What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2024-03-08 compared with 2023-03-10 · 69 added, 53 removed, 237 unchanged (34% of the section changed)

3 unchanged sentences

We urge you to consider carefully the factors described below and the risks that they present for our operations, as well as the risks addressed in other reports and materials that we file with the SEC and the other information included or incorporated by reference in this Form 10-K.

When the factors, events and contingencies described below or elsewhere in this Form 10-K materialize there could be a material adverse impact on our business, prospects, results of operations, financial condition and cash flows, and could therefore have a potential negative effect on the trading price of our common stock.

When the factors, events and contingencies described below or elsewhere in this Form 10-K materialize, there could be a material adverse impact on our business, prospects, results of operations, financial condition and cash flows, any of which could have a potential negative effect on the trading price of our common stock.

Additional risks not currently known to us or that we now deem immaterial may also harm us and negatively affect your investment.

7 unchanged sentences

(6) risks related to data, cybersecurity and confidential information;

and (7) general risks.

and (7) general risk factors.

Many risks affect more than one category, and the risks are not in order of significance or probability of occurrence because they have been grouped by categories.

1 unchanged sentence

We have a substantial amount of debt outstanding, which may limit our ability to fund general corporate requirements and obtain additional financing, limit our flexibility in responding to business opportunities and competitive developments and increase our vulnerability to adverse economic and industry conditions and changes in our debt rating.

On March 10, 2020, the Company amended and restated its senior secured credit facility (the “2020 Credit Agreement”) to include an $86.0 million term facility and to increase the revolving commitments per the revolving facility from $30.0 million to $54.0 million.

As a result of the substantial fixed costs associated with the debt obligations, we expect that:

On February 22, 2023, the Company amended and restated its senior secured credit facility to increase the revolving commitments per the revolving facility (the “2023 Credit Agreement”) from $54.0 million to $140.0 million and eliminate its term loan.

As a result of the substantial variable costs associated with the debt obligations, we expect that:

a decrease in revenues will result in a disproportionately greater percentage decrease in earnings;

we may not have sufficient liquidity to fund all of these fixed costs if our revenues decline or costs increase;

we may have to use our working capital to fund these fixed costs instead of funding general corporate requirements, including capital expenditures;

we may not have sufficient liquidity to fund all of these variable costs if our revenues decline or costs increase;

we may have to use our working capital to fund these variable costs instead of funding general corporate requirements, including capital expenditures;

we may not have sufficient liquidity to respond to business opportunities, competitive developments and adverse economic conditions;

5 unchanged sentences

A failure to pay interest or indebtedness when due could result in a variety of adverse consequences, including the acceleration of our indebtedness.

In such a situation, it is unlikely that we would be able to fulfill our obligations under, repay the accelerated indebtedness or otherwise cover our fixed costs.

As of December 31, 2022, the total principal outstanding under the term loan facility and revolving credit facility was $70.2 million and $9.0 million, respectively.

On February 22, 2023, the Company entered into a third amended and restated senior secured credit facility comprising a $140.0 million revolving credit facility, amending and restating the 2020 Credit Agreement.

In such a situation, it is unlikely that we would be able to fulfill our obligations, repay the accelerated indebtedness or otherwise cover our fixed costs.

As of December 31, 2023, the total principal outstanding under the revolving credit facility was $79.2 million.

Our failure to comply with the covenants in our credit agreement could materially and adversely affect our financial condition and liquidity.

Our credit agreement contains financial covenants requiring that we maintain, among other things, certain levels of debt coverage and fixed charges.

Our credit agreement contains financial covenants requiring that we maintain, among other things, certain leverage and interest coverage ratios.

Poor financial performance could cause us to be in default of these covenants.

3 unchanged sentences

If our lenders were unwilling to enter into an amendment or provide a waiver, all amounts outstanding under our credit facility would become immediately due and payable.

Our variable rate indebtedness will subject us to interest rate risk, which could cause our annual debt service obligations to increase significantly.

Borrowing under our credit facility bears interest at a rate per annum equal to either (i) the “Base Rate” (which is the highest of (a) the rate publicly announced from time to time by the administrative agent as its “prime rate,” (b) the Federal Funds Rate plus 0.5% per annum and (c) Term SOFR, plus 1.0%), plus the applicable margin (as defined below) or (ii) Term SOFR (which is the Term SOFR screen rate for the relevant interest period plus a credit spread adjustment of 0.10%) as determined by the administrative agent, plus the applicable margin.

The applicable margin is adjusted quarterly based upon the Company’s consolidated leverage ratio.

If interest rates increase, our debt service obligations on our variable rate indebtedness would increase even though the amount borrowed remained the same, and our cash flows could be adversely affected.

An increase in debt service obligations under our variable rate indebtedness could affect our ability to make payments required under the terms of our credit facility.

Risks Related to Acquisitions

9 unchanged sentences

If we encounter unexpected problems as we try to integrate an acquired firm into our business, our management may be required to expend time and attention to address the problems, which would divert their time and attention from other aspects of our business.

Strategic and Operation Risks

Strategy and Operation Risks

Our operating results have been, and may in the future be, adversely affected by worldwide economic conditions and credit tightening.

11 unchanged sentences

Our engagements can be terminated, or the scope of our responsibilities may be diminished, with limited advance notice.

If an engagement is terminated, delayed

or reduced unexpectedly, the professionals working on the engagement could be underutilized until we assign them to other projects.

If an engagement is terminated, delayed or reduced unexpectedly, the professionals working on the engagement could be underutilized until we assign them to other projects.

Accordingly, the termination or significant reduction in the scope of a single large engagement, or multiple smaller engagements, could harm our business results.

9 unchanged sentences

● strategic decisions by us, our clients or our competitors, such as acquisitions, divestitures, spin-offs, joint ventures, strategic investments or changes in business strategy;

global economic and political conditions and related risks, including acts of terrorism, war, such as the war in Ukraine, pandemics, such as COVID-19, inflation, slowing growth, rising interest rates and recession;

● global economic and political conditions and related risks, including acts of terrorism, war, such as the war in Ukraine and the conflict in the Middle East, pandemics, inflation, slowing growth, rising interest rates and recession;

● conditions in the travel industry that could prevent our advisors from traveling to client sites.

61 unchanged sentences

Our competitors include any firm that provides sourcing or benchmarking advisory services, IT strategy or business process consulting, which may include a variety of consulting firms, service providers, niche advisors and, potentially, advisors currently or formerly employed by us.

Some of our competitors have significantly more financial and marketing resources, larger professional staffs, closer client relationships, broader geographic presence or more widespread recognition than us.

Some of our competitors have significantly more financial and marketing resources, larger professional staffs, closer client relationships, broader geographic presences or more widespread recognition than us.

In addition, limited barriers to entry exist in the markets in which we do business.

4 unchanged sentences

Our 25 largest clients accounted for approximately 33% and 35% of revenue in 2023 and 2022, respectively.

If one or more of our large clients terminate or significantly reduce their engagements or fail to remain a viable business, then our revenues could be materially and adversely affected.

If one or more of our large clients terminate, significantly reduce their engagement or fail to remain a viable business, then our revenues could be materially and adversely affected.

In addition, sizable receivable balances could be jeopardized if large clients fail to remain a going concern.

1 unchanged sentence

The loss of key executives could adversely affect our business.

The success of our business is dependent upon the continued service of a relatively small group of key executives, including Mr.

The success of our business is dependent upon the continued service of a relatively small group of key executives, including Michael P.

Connors, Chairman and Chief Executive Officer;

Lavieri, Vice Chairman and President – ISG Americas and Asia Pacific;

Alfonso, Executive Vice President, Chief Financial Officer;

Sherrick, Executive Vice President and Chief Financial Officer;

and Thomas S.

Kucinski, Executive Vice President and Chief Human Resources Officer, among others.

23 unchanged sentences

Our international operations expose us to a variety of risks that could negatively impact our future revenue and growth.

Approximately 42% of our revenues for both 2022 and 2021, respectively, were derived from sales outside of the Americas.

Approximately 39% of our revenues for 2023 and 42% of our revenue for 2022 were derived from sales outside of the Americas.

Our operating results are subject to the risks inherent in international business activities, including:

7 unchanged sentences

● restrictions on the repatriation of profits or payment of dividends;

crime, strikes, riots, civil disturbances, pandemics, such as COVID-19, terrorist attacks and wars, such as the war in Ukraine;

● crime, strikes, riots, civil disturbances, pandemics, terrorist attacks and wars, such as the war in Ukraine and the conflict in the Middle East;

● nationalization or expropriation of property;

2 unchanged sentences

Air travel, telecommunications and entry through international borders are all vital components of our business.

If a pandemic, such as COVID-19, or terrorist attack were to occur, our business could be disproportionately impacted because of the disruption, including potential cancellation of ISG events.

If a pandemic, military conflict, or terrorist attack were to occur, our business could be disproportionately impacted because of the disruption, including potential cancellation of ISG events.

Further, conducting business abroad subjects us to increased regulatory compliance and oversight.

For example, in connection with our international operations, we are subject to laws prohibiting certain payments to governmental officials, such as the Foreign Corrupt Practices Act.

For example, in connection with our international operations, we are subject to laws prohibiting certain payments to governmental officials, such as the Foreign Corrupt Practices Act of 1977, as amended.

A failure to comply with applicable regulations could result in regulatory enforcement actions as well as substantial civil and criminal penalties assessed against us and our employees.

We intend to continue to expand our global footprint in order to meet our clients’ needs.

This may involve expanding into countries beyond those in which we currently operate.

We may involve expanding into less-developed countries, which may have less political, social or economic stability and less-developed infrastructure and legal systems.

This may involve expanding into countries beyond those in which we currently operate, including into less-developed countries that may have less political, social or economic stability and less-developed infrastructure and legal systems.

As we expand our business into new countries, regulatory, personnel, technological and other difficulties may increase our expenses or delay our ability to start up operations or become profitable in such countries.

10 unchanged sentences

Failure to comply with these laws and self-regulatory codes may result in, among other things, civil and criminal liability, negative publicity, restrictions on further use of data and/or liability under contractual warranties.

In addition, there is an increasing public concern regarding data and consumer protection issues, with the result that the number of jurisdictions with data protection laws continues to increase and the scope of existing privacy laws and the data considered to be covered by such laws are expanding.

Changes in these laws (including newly released interpretations of these laws by courts and regulatory bodies) may limit our data access, use and disclosure, and may require increased expenditures by us or may dictate that we may not offer certain types of services.

The EU’s General Data Protection Regulation (“GDPR”) has extra-territorial scope and substantial fines for breaches (up to 4% of global annual revenue or €20 million, whichever is greater).

Additionally, compliance with the GDPR is resulting in operational costs to implement new procedures corresponding to new legal rights granted under the law but has had little direct impact on ISG.

ISG is continuing to monitor the development of the EU’s ePrivacy Regulation proposal and industry response and will determine whether to take further action, as needed, following its final adoption.

To mitigate the risk and negative exposure of data outside ISG, we have put in place a data protection framework which includes policies, procedures, guidance and records.

Changes in these laws (including newly released interpretations of these laws by courts and regulatory bodies) may limit our client data access, use and disclosure, and may require increased expenditures by us or may dictate that we may not offer certain types of services.

As a global firm, ISG must comply with various international and domestic data privacy regulations such as (i) the EU and UK General Data Protection Regulation (“GDPR”), which has extra-territorial scope and substantial fines for breaches (up to 4% of global annual revenue or €20 million, whichever is greater), (ii) the California Consumer Privacy Act, which, unlike data privacy provisions enacted by other US states, covers individuals acting in a commercial or employment context not just as consumers, and (iii) the Australian Privacy Act, among others.

In addition, the new India Digital Personal Data Protection Act 2023 (“DPDP”) is likely to come into force in 2024.

Like the GDPR, the DPDP has extra-territorial reach.

The DPDP shares many provisions with existing privacy laws, and ISG therefore anticipates that its existing processes already broadly align with the new law.

However, like the GDPR, failure to comply with the DPDP may lead to substantial fines.

ISG is continuing to monitor the development of the EU’s ePrivacy Regulation proposal and industry response and will determine whether to take further action, as needed, if it is adopted.

To mitigate the risk and negative exposure of data outside ISG, we have put in place a data protection framework that includes policies, procedures, guidance, and records.

This includes policies and procedures for rights and usage of personal and client data.

ISG employs a Data Privacy Manager who works closely with a governing board made up of the Chief Financial Officer, Chief Human Resource Officer, Chief Information Officer, Chief Data and Analytics Officer, Chief Information Security Officer, Legal Counsel and Director of Corporate Compliance.

The Data Privacy Manager completes an internal audit annually and works with a specialist third party to complete one external Data Protection Compliance review annually.

Data Protection and Privacy training is included in the mandatory Information Security and Privacy training module for all new joiners.

Training is updated and republished for completion by all employees and contractors on an annual basis.

We are exposed to risks related to cybersecurity.

3 unchanged sentences

Ransomware risk has increased significantly in recent years and presents a significant risk of financial extortion and loss of data.

With the ISG NEXT operating model employees continue to work remotely or on a hybrid basis, which magnifies the importance of the integrity of our remote access security measures.

We also face risk from our third-party suppliers if they are affected by cyber security incident, which could result in their loss of service (which could be a significant component of our services to clients), exposure of ISG or client data or a potential backdoor into ISG systems and network.

Our operating model allows employees to continue to work remotely or on a hybrid basis, which magnifies the importance of the integrity of our remote access security measures.

We have robust measures in place to address and mitigate cyber-related risks.

Notwithstanding this, we continue to experience attack attempts against our environment.

We have and continue to expect to invest in the security and resiliency of our networks and products and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure and the information they contain.

These include timely detection of incidents through monitoring, training, incident response capabilities, and mitigating cyber and security risks to our data, systems, products, and services.

However, given the complex, continuing and evolving nature of cyber and other security threats, these efforts may not be fully effective, particularly against previously unknown vulnerabilities that could go undetected for an extended period.

We also face risks related to our use of third-party suppliers if such suppliers are affected by a cybersecurity threat or incident, which could result in a reduction in or loss of their ability to service us (which could be a significant component of our services to clients), the exposure of ISG or client data or a potential backdoor into ISG’s systems and network.

We may be subject to claims for substantial damages by our clients arising out of disruptions to their businesses or inadequate service, and our insurance coverage may be inadequate.

Most of our service contracts with clients contain service level and performance requirements, including requirements relating to the quality of our services.

Failure to consistently meet service requirements of a client or errors made by our employees in the course of

delivering services to our clients could disrupt the client’s business and result in a reduction in revenues or a claim for damages against us.

Additionally, we could incur liability if a process we manage for a client were to result in internal control failures or impair our client’s ability to comply with our own internal control requirements.

Failure to consistently meet service requirements of a client or errors made by our employees while delivering services to our clients could disrupt the client’s business and result in a reduction in revenues or a claim for damages against us.

Additionally, we could incur liability if a process we manage for a client were to result in internal control failures or impair our client’s ability to comply with their own internal control requirements.

Under our service agreements with our clients, our liability for breach of our obligations is generally limited to actual damages suffered by the client and is typically capped at the greater of an agreed amount or the fees paid or payable to us under the relevant agreement.

3 unchanged sentences

The successful assertion of one or more large claims against us that exceed available insurance coverage or changes in our insurance policies (including premium increases or the imposition of large deductible or co-insurance requirements) could have a material adverse effect on our business.

We could be liable to our clients for damages and subject to liability and our reputation could be damaged if our confidential information or client data is compromised.

We may be liable to our clients for damages caused by disclosure of confidential information.

We are often required to collect and store sensitive or confidential client data in order to perform the services we provide under our contracts.

We could be subject to liability and our reputation could be damaged if our confidential information or client data is compromised through security breaches, cyberattacks or otherwise.

We may be liable to our clients for damages caused by disclosure of confidential information or personal data.

We are often required to collect and store sensitive or confidential client data to perform the services we provide under our contracts.

Many of our contracts do not limit our potential liability for breaches of confidentiality.

If any person, including any of our current or former employees, penetrates our network security or misappropriates sensitive data or if we do not adapt to changes in data protection legislation, we could be subject to significant liabilities to our clients or to our clients’ customers for breaching contractual confidentiality provisions or privacy laws.

Also, we could face cyber-based attacks and attempts by hackers and similar unauthorized users to gain access to or corrupt our information technology systems in order to gain access to confidential information and client data.

Also, we could face cyber-based attacks and attempts by hackers and similar unauthorized users to gain access to or corrupt our information technology systems to gain access to confidential information and client data.

Such attacks could disrupt our business operations, cause us to incur unanticipated losses or expenses, and result in unauthorized disclosures of confidential or proprietary information.

Although we seek to prevent, detect and investigate these network security incidents, and have taken steps to mitigate the likelihood of network security breaches, there can be no assurance that attacks by unauthorized users will not be attempted in the future or that our security measures will be effective.

Unauthorized disclosure of sensitive or confidential client data, whether through breach of our processes, systems or otherwise, could also damage our reputation and cause us to lose existing and potential clients.

We may also be subject to civil actions and criminal prosecution by government or government agencies for breaches relating to such data.

Our insurance coverage for breaches or mismanagement of such data may not continue to be available on reasonable terms or in sufficient amounts to cover one or more large claims against us.

We could have liability, or our reputation could be damaged, if we fail to protect client and/or our data from security breaches or cyberattacks.

We are dependent on information technology networks and systems to securely process, transmit and store electronic information and to communicate among our locations around the world and with our people, clients, alliance partners and vendors.

As the breadth and complexity of this infrastructure continues to grow, including as a result of the use of mobile technologies, social media and cloud-based services, the risk of security breaches and cyberattacks increases.

As the breadth and complexity of this infrastructure continues to grow, because of the use of mobile technologies, social media and cloud-based services, the risk of security breaches and cyberattacks increases.

Such breaches could lead to shutdowns or disruptions of or damage to our systems and those of our clients, alliance partners and vendors and unauthorized disclosure of sensitive or confidential information, including personal data.

In addition, Third Party Cyber Security Risk is a critical focus for us.

All potential new suppliers go through our Data Protection Impact Assessment (“DPIA”) process.

This starts with an initial screening questionnaire.

The questionnaire covers what personal data and client data is processed, whether the third party has any access requirements to our environment and how is data is transferred.

From this, our security team assesses the third party, conducts further due diligence, and reviews contractual clauses.

If the risk assessment identifies that the baseline Information Security & Privacy technical and organizational controls are not met, the business will be advised accordingly.

The outcome of all DPIAs is recorded on the DPIA register.

All new third parties processing personal data or client data are assessed to be either Tier 1, 2 or 3, with Tier 1 being the highest risk in terms of data processed or interactions to our environment from a cyber security threat perspective.

Tier 1 and 2 third parties are recorded on our business-critical services register and reviewed annually, and we review the compliance documentation, such as latest ISO certifications, SOC2 reports and pen tests, of those Tier 1 and 2 third parties.

Tier 3 third parties are recorded on the DPIA register, but no further due diligence is performed by the security team, as Tier 3 third parties process no client or personal data and have no access or integration to ISG’s network or systems.

As part of our continuous improvement in our third-party risk management process, we plan to engage the services of a third-party risk monitoring services to monitor threat intelligence and known vulnerabilities.

Although we seek to prevent, detect, and investigate cybersecurity threats and incidents, and have taken steps to mitigate the likelihood of network security breaches, there can be no assurance that attacks by unauthorized users will not be attempted in the future or that our security measures will be effective.

Unauthorized disclosure of sensitive or confidential client data, whether through breach of our processes, systems or otherwise, could subject us to liability, damage our reputation and cause us to lose existing and potential clients.

We may also be subject to civil actions and/or criminal prosecution by government or quasi-government agencies for breaches relating to such

Our insurance coverage for breaches or mismanagement of such data may not continue to be available on reasonable terms or in sufficient amounts to cover one or more large claims against us.

Client restrictions on the use of client data could adversely affect our activities.

The majority of the data we use to populate our databases comes from our client engagements.

The insight sought by clients from us relates to the contractual data and terms, including pricing and costs, to which we have access in the course of assisting our clients in the negotiation of our sourcing agreements.

Most of the data we use to populate our databases comes from our client engagements.

The insight sought by clients from us relates to the contractual data and terms, including pricing and costs, to which we have access while assisting our clients in the negotiation of our sourcing agreements.

Data is obtained through the course of our engagements with clients who agree to contractual provisions permitting us to consolidate and utilize on an aggregate basis such information.

If we were unable to utilize key data from previous client engagements, our business, financial condition, and results of operations could be adversely affected.

General Risks

General Risk Factors

Failure to maintain effective internal control over financial reporting could adversely affect our business and the market price of our common stock.

3 unchanged sentences

Auditing Standard No.

5 provides the professional standards and related performance guidance for auditors to attest to, and report on, management’s assessment of the effectiveness of internal control over financial reporting under

Management’s assessment of internal control over financial reporting requires management to make subjective judgments and, some of the judgments will be in areas that may be open to interpretation.

16 unchanged sentences

Any failure to successfully implement our operating strategy or the occurrence of any of the events or circumstances set forth in this Annual Report on Form 10-K could result in the actual operating results being different than the guidance, and such differences may be adverse and material.

Unresolved Staff Comments

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors