Conduent (CNDT) Risk Analysis

As a leader in business process solutions, we leverage cloud computing, AI, machine learning and advanced analytics. We act as a trusted business partner in both front-office and back-office platforms, providing interactions on a substantial scale with our customers and other third-parties. Our customers include global commercial clients and government clients who depend upon our operational efficiency, non-interruption of service, and accuracy and security of information. We also use third-party providers such as subcontractors, software vendors, utility providers and network providers, upon whom we rely to support our business process solutions, to deliver uninterrupted, secure service. As part of our business process solutions, we also develop system software platforms necessary to support our customers' needs, with significant ongoing investment in developing and operating customer-appropriate operating systems, databases and system software solutions. We also receive, process, transmit and store substantial volumes of information relating to identifiable individuals, both in our role as a solution provider and as an employer, and we are subject to numerous laws, rules and regulations in the United States (both federal and state) and foreign jurisdictions designed to protect both individually identifiable information as well as personal health information. We also receive, process and implement financial transactions, and disburse funds, on behalf of both commercial and government customers, which activity includes receiving debit and credit card information to process payments due to our customers as well as disbursing funds to payees of our customers. As a result of these and other business process solutions, the integrity, security, accuracy and non-interruption of our systems and information technology and that of our third-party providers and our interfaces with our customers are extremely important to our business, operating results, growth, prospects and reputation. We have in the past been, and remain, susceptible to breach of security systems which may result and has resulted in unauthorized access to our facilities and those of our customers and/or access to and exfiltration of the information we and our customers are trying to protect. Cybersecurity failure might be caused by computer hacking, compromised credentials, malware, computer viruses, worms, trojans, ransomware and other destructive software, "cyber-attacks" and other malicious activity, as well as natural disasters, power outages, terrorist attacks and similar events. Operational or business delays may also result from the disruption of network or information systems and subsequent remediation activities. Because the techniques used to obtain unauthorized access are constantly changing and becoming increasingly more sophisticated and often are not recognized until launched against a target, we or our third-party service providers may be unable to anticipate these techniques or implement sufficient preventative measures. Unauthorized access, hacking, malware, phishing, viruses, worms, trojans, ransomware and other "cyber-attacks" have become more prevalent, have occurred in our systems in the past, and may occur in our systems in the future. Our cyber practices and cybersecurity systems may prove to be inadequate and result in the disruption, failure, misappropriation or corruption of our network and information systems and it may not be possible for us to fully or timely know if or when such incidents arise, or the full business impact of any cybersecurity breach. Additionally, with advances in computer capabilities and data protection requirements to address ongoing threats, we may be required to expend significant capital and other resources to protect against potential security breaches or to alleviate problems caused by security breaches. Moreover, employee error or malfeasance, faulty password management or other irregularities may result in a defeat of our or our third-party service providers' security measures and a breach of our or our third-party service providers' information systems (whether digital, cloud-based or otherwise). In addition, the increased use of employee-owned devices for communications as well as work-from-home arrangements, present additional operational risks to our information technology systems, including, but not limited to, increased risks of cyber-attacks. We have in the past experienced, and in the future could experience, an unauthorized party gaining physical access to one of our or one of our third-party service providers' facilities or gain electronic access to our or one of our third-party service providers' information systems. For example, on January 13, 2025, the Company experienced an operational disruption and learned that a threat actor gained unauthorized access to a limited portion of the Company's environment and exfiltrated a set of files associated with a subset of the Company's clients. For additional information, refer to Management's Discussion and Analysis of Financial Condition and Results of Operation – "Cyber Event" in Part II, Item 7 to this 10-K and Note 15 – Contingencies and Litigation to our Consolidated Financial Statements of Part II, Item 8 to this 10-K. This and any other such access could result in, among other things, unfavorable publicity and significant damage to our brand, governmental inquiry, oversight and possible regulatory action, difficulty in marketing our services, loss of existing and potential customers, allegations by our customers that we have not performed our contractual obligations, costs for contractual service level requirements or other financial impact experienced by customers, litigation by affected parties and possible financial obligations for substantial damages related to the theft or misuse of such information, any of which could materially adversely affect our results of operations and financial condition. Similar consequences may arise if sensitive or confidential information is misdirected, lost or stolen during transmission or transport, or is stolen or misused. Moreover, security breaches have and could require us to devote significant management resources to address the problems created by the security breach and to expend significant additional resources to upgrade further the security measures that we employ to guard such personal information against "cyber-attacks" and to maintain various systems and data centers for our customers. Often these systems and data centers must be maintained worldwide and on a 24/7 basis. We have in the past experienced and in the future could experience service interruptions that could result in curtailed operations and loss of existing and potential customers, which could significantly reduce our revenues and profits in addition to significantly impairing our reputation. If our information systems and our back-up systems are damaged, breached or cease to function properly, we may have to make a significant investment to repair or replace them, and we may suffer interruptions in our operations in the interim, each of which could materially adversely affect our results of operations and financial condition. In addition, our and our customers' systems and networks are subject to continued threats of terrorism, which could disrupt our operations as well as disrupt the utilities and telecommunications infrastructure on which our business depends. To the extent any such disruptions were to occur, our business, operating results and financial condition could be materially adversely affected. In addition, our liability insurance, which includes cyber insurance, might not be sufficient in type or amount to cover us, or the carrier may decline to cover us, against claims related to security incidents, cyberattacks and other related incidents.

Artificial intelligence ("AI") technologies create specific risks that require tailored governance and review. Insufficient oversight could lead to legal liability, financial loss, and reputational harm. We use AI to sort, organize, analyze, and generate data for business purposes. AI encompasses machine learning, generative AI, and other data processing techniques. The utilization of AI, whether implemented directly by us or in collaboration with third parties, will necessitate ongoing investment in governance and security resources to help ensure our responsible use of AI and to safeguard against potential risks and vulnerabilities. As these technologies evolve, some services and tasks currently performed by our associates may be replaced by automation, including AI-enabled solutions, which could lead to reduced demand for our services and/or reduce the required headcount for us to provide services. The use of AI carries considerable risks, and we cannot guarantee the achievement of intended outcomes. While we aim to develop and use AI responsibly and attempt to identify and mitigate ethical and legal issues presented by its use, we may be unsuccessful in identifying or resolving issues before they arise. As an evolving technology, AI may occasionally produce incomplete or misleading results. Despite training and risk management efforts, there is a possibility that employees might misuse AI, either intentionally or unintentionally. Should our AI generate suboptimal or contentious outcomes, or if public perception of AI shifts negatively due to perceived risks, we may encounter operational challenges, competitive disadvantages, legal liabilities, reputational harm, or other business impacts. AI-related legal and regulatory frameworks are evolving due to concerns about bias, discrimination, transparency, and security. The use of AI technologies involves issues associated with intellectual property, data privacy, consumer protection, competition, and equal opportunity, with potential for new regulations. Several jurisdictions where we operate are considering or have proposed or enacted legislation and policies regulating AI and non-personal data, such as the European Union's AI Act and the U.S.'s Executive Orders and U.S. state laws, some of which may be conflicting. New or expanded AI laws could raise compliance costs and pose unpredictable risks, which could materially adversely affect our results of operations and financial condition.

We are potentially subject to various contingent liabilities that are not reflected on our balance sheet, including those arising as a result of being involved in a variety of claims, lawsuits, investigations and proceedings concerning: securities laws; governmental and non-governmental entity contracting, servicing and governmental entity procurement laws; intellectual property laws; environmental laws; employment laws; the Employee Retirement Income Security Act of 1974 ("ERISA"); cyber-security and data privacy laws; and other laws, regulations and contractual undertakings, as discussed under Note 15 – Contingencies and Litigation to the Consolidated Financial Statements. If developments in any of these matters cause a change in our determination as to an unfavorable outcome and result in the need to recognize a material accrual or materially increase an existing accrual, or if any of these matters result in an adverse judgment or are settled for significant amounts above any existing accruals, it could materially adversely affect our results of operations and financial condition in the period or periods in which such change in determination, judgment or settlement occurs. There can be no assurances as to the favorable outcome of any claim, lawsuit, investigation or proceeding. It is possible that a resolution of one or more such proceedings, through judgment, settlement or otherwise, could require us to make substantial payments to satisfy judgments, fines or penalties or settlement amounts, any of which could materially adversely affect our results of operations and financial condition. Additionally, the terms of dismissal, settlement, release or other resolution may permit certain claims to be reopened under certain conditions. Claims, lawsuits investigations and proceedings involving the Company could also result in reputational harm, criminal sanctions, consent decrees or orders preventing us from offering certain services, requiring a change in our business practices in costly ways or requiring development of non-infringing or otherwise altered products or technologies, or make it more difficult to obtain adequate insurance in the future. In addition, it can be very costly to defend litigation and these costs could materially adversely affect our results of operations and financial condition. Refer to Note 15 – Contingencies and Litigation to the Consolidated Financial Statements. Our insurance does not cover all types and amounts of potential liabilities and is subject to various exclusions as well as caps on amounts recoverable. Even if we believe a claim is covered by insurance, insurers may dispute our entitlement to recovery for a variety of potential reasons, which may affect the timing and, if they prevail, the amount of our recovery.

We monitor U.S. and non-U.S. tax law changes that may adversely impact our overall tax costs. From time to time, proposals have been made and/or legislation has been introduced to change tax rates, as well as related tax laws, regulations or interpretations thereof, by various jurisdictions, or to limit tax treaty benefits which, if enacted or implemented, could materially increase our tax costs and/or our effective tax rate and could have a material adverse impact on our financial condition and results of operations. In addition, we are subject to the examination of our income tax returns by the United States Internal Revenue Service and other tax authorities around the world. We regularly assess the likelihood of adverse outcomes resulting from these examinations to determine the adequacy of its provision for income taxes. There can be no assurance that the outcomes from these examinations will not have an adverse effect on our provision for income taxes and cash tax liability.

We receive, process, transmit and store information relating to identifiable individuals, both in our role as a service provider and as an employer. As a result, we are subject to numerous laws and regulations in the United States (both federal and state) and foreign laws and regulations designed to protect both individually identifiable information and personal health information, including the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), and the regulations promulgated under HIPPA governing, among other things, the privacy, security and electronic transmission of individually identifiable health information, various state privacy laws, and the European Union General Data Protection Regulation ("GDPR"), which imposes stringent data protection requirements and significant penalties for non-compliance and has had a significant impact on how we process and handle certain data. Additional laws of the United States (both federal and state) and foreign jurisdictions apply to our processing of individually identifiable information. These laws have been subject to frequent changes, and new legislation in this area may be enacted at any time. For example, the GDPR and the invalidation of the U.S.-EU Safe Harbor regime have required us to implement alternative mechanisms for some of our data flows from Europe to the United States to comply with applicable law. Changes to existing laws, the introduction of new laws in this area or our failure to comply with existing laws that are applicable to us may subject us to, among other things, additional costs or changes to our business practices, liability for monetary damages, fines and/or criminal prosecution, unfavorable publicity, restrictions on our ability to obtain and process information and allegations by our customers and clients that we have not performed our contractual obligations, any of which could materially adversely affect our results of operations and financial condition.

Our ability to service our customers and clients and deliver and implement solutions depends to a large extent on third-party providers such as subcontractors, a relatively small number of primary software vendors, software application developers, utility providers and network providers meeting their obligations to us and our expectations in a timely, quality manner. Our results of operations and financial condition have been and in the future may be materially adversely affected and we might incur significant additional liabilities if any of our third-party providers (i) do not meet their service level obligations, (ii) do not meet our or our clients' expectations, (iii) terminate or refuse to renew their relationships with us, or (iv) offer their products to us with less advantageous prices and other terms than previously offered.

To stay competitive in our industry, we must keep pace with changing technologies and customer preferences. Many of our contracts require us to design, develop and implement new technological and operating systems for our customers. Many of these systems involve detailed and complex computer source code which must be created and integrated into a working system that meets contract specifications. The accounting for these contracts requires judgment relative to assessing risks, estimating costs to fulfill the contract and making assumptions for schedule and technical issues. To varying degrees, each contract type involves some risk that we could underestimate the costs and resources necessary to fulfill the contract. In each case, our failure to accurately estimate costs or the resources and technology needed to perform our contracts or to effectively manage and control our costs during the performance of our work could result, and in some instances has resulted, in reduced profits or in losses. In addition, many of our contracts contain complicated performance obligations, including, without limitation, designing and building new integrated computer systems. These contracts carry potential financial penalties or could result in financial damages or exposures if we fail to properly perform those obligations and have in the past resulted in and in the future could result in our results of operations and financial condition being materially adversely affected.

Our success depends on our ability to obtain adequate pricing for our services that will provide a reasonable return to our shareholders. Depending on competitive market factors, future prices we obtain for our services may decline from previous levels. If we are unable to obtain adequate pricing for our services, it could materially adversely affect our results of operations and financial condition. In addition, our contracts are increasingly requiring tighter timelines for implementation as well as more stringent service level metrics. This makes the bidding process for new contracts much more difficult and requires us to adequately consider these requirements in the pricing of our services. To meet the service requirements of our customers, which often includes 24/7 service, and to optimize our employee cost base, including our back-office support, we often locate our delivery service and back-office support centers in lower-cost locations, including several developing countries. Concentrating our centers in these locations presents several operational risks, many of which are beyond our control, including the risks of political instability, natural disasters, safety and security risks, labor disruptions, excessive employee turnover and rising labor rates. Additionally, a change in the political environment in the United States or the adoption and enforcement of legislation and regulations curbing the use of such centers outside of the United States could materially adversely affect our results of operations and financial condition. These risks could impair our ability to effectively provide services to our customers and keep our costs aligned to our associated revenues and market requirements. Our ability to sustain and improve profit margins is dependent on a number of factors, including our ability to continue to improve the cost efficiency of our operations through such programs as robotic process automation, to absorb the level of pricing pressures on our services through cost improvements, our ability to hire and retain employees in the current global labor markets and to successfully complete information technology initiatives. If any of these factors adversely materialize or if we are unable to achieve and maintain productivity improvements through restructuring actions or information technology initiatives, our ability to offset labor cost inflation and competitive price pressures would be impaired, each of which could materially adversely affect our results of operations and financial condition.