Avid Bioservices (CDMO) Risk Analysis

In the ordinary course of our business, we and the third parties with whom we work process sensitive data, and, as a result, we and the third parties with whom we work face a variety of evolving threats that could cause security incidents. We are also increasingly dependent upon sophisticated information technology systems and infrastructure in connection with the conduct of our business. We must constantly update our information technology infrastructure and our various current information technology systems may not continue to meet our current and future business needs. Furthermore, modification, upgrade or replacement of such systems may be costly. Due to the size and complexity of our information technology systems, any breakdown, interruption, corruption or unauthorized access to or cyber-attack on these systems could create system disruptions, shutdowns or unauthorized disclosure of sensitive data. Cyber-attacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive data and information technology systems, and those of the third parties with whom we work. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer "hackers," threat actors, "hacktivists," organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties upon which we rely may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our products and services. We and the third parties with whom we work are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, attacks enhanced or facilitated by AI, telecommunications failures, earthquakes, fires, floods, and other similar threats. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, ability to provide our products or services, loss of sensitive data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Remote work has become more common and has increased risks to our information technology systems and data, as more of our employees utilize network connections, computers, and devices outside our premises or network, including working at home, while in transit and in public locations. Additionally, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. We may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program. We rely on third-party service providers and technologies to operate critical business systems that process sensitive data. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. We take steps designed to detect, mitigate, and remediate vulnerabilities in our information technology systems. We may not, however, detect and remediate all such vulnerabilities including on a timely basis. Further, we may experience delays in deploying remedial measures and patches designed to address identified vulnerabilities. Vulnerabilities could be exploited and result in a security incident. While we have implemented security measures designed to protect our sensitive data and information technology systems and to prevent such breakdowns and unauthorized breaches and cyber-attacks, these measures may not be successful and these breakdowns and breaches in, or attacks on, our systems and data may not be prevented. Such breakdowns, breaches or attacks may cause business interruption and could have a material adverse effect on our business, financial condition, results of operations and cash flows and could cause the market value of our shares of common stock to decline. If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive data (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial damage or other loss, including fines or criminal penalties because of lost or misappropriated information. Applicable data privacy and security obligations may require us to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents, or to implement other requirements, such as providing credit monitoring. Such disclosures and compliance with such requirements are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. Security incidents and attendant consequences may prevent or cause customers to stop using our services, deter new customers from using our services, and negatively impact our ability to grow and operate our business. We may expend significant resources or modify our business activities to try to protect against security incidents. Additionally, certain data privacy and security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive data. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.

We depend on our ability to attract and retain qualified scientific and technical employees, as well as a number of key executives. These employees may voluntarily terminate their employment with us at any time. We may not be able to retain key personnel, or attract and retain additional qualified employees. We do not maintain key-man or similar policies covering any of our senior management or key personnel. Our inability to attract and retain key personnel would have a material adverse effect on our business.

Our operations require various raw materials, including proprietary media, resins, buffers, and filters, in addition to numerous additional raw materials supplied primarily by third parties. We or our customers specify the raw materials and other items required to manufacture their product and, in some cases, specify the suppliers from whom we must purchase these raw materials. In certain instances, the raw materials and other items can only be supplied by a limited number of suppliers and, in some cases, a single source, or in limited quantities. If third-party suppliers do not supply raw materials or other items on a timely basis, it may cause a manufacturing run to be delayed or canceled which would adversely impact our financial condition and results of operations. Additionally, we do not have long-term supply contracts with any of our single source suppliers. If we experience difficulties acquiring sufficient quantities of required materials or products from our existing suppliers, or if our suppliers are found to be non-compliant with the FDA's quality system regulation, CGMPs or other applicable laws or regulations, we would be required to find alternative suppliers. If our primary suppliers become unable or unwilling to perform, any resulting delays or interruptions in the supply of raw materials required to support our manufacturing of CGMP pharmaceutical-grade products would ultimately delay our manufacture of products for our customers, which could materially and adversely affect our financial condition and operating results. Furthermore, third-party suppliers may fail to provide us with raw materials and other items that meet the qualifications and specifications required by us or our customers. If third-party suppliers are not able to provide us with raw materials that meet our or our customers' specifications on a timely basis, we may be unable to manufacture their product or it could prevent us from delivering products to our customers within required timeframes. Any such delay in delivering our products may create liability for us to our customers for breach of contract or cause us to experience order cancellations and loss of customers. In the event that we manufacture products with inferior quality components and raw materials, we may become subject to product liability claims caused by defective raw materials or components from a third-party supplier or from a customer, or our customer may be required to recall its products from the market.

We maintain property insurance, employer's liability insurance, product liability insurance, general liability insurance, business interruption insurance, and directors' and officers' liability insurance, among others. Although we maintain what we believe to be adequate insurance coverage, potential claims may exceed the amount of insurance coverage or may be excluded under the terms of the policy, which could cause an adverse effect on our business, financial condition and results from operations. Generally, we would be at risk for the loss of inventory that is not within customer specifications. These amounts could be significant. In addition, in the future we may not be able to obtain adequate insurance coverage or we may be required to pay higher premiums and accept higher deductibles in order to secure adequate insurance coverage.

We operate in a market that is highly competitive. Our competition in the contract manufacturing market includes full-service contract manufacturers and large pharmaceutical companies offering third-party manufacturing services to fill their excess capacity. We may also compete with the internal operations of those pharmaceutical companies that choose to source their product offerings internally. In addition, most of our competitors may have substantially greater financial, marketing, technical or other resources than we do. Moreover, additional competition may emerge, particularly in lower-cost jurisdictions such as India, which could, among other things, result in a decrease in the fees paid for our services, which may adversely affect our financial condition and results of operations.

We generally do not have long-term contracts with our customers, and existing contracts and purchase commitments may be canceled under certain circumstances. As a result, we are exposed to market and competitive price pressures on every order, and our agreements with customers do not provide assurance of future revenues. Our customers are not required to make minimum purchases and, in certain circumstances, may cease using our services at any time without penalty. Our backlog should not be relied on as a measure of anticipated demand or future revenue, because the orders constituting our backlog may be subject to changes in delivery schedules or cancellation without significant penalty to the customer. Any reductions, cancellations or deferrals in customer orders would negatively impact our business.

Public health crises such as pandemics or similar outbreaks may affect our operations and those of third parties on which we rely, including our customers and suppliers. Our business, financial condition, and results of operations may be affected by: disruptions in our customers' abilities to fund, develop, or bring to market products as anticipated; delays in or disruptions to the conduct of clinical trials by our customers; cancellations of contracts or confirmed orders from our customers; and inability, difficulty, or additional cost or delays in obtaining key raw materials, components, and other supplies from our existing supply chain; among other factors caused by a public health crises. For example, the COVID-19 pandemic led to the implementation of various responses, including government-imposed quarantines, travel restrictions and other public health safety measures. The extent to which future pandemics impact our operations and/or those of our customers and suppliers will depend on future developments, which are highly uncertain and unpredictable, including the duration or recurrence of outbreaks, potential future government actions, new information that will emerge concerning the severity and impact of that pandemic and the actions to contain the pandemic or address its impact in the short and long term, among others. The business disruptions associated with a global pandemic could impact the business, product development priorities and operations of our customers and suppliers. For example, disruptions in supply chains and disruptions to the operations of the FDA and other drug regulatory authorities, could result in, among other things, delays of inspections, reviews, and approvals of our customers' products, as well as the volume and timing of orders from these customers. Such disruptions could result in delays in the development programs of our customers or impede the commercial efforts for our customers' approved products, resulting in potential reductions or delays in orders from our customers which could have a material negative effect on our business in the future.