Aon (AON) Risk Analysis

Our businesses are subject to extensive legal and regulatory oversight throughout the world, including the Irish Companies Act, the U.S. securities laws, rules, and regulations, the rules and regulations promulgated by the FCA and a variety of other laws, rules, and regulations addressing, among other things, licensing, data privacy, data management and data protection, artificial intelligence, trade sanctions laws, restrictions and export controls, anti-money laundering, wage-and-hour standards, employment and labor relations, antitrust and competition, anti-corruption, currency, reserves, government contracting, and the amount of local investment with respect to our operations in certain countries. This legal and regulatory oversight could reduce our profitability or limit our growth by: increasing the costs of legal and regulatory compliance; limiting or restricting the products or services we sell, the markets we serve or enter, the methods by which we sell our products and services, the overall structure of our business units, the type of services and prices we can charge for our services, or the form of compensation we can accept from our clients, carriers, and third parties; or by subjecting our businesses to the possibility of legal and regulatory actions, proceedings, or fines. The global nature of our operations increases the complexity and cost of compliance with laws and regulations adding to our cost of doing business. In addition, many of these laws and regulations may have differing or conflicting legal standards across jurisdictions, increasing the complexity and cost of compliance. In emerging markets and other jurisdictions with less developed legal systems, local laws and regulations may not be established with sufficiently clear and reliable guidance to provide us adequate assurance that we are operating our business in a compliant manner with all required licenses or that our rights are otherwise protected. In addition, certain laws and regulations, such as the Foreign Corrupt Practices Act and the Foreign Account Tax Compliance provisions of the Hiring Incentives to Restore Employment Act in the U.S., the Bribery Act of 2010 in the U.K. and the General Data Protection Regulation in the E.U., impact our operations outside of the legislating country by imposing requirements for the conduct of overseas operations, and in several cases, requiring compliance by foreign subsidiaries. In addition to the complexity of the laws and regulations themselves, the development of new laws and regulations or changes in application or interpretation of current laws and regulations or conflict between them also increases our legal and regulatory compliance complexity and risk. Additionally, our acquisitions of new businesses and our continued operational changes and entry into new jurisdictions and development of new service offerings increases our legal and regulatory compliance complexity, as well as the type of governmental oversight to which we may be subject. Changes in laws and regulations could mandate significant and costly changes to the way we implement our services and solutions, impose additional licensure requirements or costs to our operations, workforce and services, or cause us to cease offering certain services or solutions. New or evolving laws or regulations may also lead our clients to include contractual requirements in their agreements with us, which may increase our costs of compliance or introduce additional organizational complexity. Furthermore, as we enter new jurisdictions or businesses and further develop and expand our services, including through acquisitions, we may become subject to additional types of laws and governmental oversight and supervision, such as those applicable to the financial lending or other service institutions. Regulatory developments that could result in changes that adversely affect us or cause us to change our business or operations include: additional requirements related to the use of artificial intelligence, and the use, access, privacy, protection, management, localization and transfer of data in jurisdictions in which we operate that may increase our costs of compliance and potentially reduce the manner in which we can use data; changes in tax regulations in the jurisdictions in which we operate; regulatory actions or changes that require us to change our compensation model; or additional regulations or other governmental action in jurisdictions in which we operate. Governmental, investor, stakeholder and public attention to corporate sustainability matters, including new or changing reporting, diligence or disclosure rules and regulations, has increased in recent years and may continue to change the nature, scope, and complexity of matters that we are required to control, assess, and report. These and other rapidly changing laws, rules, regulations and expectations, which may differ across the jurisdictions in which we operate, may increase the cost of our compliance and risk management and increase the scope and rigor of data collection, controls, and external assurance of sustainability-related information, and otherwise impact our business, each of which could have a material adverse effect on our business, results of operations, and financial condition. Increased scrutiny of corporate sustainability claims, and changes in client and investor preferences may also create legal, regulatory, contractual, and reputational risks and could require changes to our products, services, client engagements or operations, which may increase our cost of doing business. In addition, the shift toward a lower-carbon economy, driven by changes in laws, rules and regulations, low-carbon technology advancement, consumer sentiment, and/or liability risks, may negatively impact our business model and/or the business models of our clients. In all jurisdictions, the applicable laws and regulations are subject to amendment or interpretation by regulatory authorities. Generally, such authorities are vested with relatively broad discretion to grant, renew, and revoke licenses and approvals and to implement regulations. Accordingly, we may have a license revoked, limited, or be unable to obtain new licenses and therefore be precluded or suspended from carrying on or developing some or all of our activities or otherwise be fined or penalized in a given jurisdiction. Our business may be unable to develop or be conducted in any given jurisdiction as it has been conducted in the past. Changes in the regulatory scheme, or changes in how applicable regulations are interpreted or applied, could have an adverse impact on our results of operations by limiting revenue streams or increasing costs of compliance. Our business' regulatory oversight also includes licensing of insurance brokers and agents, managing general agency or general underwriting operations, and the regulation of the handling and investment of client funds held in a fiduciary capacity. Our continuing ability to provide insurance broking in the jurisdictions in which we operate depends on our compliance with the rules and regulations promulgated by the regulatory authorities in each of these jurisdictions, and our failure to adhere to these rules and regulations can expose us to fines, penalties, or other sanctions. We can also be affected indirectly by the governmental regulation and supervision of insurance companies. For instance, if we are providing or managing general underwriting services for an insurer, we may have to adhere to regulations affecting our insurer client. Services provided in our Human Capital segment are also the subject of ever-evolving government regulation, either because the services provided to our clients are regulated directly or because third parties upon whom we rely to provide services to clients are regulated, thereby indirectly affecting the manner in which we provide services to those clients. In the U.S., legislative proposals have been introduced or proposed in Congress and in some state legislatures that would effect major changes in the health insurance industry, thereby impacting the cost for companies that offer healthcare benefits to their employees, or more broadly affecting the structure or the stability of the insurance markets. In particular, our health care exchange business depends upon the private sector of the U.S. insurance system and its role in financing health care delivery, and insurance carriers' use and payment of commissions to agents, brokers, and other organizations to market and sell individual and family health insurance products and plans. Uncertainty regarding, or any changes to, state or federal law, or the interpretation of such law by applicable regulatory agencies could delay client adoption of our health care exchange, impair our ability to retain clients who have adopted our health care exchange, or cause insurance carriers to alter or eliminate the products and plans that they offer or attempt to move members into new products or plans for which we receive lower commissions. In addition, changes in laws, government regulations, or the way those regulations are interpreted in the jurisdictions in which we operate could affect the viability, value, use, or delivery of benefits and human resources programs, including changes in regulations relating to health and welfare plans (such as medical), defined contribution plans (such as 401(k)), or defined benefit plans (such as pension), may adversely affect the demand for, or profitability of, our services. If we violate the laws and regulations to which we are subject, we could be subject to fines, penalties, or criminal sanctions and could be prohibited from conducting business in one or more jurisdictions. There can be no assurance that our employees, contractors, agents or business partners will not violate these laws and regulations, causing an adverse effect on our operations and financial condition. Heightened regulatory oversight and scrutiny may lead to additional regulatory investigations, increased government involvement, or enforcement actions, which could consume significant management time and resources and could have adverse effects on our business and operations. For instance, increased scrutiny by competition authorities may increase our costs of doing business or force us to change the way we conduct business or refrain from or otherwise alter the way we engage in certain activities. Additionally, we could suffer significant financial or reputational harm if we fail to properly identify and manage potential conflicts of interest, which exist or could exist any time we or any of our employees or business partners have or may have an interest in a transaction or engagement that is inconsistent with our clients' interests. This could occur, for example, when we are providing services to multiple parties in connection with a transaction. We also may provide multiple types of services to certain clients from more than one of our solution lines, creating a greater potential for conflicts with advisory services. Due to the broad scope of our businesses and our client base, we regularly address potential conflicts of interest, including, without limitation, situations where our services to a particular client or our own investments or other interests conflict, or are perceived to conflict, with the interests of another client. If these are not adequately identified and managed, this could then lead to failure or perceived failure to protect the client's interests, with consequential regulatory and reputational risks, including litigation or enforcement actions that could adversely affect us and our operations. Identifying and addressing conflicts of interest may also prove particularly difficult as we continue to bring systems and information together and integrate our existing and newly acquired businesses. Insurance intermediaries have traditionally been remunerated by base commissions paid by insurance carriers in respect of insurance placements for clients, or by fees paid by clients. Intermediaries also obtain other revenue from insurance carriers. This revenue, when derived from carriers in their capacity as insurance markets (as opposed to as corporate clients of the intermediaries where they may be purchasing insurance or reinsurance or other non-market related services), is commonly known as market-derived income, or "MDI." MDI is another example of an area in which potential conflicts of interest may arise. MDI takes a variety of forms, including volume- or profit-based contingent commissions, facilities administration charges, business development agreements, and fees for providing consulting services to carriers. Accepting this revenue is a lawful and generally commercially accepted business practice that may nonetheless be subject to scrutiny by various regulators under conflict of interest, anti-trust, unfair competition and anti-bribery laws and regulations, subject to legal or regulatory change, or negatively impacted by internal controls that are not fully effective.

We assist our clients with various matters, including advising on and placing insurance and reinsurance coverage and handling related claims, consulting on various human resources matters, and providing actuarial, investment consulting, asset management, and other services. E&O claims against us have in the past and may continue to allege our potential liability for damages arising from our services. E&O claims include, for example, the failure of our employees or sub-agents, whether negligently or intentionally, to place coverage correctly or notify carriers of claims on behalf of clients, to provide insurance carriers with complete and accurate information relating to the risks being insured, or the failure to give error-free consulting, financial, investment or other advice. It is not always possible to prevent and detect E&Os, and the precautions we take may not be effective in all cases. In addition, we are subject to other types of claims, litigation, and proceedings in the ordinary course of business, which along with E&O claims, may seek damages, including punitive damages or damages on behalf of a plaintiff class, in amounts that could, if awarded, have a material adverse impact on the Company's financial position, earnings, and cash flows. In addition to potential liability for monetary damages, such claims or outcomes could harm our reputation or divert management resources away from operating our business. We have historically purchased, and intend to continue to purchase, insurance to cover E&O claims and other insurance to provide protection against certain losses that arise in such matters and other matters related to our operations. However, we may be unable to maintain, at commercially reasonable rates, our current levels of insurance coverage for E&O claims or other risks in future periods, and with respect to such periods may seek to expand our use of self-insurance programs such as captives, the funding of which may not adequately cover the costs of potential losses. Also, we have exhausted or materially depleted our coverage under some of the policies that protect us for certain years and, consequently, are self-insured or materially self-insured for some historical claims. Additionally, parts or all of an E&O claim could fall within insurance deductibles, self-insured retentions, or policy exclusions. Accruals for these exposures, and related insurance receivables, when applicable, have been provided to the extent that losses are deemed probable and are reasonably estimable. These accruals and receivables are adjusted from time to time as developments warrant and may also be adversely affected by disputes we may have with our insurers over coverage. Amounts related to settlement provisions are recorded in Other general expenses in the Consolidated Statements of Income. Discussion of some of these claims, lawsuits, and proceedings are contained in the Notes to Consolidated Financial Statements. In addition, we provide a variety of guarantees and indemnifications to our customers and others. In the event of a default, our potential exposure is equal to the amount of the guarantee or indemnification. Furthermore, our investment businesses provide advice to clients on: investment strategy, which can include advice on setting investment objectives, asset allocation, and hedging strategies; selection (or removal) of investment managers; the investment in different investment instruments and products; and the selection of other investment service providers such as custodians and transition managers. For some clients, we are responsible for making decisions on these matters and we may implement such decisions in a fiduciary or agency capacity without assuming title over the underlying funds or assets invested. Asset classes may experience poor absolute performance and third parties we recommend or select, such as investment managers, may underperform their benchmarks due to poor market performance, negligence, or other reasons, resulting in poor investment returns or losses. These losses may be attributable in whole or in part to alleged failures on our part or to events entirely outside of our control, including but not limited to uncertainty or volatility in financial markets due to economic, political, and regulatory conditions or pandemics. Plaintiffs have filed, and may continue to file, individual and class action lawsuits alleging investment consultants have charged excessive fees, given improper advice or taken investment actions due to conflicts of interest, or recommended investments that underperformed other investments available at the time. Defending against these claims can involve potentially significant costs, including legal defense costs, as well as cause substantial distraction, publicity and diversion of other resources. If any lawsuit against the Company or any other investment consultant or asset manager results in a large adverse verdict, the size of the verdict or resultant negative adverse publicity may prompt the filing of additional lawsuits. Furthermore, our ability to limit our potential liability is restricted in certain jurisdictions and in connection with claims involving breaches of fiduciary or agency duties or other alleged errors or omissions. The ultimate outcome of claims, lawsuits, proceedings, guarantees and indemnifications cannot be ascertained, and liabilities in indeterminate amounts may be imposed on us. It is possible that future results of operations or cash flows for any particular quarterly or annual period could be materially affected by an unfavorable resolution of these matters.

In many jurisdictions, including in the E.U. and the U.S., we are subject to laws and regulations relating to the collection, use, retention, security, and transfer of the confidential information of third parties, including our clients' and employees' confidential information. These laws and regulations are frequently changing and are becoming increasingly complex and sometimes conflict among the various jurisdictions and countries in which we provide services both in terms of substance and enforceability. This makes compliance challenging and expensive. In addition, many privacy laws and related rules and regulations require us to provide individuals with information on how their personal data is used within Aon or collected from our websites. Additionally, certain jurisdictions' regulations include notice provisions that may require us to inform affected clients or employees, or the applicable regulatory authority, in the event of a breach of confidential information before we fully understand or appreciate the extent of the breach. These disclosure and notice provisions present operational challenges and related risk. In particular, there have been a number of recently adopted privacy laws around the globe including but not limited to significant privacy rulings in the E.U., which have imposed significant changes to the way companies export personal data. New guidance issued by regulators has and will continue to require significant time and resources to implement and may require significant effort to review changes to IT systems and transfer methods. Non-compliance with new and existing laws could result in proceedings against us by governmental entities or others and additional costs in connection therewith. We expect additional jurisdictions to continue to adopt new regulations in these areas and that existing regulations may be amended as governments continue to legislate in respect of personal data. We have incurred expenses and devoted resources, and will continue to incur expenses and devote resources, to bring our practices into compliance with these regulations and future regulations. Our failure to comply with or successfully implement processes in response to changing regulatory requirements in this area could result in legal liability, proceedings or fines against us by governmental entities or others, or impair our reputation in the marketplace. Further, regulatory initiatives in these areas are more frequently including provisions allowing authorities to impose substantial fines and penalties, and therefore, failure to comply could also have a significant financial impact. A growing number of jurisdictions, particularly in the E.U. and U.S., have introduced and enacted laws and regulations regarding the responsible development and use of artificial intelligence and similar tools. These new regulations and any subsequent laws or regulations may present additional complexity and risk to our business, particularly but not limited to where these laws overlap with privacy laws designed to protect individuals.

The results of our operations are generally affected by the level of business activity of our clients, which in turn is affected by the economy of the industries and markets these clients serve. Economic downturns, volatility, or uncertainty in the broader economy or in specific markets (including as a result of endemics or pandemics, climate change, political unrest, actions by governments and central banks, or otherwise) have caused in the past and may in the future cause reductions in technology and discretionary spending by our clients, which may result in reductions in the growth of new business or reductions in existing business. If our clients become financially less stable, enter bankruptcy, liquidate their operations or consolidate, our revenues and collectability of receivables could be adversely affected. The demand for property and casualty insurance generally rises as the overall level of economic activity increases and generally falls as such activity decreases, affecting both the commissions and fees generated by our Risk Capital segment. The economic activity that impacts property and casualty insurance is most closely correlated with employment levels, corporate revenues, and asset values. Downward fluctuations in the year-over-year insurance premiums charged by insurers to protect against the same risk, referred to in the industry as softening of the insurance market, has and could adversely affect these businesses as a significant portion of our revenue is determined as a percentage of premiums charged to our clients. In addition, certain discretionary services within our business, such as our talent advisory services, project-related work within our Commercial Risk, Health, and Wealth solution lines, and transaction services, may see a decrease in activity if the overall level of economic activity results in a reduction to our clients' discretionary spending. Insolvencies and consolidations associated with an economic downturn, especially insolvencies in the insurance industry, could adversely affect our brokerage business through the loss of clients by hampering our ability to place insurance and reinsurance business. Also, error and omission claims against us, which we refer to as E&O claims, may increase in economic downturns or due to natural or human-caused disasters, also adversely affecting our business. In addition, decreased underwriting capacity for insurance and reinsurance may create difficulty for our professionals to place business, which may adversely impact our ability to earn revenue.

Our operations are dependent upon our ability to protect our personnel, offices, and technology infrastructure against damage from business continuity events that could have a significant disruptive effect on our operations. Should we experience a local or regional disaster or other business continuity problem, such as a security or cyber incident or attack, a natural disaster, climate event, terrorist attack, pandemic, power loss, telecommunications failure, or other natural or human-caused disaster, our continued success will depend, in part, on the availability of our personnel and office facilities, and the proper functioning of computer systems, telecommunications, and other related systems and operations. In events like these, while our operational size, the multiple locations from which we operate, and our existing back-up systems provide us with some degree of flexibility, we still can experience near-term operational challenges in particular areas of our operations. We could potentially lose access to key executives, personnel, or client data or experience material adverse interruptions to our operations or delivery of services to our clients in a disaster recovery scenario. A disaster on a significant scale or affecting certain of our key operating areas within or across regions, or our inability to successfully recover should we experience a disaster or other business continuity problem, could materially interrupt our business operations and cause material financial loss, loss of human capital, regulatory actions, reputational harm, damaged client relationships, or legal liability.

Our success depends, in part, on our ability to enhance and implement the systems necessary to operate our businesses and to achieve intended efficiencies and improvements. We may not be successful in anticipating or responding to rapid and continuing changes in technology, data and analytics, industry standards and client preferences. The effort to gain necessary expertise and achieve internal efficiencies through technology and data and analytics requires us to incur significant expenses, and we may not be successful in identifying the optimal funding priorities. We make investments in technology and data and analytics to operate our businesses and achieve intended efficiencies; however, our investments and enhancements may not be sufficient to respond to needs across all of our businesses. In addition, data quality, integrity and availability is increasingly important to the success of our business strategies, operations, and our ability to leverage our data, both in our products and as a strategic asset. If we are not successful in developing and maintaining expertise in process excellence, technology and data management, our business performance may be compromised.

We depend, in material part, upon the members of our senior management team who possess extensive knowledge and a deep understanding of our business and our strategy, as well as the colleagues who are critical to developing and retaining client relationships. The unexpected loss of services of any of these senior leaders could have a disruptive effect adversely impacting our ability to manage our business effectively and execute our business strategy. Additionally, competition for professional personnel remains intense, and competitors are using increasingly aggressive measures to recruit professional talent in our industry. We are constantly working to attract, develop, and retain these professionals. If we cannot successfully do so, our business, operating results, and financial condition could be adversely affected. We have been and may continue to be involved in disputes and litigation in connection with our efforts to retain and hire personnel, which can be disruptive to our business, distractive to management, costly, and may expose us to potential liability for monetary damages or reputational damage. If our succession and long-term compensation plans and programs for our senior management team and critical colleagues do not operate effectively or we are required to change these plans or programs, our business could be adversely affected. We strive to maintain an equitable work environment that unlocks the full potential of all of our personnel. This includes our focus on colleague wellness, mental health and belonging, and building a flexible work environment that meets colleague and client needs. If we are unsuccessful in maintaining such a work environment or adapting to colleague needs or expectations, we could experience difficulty attracting and retaining personnel, which could have a negative impact on our business.