Greenbrier (GBX) Risk Analysis

There is no assurance that tax authorities will reauthorize, modify, or prevent the expiration of tax benefits, tax credits, or other policies aimed to incentivize the purchase of our products. If such incentives are discontinued or diminished, the demand for our products could decrease, thereby creating the potential for a material adverse effect on our financial condition or results of operations.

A substantial number of people are relying on social and other digital media to receive news, data, and information. Social and other digital media can be used by anyone to publish data and information without regard for factual accuracy. The use of social and other digital media to publish inaccurate, offensive, and disparaging data and information coupled with the frequent use of strong language and hostile expression, may influence the public's inability to distinguish between what is true and what is false and could obstruct an effective and timely response to correct inaccuracies or falsifications. Such use of social and other digital media could result in unexpected and unsubstantiated claims concerning our business in general or our products, our leadership or our reputation among customers and the public at large, thereby making it more difficult for us to compete effectively, and potentially having a material adverse effect on our business, operations, or financial condition.

Our company and the other participants in our industry are subject to regulation by governmental agencies. These authorities establish, interpret, and enforce rules and regulations for the railcar industry. New rules and regulations and shifting enforcement priorities of regulators could increase our operating costs and the operating costs of our customers. Changes to the process for obtaining regulatory approval in Europe for the operation of new or modified railcars may make it more difficult for us to deliver products timely and to comply with our sales contracts. We cannot guarantee that we or our suppliers will be in compliance at all times, compliance may prove to be more costly and limiting than we currently anticipate, and compliance requirements could increase in future years. If we or our suppliers fail to comply with applicable requirements and regulations, we could face sanctions and penalties that could negatively affect our financial results.

We are subject to income taxes in both the U.S. and foreign jurisdictions. Significant judgments and estimates are required to be made in determining our worldwide provision for income taxes. Changes in estimates of projected future operating results, loss of deductibility of items, recapture of prior deductions (including related to interest on convertible notes), limitations on our ability to utilize tax net operating losses in the future or changes in assumptions regarding our ability to generate future taxable income could result in significant increases to our tax expense and liabilities that could adversely affect our financial condition and profitability. We have in the past and may in the future take tax positions that the Internal Revenue Service (IRS) or other U.S. or foreign tax authorities may contest. We are required by an IRS regulation to disclose particular tax positions to the IRS as part of our tax returns for that year and future years. If the IRS or other tax authorities successfully contests a tax position that we take, we may be required to pay additional taxes, interest or fines that may adversely affect our results of operations and financial position. We may face other legal or regulatory actions by U.S. or foreign tax authorities contesting our tax positions that may cause management distraction and require us to incur costs to respond regardless of their outcome.

If our intellectual property rights are not adequately protected, we may not be able to commercialize our technologies, products or services and our competitors could commercialize them, which could result in a decrease in our sales and market share and could materially adversely affect our business, financial condition and results of operations. Conversely, third parties might assert that our products, services, technologies or other business activities infringe their patents or other intellectual property rights. Infringement and other intellectual property claims and proceedings brought against us, whether successful or not, could result in substantial litigation and judgment costs and harm our reputation.

We face attempts by malicious hackers, state-sponsored organizations, intruders and potential terrorists, as well as by bad actor employees or third-party service providers, to gain unauthorized access into our physical facilities, or introduce malicious software to our network or those of our customers to, among other things: steal proprietary information related to our business, products, employees, and customers; interrupt our systems and services or those of our customers; corrupt the processes used to operate our businesses and to design and manufacture our products; or demand ransom to return control of such systems and services. Such attempts are increasing in number and in technical sophistication, and if successful, would expose us and the affected parties to risk of loss or misuse of proprietary or confidential information, and could significantly disrupt our business operations. Our information technology infrastructure also includes products and services provided by third parties, and these providers can experience breaches of their systems and products that affect the security of our systems and our proprietary or confidential information. Our reliance on information technology increases to the extent working remotely increases among our employees. The theft, loss, or misuse of third-party data collected, used, stored, or transferred by us to run our business, and our attempts to address cybersecurity threats and incidents, whether or not successful, could result in our incurring significant costs related to, for example, disruptions in our operations, rebuilding internal systems, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, or taking other remedial steps with respect to third parties, as well as reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. While we seek to detect and investigate unauthorized attempts and attacks against our network, products, and services, and to prevent their recurrence where practicable through changes to our internal processes and tools, we remain potentially vulnerable to additional known or unknown threats. In some instances, we, our customers, and the users of our products and services can be unaware of an incident or its magnitude and effects. These risks can be further complicated by new and evolving government regulations and requirements for cybersecurity incident reporting, which can result in greater scrutiny of and demands on our incident detection, analysis, mitigation and remediation processes and procedures. In addition, global privacy legislation, enforcement, and policy activity in this area are rapidly expanding and creating a complex regulatory compliance environment. Costs to comply with and implement these privacy-related and data protection measures could be significant, and noncompliance could expose us to significant monetary penalties, damage to our reputation, and even criminal sanctions. Even our inadvertent failure to comply with federal, state, or international privacy-related or data-protection laws and regulations could result in audits, regulatory inquiries, or proceedings against us by governmental entities or other third parties.

We rely on information technology infrastructure and architecture, including hardware, network, software, people, processes and other infrastructure to provide useful and confidential information to conduct our business. In the ordinary course of business, we collect and store sensitive data and information, including our proprietary and regulated business information, that of our customers, suppliers and business partners, and personally identifiable information about our employees, as well as internal communications and exchanges with customers, suppliers, legal counsel, governmental agencies, and consultants. We depend on our information systems to successfully manage our business. We have taken steps to maintain adequate data security by implementing security technologies, internal controls, and network and data center resiliency and recovery processes. In addition, we continually evaluate and implement upgrades and significant changes to our information technology systems. We could experience problems in connection with such implementations, including compatibility issues, training requirements, higher than expected implementation costs and other integration challenges and delays; further, such implementations can require significant time and focus from management and other employees, which may divert attention from operating and growing our business. A significant problem with an implementation, integration with other systems or ongoing management and operation of our systems could negatively impact our business by disrupting operations. Such a problem could also have an adverse effect on our ability to generate and interpret accurate management and financial reports and other information on a timely basis, which could have a material adverse effect on our financial reporting system and internal controls and adversely affect our ability to manage our business. Furthermore, despite our efforts, our information systems and processes, like those of other companies, are susceptible to damage or interruption due to natural disasters, power loss, telecommunications failures, viruses, breaches of security, system upgrades or new system implementations, as well as the inability of these systems or processes to fulfill their intended purpose within our business. Any operational failure or breach of security could lead to the loss or disclosure of both our and our customers' financial, product and other confidential information, result in regulatory actions and legal proceedings, and/or have an adverse effect on our business and reputation.