RCM TECHNOLOGIES, INC. 10-K

ITEM 1A. RISK FACTORS (CONTINUED)   Data Center Capacity and Telecommunication Links   Uninterruptible Power Supply (UPS), card key access, fire suppression, and environmental control systems protect RCM’s datacenter.  All systems are monitored on a 24/7 basis with alerting capabilities via voice or email.  The telecommunications architecture at RCM utilizes managed private circuits from AT&T, which encompasses provisioning redundancy and diversity.   The Company’s ability to protect its data center against damage from fire, power loss, telecommunications failure and other disasters is critical to business operations.  In order to provide many of its services, RCM must be able to store, retrieve, process and manage large databases and periodically expand and upgrade its capabilities.  Any damage to the Company’s data centers or any failure of the Company’s telecommunication links that interrupts its operations or results in an inadvertent loss of data could adversely affect the Company’s ability to meet its customers’ needs and their confidence in utilizing the Company for future services.   RCM’s ability to protect its data, provide services and safeguard its installations, as it relates to the IT infrastructure, is in part dependent on several outside vendors with whom the Company maintains service level agreements.   Cyber Security   We are highly dependent on information technology systems to operate our business. A breakdown, invasion, corruption, destruction or interruption of critical information technology systems by employees, others with authorized access to our systems or unauthorized persons could negatively impact operations.  In the ordinary course of business, we collect, store and transmit confidential information and it is critical that we do so in a secure manner to maintain the confidentiality and integrity of such information.  Additionally, we outsource certain elements of our information technology systems to third parties.  As a result of this outsourcing, our third party vendors may or could have access to our confidential information making such systems vulnerable.  Data breaches of our information technology systems, or those of our third party vendors, may pose a risk that sensitive data may be exposed to unauthorized persons or to the public.  While we believe that we have taken appropriate security measures to protect our data and information technology systems, and have been informed by our third party vendors that they have as well, there can be no assurance that our efforts will prevent breakdowns or breaches in our systems, or those of our third party vendors, that could adversely affect our business.   Data Privacy   We control, process, or have access to personal information regarding our own employees or employment candidates, as well as that of many of our customers or other third parties. Information concerning these individuals may also reside in systems controlled by third party vendors with whom we do business. The legal and regulatory environment concerning data privacy is becoming more complex and challenging, and the potential consequences of non-compliance have become more severe. The European Union’s General Data Protection Regulation, the California Consumer Privacy Act, the Health Insurance Portability and Accountability Act of 1996 and similar laws impose additional compliance requirements related to the collection, use, processing, transfer, disclosure, and retention of personal information, which can increase operating costs and resources to accomplish. Any failure to abide by these regulations or to protect such personal information from inappropriate access or disclosure, whether through social engineering or by accident or other cause, could have severe consequences including fines, litigation, regulatory sanctions, reputational damage, and loss of customers or employees. There can be no assurance that the steps we take to abide by applicable requirements and protect information will meet all current and future regulatory requirements, anticipate all potential methods of unauthorized access, or prevent all inappropriate disclosures. Any failures to do so could result in governmental enforcement actions, fines, and other penalties, or other liabilities, that could adversely affect our business.     19     ITEM 1B.    UNRESOLVED STAFF COMMENTS   Not applicable.     ITEM 2.    PROPERTIES   The Company provides specialty professional consulting services, principally performed at various client locations, through 25 administrative and sales offices located in the United States, Puerto Rico, Canada and Serbia. The majority of the Company’s offices typically consist of 1,000 to 13,000 square feet and are typically leased by the Company for terms of one to five years.  Offices in larger or smaller markets may vary in size from the typical office.  The Company does not expect that it will be difficult to maintain or find suitable lease space at reasonable rates in its markets or in areas where the Company contemplates expansion.   The Company’s executive office is located at 2500 McClellan Avenue, Suite 350, Pennsauken, New Jersey 08109-4613. These premises consist of approximately 3,500 square feet and are leased at a rate of approximately $15.00 per square foot per annum for a term ending on November 30, 2025.    The Company’s operational office is located at 20 Waterview Boulevard, 4 th Floor, Parsippany, NJ 07054-1271. These premises consist of approximately 9,200 square feet and are leased at a rate of approximately $24.95 per square foot per annum for a term ending on January 31, 2024.     20     ITEM 3.    LEGAL PROCEEDINGS   From time to time, the Company is a defendant or plaintiff in various legal actions that arise in the ordinary business course.  These matters may relate to professional liability, tax, compensation, contract, competitor disputes, and employee-related matters and include individual and class action lawsuits, as well as inquiries and investigations by governmental agencies regarding the Company’s employment and compensation practices. Additionally, some of the Company’s clients may also become subject to claims, governmental inquiries and investigations, and legal actions relating to the Company’s professional services. Depending upon the particular facts and circumstances, the Company may also be subject to indemnification obligations under its contracts with such clients relating to these matters.   As such, the Company is required to assess the likelihood of any adverse outcomes to these matters as well as potential ranges of losses and possible recoveries.  The Company may not be covered by insurance as it pertains to some or all of these matters.  A determination of the amount of the provision required for these commitments and contingencies, if any, which would be charged to earnings, is made after careful analysis of each matter.  The Company records a liability when management believes an adverse outcome from a loss contingency is both probable and the amount, or a range, can be reasonably estimated. From time to time, the Company must estimate the potential loss even though the party adverse to the Company has not asserted any specific amounts.  Significant judgment is required to determine both probability of loss and the estimated amount. The Company reviews its loss contingencies at least quarterly and adjusts its accruals and/or disclosures to reflect the impact of negotiations, settlements, rulings, advice of legal counsel, or other new information, as deemed necessary. Once established, a provision may change in the future due to new developments or changes in circumstances and could increase or decrease the Company’s earnings in the period that the changes are made.    The Company is exposed to various asserted claims as of January 1, 2022, where the Company believes it has a probability of loss. Additionally, the Company is exposed to other asserted claims whereby an amount of loss has not been declared, and the Company cannot determine the potential loss. Any of these various claims could result in an unfavorable outcome or settlement that exceeds the accrued amounts. However, the Company believes that such matters will not, either individually or in the aggregate, have a material adverse effect on its business, consolidated financial position, results of operations, or cash flows. As of January 1, 2022, the Company has accrued $2.9 million for asserted claims.  Included in the January 1, 2022 accrual of $2.9 million, the Company has reserved $1.6 million for the settlement of a class-action suit in California that alleges the Company did not properly pay its travel nurses overtime wages. While the Company believes it did not violate any overtime wage laws, it decided to settle this class action lawsuit in December 2020.  The Company paid the $1.6 million settlement in early January 2022.   The Company is also subject to other pending legal proceedings and claims that arise from time to time in the ordinary course of its business, which may not be covered by insurance.     ITEM 4.    MINE SAFETY DISCLOSURES   Not applicable.     21     PART II