Franklin Covey Company (FC) Risk Factors

We are dependent on information technology networks and systems to process, transmit, and store electronic information and to communicate between our locations around the world and with our clients. Security breaches of this infrastructure could lead to shutdowns or disruptions of our systems and potential unauthorized disclosure of personal and confidential data. We are also required at times to manage, utilize, and store personal data, including sensitive or confidential client or employee data. As a result, we are subject to numerous U.S. and foreign jurisdiction laws and regulations designed to protect this information, such as the various U.S. federal and state laws governing the protection of personal data. If we, our associates, business partners, or our service providers negligently disregard or intentionally breach our established controls with respect to such data or otherwise mismanages or misappropriates that data, we could be subject to notification requirements, monetary damages, fines, and/or criminal prosecution, as well as litigation from parties impacted by a breach of their data or harm to their systems as a result of malware or other security incidents within our own networks or systems. Unauthorized disclosure, loss or alteration of personal, sensitive, or confidential client or employee data or client or end-user systems, whether through systems failure, employee negligence, fraud, or misappropriation could damage our reputation and cause us to lose clients. Legal requirements relating to the collection, storage, handling, and transfer of personal data continue to evolve. For example, in May 2018 the General Data Protection Regulation (GDPR) became effective in the European Union (EU) and other countries within the European Economic Area. The GDPR imposes strict requirements on the collection, use, security, and transfer of personal data in and from applicable countries. Under GDPR, fines of up to 20 million Euros or up to 4% of the annual global revenues of the infringer, whichever is greater, could be imposed. Although GDPR applies across the European Economic Area, local data protection authorities still have the ability to interpret GDPR, and in some areas to legislate requirements even more stringent than those in the GDPR, which occasionally creates inconsistencies in application on a country-by-country basis. Furthermore, with the United Kingdom's (UK) transition out of the EU as of January 1, 2021, we may encounter additional complexity with respect to data privacy and data transfers to and from the UK under the UK GDPR. Other countries, such as Brazil, Australia, Canada, Japan, and South Africa, have also enacted data protection laws, some of which are analogous to GDPR and others which have different and additional requirements, which may include data localization. We have implemented policies, controls, and procedures, including a team dedicated to data protection, to comply with the requirements of GDPR/UK GDPR and analogous laws. However, these new procedures and controls may not be completely effective in preventing breaches or unauthorized processing of personal data. In addition, as the laws in certain countries are fairly new, there may not always be sufficient guidance from the applicable regulators, or case law interpreting the laws. Accordingly, we will need to continue evolving our compliance measures over time, and there is some risk that common interpretations of the requirements in such laws may not necessarily align with opinions of applicable regulators or potential litigants, such that the risk of fines and litigation may be increased in countries with newer laws. In addition, on July 16, 2020, the Court of Justice of the European Union (CJEU) invalidated the EU-U.S. Privacy Shield, a framework that had enabled companies to transfer data from EU member states to the U.S. On September 8, 2020, the Swiss Federal Data Protection and Information Commissioner followed suit, and announced that the Swiss-U.S. Privacy Shield Framework was inadequate for personal data transfers from Switzerland to the U.S. The Privacy Shield Framework has now been replaced by the new Data Privacy Framework (DPF) together with a UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF. The DPF was developed by the U.S. Department of Commerce and the European Commission, UK Government, and Swiss Federal Administration, to provide U.S. organizations with reliable mechanisms for personal data transfers to the U.S. from the EU, UK and Switzerland. The European Commission adopted an adequacy decision for the EU-U.S. DPF on July 10, 2023. We have postponed our efforts to become certified under the DPF as several parties have indicated that they will be filing legal challenges to the DPF, so the continued viability of this transfer mechanism remains in some doubt. Due to the invalidation of the Privacy Shield and the current and likely future additional challenges to the DPF, we will continue to utilize the newer Standard Contractual Clauses (SCCs), adopted by the European Commission on June 4, 2021, as a GDPR-compliant mechanism for the transfer of personal data from the EU, UK and Switzerland to the U.S., in addition to the DPF. The new SCCs imposed additional obligations relating to data transfers, including the obligation to conduct a transfer impact assessment and, depending on a party's role in the transfer and the laws and practices of the destination country, to implement additional security measures, and to update internal privacy practices. Regulatory guidance suggests that certain transfers of personal data to the U.S. could be compliant only if the recipient is able to implement specific technical and procedural security controls to protect that personal data, and such controls may not be practical for certain service delivery models, in particular those reliant on cloud services. To the extent we rely on the SCCs for data transfers, we may be required to incur significant time and resources to update our contractual arrangements and implement the supplementary security measures necessary to comply with new requirements. Compliance may also require changes in services, business practices, or internal systems that may result in increased costs, lower revenue, reduced efficiency, or greater difficulty in competing with foreign-based firms. Failure to comply with existing or new rules may result in significant penalties or orders to stop the alleged noncompliant activity. The inability to import personal data from Europe to the United States or other countries may decrease demand for our products and services as our customers that are subject to such laws may seek alternatives that do not involve personal data transfers out of Europe. Our inability to transfer personal data to the United States and other countries may decrease the functionality or effectiveness of our products and services, increase costs, and adversely impact our marketing efforts, plans, and activities. Further, in 2021, China adopted the PRC Personal Information Protection Law, or PIPL, and the Data Security Law, or DSL. The PIPL took effect on November 1, 2021 and the DSL took effect on September 1, 2021. The PIPL and DSL in combination establish comprehensive requirements relating to the collection, use, transfer, security, and other processing of personal information in or from China. The PIPL and DSL together incorporate many requirements common to international privacy and security laws, such as GDPR, and adds unique regulatory requirements relating to data localization, international data transfers, consumer consent, the processing of "sensitive personal information," and the operations of certain "internet platform services." Fines and penalties under the PIPL range from fines up to RMB 50,000,000 or 5% of global annual turnover, and fines under the DSL related to data transfer violations may range up to RMB 10,000,000 and data transfers may be suspended as a result of violations. Violations of these laws may also result in the cancellation of business authorizations, personal liability or professional restrictions for responsible company officers, as well as criminal and civil liability. Early enforcement actions under PIPL have included civil actions against companies that fail to obtain proper consent for processing sensitive personal information or other unlawful data collection. Recent regulatory actions have centered on ineffective channels for data subjects to exercise rights, the over-collection of personal information, and deceptive practices. As we observe China's enforcement of the PIPL, DSL and associated laws and regulations over time, we may need to adjust our compliance activities, and we may experience increased costs, business inefficiencies, lost sales, decreased demand, and decreased competitiveness, as we may be unable to provide our services or certain features, or provide them in an efficient or centralized manner. Additionally, local companies may be favored by customers who will not consent to or accept transfer of their data out of China. Fines, corrective actions, or other penalties asserted due to alleged noncompliance may impose additional financial or operational costs, limit our ability to attract and retain local talent, or limit our ability to do business in China. These risks may be magnified due to regulatory uncertainty and selective enforcement based on geopolitical motives. Additionally, under the PIPL or DSL, we may be subject to additional liabilities, claims, penalties, or causes of action in the event of a breach or various security violations of customer personal information. Other governmental authorities throughout the U.S. and around the world are considering or have adopted similar types of legislative and regulatory proposals concerning data protection. For example, in June 2018, the State of California enacted the California Consumer Privacy Act of 2018 (the CCPA), which took effect on January 1, 2020, and which has subsequently been amended to add new requirements. The CCPA requires companies that process information on California residents to make new disclosures to consumers about their data collection, use and sharing practices, and allows consumers to opt out of data sales, as well as certain data sharing with third parties and provides a new private cause of action for data breaches. Additionally, the California Privacy Rights Act (the CPRA) amendments expanded consumer rights related to sharing of personal data, granted additional personal-data rights to consumers, removed the exceptions for business-to-business and employment data, and removed the 30-day window to cure alleged noncompliance before being subject to administrative enforcement. Nineteen other states have also passed comprehensive consumer privacy laws that are now in effect or will come into effect in the near future. Numerous other states have seriously considered passing consumer privacy laws, and a significant number of additional states are expected to adopt such laws in the future, especially if Congress persists in failing to pass a federal privacy law, as discussed below. Many of these state consumer privacy laws, like the CCPA, impose heightened privacy disclosure requirements, provide consumers with rights relating to their personal data, and impose security requirements relating to consumers' personal data. Several states have also adopted specialized privacy laws to protect individuals' biometric data and health data and some of these laws may create new compliance risks relating to our processing of these kinds of data. Furthermore, various drafts of a comprehensive federal privacy bill have been introduced to Congress, and more will likely be introduced in the coming legislative terms. Some of the proposed bills, including the recent American Privacy Rights Act of 2024 would reduce compliance risks and costs by either setting a consistent, nationwide federal minimum standard for consumer privacy or by preempting some aspects of state privacy legislation. However, the scope of preemption and enforcement-related matters remains contentious in Congress. Moreover, although these proposed bills have drawn bipartisan support, the failure of Congress to pass any of the proposed bills calls into question Congress's ability to find a workable compromise that would enable Congress to pass a federal consumer privacy law. The Federal Trade Commission and many state attorneys general are interpreting federal and state consumer protection laws to impose standards for the online collection, use, dissemination, and security of data. These privacy, security, and data protection laws and regulations continue to evolve and enforcement in the U.S. and internationally continues to increase. These developments could impose significant limitations on or require changes to our business, restrict our use or storage of personal data, and increase risks of legal liability, which may in turn increase our compliance risk and expenses, and make our business more costly or less efficient to conduct. To the extent any of these laws include a private right of action, we may also face increased risk of litigation. We strive to employ global best practices in securing and monitoring code, applications, systems, processes, and data, and our data protection practices are regularly reviewed and validated by an external auditing firm. However, no information security program is perfect, and these efforts may be insufficient to protect sensitive information against illegal activities. We are exposed to additional liabilities from the various data protection laws enacted within the jurisdictions where we operate, as well as a risk of litigation in jurisdictions where there is a private right of action related to violations.

Our mission is to enable greatness in individuals and organizations everywhere regardless of race, religion, gender, or other individual characteristics. We write and design our content and materials to accomplish this mission and believe that the principles we teach improve lives. Through our directly owned offices and international licensees, our content is delivered in numerous countries around the world in different languages and in different cultures. The language, graphics, and examples used in our content and materials may be understood and interpreted differently by individuals based on culture, experience, societal norms, and other factors. As a result, some individuals may find some of the content in our materials offensive. While we have developed an ongoing review process to remove potentially offensive terms or images from our materials, a rapidly changing cultural and social environment may create unfavorable interpretations of language or images faster than we can identify and remediate them. Although our intent is to educate and improve individual lives and organizational cultures without offense, an unfavorable interpretation by an individual or organization of the language, concepts, or images used in our content or materials may harm our reputation and brand, cause us to lose business, and adversely affect our results of operations.

We have directly owned offices that serve clients in Austria, Australia, China, Germany, Ireland, Japan, New Zealand, Switzerland, and the United Kingdom. We also have licensed operations in numerous other foreign countries. As a result of these foreign operations and their impact upon our financial statements, we are subject to a number of risks, including, but not limited to: ?Restrictions on the movement of cash ?The absence in some jurisdictions of effective laws to protect our intellectual property rights ?Political instability ?Compliance with extensive and evolving laws and regulations that are often ambiguous or inconsistently enforced ?Currency exchange rate fluctuations These and other related risks could adversely affect our ability to access sources of liquidity, increase costs related to regulatory compliance, and adversely affect our results of operations.

Our success and ability to grow are partially dependent on our ability to hire, retain, and motivate sufficient numbers of talented people with the increasingly diverse skills needed to serve our clients and grow our business. Competition for skilled personnel is intense at all levels of experience and seniority. There is a risk that we will be unable to hire and retain a sufficient number of employees with the skills or backgrounds we require, or that it will prove difficult to retain them in a competitive and inflationary labor market. If we are unable to hire and retain talented sales and delivery employees with the skills, and in the locations, we require, we might not be able to grow our business at projected levels or may not be able to effectively deliver our content and services. If we need to hire additional personnel to maintain a specified number of sales personnel or are required to re-assign personnel from other geographic areas, it could increase our costs and adversely affect our profit margins. In addition, the inability of newly hired sales personnel to achieve increased sales metrics as they progress may inhibit our ability to attain anticipated sales growth.