Exponent (EXPO) Risk Factors

The markets for our services are highly competitive. In addition, there are relatively low barriers to entry into our markets and we have faced, and expect to continue to face, additional competition from new entrants into our markets. Competitive pressure could reduce the market acceptance of our services and result in limitations in our ability to implement billing rate increases or maintain billing rates that could have a material adverse effect on our business, financial condition or results of operations.

The professional reputation of Exponent and its consultants is critical to our ability to successfully compete for new client engagements and attract or retain professionals. Proven or unproven allegations against us may damage our professional reputation. Any factors that damage our professional reputation could have a material adverse effect on our business.

Tax reform remains a legislative priority for the U.S. government and certain legislations have already been enacted. While there is current uncertainty regarding what changes will eventually be enacted, such new laws may affect our operating results and financial conditions. On August 16, 2022, the U.S. government enacted the Inflation Reduction Act of 2022 that includes, among other provisions, changes to the U.S. corporate income tax system, including a fifteen percent minimum tax based on "adjusted financial statement income," and a one percent excise tax on net repurchases of stock after December 31, 2022. Changes, if any, to the U.S. or non-U.S. taxation of our operations may increase our worldwide effective tax rate, result in additional taxes, or other costs or have other material consequences, which could harm our business, revenue, cash flows and financial results.

We manage, utilize, and store sensitive or confidential client and employee data, including personal data and protected health information. As a result, we are subject to numerous laws and regulations designed to protect this information, such as the U.S. federal and state laws governing the protection of health or other personally identifiable information, including the Health Insurance Portability and Accountability Act, and international laws such as the European Union General Data Protection Regulation and the People's Republic of China's Data Security Law. In addition, many states, U.S. federal governmental authorities and non-U.S. jurisdictions have adopted, proposed, or are considering adopting or proposing, additional data security and/or data privacy statutes or regulations. For instance, we may be subject to Federal Trade Commission (FTC) enforcement actions if the FTC has reason to believe we have engaged in unfair or deceptive privacy or data security practices in violation of the FTC Act. In addition, an increasing number of U.S. states have enacted U.S. state privacy laws that set forth comprehensive privacy and security obligations regarding the collection and processing of personal data, including such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and other state laws that set forth comprehensive privacy and security obligations regarding the collection and processing of personal data. These laws and regulations are increasing in complexity and number. As a result of these legal and regulatory requirements we incur and expect to continue to incur significant ongoing costs as part of our efforts to comply with applicable law. Failure to comply with these laws and regulations may lead to significant monetary damages, regulatory enforcement actions, fines, penalties or other regulatory liabilities, such as orders or consent decrees forcing us to modify business practices, and reputational damage or third-party lawsuits for any noncompliance with such laws. If any person, including any of our employees, negligently disregards or intentionally breaches our established controls with respect to client or employee data, or otherwise mismanages or misappropriates that data, we could also be subject to significant monetary damages, regulatory enforcement actions, fines, and/or criminal prosecution. In addition, unauthorized disclosure of sensitive or confidential client or employee data, whether through systems failure, employee negligence, fraud, or misappropriation, could damage our reputation and cause us to lose clients and their related revenue in the future.

We maintain insurance coverage from third-party insurers as part of our overall risk management strategy and because some of our contracts require us to maintain specific insurance coverage limits. If any of our third-party insurers fail, suddenly cancel our coverage or otherwise are unable to provide us with adequate insurance coverage, then our overall risk exposure and our operational expenses would increase and the management of our business operations would be disrupted. In addition, there can be no assurance that any of our existing insurance coverage will be renewable upon the expiration of the coverage period or that future coverage will be affordable at the required limits.

We are subject to risks arising from adverse changes in economic and political conditions, both domestically and globally, including unfavorable changes in economic conditions, such as inflation, rising interest rates or a recession, and other events beyond our control, such as geopolitical developments, economic sanctions, natural disasters, pandemics, epidemics, political instability, armed conflicts and wars, including the Russia-Ukraine war and the conflict in the Middle East. Worsening economic conditions have had and may continue to have an adverse impact on the businesses and financial health of many of our clients. As a result, current or potential clients may consolidate or go out of business and thus demand for our services may be reduced significantly. Political changes and trends such as populism, protectionism, economic nationalism and sentiment toward multinational companies, as well as tariffs, export controls, restrictions on outbound investment or other trade barriers, sanctions, currency controls, or changes to tax or other laws or policies, have been and may continue to be disruptive to our business. These can interfere with our global operating model, client relationships, and competitive position. Further escalation of any specific trade tensions between the U.S. and China, or in global trade conflict more broadly could be harmful to global economic growth or to our business in or with China or other countries.

In addition to our offices in the United States, we have a presence in the United Kingdom, Switzerland, Hong Kong, China, Singapore, Ireland, Germany, and Canada, and conduct business in several other countries. We expect to continue to expand globally and our international revenues may account for an increasing portion of our revenues in the future. Our international operations carry special financial, business and legal risks, including cultural and language differences; employment laws and related factors that could result in lower utilization, higher staffing costs, and cyclical fluctuations of utilization and revenues; currency fluctuations that adversely affect our financial position and operating results; burdensome regulatory requirements and other barriers to conducting business; tariffs/trade disputes and other trade barriers; geopolitical risks that could result in an adverse impact to our clients and Exponent, such as cyberattacks, trade sanctions, and increased regulatory scrutiny on operations; armed conflicts and wars, including the Russia-Ukraine war and the conflicts in the Middle East; managing the risks associated with engagements with foreign officials and governmental agencies, including the risks arising from the United States Foreign Corrupt Practices Act and the United Kingdom Bribery Act of 2010; managing the risks associated with global privacy and data security laws and regulations including the General Data Protection Regulation in Europe and China's data protection and national security laws; greater difficulties in managing and staffing foreign operations; successful entry and execution in new markets; restrictions on the repatriation of earnings; potentially adverse tax consequences; and other impending legislation that could add additional risks to the business.

We have experienced, and expect to continue to be subjected to, security breaches and threats, none of which have been material to us to date. Despite the implementation of security and business continuity measures, our information technology infrastructure and networks are vulnerable to electronic breaches of security. Furthermore, we are subject to risks to information security posed by external or insider threats, including unauthorized access, manipulation, misuse, or improper disclosure of proprietary, sensitive, or confidential information by employees, contractors, or other insiders. Any such breaches could lead to disruptions of our operations and potential unauthorized disclosure of confidential and/or personal information, which could result in legal claims or proceedings, have impacts to our operations, and/or cause harm to our reputation. Our systems and data are protected by a comprehensive Information Security program detailed in our Information Security Management System. Dedicated security, privacy, information governance, and compliance professionals maintain the program with oversight provided by the Board of Directors in conjunction with senior leadership. See Item 1C. for more information about our Cybersecurity Risk Management and Strategy. While we have taken reasonable steps to prevent and mitigate the damage of a security breach by continuously improving our design and coordination of security controls across our business, those steps may not be effective and there can be no assurance that any such steps can be effective against all possible risks.

We depend on multiple internal and external information systems for operating our business. We utilize commercially available third-party technology solutions, which in many cases are customized to our business needs. Our information systems may be compromised by power outages, computer and telecommunications failures, computer viruses, security breaches, hackers, catastrophic events, human error and other events, many of which are beyond our control, and are subject to obsolescence and technological changes. If our information systems fail to work properly or otherwise become unavailable, or if we encounter difficulties in integrating new or replacement systems, we may incur substantial time, efforts and costs to repair or replace such systems, or otherwise carry out our operations without the ability to use such systems. Failure of any such information system could result in delays, significant additional costs, incorrect information, failure of internal control and harm to our reputation as well as expose us to regulatory actions and claims any of which could adversely affect our business and results of operations and our reputation.