Sysco (SYY) Risk Factors

Under our Restated Certificate of Incorporation, our Board of Directors is authorized to issue up to 1,500,000 shares of preferred stock without stockholder approval. Issuance of these shares could make it more difficult for anyone to acquire Sysco without approval of our Board of Directors, depending on the rights and preferences of the stock issued. In addition, if anyone attempts to acquire Sysco without approval of our Board of Directors, the existence of this undesignated preferred stock could allow our Board of Directors to adopt a shareholder rights plan without obtaining stockholder approval, which could result in substantial dilution to a potential acquirer. As a result, hostile takeover attempts that might result in an acquisition of Sysco, which could otherwise have been financially beneficial to our stockholders, could be deterred.

An element of our strategy includes further expansion of operations into new markets and the establishment of new procurement organizations. Our ability to successfully operate in these new markets may be adversely affected by political, economic and social conditions beyond our control, public health crises, epidemics and pandemics, local laws and customs, and legal and regulatory constraints, including compliance with applicable anti-corruption and currency laws and regulations, of the countries or regions in which we currently operate or intend to operate in the future. Risks inherent in such expansion also include, among others, the costs and difficulties of identifying and gaining access to local suppliers, suffering possible adverse tax consequences from changes in tax laws or the unfavorable resolution of tax assessments or audits, maintaining product quality and greater difficulty in enforcing intellectual property rights. Our business strategy also includes the possibility of expansion into businesses that are closely related or complementary to, but not currently part of, our core foodservice distribution business. Our ability to successfully operate in these complementary business markets may be adversely affected by legal and regulatory constraints, including compliance with regulatory programs to which we become subject. Risks inherent in branching out into such complementary markets also include the costs and difficulties of managing operations outside of our core business, which may require additional skills and competencies, as well as difficulties in identifying and gaining access to suppliers or customers in new markets.

Data privacy laws and the regulatory activity associated therewith, continue to evolve across most jurisdictions in which we operate. Given the complexity of these laws, uncertainty regarding their interpretation, application, and enforcement and the often-onerous requirements they place on businesses regarding the collection, storage, handling, use, disclosure, transfer, and security of personal data, it is important for us to understand their impact and respond accordingly. Failure to comply with data privacy laws can result in substantial fines or penalties, legal liability and / or reputational damage and litigation. In the UK and Europe, the General Data Protection Regulation (the GDPR), which came into effect in 2018, places stringent requirements on companies when handling personal data. There continues to be a growing trend of other countries adopting similar laws. Additionally, there continues to be significant uncertainty with respect to the California Consumer Privacy Act of 2018 (the CCPA), which went into effect on January 1, 2020, and imposes additional obligations on companies regarding the handling of personal information and provides certain individual privacy rights to persons whose information is collected. Both the GDPR and the CCPA are continuously evolving and developing and may be interpreted and applied differently from jurisdiction to jurisdiction and may create inconsistent or conflicting requirements. For example, the California Privacy Rights Act (the CPRA), which was approved by California voters as a ballot initiative in November 2020, modifies the CCPA significantly, further enhancing and extending an individual's rights over their personal data and the obligations placed on companies that handle this data. The resulting new regulations became effective on January 1, 2023. Most notably, employee and business data were brought into scope, which raises the compliance requirements for us significantly, in terms of internal controls, processes and governance requirements. Furthermore, since 2020, numerous other U.S. states have enacted, or are considering more stringent privacy laws, which may impose varying standards and requirements on our data collection, use and processing activities. Continued state by state introduction of privacy laws can be expected to lead to significantly greater complexity in our compliance requirements globally, which could result in complaints from data subjects and/or action from regulators and potential litigation claims. If we do not provide sufficient resources to ensure we are able to respond, adapt and implement the necessary requirements to respond, or we do not respond sufficiently to the various forthcoming changes, which could include federal data privacy requirements in the US, while continuing to maintain our compliance with global data privacy laws, this could adversely impact our reputation and we could face exposure to fines levied by regulators and class action and similar litigation risks, which could have a significant financial impact on our business.

We have long-standing relationships and agreements with a number of our customers. Some of our customer agreements are terminable upon written notice by either us or the customer, which provides some customers with the opportunity to renegotiate their contracts with us on less favorable terms or to award more business to our competitors. Market competition, customer requirements, customer financial condition and customer consolidation through mergers or acquisitions also could adversely affect our ability to continue or expand these relationships. We may not be able to retain or renew existing agreements, maintain relationships with any of our customers on acceptable terms, or at all, or collect amounts that insolvent customers might owe us. The loss of one or more of our major customers could adversely affect our business, financial condition, and results of operations.

The foodservice distribution industry is characterized by relatively high inventory turnover with relatively low profit margins. Volatile food costs have a direct impact on our industry. In periods of significant product cost inflation, if we are unable to pass on all or a portion of such product cost increases to our customers in a timely manner, our results of operations would be adversely affected. In addition, periods of rapidly increasing inflation may adversely affect our results of operations due to the impact of such inflation on discretionary spending by consumers and our limited ability to increase prices in the current, highly competitive environment. Conversely, our results of operations may be adversely affected by periods of product cost disinflation and deflation, because we make a significant portion of our sales at prices that are based on the cost of products we sell plus a percentage margin, mark-up or fee per case. As a result, our results of operations may be adversely affected during periods of product cost disinflation and deflation, even though our gross profit percentage may remain relatively constant.

We use technology in substantially all aspects of our business operations, and our ability to serve customers most effectively depends on the reliability of our technology systems. We use software and other technology systems, among other things, to generate and select orders, to load and route trucks, to make purchases, to manage our warehouses and to monitor and manage our business on a day-to-day basis. We also use mobile devices, social networking and other online platforms to connect with our employees, suppliers, business partners and customers. Further, our business involves the storage and transmission of numerous classes of sensitive and/or confidential information and intellectual property, including customers' and suppliers' personal information, private information about employees and financial and strategic information about us and our business partners. This sensitive and/or confidential information and intellectual property are stored on information technology systems controlled by us, as well as systems controlled by third parties, such as our service providers. These technology systems and the operation thereof are vulnerable to disruption from circumstances beyond our control, including fire, natural disasters, power outages, systems failures, security breaches, espionage, cyber-attacks, viruses, theft and inadvertent release of information. In the normal course of business, we and our third-party providers experience cybersecurity threats and incidents of varying degrees from time-to-time, including ransomware and phishing attacks, as well as distributed denial of service attacks and the theft of data. Cyber threats are constantly evolving, are becoming more sophisticated and frequent, including through the introduction of viruses and malware (such as ransomware) and the use of artificial intelligence by the threat actors, and are being made by groups and individuals with a wide range of expertise and motives, and this increases the difficulty of detecting and successfully defending against them. For example, as disclosed in our Quarterly Report on Form 10-Q for our third quarter of fiscal 2023, in March 2023, Sysco became aware of a cybersecurity event perpetrated by a threat actor believed to have begun in January 2023. Immediately upon detection, Sysco initiated an investigation, with the assistance of cybersecurity and forensics professionals, determining that the threat actor had extracted certain company data, including data relating to operation of the business, customers, employees and personal data. This data extraction did not impact Sysco's operational systems and related business functions, and its service to customers continued uninterrupted. Sysco also notified federal law enforcement and provided other required notifications. To date, cybersecurity incidents have not had a material impact on our financial condition, results of operations or liquidity. However, there is no assurance that there will not be a material adverse effect in the future, especially if, for example, the amount of insurance coverage we maintain is not sufficient to cover claims or liabilities relating to an incident. Potential consequences of a future material cybersecurity incident include: business disruption; disruption to systems; theft, destruction, loss, corruption, misappropriation or unauthorized release of sensitive and/or confidential information or intellectual property (including personal information in violation of one or more privacy laws); loss of revenue; reputational and brand damage; and potential liability, including litigation or other legal actions against us or the imposition by governmental authorities of penalties, fines, fees or liabilities, which, in turn, could cause us to incur significantly increased cybersecurity protection and remediation costs and the loss of customers. In addition, if our suppliers or customers experience such a breach or unauthorized disclosure or system failure, their businesses could be disrupted or otherwise negatively affected. This may result in a disruption in our supply chain or reduced customer orders, which would adversely affect our business operations. We have also outsourced several information technology support services and administrative functions to third-party service providers, including cloud-based service providers, and may outsource other functions in the future to achieve cost savings and efficiencies. If these service providers do not perform effectively due to breach or system failure, we may not be able to achieve the expected benefits and our business may be disrupted. Many of our employees, contractors and other corporate partners now work remotely, increasing reliance on information technology systems that are outside our direct control. These systems are potentially vulnerable to cyber-based attacks and security breaches. In addition, cyber criminals are increasing their attacks on individual employees with business email compromise scams designed to trick victims into transferring sensitive data or funds, or steal credentials that compromise information systems. The actions and controls we have implemented and are implementing to date, or which we seek to cause or have caused third-party providers to implement, may be insufficient to protect our systems, information or other intellectual property. Further, we anticipate continuing to devote significant resources to maintaining and upgrading our security measures generally, including those we employ to protect personal information against these cybersecurity threats. Further, as we pursue our strategy to grow through acquisitions and to pursue new initiatives that improve our operations and cost structure, we are also expanding and improving our information technologies, resulting in a larger technological presence and corresponding exposure to cybersecurity risk. Failure to adequately assess and identify cybersecurity risks associated with acquisitions and new initiatives could increase our vulnerability to such risks. Our efforts to prevent security breaches and cybersecurity incidents, and to implement effective disaster recovery plans, may not be entirely effective to insulate us from technology disruption or protect us from adverse effects on our results of operations. Additionally, information technology systems continue to evolve and, in order to remain competitive, we must implement new technologies in a timely and efficient manner. For example, we may incorporate emerging artificial intelligence solutions into our platform, offerings, services and features, and these applications may become important in our operations over time. Our failure to implement timely and/or successfully new technologies, including artificial intelligence, may adversely affect our competitiveness and, consequently, our results of operations.