Hennessy Advisors (HNNA) Risk Analysis

We utilize unaffiliated sub-advisors to manage the portfolio composition of some of the Hennessy Funds. Although we perform due diligence on our sub-advisors, we do not manage their day-to-day business activities. Our financial condition and profitability may be adversely affected by situations that are specific to such sub-advisors, such as disruption of their operations, their exposure to disciplinary action, or reputational harm to them. We periodically negotiate the terms and conditions of these sub-advisory relationships, and there can be no assurance that such terms will remain acceptable to us or our sub-advisors. These relationships may also be terminated by us or the applicable sub-advisor without penalty on 60 days' notice. In addition, each sub-advisory agreement must be renewed annually by the Funds' Board of Trustees (or by the vote of a majority of the outstanding shares of the applicable Hennessy Fund), including a majority of the disinterested trustees. Furthermore, a sub-advisory agreement automatically terminates if it is assigned. Assignment is generally defined under the 1940 Act and the Advisers Act to include direct assignments as well as assignments that are deemed to occur due to the change in control of the investment advisor, which includes us or one of the sub-advisors that we have engaged on behalf of certain of the Hennessy Funds. However, a transaction is not an assignment under the 1940 Act or the Advisers Act if it does not result in a change of actual control or management of us or, in the context of a sub-advisor, a change of actual control or management of the sub-advisor. Generally, if a sub-advisor experiences a change of control but we do not, we could continue acting as an advisor to the applicable Hennessy Fund, but the shareholders of such Hennessy Fund would have to approve a new sub-advisory agreement for the sub-advisor. However, for the Hennessy Sustainable ETF, we have the authority to appoint and replace unaffiliated sub-advisors and to enter into and make material amendments to the related sub-advisory agreements without shareholder approval. This is because we sought and received an exemptive order from the SEC in 2023 to operate under a manager of managers structure and subsequently obtained shareholder approval to implement such structure for the Hennessy Sustainable ETF. Under the manager of managers structure, we have ultimate responsibility, subject to oversight of and approval by the Hennessy Funds' Board of Trustees, for overseeing the Hennessy Funds' unaffiliated sub-advisors and recommending their hiring, termination, or replacement. We have not yet received, and do not have an estimated timeline for receiving, shareholder approval to operate under a manager of managers structure for the Hennessy Mutual Funds that are sub-advised. Any interruption or termination of our sub-advisory relationships, whether due to a change of control or any other circumstance, could affect our ability to market our sub-advised funds and result in a reduction in assets under management, which would adversely affect our revenues.

The investment advisory industry is intensely competitive and new participants are continually entering the industry. We compete directly with numerous global and U.S. investment advisors, commercial banks, savings and loan associations, brokerage and investment banking firms, broker-dealers, insurance companies, and other financial institutions that often provide investment products with similar features and objectives to those we offer. These institutions range from small boutique firms to large financial services complexes. We are considered a small investment advisory company. Many competing companies are part of larger financial services companies that conduct business in more markets and have greater marketing, financial, technical, research, and distribution resources and other capabilities than we do. Most of the larger firms offer a broader range of financial services to the same retail and institutional investors that we seek to serve. If we are unable to attract investors and retain net assets in the Hennessy Funds due to increased competition, our revenues could decline and we could experience a material adverse effect on our business, results of operations, and financial condition. For more information regarding competitive factors, see the "Competition" subheading in Item 1, "Business."

We use software and related technologies throughout our business and also utilize third-party vendors who use software and related technologies to provide services to us and the Hennessy Funds. We are dependent on the effectiveness of our information and cybersecurity policies, procedures, and capabilities we maintain to protect our computer and telecommunications systems and the data that resides on or is transmitted through them, including data provided by third parties that is significant to our business. An information security incident, such as a cyber-attack involving a phishing scam, business email compromise, malware, or ransomware attack, or an internally caused incident or disruption, such as misuse or a failure to control access to sensitive systems, could materially interrupt our business operations or cause disclosure or modification of sensitive or confidential investor or competitive information. Moreover, our growing reliance on mobile and cloud technology and any failure by mobile technology and cloud service providers to adequately safeguard their systems and prevent cyber-attacks could disrupt our operations and result in misappropriation, corruption, or loss of personal, confidential, or proprietary information or third-party data. Additionally, although we take precautions to password protect and encrypt our laptops and other mobile electronic hardware, if such hardware is stolen, misplaced, or left unattended, it may become vulnerable to hacking or other unauthorized use, creating a possible security risk and resulting in potentially costly actions. Furthermore, there is a risk that encryption and other protective measures may be circumvented, particularly to the extent that new computing technologies increase the speed and computing power available. The financial services industry has been the subject of cyber-attacks involving the dissemination, theft, and destruction of corporate information or other assets as a result of failure to follow procedures by employees or as a result of actions by third parties, including actions by terrorist organizations and nation state actors. Although we have implemented policies and controls to prevent and address potential data breaches, inadvertent disclosures, increasingly sophisticated cyber-attacks, and cyber-related fraud, there can be no assurance that any of these measures will prove effective. Because the techniques used to obtain unauthorized access, disable, or degrade service or sabotage systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques, to implement adequate preventative measures, or to address them until they are discovered. In addition, a successful cyber-attack may persist for an extended period of time before being detected, and it may take a considerable amount of time for an investigation to be completed and the severity and potential impact to be known. While such an investigation is ongoing, we may not necessarily know the extent of the harm or how best to remediate it, certain errors or actions could be repeated or compounded before they are discovered and remediated, and communication to the public, regulators, shareholders, and investors in the Hennessy Funds may be inaccurate, any or all of which could further increase the costs and consequences of an information security incident. If material information security incidents occur in the future, we could experience financial losses, business disruptions, liability to the Hennessy Funds and their investors, regulatory intervention, or reputational damage, any of which could be material and could materially adversely affect our business, results of operations, and financial condition. We also may be required to expend significant additional resources to strengthen our protective measures or to investigate and remediate vulnerabilities or other exposures. In addition, our cybersecurity insurance may not cover all losses and damages from such events and our ability to maintain or obtain sufficient insurance coverage in the future may be limited. Finally, cybersecurity and data privacy are priorities for many regulators worldwide, and many jurisdictions have enacted laws and regulations in these areas. Compliance with evolving privacy laws and cybersecurity regulations has resulted, and may continue to result, in additional costs of compliance or potential litigation exposure. While we strive to comply with applicable laws and regulations, any failure to do so could result in regulatory investigations, penalties, or negative publicity, any of which could materially adversely affect our business, results of operations, and financial condition.