Kelly Services (KELYA) Risk Analysis

In the normal course of business we control, process, or have access to personal data regarding candidates and persons employed or engaged by us, our customers, certain customer employees, and managed suppliers. Information concerning these individuals may also reside in systems controlled by third parties for purposes such as employee benefits, assignment information, and payroll administration. The legal and regulatory environment concerning data privacy is becoming more complex and challenging, and the potential consequences of non-compliance have become more severe. The European Union's General Data Protection Regulation, the California Consumer Privacy Act, the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), and similar laws impose additional compliance requirements related to the collection, use, processing, transfer, disclosure, security, and retention of personal or protected health information ("PHI"), which can increase operating costs and resources to accomplish. The further expansion of privacy laws, and litigation for violations of those laws, including at a state-level in the United States, could make it more difficult or expensive for us to provide services and could have a material adverse effect on our business, financial condition and results of operations. Any failure to abide by these regulations or to protect such personal information or PHI from inappropriate access or disclosure, whether through social engineering or by accident or other cause, could have severe consequences including fines, litigation, regulatory sanctions, reputational damage, and loss of customers or employees. Although we have a privacy compliance program designed to preserve the privacy and rights of the individuals whose personal data we control or process, as well as personal data that we entrust to third parties, there can be no assurance that our program will meet all current and future regulatory requirements, anticipate all potential methods of unauthorized access, or prevent all inappropriate disclosures. Our insurance coverage may not be sufficient to cover all such costs or consequences, and there can be no assurance that any insurance that we now maintain will remain available under acceptable terms.

We rely on third parties to support critical functions within our operations, including portions of our technology infrastructure, vendor management, customer relationship management, applicant tracking systems and in-country staffing services. If we are unable to contract with third parties having the specialized skills needed to support our growth strategies or integrate their products and services with our business, or if they fail to meet our performance requirements, the results of operations could be adversely impacted. We also rely on supplier partnerships to deliver certain services to customers. If our suppliers fail to meet our standards and expectations, or are unfavorably regarded by our customers, our ability to discontinue the relationship may be limited, which could result in reputational damage, customer loss, and adversely affect our results of operations. The failure or inability to adequately perform on the part of one or more of these critical vendors, suppliers, or partners could cause significant disruptions and increased costs. Moreover, these third parties are often subject to international laws and regulations regarding their conduct, including compliance with anti-bribery, anti-corruption, human trafficking, forced or child labor, trade sanctions, sustainability, and other compliance obligations ("Global Compliance Obligations"). While we maintain processes to monitor these third-parties for compliance to these standards, failure of these third-parties to adhere to Global Compliance Obligations could result in significant fines and penalties, criminal sanctions against us, our officers or our employees, prohibitions on the conduct of our business, and damage to our reputation.

We rely upon multiple information technology systems and networks, some of which are web-based or managed by third parties or open source, to process, transmit, and store electronic information and to manage or support a variety of critical business processes and activities. Our networks and applications are increasingly accessed from locations and by devices not within our physical control, and the specifics of our technology systems and networks may vary by geographic region. In the course of ordinary business, we may store or process proprietary or confidential information concerning our business and financial performance and current, past or prospective employees, customers, vendors and managed suppliers. The secure and consistent operation of these systems, networks and processes is critical to our business operations. Moreover, our workers may be exposed to, or have access to, similar information in the course of their customer assignments. We routinely experience cyberattacks, which may include the use or attempted use of malware, ransomware, computer viruses, phishing, social engineering schemes and other means of attempted disruption or unauthorized access. Advanced social engineering and impersonation techniques by criminal organizations and nation-state adversaries for the purposes of espionage, data theft, or system disruption have sought to exploit information technology job opportunities at many companies. Although we have not experienced a material attack of this nature, because our services involve providing talent solutions for these roles, we are at increased risk for this advanced type of attack, whether directly or through a supplier in our MSP services. Additionally, the rapid pace of change in information security and cyber security threats could result in a heightened threat level for us or companies in our industry without notice. The potential risk increases as we expand and publicize new services. In addition to cyberattacks, our systems and services are vulnerable to damage or disruption from technology or software failures, errors by our employees or our vendors, power outages, natural disasters, extreme weather, conflicts, or other unforeseen events, which could disrupt our business operations. Our relationships with third parties, including suppliers we manage, customers, and vendors, create potential avenues for malicious actors to initiate a supply chain attack. Even in instances where we are not a target of a malicious actor, we could be exposed to risk due to our relationships and business processes with these third parties. The actions we take to reduce the risk of impairments to our operations or systems and breaches of confidential or proprietary data may not be sufficient to prevent or repel future cyber events or other impairments of our networks or information technologies, especially as cyberattacks become more sophisticated with advances in artificial intelligence. An event involving the destruction, modification, accidental or unauthorized release, or theft of sensitive information from systems related to our business, or an attack that results in damage to or unavailability of our key technology systems or those of critical vendors (e.g., ransomware), could result in damage to our reputation, fines, regulatory sanctions or interventions, contractual or financial liabilities, additional compliance and remediation costs, loss of employees or customers, loss of payment card network privileges, operational disruptions and other forms of costs, losses or reimbursements, any of which could materially adversely affect our operations or financial condition. Our cyber security and business continuity plans, and those of our third parties with whom we do business, may not be effective in anticipating, preventing and effectively responding to all potential cyber risk exposures. Cyberattacks, even if unsuccessful, may damage or disrupt our systems and services or require us to take actions to protect our systems that could have a material adverse effect on our business, financial condition and results of operations. Our insurance coverage may not be sufficient to cover all such costs or consequences, and there can be no assurance that any insurance that we now maintain will remain available under acceptable terms.

Many business processes critical to our continued operation are hosted in outsourced facilities in America, Europe and Asia, hosted at our corporate headquarters or, increasingly, occur in cloud-based computer environments. These critical processes include, but are not limited to, payroll, customer reporting, and order management. Although we have taken steps to protect such instances by establishing data backup and disaster recovery capabilities, the loss or inability to access of this data or cloud environment could create a substantial risk of business interruption which could have a material adverse effect on our business, financial condition and results of operations.

The worldwide staffing services market is highly competitive with limited barriers to entry. We compete in global, national, regional and local markets with full-service and specialized temporary staffing and consulting companies. Some competitors are considerably larger than we are and have more substantial marketing and financial resources. Additionally, the emergence of online staffing platforms, talent sourcing models, or other forms of disintermediation may pose a competitive threat to our services that operate under a more traditional staffing business model. Price competition in the staffing industry is intense, particularly for the provision of office clerical, light industrial and education personnel. We expect that the level of competition will remain high, which could limit our ability to maintain or increase our market share or profitability. The number of customers distributing their staffing service purchases among a broader group of competitors continues to increase which, in some cases, may make it more difficult for us to obtain new customers, or to retain or maintain our current share of business, with existing customers. We also face the risk that our current or prospective customers may decide to provide similar services internally. As a result, there can be no assurance that we will not encounter increased competition in the future.

We serve many large corporate customers through high volume service agreements. While we intend to maintain or increase our revenues and earnings from our major corporate customers, we are exposed to risks arising from the possible loss of major customer accounts. A change in labor strategy or labor disruptions, including work stoppages or the deterioration of the financial condition or business prospects of these customers could reduce their need for our services and result in a significant decrease in the revenues and earnings we derive from these customers. Such change could occur due to economic, social, climate, or political factors outside of our customers' control. Inability to meet customer demands in response to these factors could result in the decline in use of our service or outright loss of customers. Our customers are also exposed to third-party risk through their use of vendors and suppliers which, in the event of a third-party incident at a customer, could result in a deterioration in their financial condition. Continuing merger and acquisition activity involving our large corporate customers could put existing business at risk or impose additional pricing pressures. Since receipts from customers generally lag payroll to temporary employees, the bankruptcy of a major customer could have a material adverse impact on our ability to meet our working capital requirements. The expansion of payment terms may extend our working capital requirements and reduce available capital for investment. Additionally, most of our customer contracts can be terminated by the customer on short notice without penalty. This creates uncertainty with respect to the revenues and earnings we may recognize with respect to our customer contracts. Our business with large customer accounts reflects a market-driven shift in buying behaviors in which reliance on a small number of staffing partners has shifted to reliance upon a network of talent providers. The movement from single-sourced to competitively sourced staffing contracts may also substantially reduce our future revenues from such customers. While Kelly has sought to address this trend, including providing supplier and vendor management services as a customer's MSP within our OCG segment, we may not be selected or retained as the MSP by our large customers, or if we are the MSP, we may not be one of the underlying staffing providers. This may result in a material decrease in the revenue we derive from providing staffing services to such customers. In addition, revenues may be materially impacted if we decide to exit customers due to pricing pressure or other business factors. Our business with the federal government and government contractors presents additional risk considerations. We must comply with laws and regulations relating to the formation, administration and performance of federal government contracts. Failure to meet these obligations could result in civil penalties, fines, suspension of payments, reputational damage, disqualification from doing business with government agencies and other sanctions or adverse consequences. Government procurement practices may change in ways that impose additional costs or risks upon us or pose a competitive disadvantage. Our employees may be unable to obtain or retain the security clearances necessary to conduct business under certain contracts, or we could lose, or be unable to secure or retain, a necessary facility clearance. In the event of a security incident by us or our personnel, we may not be able to conduct future business for certain federal government clients. In addition, government agencies may temporarily or permanently lose funding for awarded contracts, reduce spending, or deprioritize future spending on contracts on which we participate, or there could be delays in the start-up of projects already awarded and funded.

Our business strategy focuses on driving profitable growth in key specialty areas, including through business process outsourcing arrangements, where we provide operational management of our customers' non-core functions or departments. We also plan to expand the outcome-based services we provide, which increases our risk associated with product delivery. This could expose us to certain risks unique to that business, including civil liability, product liability, or product recalls. As the nature of work changes, we deliver services that connect independent talent to independent work with our customers which could expose the Company to risks of misclassifying workers, which could result in regulatory audits and penalties. Although we have internal vetting processes intended to control such risks, there is no assurance that these processes will be effective or that we will be able to identify these potential risks in a timely manner. Our specialties also include professional services where errors or omissions by employees or independent contractors can result in substantial injury or damages. We attempt to mitigate and transfer such risks through contractual arrangements with our customers and suppliers; however, these services may give rise to liability claims and litigation. While we maintain insurance in types and amounts we believe are appropriate for the contemplated risks, there is no assurance that such insurance coverage will remain available on reasonable terms or be sufficient in amount or scope.

Our success depends, in part, on the value associated with our brands. Because we assign employees to work under the direction and supervision of our customer at work locations not under Kelly's control, we are at risk of our employees engaging in unauthorized conduct that could harm our reputation. Our Education segment is particularly susceptible to this exposure. Our brand reputation could also be damaged by the actions of unrelated third parties with diverse or unclear motives. Political activists, social media posts, or traditional news media could reference the Kelly brand as part of a broader communication unrelated to our business, which could result in backlash against our business practices. In addition, undesirable actions by our competitors could adversely impact the reputation of the staffing industry as a whole, negatively impacting our brand. As we increasingly use artificial intelligence in our services, incidents of bias, hallucination, or error by artificial intelligence we use, or ethical objections to our use of artificial intelligence, could negatively impact our brand. Any incident, act or omission that damages Kelly's reputation could cause the loss of current and future customers, additional regulatory scrutiny and liability to third parties, which could negatively impact profitability.

Historically, the general level of economic activity and employment in the United States and the other countries in which we operate has significantly affected the demand for staffing services. In periods of economic growth, employers often add temporary employees before hiring full-time employees. However, when economic activity declines, many employers reduce their use of temporary employees before laying off full-time employees. Customer responses to real or perceived economic conditions, including perceptions related to market conditions, labor supply and inflation, could negatively impact customer behavior. Historically, significant changes in economic activity have disproportionately impacted staffing industry volumes. We may not fully benefit from times of increased economic activity should we experience shortages in the supply of workers. We may also experience more competitive pricing pressure and slower customer payments during periods of economic decline. A substantial portion of our revenues and earnings are generated by our business operations in the United States. Any significant economic downturn in the United States or certain other countries in which we operate could have a material adverse effect on our business, financial condition and results of operations.

Because we conduct our business in major markets throughout the world, we face risks in those environments that are beyond our control. Natural disasters, severe weather, climate change, disease, pandemics, war, terrorist acts, or other similar unforeseen events could materially adversely affect our operations or financial condition. Even where the event does not directly impact our operations, its impact on regional business could adversely impact our business through decreased customer demand or inability to perform services due to the event. Historically, large-scale events have resulted in a temporary economic downturn in areas impacted by such catastrophic events. Even where we are able to provide services in relief and support operations, there is no assurance that we will be able to offset the adverse impacts of the catastrophic event.