Aecom Technology (ACM) Risk Analysis

Our project sites often put our employees and others in close proximity with mechanized equipment, moving vehicles, chemical and manufacturing processes, and highly regulated materials. On some project sites, we may be responsible for safety and, accordingly, we have an obligation to implement effective safety procedures. If we fail to implement these procedures or if the procedures we implement are ineffective, we may suffer the loss of or injury to our employees, as well as expose ourselves to possible litigation. As a result, our failure to maintain adequate safety standards and equipment could result in reduced profitability, harm to our reputation, or the loss of projects or clients, and could have a material adverse impact on our business, financial condition, and results of operations.

We are engaged in a highly competitive business. The markets we serve are highly fragmented and we compete with a large number of regional, national and international companies. These competitors may have greater financial and other resources than we do. Others are smaller and more specialized, and concentrate their resources in particular areas of expertise. The extent of our competition varies according to the particular markets and geographic area. In addition, the technical and professional aspects of some of our services generally do not require large upfront capital expenditures and provide limited barriers against new competitors. The degree and type of competition we face is also influenced by the type and scope of a particular project. Our clients make competitive determinations based upon qualifications, experience, performance, reputation, technology, customer relationships, price and ability to provide the relevant services in a timely, safe and cost-efficient manner. Increased competition may result in our inability to win bids for future projects, increased margin pressure and loss of revenue, profitability and market share.

Our success depends, in part, upon our ability to protect our intellectual property. We rely on a combination of intellectual property policies and other contractual arrangements to protect much of our intellectual property where we do not believe that trademark, patent or copyright protection is appropriate or obtainable. Trade secrets are generally difficult to protect. Although our employees are subject to confidentiality obligations, this protection may be inadequate to deter or prevent misappropriation of our confidential information and/or the infringement of our patents and copyrights. Further, we may be unable to detect unauthorized use of our intellectual property or otherwise take appropriate steps to enforce our rights. Failure to adequately protect, maintain, or enforce our intellectual property rights may adversely limit our competitive position.

We may experience errors, outages, or delays of service in our information technology systems, which could significantly disrupt our operations, impact our clients and employees, damage our reputation, and result in litigation and regulatory fines or penalties. Various privacy and securities laws pertaining to client and employee data usage require us to manage and protect sensitive and proprietary information. For example, the European's Union General Data Protection Regulation may apply to companies processing data of European Union residents, even if the company is not located in the European Union. In addition, the California Consumer Privacy Act increased the penalties for data privacy incidents. We face threats to our information technology systems, including unauthorized access, computer hackers, computer viruses, malicious code, cyber-attacks, ransomware, data extortion, phishing and other cybersecurity problems and system disruptions, including possible unauthorized access to our and our clients' proprietary information. Our cybersecurity program is designed to use industry-accepted security measures and technology to securely maintain all proprietary information on our information technology systems. In the ordinary course of business, we have been targeted by malicious cyber-attacks. Anyone who circumvents our security measures could misappropriate proprietary information, including information regarding us, our employees and/or our clients, or cause interruptions in our operations. Although we devote considerable resources to our cybersecurity programs and have implemented security measures to protect our systems and to prevent, detect and respond to cybersecurity incidents, there can be no assurance that our efforts will prevent these threats. As these security threats continue to evolve, we may be required to devote additional resources to help prevent, detect and respond to system disruptions and cybersecurity incidents. We also rely in part on third-party software and information technology vendors to run our critical accounting, project management and financial information systems. We depend on our software and information technology vendors to provide long-term software and hardware support for our information systems. Our software and information technology vendors may decide to discontinue further development, integration or long-term software and hardware support for our information systems, in which case we may need to abandon one or more of our current information systems and migrate some or all of our accounting, project management and financial information to other systems, thus increasing our operational expense, as well as disrupting the management of our business operations. Any of these events could damage our reputation and have a material adverse effect on our business, financial condition, results of operations and cash flows. Furthermore, while we maintain insurance designed to cover these events, our coverage may not sufficiently cover all types of losses or claims that may arise or be subject to exclusions.

Artificial intelligence, machine learning, data science and similar technologies (collectively, "AI"), including third-party AI tools, may be enabled by, or integrated into, some of our business processes and solutions. As with many developing technologies, AI presents risks and challenges that could affect its further development, adoption, and use, and therefore our business. AI algorithms may be flawed or biased. Datasets used to train or develop AI systems may be insufficient, of inferior quality, or contain biased, incorrect or incomplete information. The utilization of AI may increase our risk and liability exposure relating to confidentiality, intellectual property infringement, and client use restrictions. Our AI governance review process and safeguards may not be adequate to protect against these risks and challenges. Additionally, the laws and regulations concerning the use of AI continue to evolve. If the use or integration of AI systems, or the outputs generated by such systems, were determined to be non-compliant (e.g., in relation to AI statutory regimes, data privacy rights or in relation to the use of AI for certain activities or use cases), this may expose us to regulatory action or litigation. It is possible that emerging regulations or changes to intellectual property laws may limit or block the use of AI in our business or otherwise impose restrictions that may adversely affect the efficiency of our business processes or solutions that were utilizing AI technologies. Our competitors or other third parties may incorporate AI into their product and service offerings more quickly or more successfully than us, which could impair our ability to compete effectively and adversely affect our business, financial condition and results of operations.

During fiscal 2025, revenue attributable to our services provided outside of the United States to non-U.S. clients was approximately 27% of our total revenue. There are risks inherent in doing business internationally, including: - the ongoing conflict between Russia and Ukraine, which has resulted in the imposition by the U.S. and other nations of restrictive actions against Russia, Belarus and certain banks, companies and individuals;- imposition of governmental controls and changes in laws, regulations or policies;- political and economic instability, including in the Middle East;- civil unrest, acts of terrorism, force majeure, war, or other armed conflict;- changes in U.S. and other national government trade policies affecting the markets for our services, including the imposition of tariffs;- political unrest in Hong Kong where we have a significant presence;- impact of health crises and their related economic impacts;- increases in the consumer price index and interest rates;- changes in regulatory practices, tariffs and taxes;- potential non-compliance with a wide variety of laws and regulations, including anti-corruption, export control and anti-boycott laws and similar non-U.S. laws and regulations;- changes in labor conditions;- logistical and communication challenges; and - currency exchange rate fluctuations, devaluations and other conversion restrictions. Any of these factors could have a material adverse effect on our business, results of operations or financial condition.

Climate-related events, such as an increase in frequency and severity of storms, floods, wildfires, droughts, hurricanes, freezing conditions, and other natural disasters, may have a long-term impact on our business, financial condition and results of operation. While we seek to mitigate our business risks associated with climate events, we recognize that there are inherent climate-related risks regardless of where we conduct our businesses. For example, a catastrophic natural disaster could negatively impact any of our office locations and the locations of our clients. Accordingly, a natural disaster has the potential to disrupt our and our clients' businesses and may cause us to experience work stoppages, project delays, financial losses and additional costs to resume operations, including increased insurance costs or loss of cover, legal liability and reputational losses.