Booz Allen (BAH) Risk Factors

We believe that one of the key elements of our success is our position as the holder of 2,650 active task orders under IDIQ contract vehicles as of March 31, 2024. IDIQ contracts provide for the issuance by the client of orders for services or products under the contract, and often contain multi-year terms and unfunded ceiling amounts, which allow but do not commit the U.S. government to purchase products and services from contractors. Our ability to generate revenue under each of these types of contracts depends upon our ability to be awarded task orders for specific services by the client. IDIQ contracts may be awarded to one contractor (single award) or several contractors (multiple award). Multiple contractors must compete under multiple award IDIQ contracts for task orders to provide particular services, and contractors earn revenue only to the extent that they successfully compete for these task orders. A failure to be awarded task orders under such contracts would have a material adverse effect on our results of operations and financial condition. In addition, our ability to maintain our existing business and win new business depends on our ability to maintain our prime and subcontractor positions on these contracts. The loss, without replacement, of certain of these contract vehicles could have a material adverse effect on our ability to win new business and our operating results. If the U.S. government elects to use a contract vehicle that we do not hold, we will not be able to compete for work under that contract vehicle as a prime contractor.

We derive a majority of our revenue from U.S. government contracts awarded through competitive bidding and re-competing processes. We do not expect this to change for the foreseeable future. Our failure to compete effectively in this procurement environment would have a material adverse effect on our revenue and profitability. The competitive bidding and re-competing processes involve risk and significant costs to businesses operating in this environment, including: - the necessity to expend resources, make financial commitments (such as procuring leased premises), and bid on engagements in advance of the completion of their design, which may result in unforeseen difficulties in execution, cost overruns and, in the case of an unsuccessful competition, the loss of committed costs;- the substantial cost and managerial time and effort spent to prepare bids and proposals for contracts that may not be awarded to us;- the ability to accurately estimate the resources and costs that will be required to service any contract we are awarded;- the expense and delay that may arise if our competitors protest or challenge contract awards made to us pursuant to competitive bidding, and the risk that any such protest or challenge could result in the resubmission of bids on modified specifications, or in termination, reduction, or modification of the awarded contract; and - any opportunity cost of not bidding and winning other contracts we might have otherwise pursued. In circumstances where contracts are held by other companies and are scheduled to expire, we still may not be provided the opportunity to bid on those contracts if the U.S. government determines to extend the existing contract. If we are unable to win particular contracts that are awarded through the competitive bidding and re-competing processes, we may not be able to operate in the market for services that are provided under those contracts for the duration of those contracts to the extent that there is no additional demand for such services. An inability to consistently win new contract awards over any extended period would have a material adverse effect on our business and results of operations. We have seen our current competitive environment result in an increase in the number of bid protests from unsuccessful bidders on new program awards. It can take many months for the relevant U.S. government agency to resolve protests by one or more of our competitors of contract awards we receive. Bid protests may result in significant expense to us, contract modification, or loss of an awarded contract as a result of the award being overturned. Even where we do not lose the awarded contract, the resulting delay in the startup and funding of the work under these contracts may cause our actual results to differ materially and adversely from those anticipated.

The U.S. government may: - revise its procurement practices or adopt new contract laws, rules, and regulations, such as cost accounting standards, organizational conflicts of interest, and other rules governing inherently governmental functions at any time;- reduce, delay, or cancel procurement programs resulting from U.S. government efforts to improve procurement practices and efficiency;- limit the creation of new government-wide or agency-specific multiple award contracts;- face restrictions or pressure from government employees and their unions regarding the amount of services the U.S. government may obtain from private contractors;- award contracts on a technically acceptable/lowest cost basis in order to reduce expenditures, and we may not be the lowest cost provider of services;- adopt new socio-economic requirements, including setting aside procurement opportunities to small, disadvantaged businesses;- change the basis upon which it reimburses our compensation and other expenses or otherwise limits such reimbursements; and - at its option, terminate or decline to renew our contracts. In addition, any new contracting methods could be costly or administratively difficult for us to implement and could adversely affect our future revenue and profit margin. In addition, changes to the procurement system could cause delays in the procurement decision-making process. Any such changes to the U.S. government's procurement practices or the adoption of new contracting rules or practices could impair our ability to obtain new or re-compete contracts and any such changes or increased associated costs could materially and adversely affect our results of operations.

U.S. government contractors (including their subcontractors and others with whom they do business) operate in a highly regulated environment and are routinely audited and reviewed by the U.S. government and its agencies, including the DCAA, DCMA, Department of Defense Inspector General, and others. These agencies review our performance on contracts, pricing practices, cost accounting practices, and compliance with applicable policies, laws, regulations, and standards, including applicable government cost accounting standards, as well as our contract costs, including allocated indirect costs. The DCAA audits and the DCMA reviews, among other areas, the adequacy of our internal control systems and policies, including our DFARS required business systems, which are comprised of our purchasing, property, estimating, earned value, accounting and material management and accounting systems. These internal control systems could focus on significant elements of costs, such as executive compensation. Determination of a significant internal control deficiency by a government agency could result in increased payment withholding that might adversely affect our cash flow. In particular, over time the DCMA has increased and may continue to increase the proportion of executive compensation that it deems unallowable and the size of the executive population whose compensation is disallowed, which will continue to materially and adversely affect our results of operations or financial condition including the requirement to carry an increased level of reserves. We recognize as revenue, net of reserves, executive compensation that we determine, based on management's estimates, to be allowable; management's estimates in this regard are based on a number of factors that may change over time, including executive compensation survey data, our and other government contractors' experiences with the DCAA audit practices in our industry, and relevant decisions of courts and boards of contract appeals. Any costs found to be unallowable under a contract will not be reimbursed, and any such costs already reimbursed must be refunded. Further, the amount of any such refund may exceed the provision for claimed indirect costs, which is based on management's estimates and assumptions that are inherently uncertain and may not cover actual losses. For example, DCAA audits may result in, and have historically resulted in, the Company's inability to retain certain claimed indirect costs, including executive and employee compensation, due to differing views of the allowability and reasonableness of such costs. As of March 31, 2024, years subsequent to the Company's fiscal year 2011 remained subject to audit and/or final resolution. As of March 31, 2024, the Company recognized a liability of $363.7 million for estimated adjustments to claimed indirect costs based on its historical DCAA audit results, including the final resolution of such audits with the DCMA. Determining the provision for claimed indirect costs is complex and subject to management's estimate of adjustments to claimed indirect costs based on the number of years that remain open to audit and expected final resolution by U.S. government agencies. As a result, significant changes in estimates could have a material effect on the Company's results of operations. Furthermore, the disallowance of any costs previously charged could directly and negatively affect our current results of operations for the relevant prior fiscal periods, and we could be required to repay any such disallowed amounts. Each of these results could materially and adversely affect our results of operations or financial condition. Moreover, if any of the administrative processes and business systems, some of which are currently certified as effective, are found not to comply with government imposed requirements, we may be subjected to increased government scrutiny and approval that could delay or otherwise adversely affect our ability to compete for or perform contracts or to be paid timely. Unfavorable U.S. government audit, review, or investigation results could subject us to civil or criminal penalties or administrative sanctions, require us to retroactively and prospectively adjust previously agreed to billing or pricing rates for our work, and could harm our reputation and relationships with our clients and impair our ability to be awarded new contracts, which could affect our future sales and profitability by preventing us, by operation of law or in practice, from receiving new government contracts for some period of time. In addition, if our invoicing system were found to be inadequate following an audit by the DCAA, our ability to directly invoice U.S. government payment offices could be eliminated. As a result, we would be required to submit each invoice to the DCAA for approval prior to payment, which could materially increase our accounts receivable days sales outstanding and adversely affect our cash flow. In addition, proposed regulatory changes, if adopted, would require the Department of Defense's contracting officers to impose contractual withholding at no less than certain minimum levels based on assessments of a contractor's business systems. If a government investigation uncovers improper or illegal activities, we may be subject to civil and criminal penalties and administrative sanctions, including termination of contracts, forfeitures of profits, withholding of payments, suspension of payments, fines, and suspension or debarment from doing business with the U.S. government. We could also suffer serious reputational harm if allegations of impropriety were made against us. In addition, operation of our financial management systems and certain changes to our cost accounting practices that we have adopted may negatively impact our profitability. In particular, the changes to our cost accounting practices required us to estimate changes in costs for certain contracts and make payments in connection with such estimates. The changes are subject to audit by the DCAA and negotiation with the DCMA, which could result in additional payments that may be material and not recoverable. To the extent we are unable to fully mitigate the costs associated with changes to our cost accounting practices as we implement the new systems, our business and financial results may be adversely affected.

U.S. government contracts contain provisions and are subject to laws and regulations that provide government clients with rights and remedies not typically found in commercial contracts. These rights and remedies allow government clients, among other things, to: - terminate existing contracts, with short notice, for convenience as well as for default;- reduce orders under or otherwise modify contracts;- for contracts subject to the Truthful Cost or Pricing Data Statute, reduce the contract price or cost where it was increased because a contractor or subcontractor furnished cost or pricing data during negotiations that was not complete, accurate or current;- for some contracts, (i) demand a refund, make a forward price adjustment, or terminate a contract for default if a contractor provided inaccurate or incomplete data during the contract negotiation process and (ii) reduce the contract price under certain triggering circumstances, including the revision of price lists or other documents upon which the contract award was predicated;- terminate our facility security clearances and thereby prevent us from receiving classified contracts;- cancel multi-year contracts and related orders if funds for contract performance for any subsequent year become unavailable;- decline to exercise an option to renew a multi-year contract or issue task orders in connection with IDIQ contracts;- claim rights in solutions, systems, and technology produced by us, appropriate such work-product for their continued use without continuing to contract for our services and disclose such work-product to third parties, including other U.S. government agencies and our competitors, which could harm our competitive position;- prohibit future procurement awards with a particular agency due to a finding of organizational conflicts of interest based upon prior related work performed for the agency that would give a contractor an unfair advantage over competing contractors, or the existence of conflicting roles that might bias a contractor's judgment;- subject the award of contracts to protest by competitors, which may require the contracting federal agency or department to suspend our performance pending the outcome of the protest and may also result in a requirement to resubmit offers for the contract or in the termination, reduction, or modification of the awarded contract;- suspend or debar us from doing business with the U.S. government; and - control or prohibit the export of our services. Recent and potential future budget cuts and recent efforts to decrease federal awards for management support services may cause agencies with which we currently have contracts to terminate, reduce the number of task orders under or fail to renew such contracts. If a U.S. government client were to unexpectedly terminate, cancel, or decline to exercise an option to renew with respect to one or more of our significant contracts, or suspend or debar us from doing business with the U.S. government, our revenue and operating results would be materially harmed.

We derive a substantial portion of our revenue from contracts with the U.S. government that are classified or subject to security restrictions that preclude the dissemination of certain information. In general, access to classified information, technology, facilities, or programs requires appropriate personnel security clearances, is subject to additional contract oversight and potential liability, and may also require appropriate facility clearances and other specialized infrastructure. A significant number of our employees have security clearances which preclude them from providing information regarding certain clients and services provided to such clients to other employees (or members of our board of directors) without security clearances and investors. Because we are limited in our ability to provide information about these contracts and services, the various risks associated with these contracts or services or any dispute or claims relating to such contracts or services, important information concerning our business may not be available, which may limit insight into a substantial portion of our business and reduce the ability to fully evaluate the risks related to that portion of our business.

Any failure by us, our vendors or other business partners to comply with international, U.S. federal, state or local laws and regulations regarding data privacy or cybersecurity could result in regulatory actions or lawsuits against us, legal liability, injunctions, fines, damages or other costs. We may also incur substantial expenses in implementing and maintaining compliance with such laws and regulations, including those that require certain types of data to be retained on servers within these jurisdictions. In addition, enactment or expansion of laws related to the use of artificial intelligence in our operations could increase the cost of doing business, subject us to potential liability, regulatory risk or reputational harm. Our failure to comply with applicable laws and regulations may result in privacy claims or enforcement actions against us, including liabilities, fines and damage to our reputation, any of which may have a material adverse effect on our results of operations. For example, the European Union's General Data Protection Regulation (the "GDPR"), and the United Kingdom's GDPR impose compliance obligations on companies that process personal data of people in the European Union and United Kingdom, respectively. Compliance with these laws requires investment into ongoing data protection activities and documentation requirements, and creates the potential for fines and liabilities for noncompliance. In addition, California, Colorado, Connecticut, Iowa, Virginia, Utah, and other states have enacted comprehensive privacy laws that restrict the collection, use, and processing of personal information, provide rights to residents of those respective states, and create corresponding compliance obligations and litigation risks. For example, the California Consumer Privacy Act (the "CCPA", as amended by the California Privacy Rights Act, the "CPRA"), the Virginia Consumer Data Protection Act (the "VCDPA"), and the Colorado Privacy Act (the "CPA"), provide for consumer rights for residents of those respective states and create corresponding compliance obligations and litigation risks. The impact from the VCDPA and the CPA to Booz Allen is currently low because most of our personal information is client- or employee-related and therefore not defined as consumer-related. However, the CCPA now covers personal information collected from California residents in the context of recruitment and employment, as well as business-to-business arrangements, and therefore imposes additional compliance obligations on Booz Allen with respect to such personal information. These comprehensive state privacy laws, or other emerging U.S. state or global privacy laws, may require additional investment in compliance programs and potential modifications to business processes, and could result in fines, individual claims, and liabilities for certain compliance failures, particularly in the event of a data breach. As other states follow this trend, laws of this nature could be deemed applicable to some aspects of our business. This will impose new compliance obligations and require additional investment into data protection activities. Any obligations that may be imposed on us under CCPA, CPRA, VCDPA, CPA or similar laws may increase our compliance costs and potential liability, particularly in the event of a data breach, and could have a material adverse effect on our business, including how we use personal information or our results of operations. The U.S. Congress is considering federal privacy, cybersecurity and AI legislation that would create requirements similar to or possibly exceeding these comprehensive U.S. state privacy laws on a 50-state basis. Any federal legislation may or may not preempt the comprehensive U.S. state privacy laws, creating the possibility of different compliance measures or enforcement risks nationally or on a per-state basis. Any obligations that may be imposed on us under any of the comprehensive U.S. state privacy laws or similar laws may be different from or in addition to those required by the EU GDPR, UK GDPR, and any other applicable international laws, which may cause additional expense for compliance across jurisdictions. The EU GDPR, UK GDPR, other international laws, and the laws of U.S. states also impose obligations to maintain and implement an information security program that includes administrative, technical, physical, or organizational safeguards, as well as obligations to give notice to affected individuals and to certain regulators in the event of a data breach. We may be required to spend significant resources to comply with these information security and data breach legal requirements. A significant data breach (including various forms of external attack, such as ransomware, as well as data incidents resulting from internal actions or omissions) could have negative consequences for our business and future prospects, including possible penalties, fines, damages, reduced customer demand, legal claims against and by clients, personnel, business partners or other persons claiming to be affected, harm to our systems and operations and harm to our reputation and brand. In addition, as a contractor supporting defense and national security clients, we are subject to certain additional regulatory compliance requirements relating to data privacy and cybersecurity. Under DFARS and other federal regulations, our networks and IT systems are required to comply with the security and privacy controls in certain National Institute of Standards and Technology Special Publications ("NIST SP"). To the extent that we do not comply with the applicable security and control requirements, unauthorized access or disclosure of sensitive information could result in a contract termination, which could have a material adverse effect on our business and financial results and lead to reputational harm. We are also subject to the Department of Defense Cybersecurity Maturity Model Certification ("CMMC"), requirements, which will require all contractors to receive specific third-party certifications relating to specified cybersecurity standards in order to be eligible for contract awards. Under "CMMC 1.0", released in January 2020, there were 5 maturity levels, comprised of 171 requirements and 14 required processes. In March 2021, the Department of Defense initiated an interim review of CMMC's implementation, which led to a refinement of the overall program and implementation strategy. In November 2021, the Department of Defense announced "CMMC 2.0", which included updated program structure and requirements. These refinements included a reduction in levels from 5 to 3, which includes the removal of CMMC-unique practices and reliance on the practices set forth in NIST SP 800-171(r2). The Department of Defense announced that CMMC 2.0 will become a contract requirement, likely to appear in contracts within one year of the rule going into effect, and is expected to appear in all defense contracts within two years of the rule going into effect. On December 26, 2023, the Department of Defense published a proposed rule for the CMMC 2.0 program requirements, and may face delays with uncertainties regarding final details and timing of the final requirements. To the extent we are unable to achieve certification in advance of applicable contract awards that specify the requirement, we will be unable to bid on such contract awards or on follow-on awards for existing work with the Department of Defense, depending on the level of standard as required for each solicitation, which could adversely impact our revenue and profitability. In addition, our subcontractors, and in some cases our vendors, may also be required to adhere to the CMMC program requirements and potentially to achieve certification. Should our supply chain fail to meet compliance requirements or achieve certification, this may adversely affect our ability to receive award or execute on relevant government programs. In addition, any obligations that may be imposed on us under the CMMC may be different from or in addition to those otherwise required by applicable laws and regulations, which may cause additional expense for compliance.

The cost of providing our services, including the degree to which our employees are utilized, affects our profitability. The degree to which we are able to utilize our employees in a timely manner or at all is affected by a number of factors, including: - our ability to transition employees from completed projects to new assignments and to hire, assimilate, and deploy new employees;- our ability to forecast demand for our services and to maintain and deploy headcount that is aligned with demand, including employees with the right mix of skills and experience to support our projects;- our employees' inability to obtain or retain necessary security clearances;- our ability to manage attrition; and - our need to devote time and resources to training, business development, and other non-chargeable activities. If our employees are under-utilized, our profit margin and profitability could suffer. Additionally, if our employees are over-utilized, it could have a material adverse effect on employee engagement and attrition, which would in turn have a material adverse impact on our business. Our profitability is also affected by the extent to which we are able to effectively manage our overall cost structure for operating expenses, such as wages and benefits, overhead and capital, and other investment-related expenditures. If we are unable to effectively manage our costs and expenses and achieve efficiencies, our competitiveness and profitability may be adversely affected.

We are exposed to the risk that fraud or other misconduct by employees, subcontractors, suppliers or other third parties with which we do business could occur. Misconduct by employees, subcontractors or suppliers could include intentional or unintentional failures to comply with U.S. government procurement regulations, engaging in other unauthorized activities, misusing authorized access, or falsifying time records. Misconduct could also involve the improper use of our clients' sensitive or classified information, or the inadvertent or intentional disclosure of our or our clients' sensitive information in violation of our contractual, statutory, or regulatory obligations. It is not always possible to deter employee, subcontractor, or supplier misconduct, and the precautions we take to prevent and detect this activity may not be effective in controlling unknown or unmanaged risks or losses, which could materially harm our business. As a result of such misconduct, our employees could lose their security clearances and we could face fines and civil or criminal penalties, loss of facility clearance accreditation, and suspension, proposed debarment or debarment from bidding for or performing under contracts with the U.S. government, as well as reputational harm, which would materially and adversely affect our results of operations and financial condition.

To the extent the U.S. Congress is unable to approve the annual federal budget or raise the debt ceiling on a timely basis, and enacts a continuing resolution, funding for new projects may not be available and funding on contracts we are already performing may be delayed. If Congressional efforts to approve such funding fail, and Congress is unable to craft a long-term agreement on the U.S. government's ability to incur indebtedness in excess of its current limits, the U.S. government may not be able to fulfill its current funding obligations and there could be significant disruption to all discretionary programs, which would have corresponding impacts on us and our industry. Any such delays would likely result in new business initiatives being delayed or canceled and a reduction in our backlog, and could have a material adverse effect on our revenue and operating results. In addition, a failure to complete the budget process and fund government operations pursuant to a continuing resolution may result in a U.S. government shutdown, which could result in us incurring substantial costs without reimbursement under our contracts. The delay or cancellation of key programs or the delay of contract payments may have a material adverse effect on our revenue and operating results. In addition, when supplemental appropriations are required to operate the U.S. government or fund specific programs and the passage of legislation needed to approve any supplemental appropriation bill is delayed, the overall funding environment for our business could be adversely affected.

Volatile, negative, or uncertain economic conditions, an increase in the likelihood of a recession, or concerns about these or other similar risks may negatively impact our clients' ability and willingness to fund their projects. For example, declines in state and local tax revenues as well as other economic declines may result in lower state and local government spending. Our clients reducing, postponing or cancelling spending on projects in respect of which we provide services may reduce demand for our services quickly and with little warning, which could have a material adverse effect on our business, results of operations and financial condition. Moreover, instability in the credit or capital markets in the U.S., including as a result of failures of financial institutions and any related market-wide reduction in liquidity, or concerns or rumors about events of these kinds or similar risks, could affect the availability of credit, making it relatively difficult or expensive to obtain additional capital at competitive rates, on commercially reasonable terms or in sufficient amounts, or at all, thus making it more difficult or expensive for us to access funds or refinance our existing indebtedness, or obtain financing for acquisitions. Such instability could also cause counterparties, including vendors, suppliers and subcontractors, to be unable to perform their obligations, or to breach their obligations, to us under our contracts with them. In addition, instability in the credit or capital markets could negatively impact our clients' ability to fund their project and, therefore, utilize our services, which could have a material adverse effect on our business, results of operations and financial condition.

For a variety of reasons, including geopolitical factors, the global economy in which we operate has faced, and may continue to face, heightened inflationary pressure, impacting the cost of doing business (in both supply and labor markets). These inflationary pressures have been and could continue to be exacerbated by geopolitical turmoil and economic policy actions, and the duration of such pressures is uncertain. We generate revenue through various fixed price and multi-year government contracts, our primary customer being the U.S. government, which has traditionally been viewed as less affected by inflationary pressures. However, our approach to include modest annual price escalations in our bids for multi-year work may be insufficient to counter inflationary cost pressures, which may result in significant cost overruns on each contract. This could result in reduced profits, or even losses, as inflation increases, particularly for fixed priced contracts, and our longer-term multi-year contracts as contractual prices become less favorable to us over time. In the competitive environment in which we operate as a government contractor, the lack of pricing leverage and power to renegotiate long-term, multi-year contracts, coupled with reduced customer buying power as a result of inflation, could reduce our profits, disrupt our business, or otherwise materially adversely affect our results of operations.