What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2021-08-26 compared with 2021-05-26 · 49 added, 59 removed, 607 unchanged (15% of the section changed)

26 unchanged sentences

• sales to customers outside the United States or with international operations expose us to risks inherent in global operations;

• we have a history of cumulative net losses and we may not be profitable on a GAAP basis for the foreseeable future;

• we have a history of cumulative losses and we may not achieve or sustain profitability on a GAAP basis in the future;

• any failure to protect our intellectual property rights domestically and internationally could impair our ability to protect our proprietary technology and our brand;

13 unchanged sentences

Any sustained adverse impacts from the continued spread of COVID-19 could materially and adversely affect our business, financial condition, operating results, and earnings guidance that we may issue from time to time, which could have a material effect on the value of our Class A common stock.

In response to COVID-19, as many other companies have done, we have temporarily closed the majority of our global offices;

In response to COVID-19, as many other companies have done, we temporarily closed the majority of our global offices;

required most of our employees to continue to work remotely;

2 unchanged sentences

These precautionary measures could have increasingly negative effects on our employee productivity and morale, sales and marketing efforts, customer success efforts, and revenue growth rates or other financial metrics, or create operational or other challenges, any of which could adversely impact our business, financial condition, and operating results in any given period.

During the second quarter of fiscal 2022, a limited number of employees returned to our offices in certain locations, taking into consideration government restrictions, employee safety, and health risks.

Our approach may vary among geographies depending on appropriate health protocols, and may change at any time.

Additionally, our efforts to reopen our offices safely may not be successful, could expose our employees to health risks, and could involve additional costs or liability.

While vaccines have become widely available in certain countries, and businesses and economics have recently reopened, the status of global economic recovery remains uncertain and unpredictable, and will be impacted by developments in the pandemic including any subsequent waves of outbreak or new variant strains of the COVID-19 virus which may require re-closures or other preventative measures.

If the pandemic were to endure for the longer term, recession, depression or other sustained adverse market events may result.

We may also continue to experience impacts to productivity and other operational and business impacts if our employees, executives, or their family members experience health issues, or if there are continued delays in our hiring and onboarding of new employees.

The COVID-19 pandemic may also have long-term effects on the nature of the office environment and remote working, which may present risks for our real estate portfolio, as well as strategy, operational, and workplace culture challenges that may adversely affect our business.

The COVID-19 pandemic may also have long-term effects on the nature of the office environment and remote working, which may present risks for our real estate portfolio, as well as strategy, operational, talent recruiting and retention, and workplace culture challenges that may adversely affect our business.

The COVID-19 pandemic could also impact our data center and computing infrastructure operations, including potential disruptions to, among other things, the supply chain required to maintain these systems, construction projects designed to expand our data center capacity, and primary vendors who provide critical products and services.

Our future revenues rely on continued demand by existing customers and the acquisition of new customers.

We have experienced and may continue to experience delays in purchasing decisions from prospective customers and a reduction in customer demand, particularly in the industries most impacted by the COVID-19 pandemic, such as travel and hospitality and healthcare.

We may also continue to experience a reduction in renewal rates, particularly within our subset of small and medium-sized planning customers, as well as reduced customer spend and delayed payments, which could materially impact our business, financial condition, and operating results in future periods.

Similarly, we have experienced and may continue to experience a reduction in renewal rates, particularly within our subset of small and medium-sized planning customers, as well as reduced customer spend and delayed payments, which could materially impact our business, financial condition, and operating results in future periods.

In addition, some of our competitors may offer their products and services at a lower price, or may offer delayed payment terms, financing terms, or other terms and conditions that are more enticing to potential customers.

34 unchanged sentences

If we are unable to renew these agreements on commercially reasonable terms, or if any of these data center operators are acquired or cease to do business, we may be required to transfer our servers and other infrastructure to new data center facilities, and we may incur significant costs and experience possible service interruptions in connection with doing so.

In addition, we also rely upon third-party hosted infrastructure partners globally, including Amazon Web Services, NTT America, Microsoft Corporation, and Google LLC, to serve customers and operate certain aspects of our services, such as environments for development and testing, training, sales demonstrations, and production usage.

In addition, we also rely upon third-party hosted infrastructure partners globally, including Amazon Web Services, Microsoft Corporation, and Google LLC, to serve customers and operate certain aspects of our services, such as environments for development and testing, training, sales demonstrations, and production usage.

Any disruption of or interference at our hosted infrastructure partners would impact our operations and our business could be adversely impacted.

18 unchanged sentences

Our business may be adversely affected if our efforts to attract and train new members of our direct sales force do not generate a corresponding increase in revenues.

From time to time, we have experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications, and we may not be able to fill positions in desired geographic areas or at all.

We have experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications, and we may not be able to fill positions in desired geographic areas or at all and may not be successful in achieving the workforce growth goals on the timeline we have publicly announced or at all.

Many of the companies with which we compete for experienced personnel have greater resources than we have and may offer more lucrative compensation packages than we offer.

3 unchanged sentences

Our recruiting efforts may also be limited by laws and regulations, such as restrictive immigration laws, and restrictions on travel or availability of visas (including during the ongoing COVID-19 pandemic).

The challenges we face in recruiting and hiring qualified personnel may be compounded by a decreased willingness of candidates to leave their current employment due to various factors including economic uncertainty caused by the COVID-19 pandemic and uncertainty regarding immigration policies.

As the economic uncertainty related to the COVID-19 pandemic eases, we may face additional challenges in recruiting and retaining qualified personnel as other companies increase the pace of hiring.

Additionally, job candidates may be threatened with legal action under agreements with their existing employers if we attempt to hire them, which could have a chilling effect on hiring and result in a diversion of our time and resources.

72 unchanged sentences

We have experienced rapid growth, and if we fail to manage our growth effectively, we may be unable to execute our business plan, maintain high levels of service and operational controls, or adequately address competitive challenges.

We have experienced rapid growth in our customers, headcount, and operations and anticipate that we will continue to expand our customer base, headcount, and operations.

We have experienced rapid growth in our customers, headcount, and operations and anticipate that we will continue to expand our customer base, headcount, and operations, in particular, in connection with our publicly announced commitment to increase our workforce by more than 20% in our fiscal year 2022.

This growth has placed, and future growth will place, a significant strain on our management, administrative, operational, and financial infrastructure.

7 unchanged sentences

For example, we did not hold our two largest annual customer conferences for fiscal year 2021, Workday Rising and Workday Rising Europe, and we plan to again hold a primarily virtual event, Conversations for a Changing World, in place of Rising during fiscal year 2022.

We have also transitioned Adaptive Live, our customer experience for Workday Adaptive Planning customers as well as our global event series, Workday Elevate, from in-person to digital event experiences.

We have also transitioned Workday Elevate, our global event series, from an in-person to digital event experience.

Our shift to virtual customer, industry, partner, analyst, investor and employee events may not be as successful or showcase our products as well, and ultimately generate lower levels of customer interest, opportunities, and leads.

98 unchanged sentences

We depend on relationships with third parties such as deployment partners, technology and content providers, and other key suppliers, and are also dependent on third parties for the license of certain software and development tools that are incorporated into or used with our applications.

If the operations of these third parties are disrupted as a direct or indirect result of the ongoing COVID-19 pandemic, our own operations may suffer, which could adversely impact our operating results.

If the operations of these third parties are disrupted, including as a direct or indirect result of the ongoing COVID-19 pandemic, our own operations may suffer, which could adversely impact our operating results.

In addition, we rely upon licensed third-party software to help improve our internal systems, processes, and controls.

43 unchanged sentences

Future cyber-attacks and other security events may have a significant or material impact on our business and operating results.

Privacy concerns and domestic or foreign laws and regulations may reduce the effectiveness of our applications, result in significant costs and compliance challenges, and adversely affect our business and operating results.

Our customers can use our applications to collect, use, and store personal or identifying information regarding a variety of individuals in connection with their operations, including but not limited to their employees, contractors, students, job applicants, customers, and suppliers.

Additionally, individuals using our WayTo TM by Workday application may store, manage, and share with certain organizations credentials such as employment history, education, skills, and compensation information.

National, state and local governments and agencies in the countries in which our customers operate have adopted, are considering adopting, or may adopt laws and regulations regarding the collection, use, storage, transfer, processing, protection, and disclosure of personal information obtained from consumers and individuals, which could impact our ability to offer our services in certain jurisdictions or our customers’ ability to deploy our solutions globally.

We have been requested to, and may continue to need to develop features, enhancements, or modifications to our products to support our customers’ evolving compliance obligations.

This may require us to divert development and other resources from other areas, incur significant expenditures, or, if we are unsuccessful in delivering these features, enhancements, or modifications, result in monetary damages, loss of revenues or customers, reputational harm, or other adverse impacts to our business.

Privacy and data protection laws are particularly stringent, and the costs of compliance with and other burdens imposed by such laws, regulations, and standards may limit the use and adoption of our services, reduce overall demand for our services, lead to significant fines, penalties, or liabilities for noncompliance, or slow the pace at which we close sales transactions, any of which could harm our business.

Even the perception of privacy concerns, whether or not valid, may inhibit the adoption, effectiveness, or use of our applications.

Moreover, if we or our subprocessors fail to adhere to adequate data protection practices around the usage of and access to our customers’ and other users’ personal data or fail to report a data breach or other loss of data within timeframes mandated by law or our customer contracts, we may be liable for certain losses, and it may damage our reputation and brand.

Additionally, we expect that existing laws, regulations, and standards may be interpreted in new and differing manners in the future and may be inconsistent among jurisdictions.

Future laws, regulations, standards, and other obligations, and changes in the interpretation of existing laws, regulations, standards, and other obligations could result in increased regulation, increased costs of compliance and penalties for non-compliance, and limitations on data collection, use, disclosure, and transfer for Workday and our customers.

In 2016, the European Union (“EU”) adopted a new regulation governing data privacy called the General Data Protection Regulation (“GDPR”), which became effective in May 2018.

The GDPR established new requirements applicable to the handling of personal data and imposes penalties for non-compliance of the greater of €20 million or 4% of worldwide revenue.

Customers, particularly in the EU, are seeking assurances from their suppliers, including us, that their processing of personal data of EU nationals is in accordance with the GDPR.

If we are unable to provide adequate assurances to such customers, demand for our applications could be adversely affected.

In addition, we must continue to seek assurances from our subprocessors that they are handling personal data in accordance with GDPR requirements in order to meet our own obligations under the GDPR.

Additionally, the UK implemented the Data Protection Act effective in May 2018 and statutorily amended in 2019, that substantially implements the GDPR and contains provisions, including UK-specific derogations, for how GDPR is applied in the UK.

The Data Protection Act also imposes fines of up to the greater of £17 million or 4% of global turnover, in addition to the fines under the GDPR.

The UK and the EU reached a Trade Cooperation Agreement in December 2020 that allows continued transfers for a period of up to six months, and the UK and the European Commission have reached an agreement on an adequacy decision for the UK that is awaiting final approval.

If that adequacy decision is not approved prior to the end of the six-month period, transfers of data from the European Economic Area to the UK will require use of Standard Contractual Clauses (“SCCs”).

In addition, the California Consumer Privacy Act (“CCPA”) took effect on January 1, 2020, and the California Privacy Rights Act (“CPRA”), which expands upon the CCPA, was passed in the recent California election in November 2020 and comes into effect on January 1, 2023, with a “lookback” period to January 1, 2022.

The CCPA and CPRA give California consumers certain rights similar to those provided by the GDPR, and customers and other users may seek similar assurances from suppliers regarding compliance.

Likewise, the Virginia Consumer Data Protection Act, which provides similar rights, will take effect on January 1, 2023.

Moreover, there are a number of other legislative proposals worldwide, including in the United States at both the federal and state level, that could impose additional and potentially conflicting obligations in areas affecting our business.

In addition to government activity, privacy advocacy and other industry groups have established or may establish various new, additional, or different self-regulatory standards that may place additional burdens on us.

Our customers may expect us to meet voluntary certifications or adhere to other standards established by third parties.

If we are unable to maintain these certifications or meet these standards, it could reduce demand for our applications and adversely affect our business and operating results.

The costs of compliance with, and other burdens imposed by, privacy laws and regulations that are applicable to the businesses of our customers may adversely affect our customers’ ability and willingness to process, handle, store, use, and transmit demographic and personal data, which in turn could limit the use, effectiveness, and adoption of our applications and reduce overall demand.

In addition, the other bases on which we and our customers rely for the transfer of data, such as model contracts, continue to be subjected to regulatory and judicial scrutiny.

In July 2020, the Court of Justice of the European Union invalidated the Privacy Shield framework for data transferred from the European Economic Area to the United States.

While the same court upheld the use of SCCs, which we offer to our customers to enable data transfers, the decision has led to some uncertainty regarding the use of SCCs as the mechanism for data transfers to the United States and the court made clear that reliance on SCCs alone may not necessarily be sufficient in all circumstances.

Use of SCCs must now be assessed on a case-by-case basis, taking into account the legal regime applicable in the destination country.

In November 2020, the European Data Protection Board issued draft recommendations, which may impose higher burdens on the use of SCCs for cross-border data transfers, including transfers to cloud service providers, and create challenging technical issues.

To comply with these recommendations, we may need to implement additional contractual and technical safeguards for any personal data transferred out of the European Economic Area, which could increase our compliance costs, expose us to further regulatory scrutiny and liability, and adversely affect our business.

At the same time in November 2020, the European Commission released a draft of revised SCCs.

If adopted, these could make aspects of contracting around cross-border transfers easier, particularly in relation to use of subprocessors.

Ultimately, if we or our customers are unable to transfer data between and among countries and regions in which we operate, it could decrease demand for our applications, require us to restrict our business operations, and impair our ability to maintain and grow our customer base and increase our revenues.

Privacy concerns, evolving regulation of cloud computing, cross-border data transfer, and other domestic or foreign laws and regulations may reduce the effectiveness of our applications, result in significant costs and compliance challenges, and adversely affect our business and operating results.

Legal requirements related to collecting, storing, handling, and transferring personal data are rapidly evolving at both the national and international level in ways that require our business to adapt to support customer compliance.

As the regulatory focus on privacy intensifies worldwide, and jurisdictions increasingly consider and adopt privacy laws, the potential risks related to managing personal data by our business may grow.

In addition, possible adverse interpretations of existing privacy-related laws and regulations by governments in countries where our customers operate, as well as the potential implementation of new legislation, could impose significant obligations in areas affecting our business or prevent us from offering certain services in jurisdictions where we operate.

Following the European Union’s (“EU”) passage of the General Data Protection Regulation (“GDPR”), which became effective in May 2018, the global data privacy compliance landscape outside of the EU has grown increasingly complex, fragmented, and financially relevant to business operations.

As a result, our business faces current and prospective risks related to increased regulatory compliance costs, government enforcement actions and/or financial penalties for non-compliance, and reputational harm.

For example, in July 2020, the Court of Justice of the EU invalidated a framework called Privacy Shield for companies to transfer data from the European Economic Area to the United States.

This decision led to uncertainty about the legal requirements for transferring customer personal data to and from Europe, an integral process of our business that remains governed by, and subject to, GDPR requirements.

Failure to comply with the GDPR data processing requirements by either ourselves or our subcontractors could lead to regulatory enforcement actions, which can result in monetary penalties of up to 4% of worldwide revenue, private lawsuits, reputational damage, and loss of customers.

Other countries such as Russia, China, and India have also passed or are considering passing laws imposing varying degrees of restrictive data residency requirements.

Regulatory developments in the United States present additional risks.

For example, the California Consumer Privacy Act (“CCPA”) took effect on January 1, 2020, and the California Privacy Rights Act (“CPRA”), which expands upon the CCPA, was passed in November 2020 and comes into effect on January 1, 2023, with a “lookback” period to January 1, 2022.

The CCPA and CPRA give California consumers certain rights similar to those provided by the GDPR, and also provide for statutory damages or fines on a per violation basis that could be very large depending on the severity of the violation.

Other states have enacted, or are considering, privacy laws as well.

Furthermore, the U.S.

Congress is considering numerous privacy bills, and the U.S.

Federal Trade Commission continues to fine companies for unfair or deceptive data protection practices and may undertake its own privacy rulemaking exercise.

Increasing sensitivity of individuals to unauthorized processing of personal data, whether real or perceived, and an increasingly uncertain trust climate may create a negative public reaction to technologies, products and services such as ours.

Taken together, the costs of compliance with and other obligations imposed by data protection laws and regulations may require modification of our services, limit use and adoption of our services, reduce overall demand for our services, lead to significant fines, penalties, or liabilities for noncompliance, or slow the pace at which we close sales transactions, any of which could harm our business.

The perception of privacy concerns, whether or not valid, may inhibit the adoption, effectiveness, or use of our applications.

Compliance with applicable laws and regulations regarding personal data may require changes in services, business practices, or internal systems that result in increased costs, lower revenue, reduced efficiency, or greater difficulty competing with foreign-based firms which could adversely affect our business and operating results.

Any failure to protect our intellectual property rights domestically and internationally could impair our ability to protect our proprietary technology and our brand.

55 unchanged sentences

We may not be able to utilize a portion of our net operating loss or research tax credit carryforwards, which could adversely affect our profitability.

As of April 30, 2021, we had federal and state net operating loss carryforwards due to prior period losses.

As of July 31, 2021, we had federal and state net operating loss carryforwards due to prior period losses.

If not utilized, the pre-fiscal 2018 federal and the state net operating loss carryforwards expire in varying amounts between fiscal 2022 and 2042.

43 unchanged sentences

Although we have downside protection in our customer agreements in the form of base minimums, should there be any prolonged decrease in our customers’ headcounts, we could experience reduced subscription services revenues upon renewal or potentially outside of the renewal period, which could materially impact our business and operating results in any given period.

We have a history of cumulative net losses, and we do not expect to be profitable on a GAAP basis for the foreseeable future.

We have incurred significant net losses on a GAAP basis in each period since our inception in 2005.

These net losses and our accumulated deficit reflect the substantial investments we make to acquire new customers and develop our applications.

We expect our operating expenses to increase in the future due to anticipated increases in sales and marketing expenses, product development expenses, operations costs, and general and administrative costs, and therefore we expect our net losses on a GAAP basis to continue for the foreseeable future.

If we fail to grow our revenues sufficiently to keep pace with our investments and operating expenses, our financial condition and results of operations would be adversely affected.

In addition, we may encounter difficulties, delays, and other unpredictable factors that may result in unanticipated operating expenses.

We have a history of cumulative losses, and we may not achieve or sustain profitability on a GAAP basis in the future.

Until this quarter, we had incurred significant net losses on a GAAP basis in each period since our inception in 2005 and our quarterly operating results may fluctuate in the future.

We expect our operating expenses to increase in the future due to substantial investments we make to acquire new customers and develop our applications, anticipated increases in sales and marketing expenses, employee headcount growth expenses, product development expenses, operations costs, and general and administrative costs, and therefore we expect we may incur losses on a GAAP basis in the future.

Furthermore, to the extent we are successful in increasing our customer base, we also expect to incur increased net losses in the acquisition period because costs associated with acquiring customers are generally incurred up front, while subscription services revenues are generally recognized ratably over the terms of the agreements, which are typically three years or longer.

We cannot ensure that we will achieve GAAP profitability in the future or that, if we do become profitable, we will sustain profitability.

You should not consider our recent GAAP-profitability and growth in revenues as indicative of our future performance.

We cannot ensure that we will continue to achieve GAAP profitability in the future or that, if we continue to be GAAP-profitable, we will sustain such profitability.

We have substantial indebtedness which may adversely affect our financial condition and operating results.

42 unchanged sentences

Our Co-Founders have control over key decision making as a result of their control of a majority of our voting stock.

As of April 30, 2021, our Co-Founder, Director, and Chairman Emeritus David Duffield, together with his affiliates, held voting rights with respect to approximately 49 million shares of Class B common stock and 0.4 million shares of Class A common stock.

As of April 30, 2021, our Co-Founder, Co-CEO, and Chairman Aneel Bhusri, together with his affiliates, held voting rights with respect to approximately 8 million shares of Class B common stock and 0.3 million shares of Class A common stock.

As of July 31, 2021, our Co-Founder, Director, and Chairman Emeritus David Duffield, together with his affiliates, held voting rights with respect to approximately 48 million shares of Class B common stock and 0.3 million shares of Class A common stock.

As of July 31, 2021, our Co-Founder, Co-CEO, and Chairman Aneel Bhusri, together with his affiliates, held voting rights with respect to approximately 8 million shares of Class B common stock and 0.3 million shares of Class A common stock.

In addition, Mr.

16 unchanged sentences

Our Class B common stock has 10 votes per share and our Class A common stock, which is the stock that is publicly traded, has one vote per share.

Stockholders who hold shares of Class B common stock, including our executive officers, directors, and other affiliates, together hold a substantial majority of the voting power of our outstanding capital stock as of April 30, 2021.

Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively will continue to control a majority of the combined voting power of our common stock and therefore be able to control all matters submitted to our stockholders for approval until the conversion of all shares of all Class A and Class B shares to a single class of common stock on the date that is the first to occur of (i) October 17, 2032, (ii) such time as the shares of Class B common stock represent less than 9% of the outstanding Class A and Class B common stock, (iii) nine months following the death of both Mr.

83 unchanged sentences

Alternatively, a strong dollar could reduce demand for our applications and services in countries with relatively weaker currencies.

Also, Brexit has created economic and political uncertainty, including volatility in the value of foreign currencies.

Also, Brexit has created economic and political uncertainty.

While the UK and the EU reached a Trade Cooperation Agreement in December 2020, the impact of Brexit depends on the implementation of this agreement, as well as the terms of the UK’s future trade agreements with other countries and such impact may not be fully realized for several years or more.

18 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors