CorVel (CRVL) Risk Analysis

We rely on information technology to support our business activities. Our business involves the storage and transmission of a significant amount of personal, confidential, or sensitive information, including the personal information of our customers and employees, and our Company's financial, operational and strategic information. As with many businesses, we are subject to numerous data privacy and security risks. These risks may prevent us from maintaining the confidentiality of this information, result in the disruption of our business and online systems, and require us to expend significant resources to attempt to secure and protect such information and respond to incidents, any of which could materially adversely affect our business, financial condition or results of operations. The loss, theft, misuse, unauthorized disclosure, or unauthorized access of such sensitive information could lead to significant reputational or competitive harm, result in litigation or regulatory proceedings, or cause us to incur substantial liabilities, fines, penalties or expenses. Cybersecurity incidents of any of the systems on which we rely may result from circumvention of security measures, denial-of-service attacks or other cyber-attacks, hacking, "phishing" attacks, computer viruses, ransomware, malware, employee or insider error, malfeasance, social engineering, physical breaches or other actions. According to media reports, the frequency, intensity, and sophistication of cyber-attacks, ransomware attacks, and other data security incidents has significantly increased worldwide in recent years. As with many other businesses, we have experienced, and are continually at risk of being subject to, attacks that result in cybersecurity incidents caused by computer viruses, unauthorized parties gaining access to our information technology systems, and other similar threats. In some cases, cybersecurity incidents could cause reputational harm, loss of customers, loss and/or delay of revenue, loss of proprietary data, loss of licenses, regulatory actions and scrutiny, sanctions or other statutory penalties, litigation, liability for failure to safeguard customers' information, financial losses, or a drop in our stock price. We have invested in and continue to expend significant resources on information technology and information security tools, measures, processes, initiatives, policies and employee training designed to protect our information technology systems, as well as the personal, confidential or sensitive information stored on or transmitted through those systems, and to ensure an effective response to any cyber-attack or security incident. These expenditures could have an adverse impact on our financial condition and results of operations, and divert management's attention from pursuing our strategic objectives. In addition, the cost and operational consequences of implementing, maintaining and further enhancing our system's protective measures could increase significantly as cybersecurity threats increase. There can be no assurance that the security measures we employ will effectively prevent cybersecurity incidents or otherwise prevent malicious actors from obtaining access to our systems and information. As these threats evolve, cybersecurity incidents could be more difficult to detect, prevent, and remediate. Cybersecurity-attacks or data handling incidents could remain undetected for some period of time, which could not only result in significant harm to our systems, but also lead to unauthorized access to the information stored on and transmitted by our systems. Further, despite our security efforts and training, our employees may purposefully or inadvertently cause cybersecurity incidents. Any occurrence of cybersecurity incidents, whether caused by employees or third parties, could have the potential to impact our relationships with our customers or restrict our ability to meet our customers' expectations. Additionally, as artificial intelligence technologies continue to develop and become more accessible, malicious actors are increasingly leveraging it to carry out advanced cyber-attacks. These artificial intelligence tools can be used to automate and scale attacks, generate phishing or social engineering schemes, employ deepfakes, identity system vulnerabilities, or evade transitional detection methods. Consequently, the use of artificial intelligence by malicious actors may result in an increase in the frequency, speed, and severity of cyber threats targeting our systems, networks, and employees. If a cyber-attack or other data incident results in the loss, theft, misuse, unauthorized disclosure, or unauthorized access of personal, confidential, or sensitive information belonging to our customers or employees, it could put us at a competitive disadvantage, result in the deterioration of our customers' confidence in our services, cause our customers to reconsider their relationship with us, impose more onerous contractual provisions, cause us to lose our regulatory licenses, or subject us to potential litigation, liability, fines and penalties. For example, we could become subject to regulatory or other actions pursuant to privacy laws. This could result in costly investigations and litigation, civil or criminal penalties, operational changes, and negative publicity that could adversely affect our reputation, as well as our results of operations and financial condition. A cyber-attack resulting in a cybersecurity incident could have a significant impact on our business for a prolonged period of time, including: - critical business systems becoming inoperable or requiring a significant amount of time or cost to restore;- key personnel being unable to perform their duties or communicate with employees, customers or other third-parties;- the loss, theft, misuse, unauthorized disclosure, or unauthorized access of customer or Company information;- the inability to access information necessary to conduct our business;- the requirement to make unanticipated investments in equipment, technology or security measures;- our customers losing the ability to access our websites and online systems; or - becoming subject to other unanticipated liabilities, costs, or claims. Any of the foregoing could have a material adverse effect on our business, financial condition and results of operations, and result in harm to our reputation. While we maintain insurance coverage that may, subject to policy terms and conditions, cover certain aspects of the losses and costs associated with cyber-attacks and data incidents, such insurance coverage may be insufficient to cover all losses and would not, in any event, remedy damage to our reputation. In addition, we may face difficulties in recovering any losses from our provider and any losses we recover may be lower than we initially expect.

Our future success depends, in part, on our ability to anticipate and respond effectively to the risk of, and conversely, the opportunity presented by digital disruption, "big data" and data analytics, and other developments in technology. These may include new applications or insurance-related services based on artificial intelligence, machine learning, robotics, blockchain, the metaverse or new approaches to data mining that impact the nature of how we generate revenue. We may be exposed to competitive risks related to the adoption and application of new technologies by established market participants or new entrants such as technology companies, start-up companies and others. These new entrants are focused on using technology and innovation, including artificial intelligence and blockchain, in an attempt to simplify and improve the client experience, increase efficiencies, alter business models and effect other potentially disruptive changes in the industries in which we operate. We must also develop and implement technology solutions and technical expertise among our employees that anticipate and keep pace with rapid and continuing changes in technology, industry standards, client preferences and internal control standards. We may not be successful in anticipating or responding to these developments on a timely and cost-effective basis and our ideas may not be accepted in the marketplace. Data produced by or contained in technology that uses artificial intelligence may contain a degree of inaccuracy and error. Additionally, the effort to gain technological expertise, make use of data analytics, and develop new technologies in our business requires us to incur significant expenses. Investments in technology systems and data analytics capabilities may not deliver the benefits or perform as expected, or may be replaced or become obsolete more quickly than expected, which could result in operational difficulties or additional costs. If we or our third-party vendors fail to effectively implement these new technologies, including, artificial intelligence, we could be subject to additional risks that we do not understand or cannot adequately mitigate, which could have a material adverse effect on our results of operations and financial condition. Further, if we cannot offer new technologies or data analytics solutions as quickly as our competitors, or if our competitors develop more cost-effective technologies, data analytics solutions or other product offerings, we could experience a material adverse effect on our operating results, client relationships, growth and compliance programs. In some cases, we depend on key third-party vendors and partners to provide technology and other support for our strategic initiatives. If these third parties fail to perform their obligations or cease to work with us, our ability to execute on our strategic initiatives could be adversely affected.