DLH Holdings (DLHC) Risk Factors

We are exposed to legal proceedings, investigations and disputes. In addition, in the ordinary course of our business we may become involved in legal disputes regarding personal injury or employee disputes. While we provide for these types of incidents through commercial third-party insurance carriers, we often defray these types of cost through higher deductibles. Any unfavorable legal ruling against us could result in substantial monetary damages by losing our deductible portion of carried insurance. We maintain insurance coverage as part of our overall legal and risk management strategy to lower our potential liabilities. If we sustain liabilities that exceed our insurance coverage or for which we are not insured, it could have a material adverse impact on our results of operations, cash flows and financial condition, including our profits, revenues and liquidity.

The markets in which we operate are highly competitive. Further, many of our contracts and task orders with the Federal government are awarded through a competitive bidding process, which is complex and sometimes lengthy. We expect that many of the opportunities we will seek in the foreseeable future will be awarded through competitive bidding. Furthermore, budgetary pressures and developments in the procurement process have caused many government customers to increasingly purchase goods and services through IDIQ contracts, GSA schedule contracts and other government-wide acquisition contracts. These contracts, some of which are awarded to multiple contractors, have increased competition and pricing pressure, requiring that we make sustained post-award efforts to realize revenue under each such contract. Many of our competitors are larger and have greater resources than we do, larger customer bases and greater brand recognition. Our competitors, individually or through relationships with third parties, may be able to provide customers with different or greater capabilities or benefits than we can provide. If we are unsuccessful in competing with these other companies, our revenues and margins may materially decline. Overall, the competitive bidding process presents a number of risks, including the following: (i) we expend substantial cost and managerial time and effort to prepare bids and proposals for contracts that we may not win, and to defend those bids through any protest process; (ii) we may be unable to estimate accurately the resources and cost structure that will be required to service any contract we win; and (iii) we may encounter expenses and delays if our competitors protest or challenge awards of contracts to us in competitive bidding, and any such protest or challenge could result in the resubmission of bids on modified specifications, or in the termination, reduction or modification of the awarded contract. If we are unable to win particular contracts, we may be prevented from providing the services that are purchased under those contracts for a number of years. If we are unable to consistently win new contract awards over any extended period, our business and prospects will be adversely affected and that could cause our actual results to differ materially and adversely from those anticipated. In addition, upon the expiration of a contract, if the customer requires further services of the type provided by the contract, there is frequently a competitive rebidding process. There can be no assurance that we will win any particular bid, or that we will be able to replace business lost upon expiration or completion of a contract, and the termination or non-renewal of any of our significant contracts could cause our actual results to differ materially and adversely from those anticipated. If a bid is won and a contract awarded, there still is the possibility of a bid protest or other delays in implementation. Our business could be adversely affected by delays caused by our competitors protesting major contract awards received by us, resulting in the delay of the initiation of work. It can take many months to resolve protests by one or more of our competitors of contract awards we receive. The resulting delay in the startup and funding of the work under these contracts may cause our actual results to differ materially and adversely from those anticipated, and there can be no assurance that such protest process or implementation delays will not have a material adverse effect on our financial condition or results of operations in the future.

We rely upon a combination of nondisclosure agreements and other contractual arrangements, as well as copyright, trademark, and trade secret laws to protect our proprietary information. We also enter into proprietary information and intellectual property agreements with employees, which require them to disclose any inventions created during employment, to convey such rights to inventions to us, and to restrict any disclosure of proprietary information. Trade secrets are generally difficult to protect. Although our employees are subject to confidentiality obligations, this protection may be inadequate to deter or prevent misappropriation of our confidential information and/or the infringement of our trademarks and copyrights. Further, we may be unable to detect unauthorized use of our intellectual property or otherwise take appropriate steps to enforce our rights. Failure to adequately protect, maintain, or enforce our intellectual property rights may adversely limit our competitive position. We may face from time to time, allegations that we or a supplier or customer have violated the intellectual property rights of third parties. If, with respect to any claim against us for violation of third-party intellectual property rights, we are unable to prevail in the litigation or retain or obtain sufficient rights or develop non-infringing intellectual property or otherwise alter our business practices on a timely or cost-efficient basis, our business and competitive position may be adversely affected. Any infringement, misappropriation or related claims, whether or not meritorious, are time consuming, divert technical and management personnel, and are costly to resolve. As a result of any such dispute, we may have to develop non-infringing intellectual property, pay damages, enter into royalty or licensing agreements, cease utilizing certain products or services, or take other actions to resolve the claims. These actions, if required, may be costly or unavailable on terms acceptable to us.

Many of our operations rely heavily upon technology systems and networks to receive, input, maintain and communicate participant and customer data pertaining to the programs we manage. While we have programs designed to protect such information and comply with all relevant privacy and security requirements, the threats that our clients face have grown more frequent and sophisticated. Any systems failures, whether caused by us, a third-party service provider, or unauthorized intruders and hackers, or due to situations such as computer viruses, natural disasters, or power shortages, could cause loss of data or interruptions or delays in our business or that of our customers. If our systems or networks were compromised by a security breach, we could be adversely affected by losing confidential or protected information of program participants and customers, and we could suffer reputational damage and a loss of confidence from prospective and existing customers. Similarly, if our internal networks were compromised, we could be adversely affected by the loss of proprietary, trade secret or confidential technical and financial data. The loss, theft or improper disclosure of that information could subject the Company to sanctions under the relevant laws, remediation costs, contract termination, lawsuits from affected individuals, negative press articles and a loss of confidence from our government customers, all of which could adversely affect our existing business, future opportunities and financial condition. Further, our property and cyber insurance may be inadequate to compensate us for all losses that may occur as a result of any system or operational failure or disruption and, as a result, our actual results could differ materially and adversely from those anticipated. In addition, in order to provide services to our customers, we often depend upon or use customer systems that are supported by the customer or third parties. Any security breach or system failure in such systems could result in an interruption of our customer's operations which could cause us to experience significant delays under a contract, and a material adverse effect on our results of operations. Additionally, a number of projects require us to receive, maintain and transmit protected health information or other types of confidential personal information. That information may be regulated by the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health Act of 2009, Internal Revenue Service regulations and other laws. The loss, theft or improper disclosure of that information could subject us to sanctions under these laws, breach of contract claims, lawsuits from affected individuals, negative press articles and a loss of confidence from our government customers, all of which could adversely affect our existing business, future opportunities and financial condition.

We are highly dependent on the proper functioning of our information systems in operating our business. Critical information systems used in daily operations match employee resources and customer assignments and track regulatory credentialing. They also perform payroll, billing and accounts receivable functions. As the breadth and complexity of this infrastructure continues to grow, including as a result of the increasing reliance on, and use of, mobile technologies, social media and cloud-based services, as more of our employees continue to work remotely, and as cyberattacks become increasingly sophisticated (e.g. deepfakes and AI generated social engineering), the risk of security incidents and cyberattacks has increased. Threat actors may leverage emerging AI technologies to develop new hacking tools and attack vectors, exploit vulnerabilities, obscure their activities, and increase the difficulty of threat attribution. Such incidents could lead to shutdowns or disruptions of or damage to our systems and those of our clients, business partners and vendors, and unauthorized disclosure of sensitive or confidential information, including personal data and proprietary business information. Both our client and our company may experience, data security incidents resulting from unauthorized access to our and our service providers' systems and unauthorized acquisition of our data and our clients' data including: inadvertent disclosure, misconfiguration of systems, phishing ransomware or malware attacks. While we have multiple back up plans for these types of contingencies, our information systems are vulnerable to fire, storms, flood, power loss, telecommunication outages, physical break-ins, cyber-attack, ransomware, and similar events. If our information systems become inoperable, or are otherwise unavailable, these functions would have to be accomplished manually, which in turn could impact our financial viability, due to the increased cost associated with performing these functions manually. Unauthorized disclosure or use of, denial of access to, or other incidents involving sensitive or confidential client, vendor, business partner or DLH data, whether through systems failure, employee negligence, fraud, misappropriation, or cybersecurity, ransomware or malware attacks, or other intentional or unintentional acts, could damage our reputation and our competitive positioning in the marketplace, disrupt our or our clients' business, cause us to lose clients and result in significant financial exposure and legal liability. Cybersecurity threats are constantly expanding and evolving, becoming increasingly sophisticated and complex, increasing the difficulty of detecting and defending against them and maintaining effective security measures and protocols.

We face various risks related to health epidemics, pandemics, and similar outbreak. The COVID-19 pandemic and the mitigation efforts to control its spread created significant volatility, uncertainty and economic disruption and adversely impacted the U.S. and global economies. The extent to which future health epidemics or pandemics impacts our business, operations and financial results will depend on numerous factors that we may not be able to accurately predict or control, including: the duration and scope of the pandemic; governmental, business and individuals' actions that have may be taken in response to such events, including our ability to fully perform on our contracts as a result of government actions; the impact on economic activity and actions taken in response; the effect on our customers and customer demand for our services and solutions; our ability to sell and provide our services and solutions; and any closures of our and our customers' offices and facilities. Furthermore, the significant increase in remote working of our employees may exacerbate certain risks to our business, including an increased demand for information technology resources and the increased risk of malicious technology-related events, such as cyberattacks and phishing attacks. Any of these events could materially adversely affect our business, financial condition, results of operations and the market price of our common stock.