Advance Auto Parts (AWN) Risk Analysis

The amount, timing and execution of the Company's share repurchase program may fluctuate based on the Company's priorities for the use of cash for other purposes such as operational spending, capital spending, acquisitions or repayment or repurchase of debt. Changes in operational results, cash flows, tax laws and the Company's share price could also impact the Company's share repurchase program and other capital activities. The Company's ABL Facility contains restrictions on the Company's ability to increase its dividend to shareholders. Share repurchases are generally permitted under the ABL Facility; however, under certain circumstances, the Company's ability to repurchase shares may be limited or restricted. Additionally, decisions to return capital to stockholders, including through the Company's repurchase program or the issuance of dividends on the Company's common stock, remain subject to determination of the Company's Board of Directors that any such activity is in the best interests of the Company's stockholders and is in compliance with all applicable laws and contractual obligations. Item 1B. Unresolved Staff Comments.None.Item 1C. Cybersecurity.The Company has processes in place for assessing, identifying and managing risks from potential cyber threats and vulnerabilities. To protect the Company's information systems from cyber threats, the Company uses a variety of tools, controls, technologies, methods, systems and other processes that are designed to prevent, detect, escalate, investigate, mitigate and/or remediate data loss, theft, misuse, unauthorized access or other security incidents or vulnerabilities affecting information systems and data. Cybersecurity is a component of the Company's enterprise risk management ("ERM") framework and processes. The Company utilizes a range of capabilities to help identify and assess potential cyber threats and vulnerabilities, which feed into the development and regular updating of a risk mitigation plan to help manage the Company's cybersecurity risk posture. The Company evaluates cyber security risks on an ongoing basis across several categories in terms of probability of the likelihood and magnitude of potential impact, using evaluation results to inform areas of focus and prioritization. The Company evaluates risks associated with use of third-party providers through a lifecycle-based approach, conducting risk-based due diligence before engagement, using contractual provisions to apportion risk, and for certain third-party providers, engaging in architectural review and validation at the beginning of engagement. The Company uses third parties to assist with penetration testing, simulated attacks and survey and other threat intelligence reporting on third parties, as well as review and enhancement of associated response processes.The Company's cyber risk mitigation plan is reviewed on a quarterly cadence by a cross-functional Cyber Steering Committee, the managerial governing body that regularly reviews the top cyber risks to the Company and receives reports on progress on key cyber initiatives. The Company's Chief Information Security Officer ("CISO") leads the Cyber Steering Committee, which also includes individuals with experience identifying and managing enterprise risks, including the Company's President and Chief Executive Officer, Executive Vice President, Chief Financial Officer, Executive Vice President and General Counsel and Corporate Secretary as well as individuals with technical expertise in information technology, data governance and cyber matters and/or experience in managing cyber incident responses, including the Company's Chief Technology Officer, Senior Vice President, Information Technology Operations and Senior Vice President, Deputy General Counsel. The Internal Audit function assesses cyber security risks and audits components of cyber security on an annual basis. At least every three years, the Company uses an external party to evaluate the maturity of the program against the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.The Audit Committee of the Company's Board of Directors is charged with reviewing, discussing with management and overseeing the Company's information technology and cybersecurity risk. The Audit Committee receives reports on cybersecurity risk and management thereof at least semi-annually, and the full Board of Directors receives such reports at least annually. As of January 3, 2026, we are not aware of any instances of material cybersecurity incidents, including third-party incidents, that impacted the Company in the last three years.