Noodles & Co (NDLS) Risk Factors

We cannot guarantee that our internal controls and training will be fully effective in preventing all food safety issues at our restaurants, including any occurrences of foodborne illnesses such as E. coli, Hepatitis A, listeria, norovirus and salmonella. The risk of illnesses associated with our food might also increase in connection with the expansion of our catering and delivery businesses or other situations in which our food is served or delivered in conditions that we cannot control. Furthermore, we and our franchisees rely on third-party vendors throughout our supply chain, making it difficult to monitor food safety compliance and increasing the risk that foodborne illness would affect multiple locations rather than a single restaurant. Some foodborne illness incidents could be caused by third-party vendors and transporters outside of our control. New illnesses resistant to our current precautions may develop in the future, or diseases with long incubation periods could arise, that could give rise to claims or allegations on a retroactive basis. One or more instances of foodborne illness in any of our restaurants or markets or related to food products we sell could negatively affect our restaurant sales nationwide if highly publicized on national media outlets or through social media. This risk exists even if it were later determined that the illness was wrongly attributed to us or one of our restaurants. A number of other restaurant chains have experienced incidents related to foodborne illnesses that have had a material adverse effect on their operations, including E. coli, listeria and norovirus outbreaks at other fast-casual concepts. These incidents at other restaurants could cause some customers to have a negative perception of fast-casual concepts generally, which can negatively affect our restaurants. The occurrence of a similar incident at one or more of our restaurants, or negative publicity or public speculation about an incident, could materially adversely affect our business, financial condition, results of operations or cash flows.

Our ability to maintain consistent price, quality and safety throughout our restaurants depends in part upon our ability to acquire specified food products and supplies in sufficient quantities from third-party vendors, suppliers and distributors at a reasonable cost. We do not control the businesses of our vendors, suppliers and distributors and our efforts to specify and monitor the standards under which they perform may not be successful. Furthermore, certain food items are perishable, and we have limited control over whether these items will be delivered to us in appropriate condition for use in our restaurants. If any of our distributors or suppliers perform inadequately, or our distribution or supply relationships are disrupted for any reason, our business, financial condition, results of operations or cash flows could be materially adversely affected. If we cannot replace or engage distributors or suppliers who meet our specifications in a short period of time, including any suppliers who are a sole source of supply of a particular ingredient, that could increase our expenses and cause shortages of food and other items at our restaurants, which could cause a restaurant to remove items from its menu. If that were to happen, affected restaurants could experience significant reductions in sales during the shortage or thereafter, especially if customers change their dining habits as a result. Our focus on a limited menu would make the consequences of a shortage of a key ingredient more severe. In addition, because we provide moderately priced food, we may choose not to, or may be unable to, pass along commodity price increases to consumers. These potential changes in food and supply costs could materially adversely affect our business, financial condition, results of operations or cash flows. During 2022, certain vendors experienced staffing pressures and raw material availability that impacted their ability to supply and distribute our food ingredients in a timely and cost-effective manner. Despite the disruption within our vendor base, we did not experience a significant impact in our ability to supply the necessary food ingredients to our restaurants. However, several food ingredients, including chicken, experienced significant inflation predominantly in the second and third quarters of 2022, resulting in higher cost of food. We did not experience any significant supply chain disruptions in 2023. In addition, we use various third-party vendors to provide, support and maintain most of our management information systems. We also outsource certain accounting, payroll and human resource functions to business process service providers. The failure of such vendors to fulfill their obligations could disrupt our operations. Any changes we may make to the services we obtain from our vendors, or new vendors we employ, may disrupt our operations. These disruptions could materially adversely affect our business, financial condition, results of operations or cash flows. For example, during 2023 our point of sale provider and food ordering vendors experienced temporary system outages. Future outages could lead to greater disruption to our operations. We also partner with various third-party vendors to deliver our food. If any of our delivery vendors perform inadequately, or our delivery relationships are disrupted for any reason, our business, financial condition, results of operations or cash flows could be materially adversely affected.

Our intellectual property is material to the conduct of our business and our marketing efforts. Our ability to implement our business plan successfully depends in part on our ability to further build brand recognition using our trademarks, service marks, trade dress and other proprietary intellectual property, including our name and logos and the unique ambiance of our restaurants. While it is our policy to protect and defend vigorously our rights to our intellectual property, we cannot predict whether steps taken by us to protect our intellectual property rights will be adequate to prevent misappropriation of these rights or the use by others of restaurant features based upon, or otherwise similar to, our concept. It may be difficult for us to prevent others from copying elements of our concept and any litigation to enforce our rights will likely be costly and may not be successful. Although we believe that we have sufficient rights to all of our trademarks and service marks, we may face claims of infringement that could interfere with our ability to market our restaurants and promote our brand. Any such litigation may be costly and divert resources from our business. Moreover, if we are unable to successfully defend against such claims, we may be prevented from using our trademarks or service marks in the future, may be liable for damages and may have to change our marketing efforts, which in turn could materially adversely affect our business, financial condition, results of operations or cash flows.

We are part of an industry that is vulnerable to cyberattacks and other cybersecurity incidents. In response, we have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage cybersecurity risks. Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process. Our enterprise risk management team includes information technology and digital security functions to gather insights for assessing, identifying and managing cybersecurity threat risks, their severity, and potential mitigations. We assess Noodles & Company's Cybersecurity program using several frameworks including the cybersecurity framework from the National Institute of Standards and Technology (NIST-CSF). This program includes policies, processes and procedures that help assess and identify our cybersecurity risks and inform how security measures and controls are developed, implemented and maintained. The risk assessment along with risk-based analysis and judgment are used to prioritize our cybersecurity initiatives. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls and impact of controls on operations. We maintain internal resources to perform penetration testing designed to simulate evolving tactics and techniques of real-world threat actors, engage with industry partners and law enforcement and intelligence communities and conduct tabletop exercises and periodic risk interviews across our business. We also engage several independent third-parties to perform internal and external penetration testing of our technology environment periodically and engage other third-parties to periodically conduct assessments of our cybersecurity processes and capabilities. In addition, we continue to expand training and awareness practices to mitigate risk from human error, including mandatory computer-based training and internal communications for employees. Our employees undergo cybersecurity awareness training and regular phishing awareness campaigns that are based upon and designed to emulate real-world contemporary threats. We provide prompt feedback (and, if necessary, additional training or remedial action) based on the results of such exercises. We use many information technology systems throughout our operations, including systems that record and process customer sales, manage human resources and generate accounting and financial reports. For example, our restaurants use computerized management information systems, including point-of-sale computers that process customer credit card, debit card and gift card payments, and in-restaurant back office computer systems designed to assist in the management of our restaurants and provide labor and food cost management tools. Our franchisees use similar point of sale systems and are required to report business and operational data through an online reporting network. Through these systems, we have access to and store a variety of consumer, employee, financial and other types of information related to our business. We also rely on third-party vendors to provide information technology systems and to securely process and store related information. Our franchisees also use information technology systems and rely on third-party vendors. If our technology systems, or those of third-party vendors we or our franchisees rely upon, are compromised as a result of a cyber-attack (including from circumvention of security systems, denial-of-service attacks, hacking, "phishing" attacks, computer viruses, ransomware, malware, or social engineering) or other external or internal methods, it could materially adversely affect our reputation, business, financial condition, results of operations or cash flows. The cyber risks we face range from cyber-attacks common to most industries to attacks that target us due to the confidential consumer information we obtain through our electronic processing of credit and debit card transactions. Like others in our industry, we have experienced many attempts to compromise our information technology and data, including a successful attempt in 2016 that we have discussed in previous filings, and we may experience more attempts in the future. In addition to property and casualty insurance, which may cover restoration of data, certain physical damage or third-party injuries, we have cybersecurity insurance related to a breach event. However, damage and claims arising from such incidents may not be covered or may exceed the amount of any available insurance. Because cyber-attacks take many forms, change frequently, are becoming increasingly sophisticated, and may be difficult to detect for significant periods of time, we may not be able to respond adequately or timely to future cyber-attacks. If we or our franchisees, or third-party vendors, were to experience a material breach resulting in the unauthorized access, use, or destruction of our information technology systems or confidential consumer, employee, financial, or other proprietary data, it could negatively impact our reputation, reduce our ability to attract and retain customers and employees and disrupt the implementation and execution of our strategic goals. Moreover, such breaches could result in a violation of various privacy-related laws, including the various state specific privacy laws and subject us to investigations or private litigation, which, in turn, could expose us to civil or criminal liability, fines and penalties imposed by state and federal regulators, claims for purportedly fraudulent transactions arising out of the actual or alleged theft of credit or debit card information, compromised security and information systems, failure of our employees to comply with applicable laws, the unauthorized acquisition or use of such information by third parties, or other similar claims, and various costs associated with such matters.

Our customers occasionally file complaints or lawsuits against us alleging we caused an illness or injury they suffered at or after a visit to our restaurants, or that we have problems with food quality or operations. These kinds of complaints or lawsuits may be more common in a period in which the public is focused on health safety issues, or may attract more attention due to publication on various social media outlets. We are also subject to a variety of other claims arising in the ordinary course of our business, including personal injury claims, contract claims and claims alleging violations of federal and state law regarding workplace and employment matters, equal opportunity, discrimination and similar matters and we could become subject to class action or other lawsuits related to these or different matters in the future. In addition, the restaurant industry has from time to time been subject to claims based on the nutritional content of food products sold and disclosure and advertising practices. We may also become subject to various employee and workplace litigation, including claims related to discrimination, harassment, workplace safety, medical and family leave, and wage-and-hour issues. Regardless of whether any claims against us are valid, or whether we are ultimately held liable, claims may be expensive to defend and may divert time and money away from our operations and hurt our performance. A judgment in excess of our insurance coverage for any claims could materially adversely affect our financial condition or results of operations. Any adverse publicity resulting from these allegations, even if proven to be false, may also materially adversely affect our reputation or prospects, which in turn could materially adversely affect our business, financial condition, results of operations or cash flows.

Our business, and the restaurant industry in general, depends on consumer discretionary spending. Changes in market conditions, including negative economic conditions resulting from inflation, increased interest rates, recessionary economic cycles, stock market volatility, war, terrorist activities, global economic occurrences or trends or other geo-political events, may result in decreased consumer confidence, increased cost of consumer credit and ultimately reduced consumer disposable income. In turn, consumers may make changes to their discretionary spending behavior in a way that negatively affects our business, including dining out less frequently, reducing the amount they spend while dining out, or choosing to eat at other lower priced restaurants. Additionally, these changes in market conditions may impact our development pipeline, including the availability of new sites, increased construction costs and availability of contract labor. Changes in economic conditions, particularly with respect to inflationary pressures, may result in increased interest rates persisting for longer than expected and/or further increases in interest rates, labor shortages, and supply chain disruptions. These inflationary pressures may also increase our costs including our labor and raw material costs, utilities, and our cost of borrowing, and we may not be able to fully offset such higher costs through price increases. For example, in 2023, we executed an amendment to our credit agreement which resulted in increased borrowing rates. Also in 2022, the cost of several of our food ingredients increased as a result of inflation in many commodities, particularly our cost of chicken. As a result, we implemented a temporary chicken-price surcharge of $1.00 for several months while chicken was at its peak of the commodity cycle and made certain other menu price increases throughout 2022. If customer demand were to decrease or our costs were to increase without a corresponding increase in our prices, our profitability would decline. Moreover, as a result of such economic conditions, we may record additional asset impairment charges, implement additional restaurant closures, or slow our planned growth. Any of these economic factors may materially adversely affect our business, financial condition, results of operations or cash flows.

The occurrence of one or more unexpected events, including war, acts of terrorism, epidemics and pandemics (such as the COVID-19 pandemic), civil unrest, fires, tornadoes, tsunamis, hurricanes, earthquakes, floods, and other forms of severe weather (including those caused or exacerbated by climate change) in the United States or in other locations in which our suppliers are located, have affected and could in the future affect our operations and financial performance. It is possible that weather conditions may impact our business more than other businesses in our industry because of the significant concentration of our restaurants in the Upper Midwest, Rocky Mountain and Mid-Atlantic states. Such events could affect our guest traffic, sales and operating costs and/or cause complete or partial closure of one or more distribution centers, cause temporary or long-term disruption or inoperability of our information technology systems (including our digital platform), temporary or long-term disruptions in our delivery channel or the supply of products from suppliers, and disruption and delay in the transport of products, any of which may have a material adverse effect on our business, financial condition, and results of operations. Existing insurance coverage may not provide protection from all the costs that may arise from such events.