Aon (AON) Risk Analysis

Our businesses are subject to extensive legal and regulatory oversight throughout the world, including the Irish Companies Act, the U.S. securities laws, rules, and regulations, the rules and regulations promulgated by the FCA and a variety of other laws, rules, and regulations addressing, among other things, licensing, data privacy, data management and data protection, artificial intelligence, trade sanctions laws, restrictions and export controls, anti-money laundering, wage-and-hour standards, employment and labor relations, antitrust and competition, anti-corruption, currency, reserves, government contracting, and the amount of local investment with respect to our operations in certain countries. This legal and regulatory oversight could reduce our profitability or limit our growth by: increasing the costs of legal and regulatory compliance; limiting or restricting the products or services we sell, the markets we serve or enter, the methods by which we sell our products and services, the overall structure of our business units, the type of services and prices we can charge for our services, or the form of compensation we can accept from our clients, carriers, and third parties; or by subjecting our businesses to the possibility of legal and regulatory actions, proceedings, or fines. The global nature of our operations increases the complexity and cost of compliance with laws and regulations adding to our cost of doing business. In addition, many of these laws and regulations may have differing or conflicting legal standards across jurisdictions, increasing the complexity and cost of compliance. In emerging markets and other jurisdictions with less developed legal systems, local laws and regulations may not be established with sufficiently clear and reliable guidance to provide us adequate assurance that we are operating our business in a compliant manner with all required licenses or that our rights are otherwise protected. In addition, certain laws and regulations, such as the Foreign Corrupt Practices Act and the Foreign Account Tax Compliance provisions of the Hiring Incentives to Restore Employment Act in the U.S., the Bribery Act of 2010 in the U.K. and the General Data Protection Regulation in the E.U., impact our operations outside of the legislating country by imposing requirements for the conduct of overseas operations, and in several cases, requiring compliance by foreign subsidiaries. In addition to the complexity of the laws and regulations themselves, the development of new laws and regulations or changes in application or interpretation of current laws and regulations or conflict between them also increases our legal and regulatory compliance complexity and risk. Additionally, our acquisitions of new businesses and our continued operational changes and entry into new jurisdictions and development of new service offerings increases our legal and regulatory compliance complexity, as well as the type of governmental oversight to which we may be subject. Changes in laws and regulations could mandate significant and costly changes to the way we implement our services and solutions, impose additional licensure requirements or costs to our operations, workforce and services, or cause us to cease offering certain services or solutions. New or evolving laws or regulations may also lead our clients to include contractual requirements in their agreements with us, which may increase our costs of compliance or introduce additional organizational complexity. Furthermore, as we enter new jurisdictions or businesses and further develop and expand our services, including through acquisitions, we may become subject to additional types of laws and governmental oversight and supervision, such as those applicable to the financial lending or other service institutions. Regulatory developments that could result in changes that adversely affect us or cause us to change our business or operations include: additional requirements related to the use of artificial intelligence, and the use, access, privacy, protection, management, localization and transfer of data in jurisdictions in which we operate that may increase our costs of compliance and potentially reduce the manner in which we can use data; changes in tax regulations in the jurisdictions in which we operate; regulatory actions or changes that require us to change our compensation model; or additional regulations or other governmental action in jurisdictions in which we operate. Governmental, investor, stakeholder and public attention to corporate sustainability matters, including new or changing reporting, diligence or disclosure rules and regulations, has increased in recent years and may continue to change the nature, scope, and complexity of matters that we are required to control, assess, and report. These and other rapidly changing laws, rules, regulations and expectations, which may differ across the jurisdictions in which we operate, may increase the cost of our compliance and risk management and increase the scope and rigor of data collection, controls, and external assurance of sustainability-related information, and otherwise impact our business, each of which could have a material adverse effect on our business, results of operations, and financial condition. Increased scrutiny of corporate sustainability claims, and changes in client and investor preferences may also create legal, regulatory, contractual, and reputational risks and could require changes to our products, services, client engagements or operations, which may increase our cost of doing business. In addition, the shift toward a lower-carbon economy, driven by changes in laws, rules and regulations, low-carbon technology advancement, consumer sentiment, and/or liability risks, may negatively impact our business model and/or the business models of our clients. In all jurisdictions, the applicable laws and regulations are subject to amendment or interpretation by regulatory authorities. Generally, such authorities are vested with relatively broad discretion to grant, renew, and revoke licenses and approvals and to implement regulations. Accordingly, we may have a license revoked, limited, or be unable to obtain new licenses and therefore be precluded or suspended from carrying on or developing some or all of our activities or otherwise be fined or penalized in a given jurisdiction. Our business may be unable to develop or be conducted in any given jurisdiction as it has been conducted in the past. Changes in the regulatory scheme, or changes in how applicable regulations are interpreted or applied, could have an adverse impact on our results of operations by limiting revenue streams or increasing costs of compliance. Our business' regulatory oversight also includes licensing of insurance brokers and agents, managing general agency or general underwriting operations, and the regulation of the handling and investment of client funds held in a fiduciary capacity. Our continuing ability to provide insurance broking in the jurisdictions in which we operate depends on our compliance with the rules and regulations promulgated by the regulatory authorities in each of these jurisdictions, and our failure to adhere to these rules and regulations can expose us to fines, penalties, or other sanctions. We can also be affected indirectly by the governmental regulation and supervision of insurance companies. For instance, if we are providing or managing general underwriting services for an insurer, we may have to adhere to regulations affecting our insurer client. Services provided in our Human Capital segment are also the subject of ever-evolving government regulation, either because the services provided to our clients are regulated directly or because third parties upon whom we rely to provide services to clients are regulated, thereby indirectly affecting the manner in which we provide services to those clients. In the U.S., legislative proposals have been introduced or proposed in Congress and in some state legislatures that would effect major changes in the health insurance industry, thereby impacting the cost for companies that offer healthcare benefits to their employees, or more broadly affecting the structure or the stability of the insurance markets. In particular, our health care exchange business depends upon the private sector of the U.S. insurance system and its role in financing health care delivery, and insurance carriers' use and payment of commissions to agents, brokers, and other organizations to market and sell individual and family health insurance products and plans. Uncertainty regarding, or any changes to, state or federal law, or the interpretation of such law by applicable regulatory agencies could delay client adoption of our health care exchange, impair our ability to retain clients who have adopted our health care exchange, or cause insurance carriers to alter or eliminate the products and plans that they offer or attempt to move members into new products or plans for which we receive lower commissions. In addition, changes in laws, government regulations, or the way those regulations are interpreted in the jurisdictions in which we operate could affect the viability, value, use, or delivery of benefits and human resources programs, including changes in regulations relating to health and welfare plans (such as medical), defined contribution plans (such as 401(k)), or defined benefit plans (such as pension), may adversely affect the demand for, or profitability of, our services. If we violate the laws and regulations to which we are subject, we could be subject to fines, penalties, or criminal sanctions and could be prohibited from conducting business in one or more jurisdictions. There can be no assurance that our employees, contractors, agents or business partners will not violate these laws and regulations, causing an adverse effect on our operations and financial condition. Heightened regulatory oversight and scrutiny may lead to additional regulatory investigations, increased government involvement, or enforcement actions, which could consume significant management time and resources and could have adverse effects on our business and operations. For instance, increased scrutiny by competition authorities may increase our costs of doing business or force us to change the way we conduct business or refrain from or otherwise alter the way we engage in certain activities. Additionally, we could suffer significant financial or reputational harm if we fail to properly identify and manage potential conflicts of interest, which exist or could exist any time we or any of our employees or business partners have or may have an interest in a transaction or engagement that is inconsistent with our clients' interests. This could occur, for example, when we are providing services to multiple parties in connection with a transaction. We also may provide multiple types of services to certain clients from more than one of our solution lines, creating a greater potential for conflicts with advisory services. Due to the broad scope of our businesses and our client base, we regularly address potential conflicts of interest, including, without limitation, situations where our services to a particular client or our own investments or other interests conflict, or are perceived to conflict, with the interests of another client. If these are not adequately identified and managed, this could then lead to failure or perceived failure to protect the client's interests, with consequential regulatory and reputational risks, including litigation or enforcement actions that could adversely affect us and our operations. Identifying and addressing conflicts of interest may also prove particularly difficult as we continue to bring systems and information together and integrate our existing and newly acquired businesses. Insurance intermediaries have traditionally been remunerated by base commissions paid by insurance carriers in respect of insurance placements for clients, or by fees paid by clients. Intermediaries also obtain other revenue from insurance carriers. This revenue, when derived from carriers in their capacity as insurance markets (as opposed to as corporate clients of the intermediaries where they may be purchasing insurance or reinsurance or other non-market related services), is commonly known as market-derived income, or "MDI." MDI is another example of an area in which potential conflicts of interest may arise. MDI takes a variety of forms, including volume- or profit-based contingent commissions, facilities administration charges, business development agreements, and fees for providing consulting services to carriers. Accepting this revenue is a lawful and generally commercially accepted business practice that may nonetheless be subject to scrutiny by various regulators under conflict of interest, anti-trust, unfair competition and anti-bribery laws and regulations, subject to legal or regulatory change, or negatively impacted by internal controls that are not fully effective.

We depend, to a large extent, on our relationships with our clients and our reputation for high-quality advice and solutions. If a client is not satisfied with our services, it could cause us to incur additional costs and impair profitability, or lose the client relationship altogether. Moreover, if we fail to meet our contractual, statutory, common law or fiduciary obligations, we could be subject to legal liability or loss of client relationships. The nature of much of our work involves assumptions and estimates concerning future events, the actual outcome of which we cannot know with certainty in advance. For example, in our investment businesses, we may be measured based on our track record regarding judgments and advice on investments that are susceptible to influences unknown at the time the advice was given. In addition, we could make computational, software programming, or data entry or management errors. Clients have claimed and may in the future claim they have suffered losses due to reliance on our consulting advice, analysis, or reporting, which poses risks of liability exposure and costs of defense and increased insurance premiums. Many of our clients are businesses that actively share information among themselves about the quality of service they receive from their vendors. Adverse statements or claims from clients (including clients in the public sector or whose activities are frequently covered by the press) may receive media attention or other publicity. Accordingly, poor service to, or the adverse opinion of, one client may negatively impact our relationships with multiple other clients.

One of our significant responsibilities is to maintain the security and privacy of our employees' and clients' confidential and proprietary information, including confidential information about our clients' and employees' compensation, medical information, and other personally identifiable information. We maintain policies, procedures, and technological safeguards designed to protect the security and privacy of this information, including its timely disposal in connection with applicable regulatory requirements. It is possible that our internal policies, procedures and technical safeguards may not be adequate to ensure that confidential, proprietary or otherwise sensitive information is timely disposed of or deleted in a manner compliant with such policies and applicable law or regulation. We have experienced cyber incidents and cannot eliminate the risk of human error, employee or vendor malfeasance, or cyber-attacks that could result in improper access to or disclosure of confidential, personal, or proprietary information. Such access or disclosure could harm our reputation and subject us to liability under our contracts and laws and regulations that protect personal data, resulting in increased costs, fines, loss of revenue, and loss of clients. The release of confidential information as a result of a security breach, human error, or otherwise could also lead to litigation or other proceedings against us by affected individuals or business partners, or by regulators, and the outcome of such proceedings, which could include penalties or fines, could have a significant negative impact on our business.

Our operations in countries undergoing political change or experiencing economic instability are subject to uncertainty and risks that could materially adversely affect our business. These risks include, particularly but not limited to in emerging markets, the possibility we would be subject to undeveloped or evolving legal systems, unstable governments and economies, impacts from geopolitical conflicts, and potential governmental actions affecting the flow of goods, services, currency and particular sectors or entities.

We are exposed to various risks arising out of natural disasters, including earthquakes, hurricanes, fires, floods, droughts, tornadoes, extreme weather, or other climate events; pandemic health events (such as the COVID-19 pandemic), and human-caused disasters, including acts of terrorism, civil unrest, violence, military actions, and cyber-terrorism (including, but not limited to, ransomware). The continued threat of terrorism and other events or disasters may cause significant volatility in global financial markets, and a natural or human-caused disaster could trigger energy shortages, public health issues, or an economic downturn or instability in the areas directly or indirectly affected by the disaster. These consequences could, among other things, result in a decline in business and increased claims from those areas. They could also result in reduced underwriting capacity, making it more difficult for our professionals to place business. Disasters also could disrupt public and private infrastructure, including communications and financial services, which could disrupt our normal business operations and negatively impact the abilities of our counterparties to pay for our services on time or at all. If access to underwriting markets for certain lines of coverage becomes unavailable or difficult due to the impact of climate change on the claims environment, this may have a negative impact on our clients' access to coverage, which could in turn reduce our ability to place certain lines of coverage and negatively impact our business. A natural or human-caused disaster also could disrupt the operations of our counterparties or result in increased prices for the products and services they provide to us. In addition, a disaster could adversely affect the value of the assets in our investment portfolio. Finally, a natural or human-caused disaster could increase the incidence or severity of E&O claims against us. Climate change may increase the likelihood or severity of a natural or human-caused disaster.

Developing and implementing innovative strategies, efficient business practices, and new solutions to current and emerging client needs is important to our business. We may be unsuccessful in developing innovative strategies, or our competitors may be more successful in innovating and delivering services to meet new and existing client needs. Competitors may be able to innovate faster and respond better to evolving client demand and industry conditions, or may price their products in a more attractive manner. Further, new and non- traditional competitors (including "InsurTech" firms utilizing artificial intelligence or other advanced technologies), our clients' increasing ability and determination to self-insure, and capital market alternatives to traditional insurance and reinsurance markets create an even more dynamic, competitive, and innovative market environment that could affect our business. If we are unsuccessful in innovating, if we cannot innovate as quickly as our competitors, if we are not able to make sufficient investment in innovation, if new or existing competitors develop more cost-effective or efficient technologies or cause disintermediation (including through the use of artificial intelligence or other emerging technologies), or if our ideas are not accepted in the marketplace, it could have a material adverse effect on our ability to obtain and complete client engagements or on our financial condition and results of operations. For example, we have invested significantly in Aon Business Services and the development of proprietary data and analytics tools including repositories of our global insurance and reinsurance placement information, which we use to help drive results for our clients in the insurance and reinsurance placement process. Our competitors have developed or are developing competing data and analytics tools, and their success in this space may impact our ability to differentiate our own data and analytics tools. Innovations in software, cloud computing, data and analytics, generative and agentic artificial intelligence, or other technologies that alter how our services are delivered could significantly undermine our investment in the business if we are slow to innovate or unable to take advantage of these developments. In addition, innovation in the technology we leverage in our products and business processes, our capabilities, the sources of capital for our clients' insurance and reinsurance needs, and the entry into new lines of business, services, or products require significant investment and present additional risks to our business, particularly in instances where the technologies and markets are new or developing or where we are new participants in such markets. Such risks include without limitation the investment of significant time and resources; the possibility that these efforts will not be successful or result in reputational damage to us; the possibility that the marketplace does not accept our products or services or that we are unable to retain clients that adopt our new products or services; the risk that our governance process and controls in these new areas may not be effective or consistent with legal, regulatory, or client requirements or expectations and the risk of new or additional liabilities associated with these efforts, including potential E&O or other claims. For example, we continue to invest in artificial intelligence, particularly in generative artificial intelligence tools, and maintain governance and oversight measures regarding its use. Certain use cases of artificial intelligence in our business processes could pose strategic, operational, legal, ethical, regulatory or reputational risks where there may be incorrect outputs or bias in those systems or processes, potential infringement of intellectual property rights, exposure of proprietary or personal information, heightened cybersecurity risks and challenges in safely deploying, governing or controlling artificial intelligence systems or where there is inadequate human oversight.

We depend, in material part, upon the members of our senior management team who possess extensive knowledge and a deep understanding of our business and our strategy, as well as the colleagues who are critical to developing and retaining client relationships. The unexpected loss of services of any of these senior leaders could have a disruptive effect adversely impacting our ability to manage our business effectively and execute our business strategy. Additionally, competition for professional personnel remains intense, and competitors are using increasingly aggressive measures to recruit professional talent in our industry. We are constantly working to attract, develop, and retain these professionals. If we cannot successfully do so, our business, operating results, and financial condition could be adversely affected. We have been and may continue to be involved in disputes and litigation in connection with our efforts to retain and hire personnel, which can be disruptive to our business, distractive to management, costly, and may expose us to potential liability for monetary damages or reputational damage. If our succession and long-term compensation plans and programs for our senior management team and critical colleagues do not operate effectively or we are required to change these plans or programs, our business could be adversely affected. We strive to maintain an equitable work environment that unlocks the full potential of all of our personnel. This includes our focus on colleague wellness, mental health and belonging, and building a flexible work environment that meets colleague and client needs. If we are unsuccessful in maintaining such a work environment or adapting to colleague needs or expectations, we could experience difficulty attracting and retaining personnel, which could have a negative impact on our business.