Ingredion (INGR) Risk Analysis

Political events, trade and international disputes, war, threats or acts of terrorism, natural disasters, monetary and fiscal policies, tariffs, duties, laws and regulations, public health issues, including pandemics such as COVID-19, and other activities of the U.S. and foreign governments, agencies and similar organizations, may have an adverse effect on our business. These conditions include, among others, changes in a country's or region's economic or political conditions, modification or termination of trade agreements or treaties promoting free trade, creation of new trade agreements or treaties, trade regulations affecting production, pricing and marketing of products, local labor conditions and regulations, including regulations regarding child labor, reduced protection of intellectual property rights, changes in the regulatory or legal environment, restrictions on currency exchange activities, currency exchange rate fluctuations, burdensome taxes, tariffs and duties, and other trade disputes or trade barriers. In general, changes in general government policy, law, or regulation and costs of legal compliance, including compliance with environmental regulation, and international risks and uncertainties, including changing social and economic conditions as well as terrorism, political hostilities and war, could limit our ability to transact business in certain markets and could adversely affect our operating results, financial condition, cash flows and prospects. In addition, recent and potential future changes in the priorities and scope of U.S. federal or state regulatory agencies may increase legal, regulatory, and operational uncertainty for us, including with respect to environmental regulation, immigration enforcement and labor availability, trade policy, and tax and fiscal legislation. Such changes could increase costs, disrupt supply chains, limit access to talent, affect demand, and reduce predictability in regulatory oversight and enforcement.

Our future success depends on our ability to attract, develop, retain, motivate and maintain good relationships with qualified personnel, particularly those who have extensive expertise in the ingredient solutions industry and who may also have long service with our company. Such personnel are members of our senior executive leadership and work in key areas throughout our U.S. and international operations such as manufacturing, sales, and innovation, all of which are critical to our future growth and profitability. We face intensive competition in retaining and hiring individuals with the requisite expertise, both within and outside the ingredient solutions industry, including from companies that have greater resources than we do. Changes in our labor markets and those of our vendors as a result of pandemics, migration, and other socioeconomic and demographic changes have increased the competition for hiring and retaining talent. As a result of this competition, we may be unable to continue to attract, develop, retain, motivate and maintain good relationships with suitably qualified individuals at acceptable compensation levels who have the managerial, operational, and technical knowledge and experience to meet our needs. Furthermore, any failure by us to manage internal succession or to effectively transfer knowledge from departing employees to others in the organization could adversely affect our business and results of operations. Even if we succeed in hiring new personnel to fill vacancies, lengthy training and orientation periods might be required before new employees are able to achieve acceptable productivity levels. Any failure by us to attract, develop, retain, motivate and maintain good relationships with qualified individuals could adversely affect our business and results of operations.

Of our 2025 net sales, approximately 58 percent were generated by sales to the food industry, approximately 9 percent by sales to the beverage industry, approximately 7 percent by sales to the animal nutrition industry, and approximately 7 percent by sales to the brewing industry. If our customers in any of these industries were to substantially decrease their purchases, our business might be materially adversely affected.

Our operations rely on certain key information technology systems, which are dependent on services provided by third parties and provide critical data connectivity, information and services for internal and external users. These interactions include, among others, ordering and managing materials from suppliers, risk management activities, converting raw materials to finished products, inventory management, shipping products to customers, processing transactions, summarizing and reporting results of operations, administering human resources benefits and payroll management, complying with regulatory, legal and tax requirements, and other processes necessary to manage our business. Increased information technology security and social engineering threats and more sophisticated cyber crime, including advanced persistent threats, pose potential risks to the security of our information technology systems, networks and services, as well as the confidentiality, availability and integrity of our third-party and employee data. Threat actors increasingly leverage AI, including deepfakes and other tools, to enhance phishing and social-engineering attacks, which may make it more difficult for us to prevent, detect and respond to cybersecurity incidents. We also face risks from zero-day vulnerabilities, supply-chain attacks, and cybersecurity incidents involving third-party service providers, cloud platforms, or software vendors upon which we rely. In addition, evolving cybersecurity and privacy regulations, including tighter incident reporting timelines and increased enforcement, may increase our compliance costs and potential liability, and our insurance coverage for cybersecurity-related losses may be unavailable, insufficient, or subject to increased premiums, retentions or exclusions. The frequency, sophistication and unpredictability of cybersecurity events globally have increased, and can be acute during times of geopolitical tension or instability between countries or when we make changes to our information technology systems or implement new ones. We have been subjected in the past, and may be subjected in the future, to incidents including phishing, e-mails purporting to come from vendors making payment requests, malware, and communications from look-alike corporate domains, as well as security-related risks resulting from our use of third-party software and services. The use of generative artificial intelligence is increasing the sophistication and effectiveness of these types of social engineering attacks. Future data security incidents could compromise or lead to the loss of material confidential, proprietary or otherwise protected information, seize, destroy or corrupt data, or otherwise disrupt our operations or affect our customers or other stakeholders. Insider or employee cyber and security threats are also a significant concern for all companies, including ours. Despite our substantial investment in physical and technological security measures, employee training and contractual precautions, our information technology networks and infrastructure (or those of our third-party vendors and other service providers) are potentially vulnerable to unauthorized access to data, loss of access to systems or breaches of confidential information due to criminal conduct, attacks by hackers, employee or insider malfeasance or human error. Although we have put in place security measures to protect ourselves against cyber-based attacks and disaster recovery plans for our critical systems that are designed to protect our data and customer data and to prevent data loss and other security incidents, these security measures cannot provide absolute security. In some cases, it is difficult to anticipate, detect or identify indicators of such incidents and assess the damage caused by the incidents. In addition, a failure to promptly disclose such material incidents as required by law may result in additional financial or regulatory consequences. If our information technology systems are breached, damaged, or cease to function properly due to any number of causes, such as catastrophic events, power outages, security incidents, or cyber-based attacks, and if our cybersecurity response plans and disaster recovery and our cyber incident response plans do not effectively mitigate the risks on a timely basis, we may encounter significant disruptions that could interrupt our ability to manage our operations, cause loss of valuable data, and damage our reputation. Any such incidents also could subject us to government investigations or private litigation. These factors may adversely impact our operating results, financial condition, cash flows and prospects. We could also experience delays in reporting our financial results. The third-party data management providers and other vendors that we rely upon may have or develop security problems or security vulnerabilities which may also affect our systems or data. A data security or privacy breach of their systems or other form of cyber-based attack may occur in the future. In addition, we use external vendors to perform security assessments on a periodic basis to review and assess our information security. We utilize this information to audit ourselves, monitor the security of our technology infrastructure, and assess whether and how to prioritize the allocation of scarce resources to protect data and systems. These security assessments and audits, however, may not identify or appropriately categorize relevant risks or protect our computer networks against security intrusions. Although we require our third-party vendors contractually to maintain a level of security that is acceptable to us and work closely with key vendors to address potential and actual security concerns and attacks, not all confidential, proprietary, or personal information may be protected on their systems. Regardless of whether incidents result from an attack on us directly or on third-party vendors upon which we rely, the costs to address the foregoing security problems and security vulnerabilities before or after a cybersecurity incident could be significant. Remediation efforts may not be successful or timely and could result in interruptions, delays or cessation of service and loss of existing or potential customers that may impede our sales, manufacturing or other critical functions. Breaches of our security measures and the unapproved dissemination of proprietary information or sensitive or confidential data about us, our employees, our customers or other third parties could expose us, our employees, our customers or other affected third parties to a risk of loss or misuse of this information.