Mueller Water Products (MWA) Risk Analysis

We are in the initial stages of incorporating AI into our operations and our products, services and solutions. AI presents risks and challenges that could adversely impact our business. AI, especially during the early stages of the development and use, carries inherent risks with no guarantee that AI will enhance or improve our operations, products, services or solutions. Ineffective or inadequate AI development or deployment practices could result in unintended consequences. Any disruption, malfunction or failure in AI functionality could result in delays in production, use or sale of our products, services and solutions and adversely affect our business and reputation. Further, we face risks of competitive disadvantage if our competitors more effectively leverage AI to drive operational efficiencies, create new or enhanced products, services and solutions or otherwise disrupt the marketplace. Failure to effectively develop, implement, use and manage AI may negatively impact our ability to compete, reduce revenue and adversely impact our business. The legal and regulatory environment landscape surrounding AI is uncertain and rapidly evolving, including the areas of intellectual property, cybersecurity and privacy and data protection. Compliance with new or changing laws, regulations or industry standards relating to AI may require significant investment and resources, and may limit our ability to develop, implement or use AI, which may result in reputational harm, legal liability or other adverse effects on our operations, products, services, solutions and overall business. Our vendors, suppliers and third-party providers may incorporate AI into their offerings with or without disclosing this use to us. These third-parties may not meet existing or rapidly evolving regulatory or industry standards related to privacy and data protection, or such AI use may result in unintended consequences related to our operations, products, services and solutions, any of which may adversely impact our reputation, operations, products, services, solutions and overall business. Further, threat actors may continue to develop and use AI to engage in illegal activities, including cyberattacks, to access, steal or misuse personal data, confidential information and intellectual property. Any of these uses of AI could damage our reputation, result in the loss of valuable property and information and adversely impact our business.

Our business depends on our technology and expertise, which were largely developed internally and are not subject to statutory protection. We rely on a combination of patent protection, copyright and trademark laws, trade secrets protection, employee and third-party confidentiality agreements as well as technical measures to protect our intellectual property rights. The methods we employ to protect our intellectual property rights may not adequately deter infringement, misappropriation or independent development of our technology, and they may not prevent an unauthorized party from obtaining or using information or intellectual property that we regard as proprietary or keep others from using brand names similar to our own. The disclosure, misappropriation or infringement of our intellectual property could harm our competitive position. In addition, our actions to enforce our rights may result in substantial costs and the diversion of management time and other resources. We may also be subject to intellectual property infringement claims from time to time, which may result in additional expense and the diversion of resources to respond to these claims. Finally, for those products in our portfolio that rely on patent protection, once a patent has expired the product is further subjected to competition. Products under patent protection potentially generate significantly higher sales and earnings than those not protected by patents. If we fail to successfully enforce our intellectual property rights or register new patents, our competitive position could suffer, which could adversely affect our business, financial condition, results of operations and cash flows.

The United States and Canadian markets for water infrastructure and flow control products are very competitive. While there are only a few competitors for most of our product and service offerings, many of our competitors are well-established companies with strong brand recognition. We compete on the basis of a variety of factors, including the quality, price and innovation of our products, services and service levels, and product specifications and availability. Our ability to retain customers in the face of competition depends on our ability to market our products and services to our customers and end users effectively. The United States markets for water metering products and systems are highly competitive. Our primary competitors benefit from strong market positions and many end users are slow to transition to new products or new brands. Our ability to attract new customers depends on our technological advancements and ability to market our products and services to our customers and end users effectively. In addition to competition from United States and Canadian companies, we face the threat of competition from outside of North America. The intensity of competition from these companies is affected by fluctuations in the value of the United States dollar against foreign local currencies, the cost to ship competitive products into North America and the availability of trade remedies, if any. Competition may also increase as a result of competitors located in the United States and Canada shifting their operations to lower-cost countries or otherwise reducing their costs. Our competitors may reduce the prices of their products or services, improve their quality and functionality or enhance their marketing or sales activities. Any of these potential developments could adversely affect our prices and demand for our products and services.

Part of our growth strategy depends on expanding internationally. Although sales outside of the United States account for a relatively small percentage of our total net sales, we have business activity in Canada, China, Israel and the United Kingdom. Some countries that present potential business opportunities also face political and economic instability and vulnerability to infrastructure and other disruptions. Seeking to expand our business internationally exposes us to additional risks, which include foreign exchange risks and currency fluctuations, as discussed more fully below, political and economic uncertainties, changes in local business conditions and national and international conflicts. A primary risk we face in connection with our export shipments relates to our ability to collect amounts due from customers. We also face the potential risks arising from staffing, monitoring and managing international operations, including the risk that such activities may divert our resources and management time. In addition, compliance with the laws, regulations and taxes of multiple international jurisdictions increases our cost of doing business. International operations are subject to anti-corruption laws and anti-competition regulations, among others. For example, the United States Foreign Corrupt Practices Act and similar anti-corruption laws outside of the United States generally prohibit companies and their intermediaries from making improper payments or providing anything of value to improperly influence foreign government officials and certain others for the purpose of obtaining or retaining business or obtaining an unfair advantage. Violations of these laws and regulations could result in criminal and civil sanctions, disrupt our business and adversely affect our brands, international expansion efforts, business and operating results. We make sales, incur expenses and invest cash in foreign currencies as part of our operations outside of the United States. Accordingly, fluctuations in foreign currency exchange rates may significantly increase the amount of United States dollars required for foreign currency expenses or significantly decrease the United States dollars we receive from sales denominated in a foreign currency. Changes between a foreign exchange rate and the United States dollar affect the amounts we record for our foreign assets, liabilities, revenues and expenses, and could have a negative effect on our financial results. We expect that our exposure to foreign currency exchange rate fluctuations will grow as the relative distribution of our operations outside the United States increases through both organic and inorganic growth.

The COVID-19 pandemic and the resulting impact on global economies created a number of macroeconomic challenges that impacted our business, including volatility and uncertainty in business planning, disruptions in global supply chains, material, freight and labor inflation, shortages of and delays in obtaining certain materials and component parts and labor shortages. Future outbreaks of infectious diseases may result in widespread or localized health crises that adversely affect general commercial activity and the economies and markets of the countries and localities in which we operate, sell and purchase goods and services. Any outbreak of infectious disease poses the risk that we or our employees, contractors, suppliers, customers, transportation providers and other business partners may be prevented or impaired from conducting ordinary business activities for an indefinite period of time, including self-imposed facility shutdowns to protect the health and well-being of our employees or government-mandated shutdowns. In addition, our suppliers, business partners and customers may also experience similar negative impacts. Global supply chains may be disrupted, causing shortages, which could impact our ability to manufacture or supply our products. This disruption of our employees, distributors, suppliers and customers may impact our sales and future operating results. Item 1C.    CYBERSECURITY Our Board of Directors maintains oversight responsibility for how we manage risk, and it charges management with assessing and mitigating that risk through the development, implementation and maintenance of our risk management processes, including our cybersecurity program. Our internal audit department, which reports to the Audit Committee, administers our enterprise risk assessment and, in coordination with our legal and compliance functions, is responsible for ongoing enterprise risk management assessments. Our internal audit department also regularly reports to the Board of Directors and its committees on risk-related issues. The Audit Committee of the Board of Directors oversees our cybersecurity and data privacy programs and practices and consults with management regarding cybersecurity initiatives. This committee is also responsible for reviewing cyber and data security matters, including cybersecurity threats that we may face in our operations and our risk mitigation initiatives. At least twice a year, the Audit Committee receives updates on our cybersecurity and data privacy programs and practices from our Senior Vice President of Information Technology and our Senior Director of Information Security. The topics reported by the Senior Vice President of Information Technology and our Senior Director of Information Security include updates on cybersecurity threats we face, the status of projects to strengthen our information security systems, assessments of the cybersecurity program, and the emerging threat landscape, as well as the results of any third-party assessments conducted. Our Senior Vice President of Information Technology holds an undergraduate degree in Technology Management (Manufacturing Systems), and has served in various roles in information technology for over 20 years and within Mueller for over five years. Our Senior Director of Information Security holds an undergraduate degree in Computer Engineering and has served in various roles in information security and engineering within Mueller for over 21 years. We have two cybersecurity teams, each dedicated to a specific area. Our Information Technology Cybersecurity team focuses on corporate programs, and our Products Cybersecurity team focuses on customer-facing programs. These teams work collaboratively to implement programs designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, these teams are responsible for addressing cybersecurity threats and responding to cybersecurity incidents. Through ongoing communications with these teams, the Senior Vice President of Information Technology, the Senior Director of Information Security and the General Counsel monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate. Similarly, the Audit Committee reports cybersecurity threats and incidents to the full Board of Directors as appropriate. Risk Management and StrategyRisk AssessmentOur cybersecurity policies, standards, processes and practices are integrated into our enterprise risk management processes and are based on a recognized framework established by the National Institute of Standards and Technology ("NIST") and combined with the Center of Internet Security ("CIS") controls framework are used to develop actionable steps for improving technical defenses and protecting against common threats. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. We have established and maintain comprehensive incident response and recovery plans that detail our planned responses to cybersecurity incidents. These plans are tested and evaluated on a regular basis. We periodically assess and test the policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.Independent AssessmentsWe engage third parties to perform assessments of our cybersecurity programs, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board of Directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.Technical SafeguardsWe deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including 24/7 detect and response services, network activity monitoring, phishing prevention, penetration testing and periodic IT security maturity assessments. As part of these efforts, we have engaged third-party cybersecurity providers to help deploy and monitor these safeguards and to assist in the event of a security incident or similar issue by conducting forensics reviews and assisting more broadly with the mitigation and remediation of any such event.Third-Party RisksWe maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. Education and AwarenessAll employees are required to complete information security awareness training upon joining the Company. Based on individual phishing test performance and job requirements, additional training may be offered or required on an as-needed basis.Effects and Impacts of Cybersecurity Risks As announced on October 28, 2023, we identified a cybersecurity incident impacting certain internal operations and information technology systems which adversely affected our ability to ship orders in the first quarter of fiscal 2024. All of our facilities were operational by mid-December 2023 and were returned to normalized operations. We incurred $1.5 million of expenses related to the cybersecurity incident in the first fiscal quarter of fiscal 2024. Additionally, we have invested and intend to continue to invest in strengthening our systems, cybersecurity training, policies, programs, response plans and other similar measures. As of the date of this report, except as set forth herein, we are not aware of any risks from cybersecurity threats that have materially affected us, including our business strategy, results of operations or financial condition. See "Item 1A. RISK FACTORS" - "If we do not successfully maintain our information and technology networks, including the security of those networks, our operations could be disrupted and unanticipated increases in costs and/or decreases in sales could result," "We may fail to effectively manage confidential data, which could harm our reputation, result in substantial additional costs and subject us to litigation," and "Cyberattacks and security vulnerabilities could lead to reduced sales, increased costs, liability claims, unauthorized access to customer data or harm to our reputation."

Our goal is to invest capital to generate long-term value for our stockholders. This includes spending on capital projects; developing or acquiring strategic businesses, technologies and product lines with the potential to strengthen our industry position; enhancing our existing set of product and service offerings or entering into new markets; as well as periodically returning value to our stockholders through share repurchases and dividends. To a large degree, capital efficiency reflects how well we manage key risks. The actions taken to address specific risks may affect how well we manage the more general risk of capital efficiency. If we do not allocate properly and manage our capital, we may fail to produce expected financial results, and we may experience a reduction in stockholder value, including increased volatility in our stock price.

As part of our long-term business strategy, we continue to evaluate the development or acquisition of strategic businesses, technologies and product lines with the potential to strengthen our industry position, enhance and expand our existing set of product and service offerings or enter new markets. We may be unable to identify or successfully complete suitable acquisitions in the future and completed acquisitions may not be successful. Acquisitions and technology investments may involve significant cash expenditures, the incurrence of debt, operating losses and expenses that could have a materially adverse effect on our business, financial condition, results of operations and cash flows. These types of transactions involve numerous other risks, including but not limited to: - Diversion of management time and attention from existing operations,- Difficulties in integrating acquired businesses, technologies and personnel into our business or into our compliance and control programs, particularly those that include international operations,- Working with partners or other ownership structures with shared decision-making authority (our interests and other ownership interests may be inconsistent),- Difficulties in obtaining and verifying relevant information regarding a business or technology prior to the consummation of a transaction, including the identification and assessment of liabilities, claims or other circumstances, including those relating to intellectual property claims, which could result in litigation or regulatory exposure,- Assumption of liabilities that exceed our estimated amounts,- Verification of financial statements and other business information of an acquired business,- Inability to obtain required regulatory approvals and/or required financing on favorable terms,- Potential loss of key employees, contractual relationships or customers of the acquired business,- Increased operating expenses related to the acquired businesses or technologies,- The failure of new technologies, products or services to gain market acceptance with acceptable profit margins,- Entering new markets in which we have little or no experience or in which competitors may have stronger market positions,- Dilution of stockholder value through the issuance of equity securities or equity-linked securities, and - Inability to achieve expected synergies or the achievement of such synergies taking longer than expected to realize, including increases in sales, enhanced efficiencies or increased market share, or the benefits ultimately may be smaller than we expected. Any acquisitions or investments may ultimately harm our business or financial condition, as they may not be successful and may ultimately have an adverse effect on our operating results, financial condition and/or result in impairment charges.