West Pharmaceutical Services (WPS) Risk Analysis
Risk Overview Q2, 2026
Source: the company's latest filing for the period ended Jun 30, 2026, filed Jul 23, 2026
Risk Change Over Time
- Cyber Security - Risk 1Unauthorized access to our or our customers' information and systems could negatively impact our business.
Our systems and networks, as well as those of our customers, suppliers, service providers, and banks, have been, or may in the future become the target of cyberattacks or information security breaches which, in turn, could result in the unauthorized release and misuse of confidential or proprietary information about our company, our employees or our customers, as well as disrupt our operations or damage our facilities or those of third parties. Attacks on information systems and networks are increasing in their frequency, levels of persistence, sophistication, and intensity, and they are being conducted by increasingly sophisticated and organized groups and individuals, including state-sponsored organizations, with a wide range of motives and expertise. For example, in May 2026, we experienced a material cybersecurity attack in which certain data was exfiltrated by an unauthorized party and certain systems were encrypted. Upon initial detection of an intrusion, we promptly activated our incident response protocols (including proactively taking systems offline globally for containment purposes), notified law enforcement, and engaged external cyber-forensic experts. The incident and our response temporarily disrupted our global operations. We have taken steps intended to mitigate the risk of dissemination of the exfiltrated data. This incident has been contained and our operations have fully recovered. Techniques used to gain unauthorized access to or to acquire data and systems, disable or degrade service, or sabotage systems, are constantly evolving (including through the use of artificial intelligence), and we are unable to anticipate all techniques or comprehensively avoid unauthorized access, acquisition of, or other adverse impacts to our data or our systems or the networks and systems of third parties upon which we rely. We may not discover all such incidents or activities or be able to respond or otherwise address them promptly, in sufficient respects or at all. Additionally, our systems are subject to regulations to preserve the privacy of certain data held on those systems. We maintain an extensive network of technical security controls, policy enforcement mechanisms and monitoring systems, in order to address these threats. While these measures are designed to prevent, detect and respond to unauthorized activity in our systems, certain types of attacks could result in financial or information losses and/or reputational harm. If we cannot comply with regulations or prevent the unauthorized access, release and/or corruption of our or our customers' confidential, classified or personally identifiable information, our reputation could be damaged, and/or we could face financial losses. An adverse impact to the availability, integrity, or confidentiality of our information technology systems or data, or the information technology systems or data of third parties upon which we rely, could require us to incur additional costs to modify or enhance our systems, or to try to prevent or remediate any such attacks. Modifying or enhancing our systems may result in unanticipated or prolonged disruption events, which could have a material adverse effect on our business and/or results of operations. The costs of mitigating data security risks could be significant and are likely to increase in the future. Although we carry cybersecurity insurance, there can be no assurance that our limits are sufficient to cover us against all potential losses for damages or fines in an amount exceeding our policy limits, or that applicable insurance will be available to us in the future on economically reasonable terms or at all.
Risk Highlights Q2, 2026
Risk Word Cloud
Risk Factors Full Breakdown - Total Risks 34
- Regulation - Risk 1We are subject to regulation by governments around the world, and if these regulations are not complied with, existing and future operations may be curtailed, and we could be subject to liability.
As a multinational corporation with operations and distribution channels throughout the world, we are subject to and must comply with extensive laws and regulations in the United States and other jurisdictions in which we have operations and distribution channels. For example, the design, development, manufacturing, marketing and labeling of certain of our products and our customers' products that incorporate our products are subject to regulation by governmental authorities in the U.S., Europe and other countries, including the FDA, the European Medicines Agency and the National Medical Products Administration (China). Complying with governmental regulation can be costly and can result in required modification or withdrawal of existing products and a substantial delay in the introduction of new products. Failure to comply with applicable regulatory requirements or failure to obtain regulatory approval for a new product could subject us to fines, sanctions or other penalties that could negatively affect our reputation, business, financial condition, and results of operations. The global nature of our business also means legal and compliance risks, such as anti-bribery, anti-corruption, fraud, trade, environmental, competition, privacy, and other regulatory matters, will continue to exist and additional legal proceedings and other contingencies will arise from time to time, which could adversely affect us. In addition, the adoption of new laws or regulations, or changes in the interpretation of existing laws or regulations, may result in significant unanticipated legal and reputational risks. Any current or future legal or regulatory proceedings could divert management's attention from our operations and result in substantial legal fees.
- Regulation - Risk 2Products that incorporate our technologies and medical devices that we produce are subject to regulations and extensive approval or clearance processes, which make the timing and success of new-product commercialization difficult to predict.
The process of obtaining and maintaining FDA and other required regulatory approvals is expensive and time-consuming. Historically, most medical devices that incorporate our technologies and medical devices that we produce have been subject to the FDA's 510(k) marketing approval process, which typically lasts from six to nine months. Supplemental or full pre-market approval reviews require a significantly longer period, delaying commercialization. Changes in regulation on a global scale must be monitored and actions taken to ensure ongoing compliance. Pharmaceutical products that incorporate our technologies and medical devices that we produce are subject to the FDA's New Drug Application process, which typically takes a number of years to complete. Additionally, biotechnology products that incorporate our technologies and medical devices that we produce are subject to the FDA's Biologics License Application process, which also typically takes a number of years to complete. Outside of the U.S., sales of medical devices and pharmaceutical or biotechnology products are subject to international regulatory requirements that vary from country to country. The time required to obtain approval for sale internationally may be longer or shorter than that required for FDA approval. There is no certainty that any regulatory approval may be obtained or maintained indefinitely, and our ability to launch products to the market and maintain market presence is not guaranteed.
- Regulation - Risk 3Changes in the regulation of drug products and devices may increase competitive pressure and adversely affect our business.
An effect of the governmental regulation of our medical devices and our customers' drug products, devices, and manufacturing processes is that compliance with regulations makes it difficult to change components and devices produced by one supplier with those from another supplier, due to the large amount of data and information that customers must generate to demonstrate that the components and devices are equivalent and pose no additional risk to the patient. The regulation of our medical devices and our customers' products that incorporate our components and devices has increased over time. If the applicable regulations were to be modified in a way that reduced the level of data and information needed to prove equivalency for a change from one supplier's components or devices to those made by another, it is likely that the competitive pressure would increase and adversely affect our sales and profitability.
- Regulation - Risk 4Failure to comply with anti-bribery, anti-corruption and anti-money laundering laws could subject us to penalties and other adverse consequences.
We are subject to the Foreign Corrupt Practices Act (the "FCPA"), the U.K. Bribery Act and other anti-bribery, anti-corruption, and anti-money laundering laws in various jurisdictions around the world. The FCPA, the U.K. Bribery Act and similar applicable laws generally prohibit companies, as well as their officers, directors, employees and third-party intermediaries, business partners and agents, from making improper payments or providing other improper things of value to government officials or other persons. We and our third-party intermediaries may have direct or indirect interactions with officials and employees of government agencies or state owned or affiliated entities and other third parties where we may be held liable for corrupt or other illegal activities, even if we do not explicitly authorize them. While we have policies and procedures and internal controls to address compliance with such laws, we cannot provide assurance that all of our employees and third-party intermediaries, business partners and agents will not take actions in violation of such policies and laws, for which we may be ultimately held responsible. To the extent that we learn that any of our employees or third-party intermediaries, business partners or agents do not adhere to our policies, procedures, or internal controls, we are committed to taking appropriate remedial action. In the event that we believe or have reason to believe that our directors, officers, employees or third-party intermediaries, agents or business partners have or may have violated such laws, we may be required to investigate or to have outside counsel investigate the relevant facts and circumstances. Detecting, investigating and resolving actual or alleged violations can be extensive and require a significant diversion of time, resources, and attention from senior management. Any violation of the FCPA, the U.K. Bribery Act or other applicable anti-bribery, anti-corruption and anti-money laundering laws could result in whistleblower complaints, adverse media coverage, investigations, loss of export privileges, and criminal or civil sanctions, penalties, and fines, any of which may adversely affect our business and financial condition.
See a full breakdown of risk according to category and subcategory. The list starts with the category with the most risk. Click on subcategories to read relevant extracts from the most recent report.