What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2022-02-28 compared with 2021-03-02 · 212 added, 158 removed, 500 unchanged (43% of the section changed)

9 unchanged sentences

Consistent with the foregoing, we are exposed to a variety of risks, including those associated with the following:

• the ongoing COVID-19 pandemic, the resulting global economic volatility, and measures taken in response to the pandemic may materially and adversely affect our business, operating results, financial condition, and earnings guidance that we may issue from time to time;

• if our security measures are breached or unauthorized access to customer or user data is otherwise obtained, our applications may be perceived as not being secure, customers and end users may reduce the use of or stop using our applications, and we may incur significant liabilities;

• the ongoing COVID-19 pandemic, the resulting global economic volatility, and measures taken in response to the pandemic may materially and adversely affect our business, financial condition, operating results, and earnings guidance that we may issue from time to time;

• if our security measures or the security measures of our service partners are breached or unauthorized access to customer or user data is otherwise obtained, our applications may be perceived as not being secure, customers and end users may reduce the use of or stop using our applications, and we may incur significant liabilities;

• if we fail to properly manage our technical operations infrastructure, including our data centers and computing infrastructure operated by third parties, experience service outages or delays in the deployment of our applications, or our applications fail to perform properly, we may be subject to liabilities and our reputation and operating results may be adversely affected;

• privacy concerns and evolving domestic or foreign laws and regulations may reduce the effectiveness of our applications, result in significant costs and compliance challenges, and adversely affect our business and operating results;

• privacy concerns and evolving domestic or foreign laws and regulations may reduce the adoption of our applications, result in significant costs and compliance challenges, and adversely affect our business and operating results;

• we may lose key employees or be unable to attract, train, and retain highly skilled employees, which may adversely affect our business and future growth prospects;

• the markets in which we participate are intensely competitive, and if we do not compete effectively, our operating results could be adversely affected;

• our quarterly results may fluctuate significantly as a result of a variety of factors, many of which are outside of our control, and such fluctuations and related impacts to any earnings guidance we may issue from time to time, or any modification or withdrawal thereof, may negatively impact the value of our securities;

• our brand promotion activities may not generate the customer awareness or increased revenues we anticipate, and even if they do, any increase in revenues may not offset the significant expenses we incur in building our brand;

• if we are not able to realize a return on our current development efforts or offer new features, enhancements, and modifications to our products and services, our business and operating results could be adversely affected;

3 unchanged sentences

• if we fail to manage our growth effectively, we may be unable to execute our business plan, maintain high levels of service and operational controls, or adequately address competitive challenges;

• we may lose key employees or be unable to attract, train and retain highly skilled employees, which may adversely affect our business and future growth prospects;

Table of Conten t s

• if we cannot maintain our corporate culture, we may lose the innovation, teamwork, and passion that we believe contribute to our success, and our business may be harmed;

• because we encounter long sales cycles when selling to large customers and we recognize subscription services revenue over the term of the contract, downturns or upturns in new sales will not be immediately reflected in our operating results and it may be difficult to predict a negative impact on our operating and financial results;

• because we encounter long sales cycles when selling to large customers and we recognize subscription services revenues over the term of the contract, downturns or upturns in new sales will not be immediately reflected in our operating results and it may be difficult to predict a negative impact on our operating and financial results;

additionally, our ability to predict the rate of customer subscription renewals or adoptions is limited;

1 unchanged sentence

• sales to customers outside the United States or with international operations expose us to risks inherent in global operations;

• we have a history of cumulative net losses and we may not be profitable on a basis prepared in accordance with generally accepted accounting principles in the United States (“GAAP”) for the foreseeable future;

• we have a history of cumulative losses and we may not achieve or sustain profitability on a basis prepared in accordance with generally accepted accounting principles in the United States (“GAAP”) in the future;

• any failure to protect our intellectual property rights domestically and internationally could impair our ability to protect our proprietary technology and our brand;

1 unchanged sentence

• risks related to government contracts and related procurement regulations, including risks of fines and termination of such contracts by the government at any time, may adversely impact our business and operating results;

• the dual class structure of our common stock has the effect of concentrating voting control with our Chairman and co-CEO, as well as with other executive officers, directors, and affiliates, which gives our Chairman and co-CEO and other members of management control over key decisions and limits or precludes the ability of non-affiliates to influence corporate matters;

• adverse litigation results could have a material adverse impact on our business;

• the dual class structure of our common stock has the effect of concentrating voting control with our Co-Founders, as well as with other executive officers, directors, and affiliates, which gives our Co-Founders and other members of management control over key decisions and limits or precludes the ability of non-affiliates to influence corporate matters;

• our substantial indebtedness may adversely affect our financial condition and operating results;

3 unchanged sentences

Risks Related to Our Business and Industry

The extent to which the ongoing COVID-19 pandemic, the resulting global economic volatility, and measures taken in response to the pandemic will continue to impact our business, operating results, and financial condition will depend on future developments, which are highly uncertain and difficult to predict.

The extent to which the ongoing COVID-19 pandemic, the resulting global economic volatility, and measures taken in response to the pandemic will continue to impact our business, financial condition, and operating results will depend on future developments, which are highly uncertain and difficult to predict.

The COVID-19 pandemic has disrupted the U.S.

and global economies and put unprecedented strain on governments, healthcare systems, educational institutions, businesses, and individuals around the world, the impact and duration of which is difficult to assess or predict.

It is especially difficult to predict the impact on the global economic markets, which have been and will continue to be highly dependent upon the actions of governments, businesses, and other enterprises in response to the pandemic, as well as the effectiveness of those actions.

As a result of the COVID-19 pandemic, the trading prices for our Class A common stock and the stock of other technology companies have been highly volatile, and such volatility may continue for the duration of and possibly beyond the COVID-19 pandemic.

Any sustained adverse impacts from the continued spread of COVID-19 could materially and adversely affect our business, operating results, financial condition, and earnings guidance that we may issue from time to time, which could have a material effect on the value of our Class A common stock.

In response to COVID-19, as many other companies have done, we have temporarily closed the majority of our global offices;

required most of our employees to continue to work remotely;

As a result of the COVID-19 pandemic, we have experienced volatility in the trading prices for our Class A common stock, and such volatility may continue beyond the COVID-19 pandemic.

Any sustained adverse impacts from the continued spread of COVID-19 could materially and adversely affect our business, financial condition, operating results, and earnings guidance that we may issue from time to time, which could have a material effect on the value of our Class A common stock.

In response to COVID-19, as many other companies have done, we temporarily closed the majority of our global offices;

required most of our employees to work remotely;

implemented travel restrictions;

and postponed or canceled certain of our customer, industry, implementation partner, analyst, investor, and employee events, and converted other events to virtual-only experiences.

These precautionary measures could have increasingly negative effects on our sales and marketing efforts, customer success efforts, and revenue growth rates or other financial metrics, or create operational or other challenges, any of which could adversely impact our business, operating results, and financial condition in any given period.

As the pandemic persists, these measures could have increasingly negative effects on our employee productivity and morale, sales and marketing efforts, customer success efforts, and revenue growth rates or other financial metrics, or create operational or other challenges, any of which could adversely impact our business, financial condition, and operating results in any given period.

Table of Conten t s

Starting in the second quarter of fiscal 2022, a limited number of employees returned to our offices in certain locations, taking into consideration government restrictions, employee safety, and health risks.

Our approach may vary among geographies depending on appropriate health protocols, and may change at any time.

Additionally, our efforts to reopen our offices safely may not be successful, could expose our employees to health risks, and could involve additional costs or liability.

While vaccines have become widely available in certain countries, and businesses and economies have reopened, the status of global economic recovery remains uncertain and unpredictable, and will continue to be impacted by developments in the pandemic including any subsequent waves of outbreak or new variant strains of the COVID-19 virus which may require re-closures or other preventative measures.

We may also continue to experience impacts to productivity and other operational and business impacts if our employees, executives, or their family members experience health issues, or if there are continued delays in our hiring and onboarding of new employees.

The COVID-19 pandemic may also have long-term effects on the nature of the office environment and remote working, which may present risks for our real estate portfolio, as well as strategy, operational, and workplace culture challenges that may adversely affect our business.

The COVID-19 pandemic may also have long-term effects on the nature of the office environment and remote working, which may present risks for our real estate portfolio, as well as strategy, operational, talent recruiting and retention, and workplace culture challenges that may adversely affect our business.

The COVID-19 pandemic could also impact our data center and computing infrastructure operations, including potential disruptions to, among other things, the supply chain required to maintain these systems, construction projects designed to expand our data center capacity, and primary vendors who provide critical products and services.

Our future revenues rely on continued demand by existing customers and the acquisition of new customers.

We have experienced and may continue to experience increased delays in purchasing decisions from prospective customers and a reduction in customer demand, particularly in the industries most impacted by the COVID-19 pandemic, such as travel and hospitality and healthcare.

We may also continue to experience a reduction in renewal rates, particularly within our subset of small and medium-sized planning customers, as well as reduced customer spend and delayed payments, which could materially impact our business, operating results, and financial condition in future periods.

In addition, some of our competitors may offer their products and services at a lower price, or may offer delayed payment terms, financing terms, or other terms and conditions that are more enticing to potential customers.

While our subscription services revenue is relatively predictable in the near term as a result of our subscription-based business model, the effect of the COVID-19 pandemic may not be fully reflected in our operating results and overall financial performance until future periods.

It is not possible for us to estimate the duration or magnitude of the adverse results of the COVID-19 pandemic and its effects on our business, operating results, or financial condition at this time, as the impact will depend on future developments, which are highly uncertain and difficult to predict.

To the extent the COVID-19 pandemic adversely affects our business, operating results, and financial condition, it may also have the effect of heightening many of the other risks described in this “Risk Factors” section.

Our future revenues rely on continued demand by existing customers and the acquisition of new customers who may be subject to labor shortages and global supply chain disruptions due to the COVID-19 pandemic.

During the COVID-19 pandemic, we experienced delays in purchasing decisions from prospective customers and a reduction in customer demand, particularly in the industries most impacted by the COVID-19 pandemic, such as travel and hospitality.

Similarly, we experienced a reduction in renewal rates, particularly within our subset of small and medium-sized planning customers, as well as reduced customer spend and delayed payments.

If these conditions were to return, whether as a result of a resurgence of COVID-19 or otherwise, our business, financial condition, and operating results could be negatively impacted in future periods.

While our subscription services revenues are relatively predictable in the near term as a result of our subscription-based business model, the effect of the COVID-19 pandemic may not be fully reflected in our operating results and overall financial performance until future periods.

As a federal contractor, we are subject to the U.S.

Government’s Safer Federal Workforce Task Force’s guidelines on vaccination requirements for our employees (the “Federal Contractor Mandate”), which is currently on a nationwide stay by trial courts.

We anticipate that if the Federal Contractor Mandate goes into effect, or if similar regulations are subsequently implemented, we would be required to comply.

In addition to any federal vaccine mandates, it is possible that additional, more protective vaccine mandates may be announced by state or local jurisdictions that could impact our workforce and operations.

Although we cannot predict with certainty the impact that the Federal Contractor Mandate or any other similar or related measures will have on our workforce and operations, these requirements and any future requirements may result in attrition and impede our ability to recruit and retain our workforce.

Additionally, our implementation of these vaccine mandates may impact our ability to maintain satisfactory arrangements with third-party vendors and service providers, to the extent they are subject to the mandates.

These measures may also result in increased labor costs and further disrupt the national supply chain, all of which could have a material adverse effect on our business, financial condition, results of operations and prospects.

It is not possible for us to estimate the duration or magnitude of the adverse results of the COVID-19 pandemic and its effects on our business, financial condition, or operating results at this time, as the impact will depend on future developments, which are highly uncertain and difficult to predict.

To the extent the COVID-19 pandemic adversely affects our business, financial condition, and operating results, it may also have the effect of heightening many of the other risks described in this “Risk Factors” section.

Table of Conten t s

If we fail to properly manage our technical operations infrastructure, experience service outages, undergo delays in the deployment of our applications, or our applications fail to perform properly, we may be subject to liabilities and our reputation and operating results may be adversely affected.

15 unchanged sentences

If a service provider fails to provide sufficient capacity to support our applications or otherwise experiences service outages, such failure could interrupt our customers’ and other users’ access to our applications, which could adversely affect their perception of our applications’ reliability and our revenues.

In addition, certain countries have implemented or may implement legislative and technological actions that either do or can effectively regulate access to the internet, including the ability of internet service providers to limit access to specific websites or content.

Other countries have attempted or are attempting to change or limit the legal protections available to businesses that depend on the internet for the delivery of their services.

Our customer agreements typically provide for monthly service level commitments.

6 unchanged sentences

In addition, our policy may not cover all claims made against us and defending a suit, regardless of its merit, could be costly and divert management’s attention.

Table of Conten t s

We depend on data centers and computing infrastructure operated by third parties, and any disruption in these operations could adversely affect our business and operating results.

2 unchanged sentences

The owners of these data center facilities have limited or no obligation to renew their agreements with us on commercially reasonable terms, or at all.

If we are unable to renew these agreements on commercially reasonable terms, or if any of these data center operators are acquired or cease to do business, we may be required to transfer our servers and other infrastructure to new data center facilities, and we may incur significant costs and experience possible service interruptions in connection with doing so.

In addition, we also rely upon third-party hosted infrastructure partners globally, including Amazon Web Services (“AWS”), Dimension Data, Microsoft Corporation, and Google LLC, to serve customers and operate certain aspects of our services, such as environments for development and testing, training, sales demonstrations, and production usage.

If we are unable to renew these agreements on commercially reasonable terms, or if any of these data center operators are acquired, cease to do business, or stop providing contracted services, we may be required to transfer our servers and other infrastructure to new data center facilities, and we may incur significant costs and experience possible service interruptions in connection with doing so.

In addition, we rely upon third-party hosted infrastructure partners globally, including Amazon Web Services (“AWS”), Google LLC, and Microsoft Corporation, to serve customers and operate certain aspects of our services.

Any disruption of or interference at our hosted infrastructure partners would impact our operations and our business could be adversely impacted.

Problems faced by these data center operators or hosted infrastructure partners, with the telecommunications network providers with whom we or they contract, or with the systems by which our telecommunications providers allocate capacity among their customers, including us, could adversely affect the experience of our customers or other users.

Furthermore, these data center operators or hosted infrastructure partners could decide to close their facilities, cease operations without adequate notice, or stop providing contracted services.

In addition, any financial difficulties, such as bankruptcy, faced by these data center operators, our hosted infrastructure partners, or any of the other service providers with whom we or they contract may have negative effects on our business, the nature and extent of which are difficult to predict.

1 unchanged sentence

Additionally, if these data center operators or hosted infrastructure partners are unable to keep up with our needs for capacity, this could have an adverse effect on our business.

Any changes in third-party service levels at these data centers or at our hosted infrastructure partners, or any errors, defects, disruptions, or other performance problems with our applications or the infrastructure on which they run, could adversely affect our reputation and may damage our customers’ or other users’ stored files or result in lengthy interruptions in our services.

Any changes in third-party service levels at these data centers or at our hosted infrastructure partners, or any errors, defects, disruptions, or other performance problems with our applications or the infrastructure on which they run, including those related to cybersecurity threats or attacks, could adversely affect our reputation and may damage our customers’ or other users’ stored files or result in lengthy interruptions in our services.

Interruptions in our services might adversely affect our reputation and operating results, cause us to issue refunds or service credits to customers for prepaid and unused subscription services, subject us to potential liabilities, result in contract terminations, or adversely affect our renewal rates.

5 unchanged sentences

To execute our growth plan, we must attract, train, and retain highly qualified personnel.

In the technology industry, and particularly in the San Francisco Bay Area, the competition is intense for highly skilled employees, especially for engineers with significant experience in designing and developing software and internet-related services, including in the areas of machine learning and artificial intelligence;

During this period of the “great resignation,” we have faced and may continue to face higher attrition.

Our ability to compete and succeed in a highly competitive environment is directly correlated to our ability to recruit highly skilled employees, especially in the areas of product development, engineers with significant experience in designing and developing software and internet-related services, including in the areas of machine learning and artificial intelligence;

for cybersecurity professionals;

and for senior sales executives.

The market for skilled personnel in the software industry is very competitive, and we have seen these pressures increase significantly through the COVID-19 pandemic.

As we are headquartered in the San Francisco Bay Area, we face intense competition among large and small firms in the Silicon Valley market.

In addition, the expansion of our sales infrastructure, both domestically and internationally, is necessary to grow our customer base and business.

1 unchanged sentence

Our business may be adversely affected if our efforts to attract and train new members of our direct sales force do not generate a corresponding increase in revenues.

From time to time, we have experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications, and we may not be able to fill positions in desired geographic areas or at all.

We have experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications, and we may not be able to fill positions in desired geographic areas or at all and may not be successful in achieving the workforce growth goals on the timeline we have publicly announced or at all.

Table of Conten t s

Many of the companies with which we compete for experienced personnel have greater resources than we have and may offer more lucrative compensation packages than we offer.

3 unchanged sentences

Our recruiting efforts may also be limited by laws and regulations, such as restrictive immigration laws, and restrictions on travel or availability of visas (including during the ongoing COVID-19 pandemic).

The challenges we face in recruiting and hiring qualified personnel may be compounded by a decreased willingness of candidates to leave their current employment due to various factors including economic uncertainty caused by the COVID-19 pandemic and uncertainty regarding immigration policies.

As the economic uncertainty related to the COVID-19 pandemic eases, we may face additional challenges in recruiting and retaining qualified personnel as other companies increase the pace of hiring.

Additionally, job candidates may be threatened with legal action under agreements with their existing employers if we attempt to hire them, which could have a chilling effect on hiring and result in a diversion of our time and resources.

We must also continue to retain and motivate existing employees through our compensation practices, company culture, and career development opportunities.

Further, our current and future office environments or flexible work policies may not meet the expectations of our employees or prospective employees.

If we fail to attract new personnel or to retain our current personnel, our business and future growth prospects could be adversely affected.

1 unchanged sentence

We believe that a critical component of our success has been our corporate culture, as reflected in our core values:

employees, customer service, innovation, integrity, inclusion, fun, and profitability.

employees, customer service, innovation, integrity, fun, and profitability.

We also believe that our commitment to our corporate culture, as well as our commitment to building products and services that help provide our customers with information regarding their own workforce and corporate culture, is part of the reason why our customers choose us.

1 unchanged sentence

Additionally, we and our stakeholders increasingly expect to have a corporate culture that embraces diversity and inclusion, and any inability to attract and retain diverse and qualified personnel may harm our corporate culture and our business.

Moreover, the COVID-19 pandemic requires significant action to preserve culture with an employee base temporarily working remotely and facing unique personal and professional challenges.

Any failure to preserve our culture could negatively affect our future success, including our ability to retain and recruit personnel and to achieve our corporate objectives, including our ability to quickly develop and deliver new and innovative products.

Moreover, our flexible work policies require significant action to preserve culture with some of the employee base working remotely.

Furthermore, we substantially grew our employee base in fiscal 2022, and we must be able to effectively integrate, develop, and motivate a large number of new employees, while maintaining the effectiveness of our business execution and the beneficial aspects of our corporate culture.

Any failure to maintain or adapt our culture could negatively affect our future success, including our ability to retain and recruit personnel and to achieve our corporate objectives, including our ability to quickly develop and deliver new and innovative products.

Our business could be adversely affected if our users are not satisfied with the deployment, training, and support services provided by us and our partners.

1 unchanged sentence

High customer satisfaction requires that our customers undergo a successful implementation and be properly trained on our applications to effectively implement and increase their level of adoption of such applications.

Implementation of our applications may be technically complicated because they are designed to enable complex and varied business processes across large organizations, integrate data from a broad and complex range of workflows and systems, and may involve deployment in a variety of environments.

Incorrect or improper implementation or use of our applications could result in customer and user dissatisfaction and harm our business and operating results.

Table of Conten t s

In order for our customers to successfully implement our applications, they need access to highly skilled and trained service professionals.

Professional services may be performed by our own staff, by a third party, or by a combination of the two.

Our strategy is to work with third parties to increase the breadth of capability and depth of capacity for delivery of these services to our customers, and third parties provide a majority of deployment services for our customers.

The work performed by us or these third parties that we rely on, including any work related to the on-site components of deployment services requested by a customer, might be adversely impacted directly or indirectly by the ongoing COVID-19 pandemic, including as a result of restrictions in accessing customer sites.

Additionally, if our customers’ personnel are unable to participate in deployment activities as a direct or indirect result of the ongoing COVID-19 pandemic, this could result in delays in customer go-live dates for our applications.

10 unchanged sentences

Our future success depends on the rate of customer subscription renewals or adoptions, and our revenues or operating results could be adversely impacted if we do not achieve renewals and adoptions at expected rates or on anticipated terms.

As the markets for our applications mature, or as new competitors introduce new products or services that compete with ours, we may be unable to attract new customers at the same price or based on the same pricing model as we have used historically.

As the markets for our applications mature, or as new competitors introduce new products or services that compete with ours, we may be unable to attract new customers at the same pace or based on the same pricing model as we have used historically.

From time to time, we may also change our pricing structure, which could adversely impact demand for our products.

Moreover, large customers, which are a primary focus of our sales efforts, have and may continue to request greater price concessions and delayed payment terms.

As a result of the COVID-19 pandemic, some of our existing and potential customers have deferred, and may continue to defer, purchasing decisions, request price concessions and delayed payment terms, and request other terms and conditions.

As a result, in the future we may be required to reduce our prices or accept onerous terms and conditions, including delayed payment terms, which could adversely affect our revenues, profitability, financial position, and cash flows in any given period.

As a result of the COVID-19 pandemic, some of our existing and potential customers deferred purchasing decisions, requested price concessions and delayed payment terms, and requested other terms and conditions.

If these conditions were to return, whether as a result of a resurgence of COVID-19 or otherwise, we may be required to reduce our prices or accept onerous terms and conditions, including delayed payment terms, which could adversely affect our revenues, profitability, financial position, and cash flows in any given period.

Restrictions on travel and in-person meetings have interrupted, and could continue to interrupt, our sales activity, and we cannot predict whether, for how long, or the extent to which the COVID-19 pandemic may continue to have an impact.

Our sales force has historically met with our customers and potential customers face-to-face when selling our solutions, and while the majority of our deployment activities are completed remotely, many of our customers may prefer to have certain deployment activities such as project initiation and go-live activities completed on-site.

Attrition of key personnel at our customers has impacted and may continue to impact our direct sales efforts.

Furthermore, because our future revenue growth relies, in large part, on new customer acquisition, any inability of our sales force to establish relationships with potential customers during the current environment or prospects deferring buying decisions due to the economic uncertainty, is likely to have a negative impact on our future revenue growth and other financial measures.

4 unchanged sentences

In addition, over time the average term of our contracts could change based on renewal rates or for other reasons.

Table of Conten t s

Our future success also depends, in part, on our ability to sell additional products to our current customers, and the success rate of such endeavors is difficult to predict, especially with regard to any new lines of business that we may introduce from time to time.

2 unchanged sentences

Our quarterly results may fluctuate significantly and may not fully reflect the underlying performance of our business.

Our quarterly operating results, including our revenues, operating margin, profitability, cash flow, unearned revenue, and remaining subscription services revenue performance obligations, or backlog, may vary significantly in the future and period-to-period comparisons of our operating results may not be meaningful.

Our quarterly operating results, including our revenues, subscription revenue backlog, operating margin, profitability, and cash flow, may vary significantly in the future and period-to-period comparisons of our operating results may not be meaningful.

Accordingly, the results of any one quarter should not be relied upon as an indication of future performance.

1 unchanged sentence

As discussed above, the extent to which the ongoing COVID-19 pandemic, the resulting global economic uncertainty, and measures taken in response to the pandemic could continue to impact our operating results will depend on future developments, which are highly uncertain and difficult to predict.

For example, beginning in March 2020, we began experiencing and continue to experience unfavorable impacts to our new subscription bookings, causing us to reduce our fiscal 2021 subscription revenue outlook.

Fluctuations in our quarterly results and related impacts to any earnings guidance we may issue from time to time, including any modification or withdrawal thereof, may negatively impact the value of our securities.

Additionally, as we typically sign a significantly higher percentage of agreements with new customers as well as renewal agreements with existing customers in the fourth quarter of each year, we may experience a greater impact on our business and quarterly results due to the prolonged uncertainty.

Additional factors that may cause fluctuations in our quarterly financial results include, without limitation, those listed below:

7 unchanged sentences

• increases or decreases in the number of elements of our services or pricing changes upon any renewals of customer agreements;

• the changes in payment terms and timing of customer payments and payment defaults by customers, including those significantly impacted by the ongoing COVID-19 pandemic;

• the changes in payment terms and timing of customer payments and payment defaults by customers, including those impacted by the ongoing COVID-19 pandemic;

• changes in our pricing policies or those of our competitors and the mix of applications sold during a period;

10 unchanged sentences

Failure to effectively manage growth could result in difficulty or delays in deploying products and services to customers, declines in quality or customer satisfaction, increases in costs, difficulties in introducing new features, or other operational difficulties, and any of these difficulties could adversely impact our business performance and operating results.

Table of Conten t s

If we fail to develop widespread brand awareness cost-effectively, our business may suffer.

2 unchanged sentences

Moreover, the ongoing COVID-19 pandemic has made it more difficult to develop and maintain positive awareness of our brand.

For example, we did not hold our two largest annual customer conferences for fiscal year 2021, Workday Rising and Workday Rising Europe.

We also transitioned Adaptive Live, our customer experience for Workday Adaptive Planning customers as well as our global event series, Workday Elevate, from in-person to digital event experiences.

Our shift to creating virtual customer, industry, partner, analyst, investor and employee events may not be successful, and we may not be able to showcase our products as well, or generate similar levels of customer interest, opportunities, and leads through these virtual events as we have historically done through in-person events.

For example, we held a virtual event, Conversations for a Changing World, in both fiscal 2021 and 2022, in place of our two largest annual customer conferences, Workday Rising and Workday Rising Europe.

We also transitioned Workday Elevate, our global event series, from an in-person to digital event experience.

Our shift to virtual customer, industry, partner, analyst, investor and employee events may not be as successful or showcase our products as well, and ultimately generate lower levels of customer interest, opportunities, and leads.

In addition, we have and may continue to delay certain corporate advertising programs.

These precautionary measures that have been adopted, particularly if extended for prolonged periods, could have increasingly negative effects on our ability to develop and maintain widespread positive awareness of our brand, which could harm our business, operating results, and financial condition.

In addition, positions we take on environmental, social, governance, and ethical issues from time to time may impact our brand, reputation, or ability to attract or retain customers.

If we fail to successfully promote and maintain our brand, we may fail to attract or retain customers necessary to realize a sufficient return on our brand-building efforts, or to achieve the widespread brand awareness that is critical for broad customer adoption of our applications.

In addition, positions we take on environmental, social, governance (“ESG”), and ethical issues from time to time may impact our brand, reputation, or ability to attract or retain customers.

Statements about our ESG initiatives and goals, and progress against those goals, may be based on standards for measuring progress that are still developing, internal controls and processes that continue to evolve, and assumptions that are subject to change in the future.

If we fail to successfully promote and maintain our brand, or we fail to expand awareness of our newer solutions or products, we may fail to attract or retain customers necessary to realize a sufficient return on our brand-building efforts, or to achieve the widespread brand awareness that is critical for broad customer adoption of our applications.

Additionally, the loss of one or more of our key customers, or a failure to renew our subscription agreements with one or more of our key customers, could significantly impair our ability to market our applications which, in turn, could have a negative impact on our revenues, reputation, and our ability to obtain new customers.

2 unchanged sentences

We have acquired, and may in the future acquire, other companies, employee teams, or technologies to complement or expand our applications, enhance our technical capabilities, obtain personnel, or otherwise offer growth opportunities.

For example, we acquired Adaptive Insights in fiscal 2019 and Scout in fiscal 2020, and have entered into an agreement to acquire Peakon in fiscal 2022.

For example, we acquired Scout in fiscal 2020 and Peakon, Zimit, and VNDLY in fiscal 2022.

The pursuit of acquisitions may divert the attention of management, disrupt ongoing business, and cause us to incur various expenses in identifying, investigating, and pursuing suitable acquisitions, whether or not they are consummated.

2 unchanged sentences

We also may not achieve the anticipated benefits from an acquisition due to a number of factors, including:

• inability to integrate or benefit from an acquisition in a profitable manner;

• inability to integrate the intellectual property, technology infrastructure, personnel, and operations of the acquired business, including difficulty in addressing security risks of the acquired business, or benefit from an acquisition in a profitable manner;

• acquisition-related costs, liabilities, or tax impacts, some of which may be unanticipated;

• difficulty in integrating the intellectual property, technology infrastructure, and operations of the acquired business, including difficulty in addressing security risks of the acquired business;

• difficulty in integrating and retaining the personnel of the acquired business, including integration of the culture of the acquired company with Workday;

• difficulty in leveraging the data of the acquired business if it includes personal data;

• ineffective or inadequate controls, procedures, or policies at the acquired company;

• ineffective or inadequate controls, procedures, or policies at the acquired company and increased risk of non-compliance;

• multiple product lines or service offerings as a result of our acquisitions that are offered, priced, and supported differently, as well as the potential for such acquired product lines and service offerings to impact the profitability of existing products;

2 unchanged sentences

• unknown liabilities or risks associated with the acquired businesses, including those arising from existing contractual obligations or litigation matters;

• adverse effects on our existing business relationships with business partners and customers as a result of the acquisition;

• adverse effects on our brand or existing business relationships with business partners and customers as a result of the acquisition;

• potential write-offs of acquired assets and potential financial and credit risks associated with acquired customers;

• inability to maintain relationships with key customers, suppliers, and partners of the acquired business;

Table of Conten t s

• difficulty in predicting and controlling the effect of integrating multiple acquisitions concurrently;

2 unchanged sentences

• the inability to obtain (or a material delay in obtaining) regulatory approvals necessary to complete transactions or to integrate operations, or potential remedies imposed by regulatory authorities as a condition to or following the completion of a transaction, which may include divestitures, ownership or operational restrictions or other structural or behavioral remedies;

• use of resources that are needed in other parts of our business;

• the failure of strategic acquisitions to perform as expected or to meet financial projections;

• use of substantial portions of our available cash to consummate the acquisition.

9 unchanged sentences

In addition to navigating the challenges related to the ongoing COVID-19 pandemic in foreign jurisdictions, we face other risks in doing business on a global scale that could adversely affect our business, including:

• the need to develop, localize, and adapt our applications for specific countries, including translation into foreign languages, localization of contracts for different legal jurisdictions, and associated expenses;

• the need to develop, localize, and adapt our applications and customer support for specific countries, including translation into foreign languages, localization of contracts for different legal jurisdictions, and associated expenses;

• the need to successfully develop and execute on a go-to-market strategy that aligns application management efforts and the development of supporting infrastructure;

14 unchanged sentences

• the cost and potential outcomes of any international claims or litigation;

Table of Conten t s

• adverse tax consequences and tax rulings;

1 unchanged sentence

Any of the above factors may negatively impact our ability to sell our applications and offer services globally, reduce our competitive position in foreign markets, increase our costs of global operations, and reduce demand for our applications and services from global customers.

Additionally, the majority of our international costs are denominated in local currencies and we anticipate that over time an increasing portion of our sales contracts outside the U.S.

may be denominated in local currencies.

Therefore, fluctuations in the value of the U.S.

dollar and foreign currencies may impact our operating results when translated into U.S.

Additionally, the majority of our international costs are denominated in local currencies and we anticipate that over time an increasing portion of our sales contracts may be outside the U.S.

and will therefore be denominated in local currencies.

Additionally, global events as well as geopolitical developments, fluctuating commodity prices, trade tariff developments, and inflation have caused, and may in the future cause, global economic uncertainty, and uncertainty about the interest rate environment, which could amplify the volatility of currency fluctuations.

Therefore, fluctuations in the value of foreign currencies may impact our operating results when translated into U.S.

Such fluctuations may also impact our ability to predict our future results accurately.

18 unchanged sentences

Pricing pressures and increased competition could result in reduced sales, reduced margins, losses, or a failure to maintain or improve our competitive market position, any of which could adversely affect our business and operating results.

Table of Conten t s

If we are not able to realize a return on our current development efforts or offer new features, enhancements, and modifications to our services that are desired by current or potential customers, our business and operating results could be adversely affected.

2 unchanged sentences

However, we may not receive significant revenues from these investments for several years, if at all.

Furthermore, the COVID-19 pandemic could have an impact on our plans to offer certain new features, enhancements, and modifications of our applications in a timely manner, particularly if we experience impacts to productivity due to our employees or their family members experiencing health issues, if our employees continue to work remotely for extended periods, or if there are continuing delays in our hiring and onboarding of new employees.

Furthermore, the COVID-19 pandemic could have a continuing impact on our plans to offer certain new features, enhancements, and modifications of our applications in a timely manner, particularly if we experience impacts to productivity due to our employees or their family members experiencing health issues, or as our employees continue to work remotely, or if there are continuing delays in our hiring and onboarding of new employees.

If we are unable to provide new features, enhancements, and modifications in a timely and cost-effective manner that achieve market acceptance or that keep pace with rapid technological developments and changing regulatory landscapes, our business and operating results could be adversely affected.

6 unchanged sentences

We depend on relationships with third parties such as deployment partners, technology and content providers, and other key suppliers, and are also dependent on third parties for the license of certain software and development tools that are incorporated into or used with our applications.

If the operations of these third parties are disrupted as a direct or indirect result of the ongoing COVID-19 pandemic, our own operations may suffer, which could adversely impact our operating results.

If the operations of these third parties are disrupted, including as a direct or indirect result of the ongoing COVID-19 pandemic, our own operations may suffer, which could adversely impact our operating results.

In addition, we rely upon licensed third-party software to help improve our internal systems, processes, and controls.

3 unchanged sentences

If we are unsuccessful in establishing or maintaining our relationships with these third parties, or in monitoring the quality of their products or performance, our ability to compete in the marketplace or to grow our revenues could be impaired and our operating results may suffer.

To the extent that our applications depend upon the successful integration and operation of third-party software in conjunction with our software, any undetected errors or defects in this third-party software, as well as cybersecurity threats or attacks related to such software, could prevent the deployment or impair the functionality of our applications, delay new application introductions, result in a failure of our applications, result in increased costs, including warranty and other related claims from customers, and injure our reputation.

To the extent that our applications depend upon the successful integration and operation of third-party software in conjunction with our software, any undetected errors or defects in this third-party software, as well as cybersecurity threats or attacks related to such software, such as the Log4j vulnerability (as defined below), could prevent the deployment or impair the functionality of our applications, delay new application introductions, result in a failure of our applications, result in increased costs, including warranty and other related claims from customers, and injure our reputation.

Furthermore, software may not continue to be available to us on commercially reasonable terms.

1 unchanged sentence

Integration of new software into our applications may require significant work and require substantial investment of our time and resources.

Table of Conten t s

We also need to continuously modify and enhance our applications to keep pace with changes in third-party internet-related hardware, iOS, Android, other mobile-related technologies, and other third-party software, communication, browser, and database technologies.

7 unchanged sentences

We may also fail to accurately anticipate adoption rates of these new lines of business or their underlying technology.

For example, machine learning, artificial intelligence, and blockchain are propelling advancements in technology, but if they are not widely adopted and accepted or fail to operate as expected, our business and reputation may be harmed.

For example, machine learning and artificial intelligence are propelling advancements in technology, but if they are not widely adopted and accepted or fail to operate as expected, our business and reputation may be harmed.

Also, we may not be able to properly price our solutions in these new markets, which could negatively affect our ability to sell to customers.

Furthermore, customers in these new markets or of the new lines of business may demand more features and professional services, which may require us to devote even greater research and development, sales, support, and professional services resources to such customers.

If we fail to generate adequate revenue from these new markets and lines of business, or if we fail to do so within the envisioned timeframe, it could have an adverse effect on our business or financial condition.

We are subject to risks associated with our equity investments, including partial or complete loss of invested capital, and significant changes in the fair value of this portfolio could adversely impact our financial results.

We invest in early to late stage companies for strategic reasons and to support key business initiatives, and we may not realize a return on our equity investments.

Many such companies generate net losses and the market for their products, services, or technologies may be slow to develop or never materialize.

These companies are often dependent on the availability of later rounds of financing from banks or investors on favorable terms to continue their operations.

The financial success of our investment in any company is typically dependent on a liquidity event, such as a public offering, acquisition, or other favorable market event reflecting appreciation to the cost of our initial investment.

The capital markets for public offerings and acquisitions are dynamic and the likelihood of liquidity events for the companies we have invested in could deteriorate, which could result in a loss of all or a substantial part of our investment in these companies.

Further, valuations of non-marketable equity investments are inherently complex due to the lack of readily available market data.

In addition, we may experience additional volatility to our statements of operations due to changes in market prices of our marketable equity investments, the valuation and timing of observable price changes or impairments of our non-marketable equity investments, including impairments to such investments due to the COVID-19 pandemic, and changes in the proportionate share of earnings and losses or impairment of our equity investments accounted for under the equity method.

This volatility could be material to our results in any given quarter and may cause our stock price to decline.

If we fail to generate adequate revenues from these new markets and lines of business, or if we fail to do so within the envisioned timeframe, it could have an adverse effect on our business, financial condition, and operating results.

Risks Related to Cybersecurity, Data Privacy, and Intellectual Property

1 unchanged sentence

Our applications involve the storage and transmission of our customers’ sensitive and proprietary information, including personal or identifying information regarding our customers, their employees, customers, and suppliers, as well as financial, accounting, health, and payroll data and other sensitive information.

As a result, unauthorized access, acquisition, use, or destruction of this data, or unavailability of data, could expose us to regulatory actions, litigation, investigations, remediation and indemnity obligations, damage to our reputation and brand, supplemental disclosure obligations, loss of customer, consumer, and partner confidence in the security of our applications, destruction of information, an increase in our insurance premiums, impairment to our business, and resulting fees, expenses, loss of revenues, and other potential liabilities.

We devote significant financial and personnel resources to implement and maintain security measures.

As a result, a compromise of our applications or unauthorized access, acquisition, use, tampering, or destruction of this data, or unavailability of data, could expose us to regulatory actions, litigation, investigations, remediation and indemnity obligations, damage to our reputation and brand, supplemental disclosure obligations, loss of customer, consumer, and partner confidence in the security of our applications, destruction of information, an increase in our insurance premiums, loss of authorization under the Federal Risk and Authorization Management Program (“FedRAMP”) or other authorizations, impairment to our business, and related fees, expenses, loss of revenues, and other potential liabilities.

We devote significant financial and personnel resources to implement and maintain security measures and we maintain an information security risk insurance policy.

While we have security measures in place that are designed to protect against these risks, preserve the integrity of customer and personal information, and prevent data loss, misappropriation, and other security breaches, our security measures may be compromised as a result of intentional misconduct, including by computer hackers, employees, contractors, or vendors, as well as software bugs, human error, technical malfunctions, or other malfeasance.

Cybersecurity threats and attacks are often targeted at companies such as ours and may take a variety of forms ranging from individuals or groups of hackers, including those who appear to offer a solution to a vulnerability, to sophisticated organizations, including state-sponsored actors.

Key cybersecurity risks range from viruses, worms, and other malicious software programs, including phishing attacks or ransomware, to exploitation of software bugs or other defects, to “mega breaches” targeted against cloud services and other hosted software, any of which can result in disclosure of confidential information and intellectual property, defective products, production downtimes, reputational harm, compromised data, and an increase in costs to the business.

As the techniques used to obtain unauthorized access or sabotage systems change frequently and generally are not identified until they are launched against a target, we may be unable to anticipate these attacks or to implement adequate preventative measures.

There may also be attacks targeting any vulnerabilities in our internally built infrastructure, enhancements, and updates to our existing offerings, or in the many different underlying networks and services that power the internet that our products depend on, most of which are not under our control or the control of our vendors, partners, or customers.

Although we have developed systems and processes that are designed to protect our systems, software and data, as well as customer data and other user data, and to prevent data loss and detect security breaches, there can be no assurance that such measures will be effective against all cybersecurity threats or perceived threats.

Cybersecurity threats and attacks are often targeted at companies such as ours and may take a variety of forms ranging from individuals or groups of security researchers and hackers, including those who appear to offer a solution to a vulnerability, to sophisticated organizations, including state-sponsored actors.

As our market presence grows, we may face increased risks of cybersecurity attack or other security threats.

Key cybersecurity risks range from viruses, worms, and other malicious software programs, phishing attacks or ransomware, to exploitation of software bugs or other defects, to “mega breaches” targeted against cloud services and other hosted software, any of which can result in disclosure of confidential information and intellectual property, defective products, production downtimes, reputational harm, compromised data, and an increase in costs to the business.

As the techniques used to obtain unauthorized access or sabotage systems change frequently, are becoming increasingly sophisticated and complex, and generally are not identified until they are launched against a target, we may be unable to anticipate these attacks or to implement adequate preventative measures.

Table of Conten t s

There may also be attacks targeting any vulnerabilities in our applications, internally built infrastructure, enhancements, and updates to our existing offerings, or in the many different underlying networks and services that power the internet that our products depend on, most of which are not under our control or the control of our vendors, partners, or customers.

Although we have developed systems and processes that are designed to protect our applications, systems, software and data, as well as customer data and other user data, and to prevent data loss and detect security breaches, there can be no assurance that such measures will be effective against all cybersecurity threats or perceived threats.

In April 2021, as a result of a security breach at a software provider, a malicious third party accessed the development environment of a company we had recently acquired, Peakon, and took a copy of Peakon’s source code.

We took immediate action to secure Peakon’s development environment and prevent any additional unauthorized access, as well as to confirm that no customer data had been accessed and that this incident had not impacted Workday’s production, development, or other environments or applications.

Our response included engaging an external cybersecurity firm for forensic investigation and incident response, performing an internal incident investigation and code vulnerability review, alerting law enforcement, and engaging a third party to conduct a code review.

These efforts may not be completely effective or eliminate potential risks from such incidents, however, and there can be no assurance that there will be no impact from this or similar incidents in the future.

In December 2021, a critical remote code execution (RCE) vulnerability was identified in the Apache Software Foundation’s Log4j software library (“Log4j”).

Log4j is an open source software broadly used in Java-based applications to log security and performance information.

According to public information, a bad actor can exploit the Log4j vulnerability to remotely access a vulnerable system, allowing the bad actor to then steal information, launch ransomware or conduct other malicious activity.

We use Log4j in a number of our environments although to date we have found no indication that customer data or environments containing customer data have been affected.

We have identified, tested, and deployed recommended mitigation techniques and currently available remediation patches against this vulnerability in our environments, and we have upgraded our firewalls and the Log4j library directly used by Workday.

Despite these efforts, we expect the risk of additional vulnerabilities and potential attacks to continue for several months given the complexity of the situation and the widespread nature of the Log4j vulnerability.

Additionally, during the ongoing COVID-19 pandemic, and potentially beyond as remote work and resource access expand, there is an increased risk of cybersecurity-related events such as COVID-19 themed phishing attacks, exploitation of any cybersecurity flaws that may exist, an increase in the number cybersecurity threats or attacks, and other security challenges as a result of most of our employees and our service providers continuing to work remotely from non-corporate managed networks.

Furthermore, we have acquired or partnered with a number of companies, products, services, and technologies over the years, as well as incorporated third-party products, services and technologies into our products and services.

Although we devote significant resources to address any known security issues with respect to such acquisitions, partnerships, and incorporated technologies, we may still inherit additional risks when they are integrated within Workday.

Furthermore, we have acquired or partnered with a number of companies, products, services, and technologies over the years, and incorporated third-party products, services and technologies in connection with our products and services.

Although we devote significant resources to address any known security issues with respect to such acquisitions, partnerships, incorporated technologies, and our supply chain, we may still inherit additional risks when they are integrated within or used by Workday.

In addition, if a high-profile security breach occurs with respect to an industry peer, our customers and potential customers may generally lose trust in the security of financial management, spend management, human capital management, planning, or analytics applications, or in cloud applications for enterprises in general.

Any or all of these issues could negatively affect our ability to attract new customers, cause existing customers to elect to terminate or not renew their subscriptions, result in reputational damage, cause us to pay remediation and indemnity costs and/or issue service credits or refunds to customers for prepaid and unused subscription services, or result in lawsuits, regulatory fines, or other action or liabilities, which could adversely affect our business and operating results.

We rely on sophisticated information systems and technology, including those provided by third parties, for the secure collection, processing, transmission, and storage of confidential, proprietary, and personal information to support our business operations.

In the past several years, supply chain attacks have increased in frequency and severity.

As we are both a provider and consumer of information systems and technology, we are at higher risk of being impacted either directly or indirectly by these attacks.

While we have implemented what we believe is an appropriate information security program with cybersecurity procedures, policies, practices, and controls, the control systems, cybersecurity program, infrastructure, physical facilities of, and personnel associated with third parties that we rely on are beyond our control.

Although we periodically conduct audits of some of our third parties vendors, we cannot guarantee the security of and may be unable to prevent security events impacting the information technology systems of third parties that are part of our supply chain or that provide valuable services to us, which could result in the unauthorized access to or acquisition, destruction, alteration, release, theft or loss of confidential, proprietary, or personal data of Workday, our employees, our customers, or our third party partners, which could in turn disrupt our operations and ability to conduct business with customers, or otherwise adversely affect our business, operating results, reputation, or financial condition.

In the normal course of business, we are and have been the target of malicious cyber-attack attempts and have experienced other security events.

Future cyber-attacks and other security events may have a significant or material impact on our business and operating results.

Privacy concerns and domestic or foreign laws and regulations may reduce the effectiveness of our applications, result in significant costs and compliance challenges, and adversely affect our business and operating results.

Our customers can use our applications to collect, use, and store personal or identifying information regarding a variety of individuals in connection with their operations, including but not limited to their employees, contractors, students, job applicants, customers, and suppliers.

Additionally, individuals using our WayTo TM by Workday application may store, manage, and share with certain organizations credentials such as employment history, education, skills, and compensation information.

National, state and local governments and agencies in the countries in which our customers operate have adopted, are considering adopting, or may adopt laws and regulations regarding the collection, use, storage, transfer, processing, protection, and disclosure of personal information obtained from consumers and individuals, which could impact our ability to offer our services in certain jurisdictions or our customers’ ability to deploy our solutions globally.

We have been requested to, and may continue to need to develop features, enhancements, or modifications to our products to support our customers’ evolving compliance obligations.

This may require us to divert development and other resources from other areas, incur significant expenditures, or, if we are unsuccessful in delivering these features, enhancements, or modifications, result in monetary damages, loss of revenue or customers, reputational harm, or other adverse impacts to our business.

Privacy and data protection laws are particularly stringent, and the costs of compliance with and other burdens imposed by such laws, regulations, and standards may limit the use and adoption of our services, reduce overall demand for our services, lead to significant fines, penalties, or liabilities for noncompliance, or slow the pace at which we close sales transactions, any of which could harm our business.

Even the perception of privacy concerns, whether or not valid, may inhibit the adoption, effectiveness, or use of our applications.

Moreover, if we or our subprocessors fail to adhere to adequate data protection practices around the usage of and access to our customers’ and other users’ personal data or fail to report a data breach or other loss of data within timeframes mandated by law or our customer contracts, we may be liable for certain losses, and it may damage our reputation and brand.

Additionally, we expect that existing laws, regulations, and standards may be interpreted in new and differing manners in the future and may be inconsistent among jurisdictions.

Future laws, regulations, standards, and other obligations, and changes in the interpretation of existing laws, regulations, standards, and other obligations could result in increased regulation, increased costs of compliance and penalties for non-compliance, and limitations on data collection, use, disclosure, and transfer for Workday and our customers.

In 2016, the European Union (“EU”) adopted a new regulation governing data privacy called the General Data Protection Regulation (“GDPR”), which became effective in May 2018.

The GDPR established new requirements applicable to the handling of personal data and imposes penalties for non-compliance of the greater of €20 million or 4% of worldwide revenue.

Customers, particularly in the EU, are seeking assurances from their suppliers, including us, that their processing of personal data of EU nationals is in accordance with the GDPR.

If we are unable to provide adequate assurances to such customers, demand for our applications could be adversely affected.

In addition, we must continue to seek assurances from our subprocessors that they are handling personal data in accordance with GDPR requirements in order to meet our own obligations under the GDPR.

Additionally, the UK implemented the Data Protection Act effective in May 2018 and statutorily amended in 2019, that substantially implements the GDPR and contains provisions, including UK-specific derogations, for how GDPR is applied in the UK.

The Data Protection Act also imposes fines of up to the greater of £17 million or 4% of global turnover, in addition to the fines under the GDPR.

The UK and the EU reached a Trade Cooperation Agreement in December 2020 that allows continued transfers for a period of up to six months.

Beyond that, transfers of data from the European Economic Area to the UK will require use of Standard Contractual Clauses (“SCCs”) absent an EU determination that UK data protection law is “adequate” under EU standards.

In addition, the California Consumer Privacy Act (“CCPA”) took effect on January 1, 2020, and the California Privacy Rights Act (“CPRA”), which expands upon the CCPA, was passed in the recent California election in November 2020 and comes into effect on January 1, 2023, with a “lookback” period to January 1, 2022.

The CCPA and CPRA give California consumers certain rights similar to those provided by the GDPR, and customers and other users may seek similar assurances from suppliers regarding compliance.

Moreover, there are a number of other legislative proposals worldwide, including in the United States at both the federal and state level, that could impose additional and potentially conflicting obligations in areas affecting our business.

In addition to government activity, privacy advocacy and other industry groups have established or may establish various new, additional, or different self-regulatory standards that may place additional burdens on us.

Our customers may expect us to meet voluntary certifications or adhere to other standards established by third parties.

If we are unable to maintain these certifications or meet these standards, it could reduce demand for our applications and adversely affect our business and operating results.

The costs of compliance with, and other burdens imposed by, privacy laws and regulations that are applicable to the businesses of our customers may adversely affect our customers’ ability and willingness to process, handle, store, use, and transmit demographic and personal data, which in turn could limit the use, effectiveness, and adoption of our applications and reduce overall demand.

In addition, the other bases on which we and our customers rely for the transfer of data, such as model contracts, continue to be subjected to regulatory and judicial scrutiny.

In July 2020, the Court of Justice of the European Union invalidated the Privacy Shield framework for data transferred from the European Economic Area to the United States.

While the same court upheld the use of SCCs, which we offer to our customers to enable data transfers, the decision has led to some uncertainty regarding the use of SCCs as the mechanism for data transfers to the United States and the court made clear that reliance on SCCs alone may not necessarily be sufficient in all circumstances.

Use of SCCs must now be assessed on a case-by-case basis, taking into account the legal regime applicable in the destination country.

In November 2020, the European Data Protection Board issued draft recommendations, which may impose higher burdens on the use of SCCs for cross-border data transfers, including transfers to cloud service providers, and create challenging technical issues.

To comply with these recommendations, we may need to implement additional contractual and technical safeguards for any personal data transferred out of the European Economic Area, which could increase our compliance costs, expose us to further regulatory scrutiny and liability, and adversely affect our business.

At the same time in November 2020, the European Commission released a draft of revised SCCs.

If adopted, these could make aspects of contracting around cross-border transfers easier, particularly in relation to use of subprocessors.

Ultimately, if we or our customers are unable to transfer data between and among countries and regions in which we operate, it could decrease demand for our applications, require us to restrict our business operations, and impair our ability to maintain and grow our customer base and increase our revenue.

Table of Conten t s

Privacy concerns, evolving regulation of cloud computing, cross-border data transfer, and other domestic or foreign laws and regulations may reduce the adoption of our applications, result in significant costs and compliance challenges, and adversely affect our business and operating results.

Legal requirements related to collecting, storing, handling, and transferring personal data are rapidly evolving at both the national and international level in ways that require our business to adapt to support customer compliance.

As the regulatory focus on privacy intensifies worldwide, and jurisdictions increasingly consider and adopt privacy laws, the potential risks related to managing personal data by our business may grow.

In addition, possible adverse interpretations of existing privacy-related laws and regulations by governments in countries where our customers operate, as well as the potential implementation of new legislation, could impose significant obligations in areas affecting our business or prevent us from offering certain services in jurisdictions where we operate.

Following the European Union’s (“EU”) passage of the General Data Protection Regulation (“GDPR”), which became effective in May 2018, the global data privacy compliance landscape outside of the EU has grown increasingly complex, fragmented, and financially relevant to business operations.

As a result, our business faces current and prospective risks related to increased regulatory compliance costs, government enforcement actions and/or financial penalties for non-compliance, and reputational harm.

For example, in July 2020, the Court of Justice of the EU invalidated a framework called Privacy Shield for companies to transfer data from the European Economic Area to the United States.

This decision led to uncertainty about the legal requirements for transferring customer personal data to and from Europe, an integral process of our business that remains governed by, and subject to, GDPR requirements.

Failure to comply with the GDPR data processing requirements by either ourselves or our subcontractors could lead to regulatory enforcement actions, which can result in monetary penalties of up to 4% of worldwide revenue, private lawsuits, reputational damage, and loss of customers.

The UK government is considering amending its data protection legislation.

If UK data protection changes significantly from EU norms, new data flow barriers could emerge, creating costs and complexity for companies.

Other countries such as Russia, China, and India have also passed or are considering passing laws imposing varying degrees of restrictive data residency requirements.

Regulatory developments in the United States present additional risks.

For example, the California Consumer Privacy Act (“CCPA”) took effect on January 1, 2020, and the California Privacy Rights Act (“CPRA”), which expands upon the CCPA, was passed in November 2020 and comes into effect on January 1, 2023, with a “lookback” period to January 1, 2022.

The CCPA and CPRA give California consumers certain rights similar to those provided by the GDPR, and also provide for statutory damages or fines on a per violation basis that could be very large depending on the severity of the violation.

Other states have enacted, or are considering, privacy laws as well.

Furthermore, the U.S.

Congress is considering numerous privacy bills, and the U.S.

Federal Trade Commission continues to fine companies for unfair or deceptive data protection practices and may undertake its own privacy rulemaking exercise.

Increasing sensitivity of individuals to unauthorized processing of personal data, whether real or perceived, and an increasingly uncertain trust climate may create a negative public reaction to technologies, products and services such as ours.

Taken together, the costs of compliance with and other obligations imposed by data protection laws and regulations may require modification of our services, limit use and adoption of our services, reduce overall demand for our services, lead to significant fines, penalties, or liabilities for noncompliance, or slow the pace at which we close sales transactions, any of which could harm our business.

The perception of privacy concerns, whether or not valid, may inhibit the adoption, effectiveness, or use of our applications.

Compliance with applicable laws and regulations regarding personal data may require changes in services, business practices, or internal systems that result in increased costs, lower revenue, reduced efficiency, or greater difficulty competing with foreign-based firms which could adversely affect our business and operating results.

Table of Conten t s

Any failure to protect our intellectual property rights domestically and internationally could impair our ability to protect our proprietary technology and our brand.

24 unchanged sentences

Furthermore, from time to time we may introduce or acquire new products, including in areas where we historically have not competed, which could increase our exposure to patent and other intellectual property claims.

Table of Conten t s

Some of our applications utilize open source software, and any failure to comply with the terms of one or more of these open source licenses could negatively affect our business.

15 unchanged sentences

In addition, these regulations and any related enforcement actions could establish and further expand our obligations to customers, individuals, and other third parties with respect to our products and services, limit the countries in which such products and services may be used, restrict the way we structure and operate our business, require us to divert development and other resources, and reduce the types of customers and individuals who can use our products and services.

Furthermore, our customers may operate in foreign jurisdictions, including countries in which we don't operate, and may be subject to additional laws and regulations outside the scope of our products.

Increased regulation and oversight of products or services which utilize or rely on these technologies may result in costly compliance burdens or otherwise increase our operating costs, detrimentally affecting our business.

4 unchanged sentences

In particular, our brand and reputation are associated with our public commitments to sustainability, equality, inclusivity, accessibility, and ethical use, and any perceived changes in our dedication to these commitments could impact our relationships with potential and current customers and other users.

Table of Conten t s

We are subject to risks related to government contracts and related procurement regulations, which may adversely impact our business and operating results.

Our contracts with federal, state, local, and foreign government entities are subject to various procurement regulations and other requirements relating to their formation, administration, performance, and termination, which could adversely impact our business and operating results.

Government certification requirements applicable to our platform may change and, in doing so, restrict our ability to sell into the governmental sector until we have attained the full or revised certification.

For example, although we have recently achieved Ready status under FedRAMP, we may not achieve full FedRAMP authorization in a timely manner or at all.

These laws and regulations provide public sector customers various rights, many of which are not typically found in commercial contracts.

3 unchanged sentences

In addition, such contracts may provide for delays, interruptions, or termination by the government at any time, without cause, which activities may adversely affect our business and operating results and impact other existing or prospective government contracts.

Adverse litigation results could have a material adverse impact on our business.

We are regularly involved with claims, suits, purported class or representative actions, and may be involved in regulatory and government investigations and other proceedings, involving competition, intellectual property, data security and privacy, bankruptcy, tax and related compliance, labor and employment, commercial disputes, and other matters.

Such claims, suits, actions, regulatory and government investigations, and other proceedings can impose a significant burden on management and employees, could prevent us from offering one or more of our applications, services, or features to others, could require us to change our technology or business practices, or could result in monetary damages, fines, civil or criminal penalties, reputational harm, or other adverse consequences.

Adverse outcomes in some or all of these claims may result in significant monetary damages or injunctive relief that could adversely affect our ability to conduct our business.

The litigation and other claims are subject to inherent uncertainties and management’s view of these matters may change in the future.

A material adverse impact in our consolidated financial statements could occur for the period in which the effect of an unfavorable outcome becomes probable and reasonably estimable.

We may not be able to utilize a portion of our net operating loss or research tax credit carryforwards, which could adversely affect our profitability.

12 unchanged sentences

These contemplated tax initiatives, if finalized and adopted by countries, may ultimately impact our effective tax rate and could adversely affect our sales activity resulting in a negative impact on our operating results and cash flows.

Table of Conten t s

In addition, existing tax laws, statutes, rules, regulations, or ordinances could be interpreted, changed, modified, or applied adversely to us (possibly with retroactive effect), which could require us to pay additional tax amounts, fines or penalties, and interest for past amounts.

2 unchanged sentences

If our customers must pay additional fines or penalties, it could adversely affect demand for our services.

As of January 31, 2021, we had federal and state net operating loss carryforwards due to prior period losses.

If not utilized, the pre-fiscal 2018 federal and the state net operating loss carryforwards expire in varying amounts between fiscal 2022 and fiscal 2041.

The federal net operating losses generated in and after fiscal 2018 do not expire and may be carried forward indefinitely.

We also have federal research tax credit carryforwards, which if not utilized will begin to expire in fiscal 2022.

These net operating loss and research tax credit carryforwards could expire unused and be unavailable to reduce future income tax liabilities, which could adversely affect our profitability.

In addition, under Section 382 of the Internal Revenue Code of 1986, as amended, our ability to utilize net operating loss carryforwards or other tax attributes, such as research tax credits, in any taxable year may be limited if we experience an “ownership change.” A Section 382 “ownership change” generally occurs if one or more stockholders or groups of stockholders who own at least 5% of our stock increase their ownership by more than 50 percentage points over their lowest ownership percentage within a rolling three-year period.

Similar rules may apply under state tax laws.

It is possible that an ownership change, or any future ownership change, could have a material effect on the use of our net operating loss carryforwards or other tax attributes, which could adversely affect our profitability.

Risks Related to Financial Matters

7 unchanged sentences

Moreover, it has been and, until the effects of the COVID-19 pandemic are contained, will continue to be, even more difficult for us to forecast our operating results.

We plan our expense levels and investments on estimates of future revenue and anticipated rates of growth.

We plan our expense levels and investments on estimates of future revenues and anticipated rates of growth.

If our growth does not meet estimates, we may not be able to adjust our spending quickly enough to avoid an adverse impact on our financial results as a consequence of spending that is not aligned with our actual performance.

1 unchanged sentence

If our assumptions regarding these risks and uncertainties (which we use to plan our business) are incorrect or change due to changes in our markets, or if we do not address these risks successfully, our operating and financial results could differ materially from our expectations and our business could suffer.

Because we encounter long sales cycles when selling to large customers and we recognize subscription services revenue over the term of the contract, downturns or upturns in new sales will not be immediately reflected in our operating results and may be difficult to discern.

We generally recognize subscription services revenue over time as services are delivered to the customer, which typically occurs over a period of three years or longer.

As a result, most of the subscription services revenue we report in each quarter is derived from the recognition of unearned revenue relating to subscriptions entered into during previous quarters.

Because we encounter long sales cycles when selling to large customers and we recognize subscription services revenues over the term of the contract, downturns or upturns in new sales will not be immediately reflected in our operating results and may be difficult to discern.

We generally recognize subscription services revenues over time as services are delivered to the customer, which typically occurs over a period of three years or longer.

As a result, most of the subscription services revenues we report in each quarter are derived from the recognition of unearned revenue relating to subscriptions entered into during previous quarters.

Consequently, a decline in new or renewed subscription contracts in any single quarter will likely have a minor impact on our revenue results for that quarter.

However, such a decline will negatively affect our revenue in future quarters.

However, such a decline will negatively affect our revenues in future quarters.

Additionally, because much of our sales efforts are targeted at large enterprise customers, our sales cycles involve greater costs, longer sales cycles, the provision of greater levels of education regarding the use and benefits of our applications, less predictability in completing some of our sales, and varying deployment timeframes based on many factors including the number, type, and configuration of applications being deployed, the complexity, scale, and geographic dispersion of the customers’ business and operations, the number of integrations with other systems, and other factors, many of which are beyond our control.

Our typical sales cycles are six to twelve months but can extend for eighteen months or more, including as a result of the ongoing COVID-19 pandemic, and we expect that this lengthy sales cycle may continue or expand as customers increasingly adopt our applications beyond HCM.

Table of Conten t s

Longer sales cycles could cause our operating and financial results to suffer in a given period.

Accordingly, the effect of significant downturns in sales and market acceptance of our applications, as well as potential changes in our pricing policies or rate of renewals, may not be fully reflected in our operating results until future periods.

Additionally, we may be unable to adjust our cost structure to reflect any such changes in revenue.

In addition, a majority of our costs are expensed as incurred, while revenue is recognized over the life of the customer agreement.

As a result, increased growth in the number of our customers could result in our recognition of more costs than revenue in the earlier periods of the terms of our agreements.

Our subscription model also makes it difficult for us to rapidly increase our revenue through additional sales in any period, as subscription services revenue from new customers generally is recognized over the applicable subscription term.

Additionally, we may be unable to adjust our cost structure to reflect any such changes in revenues.

In addition, a majority of our costs are expensed as incurred, while revenues are recognized over the life of the customer agreement.

As a result, increased growth in the number of our customers could result in our recognition of more costs than revenues in the earlier periods of the terms of our agreements.

Our subscription model also makes it difficult for us to rapidly increase our revenues through additional sales in any period, as subscription services revenues from new customers generally are recognized over the applicable subscription term.

Furthermore, our subscription-based model is largely based on the size of our customers’ employee headcount.

Therefore, the addition or loss of employees by our customers, including any significant reductions in force by our customers during the COVID-19 pandemic, or customer insolvencies resulting from severe economic hardship during the COVID-19 pandemic, could have an impact on our subscription services revenue in any given period.

Although we have downside protection in our customer agreements in the form of base minimums, should there be any prolonged decrease in our customers’ headcounts, we could experience reduced subscription services revenue upon renewal or potentially outside of the renewal period, which could materially impact our business and operating results in any given period.

We have a history of cumulative net losses, and we do not expect to be profitable on a GAAP basis for the foreseeable future.

We have incurred significant net losses on a GAAP basis in each period since our inception in 2005.

These net losses and our accumulated deficit reflect the substantial investments we make to acquire new customers and develop our applications.

We expect our operating expenses to increase in the future due to anticipated increases in sales and marketing expenses, product development expenses, operations costs, and general and administrative costs, and therefore we expect our net losses on a GAAP basis to continue for the foreseeable future.

If we fail to grow our revenue sufficiently to keep pace with our investments and operating expenses, our results of operations and financial condition would be adversely affected.

In addition, we may encounter difficulties, delays, and other unpredictable factors that may result in unanticipated operating expenses.

Furthermore, to the extent we are successful in increasing our customer base, we also expect to incur increased net losses in the acquisition period because costs associated with acquiring customers are generally incurred up front, while subscription services revenue is generally recognized ratably over the terms of the agreements, which are typically three years or longer.

We cannot ensure that we will achieve GAAP profitability in the future or that, if we do become profitable, we will sustain profitability.

Although we have downside protection in our customer agreements in the form of base minimums, should there be any prolonged decrease in our customers’ headcounts, we could experience reduced subscription services revenues upon renewal or potentially outside of the renewal period, which could materially impact our business and operating results in any given period.

We have a history of cumulative losses, and we may not achieve or sustain profitability on a GAAP basis in the future.

Until recently, we had incurred significant net losses on a GAAP basis in each period since our inception in 2005 and our quarterly operating results may fluctuate in the future.

We expect our operating expenses to increase in the future due to substantial investments we make to acquire new customers and develop our applications, anticipated increases in sales and marketing expenses, employee headcount growth expenses, product development expenses, operations costs, and general and administrative costs, and therefore we expect we may incur losses on a GAAP basis in the future.

Furthermore, to the extent we are successful in increasing our customer base, we also expect to incur increased net losses in the acquisition period because costs associated with acquiring customers are generally incurred up front, while subscription services revenues are generally recognized ratably over the terms of the agreements, which are typically three years or longer.

You should not consider our recent GAAP-profitability and growth in revenues as indicative of our future performance.

We cannot ensure that we will continue to achieve GAAP profitability in the future or that, if we continue to be GAAP-profitable, we will sustain such profitability.

We have substantial indebtedness which may adversely affect our financial condition and operating results.

13 unchanged sentences

• negatively impact our credit rating, which could limit our ability to obtain additional financing in the future and adversely affect our business.

Table of Conten t s

Our Credit Agreement also imposes restrictions on us and requires us to maintain compliance with specified covenants, including a specific leverage ratio.

14 unchanged sentences

In addition, upon a default by one of the option counterparties, we may suffer dilution with respect to our Class A common stock as well as adverse financial consequences.

We invest in early to late stage companies for strategic reasons and to support key business initiatives, and we may not realize a return on our equity investments.

Many such companies generate net losses and the market for their products, services, or technologies may be slow to develop or never materialize.

These companies are often dependent on the availability of later rounds of financing from banks or investors on favorable terms to continue their operations.

Further, valuations of non-marketable equity investments are inherently complex due to the lack of readily available market data.

In addition, we may experience additional volatility to our results of operations due to changes in market prices of our marketable equity investments and the valuation and timing of observable price changes or impairments of our non-marketable equity investments, including changes in the proportionate share of earnings and losses or impairment of our equity investments accounted for under the equity method.

This volatility could be material to our results in any given quarter and may cause our stock price to decline.

In addition, our ability to mitigate this volatility and realize gains on investments may be impacted by our contractual obligations to hold securities for a set period of time.

For example, to the extent a company we have invested in undergoes an initial public offering (“IPO”), we may be subject to a lock-up agreement that restricts our ability to sell our securities for a period of time after the public offering or otherwise impedes our ability to mitigate market volatility in such securities.

Table of Conten t s

Risks Related to Ownership of Our Class A Common Stock

Our Chairman and a co-CEO have control over key decision making as a result of their control of a majority of our voting stock.

As of January 31, 2021, our co-founder and Chairman David Duffield, together with his affiliates, held voting rights with respect to approximately 49 million shares of Class B common stock and 0.5 million shares of Class A common stock.

As of January 31, 2021, our co-founder and co-CEO Aneel Bhusri, together with his affiliates, held voting rights with respect to approximately 8 million shares of Class B common stock and 0.3 million shares of Class A common stock.

Our Co-Founders have control over key decision making as a result of their control of a majority of our voting stock.

As of January 31, 2022, our Co-Founder and CEO Emeritus David Duffield, together with his affiliates, held voting rights with respect to approximately 46 million shares of Class B common stock and 0.5 million shares of Class A common stock.

As of January 31, 2022, our Co-Founder, Co-CEO, and Chairman Aneel Bhusri, together with his affiliates, held voting rights with respect to approximately 8 million shares of Class B common stock and 0.3 million shares of Class A common stock.

In addition, Mr.

1 unchanged sentence

Further, Messrs.

Duffield and Bhusri have entered into a voting agreement under which each has granted a voting proxy with respect to certain Class B common stock beneficially owned by him effective upon his death or incapacity as described in our registration statement on Form S-1 filed in connection with our initial public offering.

Duffield and Bhusri have each initially designated the other as their respective proxies.

5 unchanged sentences

Duffield and Bhusri have the ability to control the outcome of matters submitted to our stockholders for approval, including the election of directors and any merger, consolidation, or sale of all or substantially all of our assets.

In addition, they have the ability to control the management and affairs of our company as a result of their positions as our Chairman and co-CEO, respectively, and their ability to control the election of our directors.

In addition, they have the ability to control the management and affairs of our company as a result of their positions as members of our board of directors and, in the case of Mr.

Bhusri, an officer of Workday.

Duffield, in his capacity as a board member, and Mr.

1 unchanged sentence

As stockholders, even as controlling stockholders, they are entitled to vote their shares in their own interests, which may not always be in the interests of our stockholders generally.

The dual class structure of our common stock has the effect of concentrating voting control with our Chairman and a co-CEO, as well as with other executive officers, directors, and affiliates, which limits or precludes the ability of non-affiliates to influence corporate matters.

The dual class structure of our common stock has the effect of concentrating voting control with our Co-Founders, as well as with other executive officers, directors, and affiliates, which limits or precludes the ability of non-affiliates to influence corporate matters.

Our Class B common stock has 10 votes per share and our Class A common stock, which is the stock that is publicly traded, has one vote per share.

17 unchanged sentences

• guidance, as well as our ability to give guidance, as to our operating results and other financial metrics that we provide to the public, differences between our guidance and market expectations, our failure to meet our guidance, any withdrawal of previous guidance or changes from our historical guidance;

Table of Conten t s

• the research and reports that securities or industry analysts publish about us or our business, and whether analysts who cover us downgrade our Class A common stock or publish unfavorable or inaccurate research about our business;

7 unchanged sentences

• trading activity by directors, executive officers, and significant stockholders, or the perception in the market that the holders of a large number of shares intend to sell their shares;

• the exercise of rights held by certain of our stockholders, subject to some conditions, to require us to file registration statements covering their shares or to include their shares in registration statements that we may file for ourselves or our stockholders;

• the size of our market float and significant stock option exercises;

20 unchanged sentences

◦ vacancies on our Board of Directors will be able to be filled only by our Board of Directors and not by stockholders;

• only our chairman of the board, co-chief executive officers, president, or a majority of our Board of Directors are authorized to call a special meeting of stockholders;

• only our chairman of the board, co-chief executive officers, co-presidents, or a majority of our Board of Directors are authorized to call a special meeting of stockholders;

Table of Conten t s

• certain litigation against us can only be brought in Delaware;

14 unchanged sentences

There is uncertainty as to whether a court would enforce this exclusive forum provision with respect to claims under the Securities Act.

If a court were to find the choice of forum provisions contained in our restated certificate of incorporation to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving such action in other jurisdictions, which could harm our business, results of operations and financial condition.

In April 2020, we amended and restated our bylaws to provide that the federal district courts of the United States of America will, to the fullest extent permitted by law, be the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act (“Federal Forum Provision”).

9 unchanged sentences

Consequently, stockholders must rely on sales of their common stock after price appreciation as the only way to realize any future gains on their investment.

Table of Conten t s

General Risk Factors

5 unchanged sentences

Alternatively, a strong dollar could reduce demand for our applications and services in countries with relatively weaker currencies.

Also, Brexit has created economic and political uncertainty, including volatility in the value of foreign currencies.

While the UK and the EU reached a Trade Cooperation Agreement in December 2020, the impact of Brexit depends on the implementation of this agreement, as well as the terms of the UK’s future trade agreements with other countries and such impact may not be fully realized for several years or more.

This uncertainty may cause some of our customers or potential customers to curtail spending and may ultimately result in new regulatory, operational, and cost challenges to our UK and global operations.

The impact of Brexit on EU-UK political, trade, economic and diplomatic relations continues to be uncertain and such impact may not be fully realized for several years or more.

Continued uncertainty and friction may result in regulatory, operational, and cost challenges to our UK and global operations.

These adverse conditions could continue to result in reductions in sales of our applications, longer sales cycles, reductions in subscription duration and value, customer bankruptcies, slower adoption of new technologies, and increased price competition.

Any of these events would likely have an adverse effect on our business, operating results, and financial position.

Catastrophic events may disrupt our business.

Our corporate headquarters are located in Pleasanton, California, and we have data centers located in the United States, Canada, Europe, and Asia.

Catastrophic or climate-related events may disrupt our business.

Our corporate headquarters are located in Pleasanton, California, and we have data centers located in the United States, Canada, and Europe.

The west coast of the United States contains active earthquake zones and the southeast is subject to seasonal hurricanes or other extreme weather conditions.

Additionally, we rely on internal technology systems, our website, and our network and third-party infrastructure and enterprise applications, which are located in a wide variety of regions, for our development, marketing, operational support, hosted services, and sales activities.

Additionally, we rely on internal technology systems, our website, our network, and third-party infrastructure and enterprise applications, which are located in a wide variety of regions, for our development, marketing, operational support, hosted services, and sales activities.

In the event of a major earthquake, hurricane, or other natural disaster, or a catastrophic event such as fire, power loss, telecommunications failure, vandalism, civil unrest, cyber-attack, geopolitical instability, war, terrorist attack, insurrection, pandemics or other public health emergencies (including the ongoing COVID-19 pandemic), or the effects of climate change (such as drought, flooding, wildfires, increased storm severity, and sea level rise), we may be unable to continue our operations and may endure system interruptions, delays in our product development, lengthy interruptions in our services, breaches of data security, and loss of critical data, all of which could cause reputational harm or otherwise have an adverse effect on our business and operating results.

In addition, the impacts of climate change on the global economy and our industry are rapidly evolving.

We may be subject to increased regulations, reporting requirements, standards, or expectations regarding the environmental impacts of our business.

We may discover weaknesses in our internal controls over financial reporting, which may adversely affect investor confidence in the accuracy and completeness of our financial reports and consequently the market price of our securities.

7 unchanged sentences

UNRESOLVED STAFF COMMENTS

Table of Conten t s

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors