It may also require changes to the current accounting treatment of certain transactions and the way they are reported in our financial statements.

32 unchanged sentences

These contracts are more common in our management consulting area, and would likely grow in number with expansion of that area.

Fluctuations in the mix between time-and-material contracts, fixed-price contracts and arrangements with fees tied to performance-based criteria may result in fluctuations of revenue and results of operations.

Fluctuations in the mix between time-and-material contracts, fixed-price contracts and arrangements with fees tied to performance-based criteria may result in fluctuations

of revenue and results of operations.

In addition, if we fail to accurately estimate third-party vendor expenses and the resources required for a fixed-price project or fail to satisfy our contractual obligations in a manner consistent with the project budget, we might generate a smaller profit or incur a loss on the project.

14 unchanged sentences

Any failure by us to protect our proprietary rights, or any court determination that we have either infringed or lost ownership of proprietary rights, could adversely affect our business, operating results and financial condition.

Insurance and claims expenses could significantly reduce our profitability

We are exposed to claims related to group health insurance.

We self-insure a portion of the risk associated with these claims.

If the number or severity of claims increases, or we are required to accrue or pay additional amounts because the claims prove to be more severe than our original assessment, our operating results would be adversely affected.

Our future insurance and claims expense might exceed historical levels, which could reduce our earnings.

We expect to periodically assess our self-insurance strategy.

We are required to periodically evaluate and adjust our claims reserves to reflect our experience.

However, ultimate results may differ from our estimates, which could result in losses over our reserved amounts.

We maintain individual and aggregate medical plan stop loss insurance with a licensed insurance carrier to limit our ultimate risk exposure for any one case and for our total liability.

Many businesses are experiencing the impact of increased medical costs as well as greater variability in ongoing costs.

As a result, our insurance and claims expense could increase, or we could raise our self-insured retention, when our policies are renewed.

If these expenses increase or we experience a claim for which coverage is not provided, results of our operations and financial condition could be materially and adversely affected.

Risks Related to Our Competition

10 unchanged sentences

Our international operations carry financial and business risks, including:

• currency fluctuations that could adversely affect our financial position and operating results;

• adverse social, political and economic conditions, such as inflation, rising interest rates and risk of global or regional recession;

66 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors