Information Services Group (III) Risk Factors

Our clients may decide at any time to abandon, postpone and/or reduce our involvement in an engagement. Our engagements can be terminated, or the scope of our responsibilities may be diminished, with limited advance notice. If an engagement is terminated, delayed or reduced unexpectedly, the professionals working on the engagement could be underutilized until we assign them to other projects. Accordingly, the termination or significant reduction in the scope of a single large engagement, or multiple smaller engagements, could harm our business results.

We provide services primarily in connection with significant or complex sourcing transactions and other matters that provide potential competitive advantage and/or involve sensitive client information. Our engagement by a client occasionally precludes us from staffing certain advisors on new engagements with other clients because the advisors have received confidential information from a client who is a competitor of the new client.  Furthermore, it is possible that our engagement by a client could preclude us from accepting engagements with such client's competitors because of confidentiality concerns.

Advisory engagements typically are project-based. Our ability to attract advisory engagements is subject to numerous factors, including the following: - delivering consistent, high-quality advisory services to our clients;- tailoring our advisory services to the changing needs of our clients;- matching the skills and competencies of our advisory staff to the skills required for the fulfillment of existing or potential advisory engagements; and - maintaining a global business operation. Any material decline in our ability to secure new advisory arrangements could have an adverse impact on our revenues and financial condition.

We are dependent on information technology networks and systems to securely process, transmit and store electronic information and to communicate among our locations around the world and with our people, clients, alliance partners and vendors. As the breadth and complexity of this infrastructure continues to grow, because of the use of mobile technologies, social media and cloud-based services, the risk of security breaches and cyberattacks increases. Such breaches could lead to shutdowns or disruptions of or damage to our systems and those of our clients, alliance partners and vendors and unauthorized disclosure of sensitive or confidential information, including personal data. In addition, Third Party Cyber Security Risk is a critical focus for us. All potential new suppliers go through our Data Protection Impact Assessment ("DPIA") process. This starts with an initial screening questionnaire. The questionnaire covers what personal data and client data is processed, whether the third party has any access requirements to our environment and how is data is transferred. From this, our security team assesses the third party, conducts further due diligence, and reviews contractual clauses. If the risk assessment identifies that the baseline Information Security & Privacy technical and organizational controls are not met, the business will be advised accordingly. The outcome of all DPIAs is recorded on the DPIA register. All new third parties processing personal data or client data are assessed to be either Tier 1, 2 or 3, with Tier 1 being the highest risk in terms of data processed or interactions to our environment from a cyber security threat perspective.  Tier 1 and 2 third parties are recorded on our business-critical services register and reviewed annually,  and we review the compliance documentation, such as latest ISO certifications, SOC2 reports and pen tests, of those Tier 1 and 2 third parties. Tier 3 third parties are recorded on the DPIA register, but no further due diligence is performed by the security team, as Tier 3 third parties process no client or personal data and have no access or integration to ISG's network or systems. As part of our continuous improvement in our third-party risk management process, we plan to engage the services of a third-party risk monitoring services to monitor threat intelligence and known vulnerabilities. Although we seek to prevent, detect, and investigate cybersecurity threats and incidents, and have taken steps to mitigate the likelihood of network security breaches, there can be no assurance that attacks by unauthorized users will not be attempted in the future or that our security measures will be effective. Unauthorized disclosure of sensitive or confidential client data, whether through breach of our processes, systems or otherwise, could subject us to liability, damage our reputation and cause us to lose existing and potential clients. We may also be subject to civil actions and/or criminal prosecution by government or quasi-government agencies for breaches relating to such data. Our insurance coverage for breaches or mismanagement of such data may not continue to be available on reasonable terms or in sufficient amounts to cover one or more large claims against us.

Our success depends in part upon our ability to anticipate rapidly changing technologies and market trends and to adapt our advice, services and products to meet the changing sourcing advisory needs of our clients. Our clients regularly undergo frequent and often dramatic changes.  That environment of rapid and continuous change presents significant challenges to our ability to provide our clients with current and timely analysis, strategies and advice on issues of importance to them. Meeting these challenges requires the commitment of substantial resources.  Any failure to continue to respond to developments, technologies and trends in a manner that meets market needs could have an adverse effect on our business results.

Various statutes and rules regulate conduct in areas such as privacy and data protection that may affect our collection, use, storage, and transfer of information both abroad and in the United States. Compliance with these laws and self-regulatory codes may require us to make certain investments or may dictate that we not offer certain types of services or only offer such services after making necessary modifications. Failure to comply with these laws and self-regulatory codes may result in, among other things, civil and criminal liability, negative publicity, restrictions on further use of data and/or liability under contractual warranties. In addition, there is an increasing public concern regarding data and consumer protection issues, with the result that the number of jurisdictions with data protection laws continues to increase and the scope of existing privacy laws and the data considered to be covered by such laws keep expanding. Changes in these laws (including newly released interpretations of these laws by courts and regulatory bodies) may limit our client data access, use and disclosure, and may require increased expenditures by us or may dictate that we may not offer certain types of services. As a global firm, ISG must comply with various international and domestic data privacy regulations such as (i) the EU and UK General Data Protection Regulation ("GDPR"), which has extra-territorial scope and substantial fines for breaches (up to 4% of global annual revenue or €20 million, whichever is greater), (ii) the California Consumer Privacy Act, which, unlike data privacy provisions enacted by other US states, covers individuals acting in a commercial or employment context not just as consumers, and (iii) the Australian Privacy Act, among others. In addition, the new India Digital Personal Data Protection Act 2023 ("DPDP") is likely to come into force in 2024. Like the GDPR, the DPDP has extra-territorial reach. The DPDP shares many provisions with existing privacy laws, and ISG therefore anticipates that its existing processes already broadly align with the new law. However, like the GDPR, failure to comply with the DPDP may lead to substantial fines. ISG is continuing to monitor the development of the EU's ePrivacy Regulation proposal and industry response and will determine whether to take further action, as needed, if it is adopted. To mitigate the risk and negative exposure of data outside ISG, we have put in place a data protection framework that includes policies, procedures, guidance, and records. This includes policies and procedures for rights and usage of personal and client data.