What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-03-06 compared with 2025-03-13 · 91 added, 28 removed, 287 unchanged (29% of the section changed)

36 unchanged sentences

If we fail to comply with the covenants in our credit agreement, we may have to seek an amendment or waiver from our lenders to avoid the termination of their commitments and/or the acceleration of the maturity of outstanding amounts under the credit facility.

The cost of our obtaining an amendment or waiver could be significant, and further, there can be no assurance that we would be able to obtain an amendment or waiver.

The cost of our obtaining an

amendment or waiver could be significant, and further, there can be no assurance that we would be able to obtain an amendment or waiver.

If our lenders were unwilling to enter into an amendment or provide a waiver, all amounts outstanding under our credit facility would become immediately due and payable.

6 unchanged sentences

We have risks associated with acquisitions or investments.

Since our inception, we have expanded through acquisitions.

Since our inception, we have expanded through acquisitions, including our most recent acquisition of Martino & Partners s.r.l.

(“Martino & Partners”), a strategic advisory firm serving public and private sector clients in Italy, on September 1, 2025.

In the future, we plan to pursue additional acquisitions and investments as opportunities arise.

5 unchanged sentences

In integrating acquired businesses, we may not achieve expected economies of scale or profitability or realize sufficient revenue to justify our investment.

If we encounter unexpected problems as we try to integrate an acquired firm into our

business, our management may be required to expend time and attention to address the problems, which would divert their time and attention from other aspects of our business.

If we encounter unexpected problems as we try to integrate an acquired firm into our business, our management may be required to expend time and attention to address the problems, which would divert their time and attention from other aspects of our business.

We have risks associated with dispositions.

We have conducted dispositions in the past and may again in the future.

We have conducted dispositions in the past, most recently disposing of our automation business in 2024, and may again in the future.

Disposition involve risks and uncertainties, such as our ability to sell such businesses for a satisfactory price and terms and in a timely manner, or at all, potential disruptions to other parts of our organization and distraction of management, the reallocation of internal resources that would otherwise be devoted to completing strategic acquisitions, potential losses of key employees or customers, exposure to unanticipated liabilities, any ongoing obligations to support the business following any such disposition, and other adverse financial impacts.

12 unchanged sentences

We may not be successful in our artificial intelligence initiatives, which could adversely affect our business, reputation or financial results.

Artificial Intelligence (“AI”) presents new risks and challenges that may affect our business.

Artificial intelligence presents new risks and challenges that may affect our business.

We have made, and expect to continue to make, investments to integrate AI and machine learning technology into our services.

4 unchanged sentences

For example, privacy concerns, user consent, supply chain security, transparency and the accuracy, completeness and suitability of data sets are all potential issues that could adversely affect our business, reputation or financial results.

The development, deployment, and use of artificial intelligence technologies, including generative AI, involve significant legal, regulatory, operational, ethical and commercial risks, any of which could materially and adversely affect our business, financial condition, results of operations and reputation.

We are increasing our use of AI across our service delivery, advisory offerings and internal operations.

AI technologies are at an early stage of development and present uncertainties regarding reliability, accuracy, explainability, data governance and long-term economic viability.

Although we are dedicating resources to AI-related investments, training and partnerships, we may be unable to develop, procure, implement, or maintain AI tools and capabilities in a manner that meets client requirements, complies with applicable laws or produces anticipated operational or financial benefits.

AI systems may generate outputs that are inaccurate, biased, incomplete, unpredictable or otherwise unintended.

Such outcomes could result in operational failures, adverse client impacts, misinformed decision-making, or reputational harm.

Any failure by us—or by third parties whose tools or data we use—to appropriately design, test, validate, monitor or govern AI systems could expose us to contractual claims, indemnification demands, regulatory enforcement, litigation, financial penalties or other liabilities.

The regulatory framework governing AI is rapidly evolving and varies significantly across jurisdictions in which we operate.

New or amended laws, regulations, standards or guidance may impose additional obligations on the development, use, auditing or documentation of AI systems, restrict certain uses of AI, require enhanced disclosures, or create new liabilities.

Compliance with such frameworks may require substantial investment in governance, controls, reporting processes and oversight mechanisms.

Failure to comply—whether actual or perceived—may result in investigations, fines, operational restrictions, adverse publicity or loss of client trust.

Our competitive position may be adversely affected by rapid technological change and heightened competition related to AI.

Competitors, including global consultancies, technology vendors, hyperscalers and emerging AI-native firms, may introduce capabilities that exceed or supplant our own.

Clients may accelerate internal development of AI capabilities that reduce demand for our services.

AI and automation may also diminish the need for certain services currently provided by our personnel, and we may not be able to adjust our delivery model, pricing, staffing, training or organizational structure in a timely or cost-effective manner.

In addition, our AI capabilities depend on access to third-party infrastructure, data sets, cloud environments, software, models and specialized hardware.

Supply constraints, increased pricing, licensing limitations, service interruptions, security vulnerabilities and/or incidents, or changes in contractual terms could materially impair our ability to develop, deliver or support AI-related services.

Uncertainties regarding ownership, licensing or permissible use of training data, model outputs or other intellectual property may expose us to disputes, forced modifications, operational delays or damages.

Any of the foregoing factors—individually or collectively—could materially and adversely affect our business, financial condition, results of operations and reputation.

Our engagements may be terminated, delayed or reduced in scope by clients at any time.

13 unchanged sentences

● strategic decisions by us, our clients or our competitors, such as acquisitions, divestitures, spin-offs, joint ventures, strategic investments or changes in business strategy;

● global economic and political conditions and related risks, including acts of terrorism, war, such as the war in Ukraine and the conflict in the Middle East, pandemics, inflation, slowing growth, rising interest rates and recession;

● global economic and political conditions and related risks, including acts of terrorism, war, pandemics, inflation, slowing growth, rising interest rates and recession;

● conditions in the travel industry that could prevent our advisors from traveling to client sites.

7 unchanged sentences

Any material declines in our ability to secure new advisory arrangements could have an adverse impact on our revenues and financial condition.

Clients’ failure or inability to pay for our services, whether on a timely basis or at all, could materially, adversely affect our results of operations and financial condition.

As further described in Note 2 to the Consolidated Financial Statements, “Summary of Significant Account Policies – Accounts Receivable, Contract Assets and Allowance for Doubtful Accounts,” the Company has been engaged in litigation with certain clients who have either failed to make payments as per the contracted payment schedule or have disputed account receivable balances for services rendered.

While we maintain an allowance for doubtful accounts for estimated losses resulting from the inability of clients to pay fees or for disputes that affect our ability to fully collect billed accounts receivable, our actual experience may vary from these estimates, and there is no guarantee that such allowance will ultimately be sufficient.

We may be required to record additional allowances or write offs in future periods, which, in turn, could adversely impact our financial condition and results of operation.

Moreover, while the Company continues to aggressively pursue legal action and/or collection against clients who dispute charges or fail to make payments, there is no guarantee that the Company’s legal actions will be successful, that actual collections from clients will reflect the Company’s estimate of amounts owed, and/or that the Company will be able to recoup legal fees expended on such actions.

If we are unable to achieve or maintain adequate utilization for our consultants, our operating results could be adversely impacted.

58 unchanged sentences

We derive a significant portion of our revenues from our largest clients and could be materially and adversely affected if we lose one or more of our large clients.

Our 25 largest clients accounted for approximately 30% and 33% of revenue in 2024 and 2023, respectively.

Our 25 largest clients accounted for approximately 30% of revenue in both 2025 and 2024.

If one or more of our large clients terminate, significantly reduce their engagement or fail to remain a viable business, then our revenues could be materially and adversely affected.

4 unchanged sentences

Connors, Chairman and Chief Executive Officer;

Lavieri, Vice Chairman and President – ISG Americas and Asia Pacific;

Lavieri, Vice Chairman and President – ISG Americas and Asia

Sherrick, Executive Vice President and Chief Financial Officer;

25 unchanged sentences

Our international operations expose us to a variety of risks that could negatively impact our future revenue and growth.

Approximately 36% of our revenues for 2024 and 39% of our revenue for 2023 were derived from sales outside of the Americas.

Approximately 34% of our revenues for 2025 and 36% of our revenues for 2024 were derived from sales outside of the Americas.

Our operating results are subject to the risks inherent in international business activities, including:

7 unchanged sentences

● restrictions on the repatriation of profits or payment of dividends;

● crime, strikes, riots, civil disturbances, pandemics, terrorist attacks and wars, such as the war in Ukraine and the conflict in the Middle East;

● crime, strikes, riots, civil disturbances, pandemics, terrorist attacks and wars;

● nationalization or expropriation of property;

10 unchanged sentences

This may affect our relationships with our clients and could have an adverse effect on our business.

Changes to trade policy, including new or increased tariffs and changing import/export regulations, may adversely affect our business, financial condition and results of operations .

Changes in U.S.

or international laws and policies governing foreign trade could materially and adversely affect our business.

has instituted certain changes, and has proposed additional changes, in trade policies that include the negotiation or termination of trade agreements, the imposition of higher tariffs on imports into the U.S.

and other government regulations affecting trade between the U.S.

and other countries where we conduct our business.

The new tariffs and other changes in U.S.

trade policy have triggered retaliatory actions by affected countries, and foreign governments have instituted, or are considering imposing, trade sanctions on U.S.

The imposition of tariffs and other trade restrictions, as well as the escalation of trade disputes and any downturns in the global economy resulting therefrom, could materially and adversely affect our business, financial condition and results of operations.

The extent and duration of the tariffs and other trade restrictions and the resulting impact on general economic conditions and on our business are uncertain and depend on various factors, such as negotiations between the U.S.

and affected countries, the responses of other countries or regions, exemptions or exclusions that may be granted, the availability and cost of alternative sources of supply and demand for our services in affected markets.

We operate in a number of international areas which exposes us to significant foreign currency exchange rate risk.

4 unchanged sentences

Risks Related to Data, Cybersecurity and Confidential Information

Data protection laws and self-regulatory codes may restrict our activities and increase our costs.

Various statutes and rules regulate conduct in areas such as privacy and data protection that may affect our collection, use, storage, and transfer of information both abroad and in the United States.

Data protection and emerging cybersecurity laws and self-regulatory codes may restrict our activities and increase our costs.

Various statutes and rules regulate conduct in areas such as privacy, data protection, and cybersecurity that may affect our collection, use, storage, and transfer of information both abroad and in the United States.

Compliance with these laws and self-regulatory codes may require us to make certain investments or may dictate that we not offer certain types of services or only offer such services after making necessary modifications.

Failure to comply with these laws and self-regulatory codes may result in, among other things, civil and criminal liability, negative publicity, restrictions on further use of data and/or liability under contractual warranties.

Moreover, these laws and regulations impose operational requirements, including disclosures to consumers about personal data practices, opt-out and consent choices and required contractual terms with certain third parties, and obligations to provide notice to individuals, third parties, and/or regulators in the event of certain cybersecurity incidents involving personal data.

In addition, there is an increasing public concern regarding data and consumer protection issues, with the result that the number of jurisdictions with data protection laws continues to increase and the scope of existing privacy laws and the data considered to be covered by such laws keeps expanding.

Changes in these laws (including newly released interpretations of these laws by courts and regulatory bodies) may limit our client data access, use and disclosure, and may require increased expenditures by us or may dictate that we may not offer certain types of services.

Changes in these laws (including newly released interpretations of these laws by courts and regulatory bodies)

may limit our client data access, use and disclosure, and may require increased expenditures by us or may dictate that we may not offer certain types of services.

As a global company, ISG must comply with various international and domestic data privacy regulations such as (i) the EU and UK General Data Protection Regulation (“GDPR”), which has extra-territorial scope and substantial fines for breaches (up to 4% of global annual revenue or €20 million, whichever is greater), (ii) the California Consumer Privacy Act, which, unlike data privacy provisions enacted by other US states, covers individuals acting in a commercial or employment context not just as consumers, and (iii) the Australian Privacy Act, among others.

In addition, the new India Digital Personal Data Protection Act 2023 (“DPDP”) draft rules are out for consultation, which closed in February 2025.

The DPDP is anticipated to come into force within two years.

Like the GDPR, the DPDP has extra-territorial reach.

The DPDP shares many provisions with existing privacy laws, and ISG therefore anticipates that its existing processes already broadly align with the new law.

However, like the GDPR, failure to comply with the DPDP may lead to substantial fines.

ISG is continuing to monitor the development of the EU’s ePrivacy Regulation and published guidelines to determine whether further action as required.

In addition, India’s Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules 2025 (the “Rules”) November 13, 2025, operationalizing the Digital Personal Data Protection Act 2023 (“DPDPA”) enacted by the Parliament of India in August 2023.

Companies operating in India must meet the DPDPA’s core compliance obligations, which includes reporting data breaches within seventy-two hours, appointing consent managers and data protection officers, and implementing systems for express user permission, within a phased twelve-to-eighteen-month timeline.

Like the GDPR, the DPDPA has extra-territorial reach.

The DPDPA shares many provisions with existing privacy laws, and ISG therefore anticipates that its existing processes already broadly align with the law.

However, like the GDPR, failure to comply with the DPDPA may lead to substantial fines.

ISG is also continuing to monitor the development of and public guidelines regarding the EU’s ePrivacy Regulation to determine whether further action is required.

To mitigate the risk and negative exposure of data outside ISG, we have put in place a data protection framework that includes policies, procedures, guidance and records.

2 unchanged sentences

A significant portion of our business is conducted over the internet, and we rely on the secure processing, storage and transmission of confidential, sensitive, proprietary and other types of information relating to our business operations and confidential and sensitive information about our clients and employees in our computer systems and networks, and in those of our third-party vendors.

Individuals, groups and state-sponsored organizations may take steps that pose threats to our operations, our computer systems, our employees, and our clients.

Individuals, groups, state-sponsored organization, and actors utilizing AI may take steps that pose threats to our operations, our computer systems, our employees, and our clients.

The cybersecurity risks we face range from cyberattacks common to most industries, such as the development and deployment of malicious software to gain access to our networks and attempt to steal confidential information, launch distributed denial of service attacks or attempts at other coordinated disruptions, to more advanced threats that target us because of our prominence in the global research and advisory field.

6 unchanged sentences

However, given the complex, continuing and evolving nature of cyber and other security threats, these efforts may not be fully effective, particularly against previously unknown vulnerabilities that could go undetected for an extended period.

We also face risks related to our use of third-party suppliers if such suppliers are affected by a cybersecurity threat or incident, which could result in a reduction in or loss of their ability to service us (which could be a significant component of our services to clients), the exposure of ISG or client data or a potential backdoor into ISG’s systems and network.

We also face risks related to our use of third-party suppliers, with whom we may share data and operational systems.

If such suppliers are affected by a cybersecurity threat or incident, it could result in not only a reduction in or loss of their ability to service us (which could be a significant component of our services to clients) but also the exposure of ISG or client data or a potential backdoor into ISG’s systems and network.

We are exposed to risks related to artificial intelligence.

We recognize that our use of AI introduces risks related to data protection, cybersecurity, model integrity, confidentiality and operational reliability.

In particular, our use of AI technologies may expose us to errors, data quality issues, security vulnerabilities, or other harms, especially as these technologies can behave unpredictably, fail, or produce inaccurate or biased outputs.

Failures in oversight, system design, or data quality could result in various harms to us or our clients, including, but not limited to, operational disruptions, security or privacy incidents, and/or reputational challenges.

Because AI systems can be complex and difficult to fully evaluate or audit, we may be unable to detect errors or vulnerabilities in a timely manner.

If we are unable to effectively implement, monitor, and manage these technologies, our business, financial condition, and results of operations could be adversely affected.

In light of these risks, we have established governance processes intended to support the responsible evaluation, approval, deployment and monitoring of AI tools used in our internal operations and in client delivery.

These processes include review mechanisms

for higher-risk AI use cases, defined roles and responsibilities for management oversight, and coordination among our information security, legal, compliance and risk management functions.

Our Board of Directors, through its designee, the Information Security Committee (“ISC”), receives periodic updates from management regarding emerging AI-related risks, regulatory developments, and the potential impact of AI on our operations, technology environment and risk profile.

Management is responsible for implementing controls, policies, training and monitoring procedures relevant to AI technologies, including restrictions on the use of unapproved or public AI tools that may create confidentiality, cybersecurity or compliance risks.

As AI technologies and associated global and domestic laws and regulations continue to evolve, we may be required to, among other things:

enhance our governance frameworks, controls, documentation and reporting practices, increase our compliance costs;

and/or limit our use of certain technologies.

There can be no assurance that our processes will be sufficient to prevent or mitigate all AI-related risks, and failures or limitations in these processes could have a material adverse effect on our operations, reputation or regulatory posture.

Moreover, any failure to comply with emerging AI regulatory frameworks could result in enforcement actions, fines, or other adverse consequences.

We may be subject to claims for substantial damages by our clients arising out of disruptions to their businesses or inadequate service, and our insurance coverage may be inadequate.

1 unchanged sentence

Failure to consistently meet the service requirements of a client or errors made by our employees while delivering services to our clients could disrupt the client’s business and result in a reduction in revenues or a claim for damages against us.

Additionally,

we could incur liability if a process we manage for a client was to result in internal control failures or impair our client’s ability to comply with their own internal control requirements.

Additionally, we could incur liability if a process we manage for a client was to result in internal control failures or impair our client’s ability to comply with their own internal control requirements.

Under our service agreements with our clients, our liability for breach of our obligations is generally limited to actual damages suffered by the client and is typically capped at the greater of an agreed amount or the fees paid or payable to us under the relevant agreement.

18 unchanged sentences

As part of our continuous improvement in our third-party risk management process, we engage the services of a third-party risk monitoring service to monitor threat intelligence and known vulnerabilities.

Although we seek to prevent, detect, and investigate cybersecurity threats and incidents, and have taken steps to mitigate the likelihood of network security breaches, there can be no assurance that attacks by unauthorized users will not be attempted in the future or that our security measures will be effective.

that our security measures will be effective.

Unauthorized disclosure of sensitive or confidential client data, whether through breach of our processes, systems or otherwise, could subject us to liability, damage our reputation and cause us to lose existing and potential clients.

8 unchanged sentences

Failure to maintain effective internal control over financial reporting could adversely affect our business and the market price of our common stock.

Pursuant to rules adopted by the SEC implementing Section 404 of the Sarbanes Oxley Act of 2002, we are required to assess the effectiveness of our internal control over financial reporting and provide a management report on our internal control over financial reporting

in all annual reports.

This report contains, among other matters, a statement as to whether or not our internal control over financial reporting is effective and the disclosure of any material weaknesses in our internal control over financial reporting identified by management.

20 unchanged sentences

Any failure to successfully implement our operating strategy or the occurrence of any of the events or circumstances set forth in this Annual Report on Form 10-K could result in the actual operating results being different than the guidance, and such differences may be adverse and material.

We may experience employment-related claims, commercial indemnification claims and other legal proceedings that could materially harm our business.

We currently are, and may again in the future be, subject to employment-related claims in certain of the jurisdictions in which we operate, including claims of wage and hour violations.

We incur a risk of liability for claims relating to employment-related matters, contractual obligations, government inquiries and other claims.

Some or all of these claims may give rise to litigation or settlements, which may cause us to incur costs or have other material adverse impacts on our financial statements.

Additionally, new employment and labor laws and regulations may be proposed or adopted in the jurisdictions in which we operate that may increase the potential exposure of employers to employment-related claims and litigation.

Certain clients have negotiated broad indemnification provisions regarding the services we provide.

In addition, we may have liability to our clients for the action or inaction of our consultants that may cause harm to our clients or third parties.

In some cases, we must indemnify our clients for certain acts of our consultants or arising from our consultants’ presence on the client’s job site.

We may also incur fines, penalties, and losses that are not covered by insurance or negative publicity with respect to these matters.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors