WW Grainger (GWW) Risk Analysis

Grainger's contracts with federal, state and local government entities are subject to various and changing regulations related to procurement, formation and performance. In addition, Grainger's government contracts may provide for termination, reduction or modification by the government at any time, with or without cause. From time to time, Grainger is subject to governmental or regulatory investigations or audits related to its compliance with these rules and regulations. Violations of these terms, rules, and regulations could result in fines, criminal sanctions, the inability to participate in existing or future government contracting and other administrative sanctions. Any such penalties could result in damage to Grainger's reputation, increased costs of compliance and/or remediation and could adversely affect Grainger's financial condition and results of operations.

Grainger has established and publicly announced its Grainger Impact Program, including its efforts to eliminate waste, reduce its carbon footprint, improve workplace safety and foster a welcoming workplace. These statements reflect its current plans and are not guarantees that Grainger will be able to achieve them. Grainger's pursuit of or inability to update, achieve, or accurately report its goals could damage its reputation, financial performance, and growth, leading to increased scrutiny from customers, enforcement authorities, and other various stakeholders and potential risks such as reputational harm, lawsuits, or market access restrictions. Grainger's ability to achieve the objectives of the Grainger Impact Program is subject to numerous risks, some of which are outside of its control. For example, evolving climate-related regulations in multiple jurisdictions-such as stricter emissions limits, carbon disclosure mandates, and supply chain sustainability requirements-may require Grainger to adjust its operations and increase compliance investments. New environmental laws, regulations, and enforcement could strain Grainger's suppliers and result in increased compliance-related costs, which could result in higher product costs that are passed to Grainger. Furthermore, our customers may adopt procurement policies that include varying requirements that their suppliers should comply with, or they may seek to include such provisions or requirements in their procurement terms and conditions. Standards for tracking and reporting Grainger's activity, if any, related to the Grainger Impact Program continue to evolve. Grainger's selection of voluntary disclosure frameworks and standards, and the interpretation or application of those frameworks and standards, may change from time to time or differ from those of others. Methodologies for reporting applicable data may be updated and previously reported data may be adjusted to reflect improvement in availability and quality of third-party data, changing assumptions, changes in the nature and scope of Grainger's operations and other changes in circumstances. Grainger's processes and controls for reporting such matters across its operations and supply chain are evolving along with multiple disparate standards for identification, measurement, and reporting regulatory disclosure standards are or may become required by the SEC, European and other regulators (including, but not limited to, the EU Corporate Sustainability Reporting Directive, the EU Corporate Sustainability Due Diligence Directive, and other state or federal climate change disclosure requirements that may become effective), and such standards may change over time, which could result in revisions to Grainger's current goals, reported progress in achieving such goals, or ability to achieve such goals in the future. If Grainger's practices do not meet evolving government, investor or other stakeholder expectations and standards, then Grainger's reputation or its attractiveness as an investment, business partner, product or service provider or employer could be negatively impacted, and Grainger could be subject to litigation or regulatory proceedings.

Through Grainger's sales and digital channels, as well as its ordinary course of business, Grainger collects and stores personally identifiable, confidential, proprietary and other information from customers, team members, suppliers, website visitors, and other entities or individuals so that they may, among other things, purchase products or services, enroll in promotional programs, register on Grainger's websites or otherwise communicate or interact with Grainger. Grainger's operations routinely involve receiving, storing, processing and transmitting sensitive information pertaining to its business, customers, suppliers and team members, and other sensitive matters. Cybersecurity threats are rapidly evolving and the means for obtaining unauthorized access to information systems and data are becoming increasingly sophisticated, including through the use of artificial intelligence to enhance social engineering and other techniques. Threat actors may attempt to access the information stored in Grainger's information systems or the information systems of Grainger's third-party business partners. Loss of customer, supplier, and team member information, intellectual property or other business information, or failure to comply with data privacy and security laws, or failure to maintain systems or software, could, for example, disrupt operations, damage Grainger's reputation and expose Grainger to claims from customers, suppliers, financial institutions, regulators, payment card associations, team members and others, any of which could have a material adverse effect on Grainger, including its business strategy, financial condition and results of operations. If successful, incidents may expose Grainger to risk of loss or misuse of proprietary or confidential information or disruptions of business operations. Grainger's IT infrastructure also includes products and services provided by suppliers, vendors and other third-party business partners, and these third parties may experience cybersecurity threats, breaches, attacks, disruptions, and other incidents that could affect confidentiality, integrity or availability of systems and proprietary or confidential information. Grainger shares information with third parties in connection with the products and services they provide to the business. Although Grainger performs risk assessments on third parties where Grainger deems it appropriate to evaluate their security programs, such assessments may not identify all risks, and the confidentiality of data held or accessed by them may be compromised or their systems may be disrupted or interrupted by threat actors. Grainger, or its third-party business partners, may face cybersecurity threats and incidents which could include unauthorized access to information systems, business email compromise, misconfiguration of assets, exploitation of vulnerabilities, malware (including viruses and other malicious code), ransomware, denial-of-service attacks and other targeted or organized cyber-attacks. Cybersecurity incidents may also include team member failures, fraud, phishing or other social engineering attempts or other methods to cause confidential information, payments, account access or access credentials, or other data to be transmitted to an unintended recipient. Threat actors also may attempt to exploit vulnerabilities in software that is commonly used by companies in cloud-based services and bundled software. If successful, those attempting to penetrate Grainger's or its third-party business partners' information systems may misappropriate intellectual property or personally identifiable, credit card, confidential, proprietary or other sensitive customer, supplier, team member or business information, or cause systems disruption. Cybersecurity threats or cybersecurity incidents that impact Grainger's systems, or those of its third-party business partners, could have a material adverse effect on Grainger, including its business strategy, financial condition and results of operations. Such incidents could result in major disruptions to business operations, alteration or corruption of data or systems, costs related to remediation or the payment of ransom, and litigation including individual claims or consumer class actions, commercial litigation, administrative, and civil or criminal investigations or actions, regulatory intervention and sanctions or fines, investigation and remediation costs and possible prolonged negative publicity. While many of Grainger's agreements with these third parties include indemnification provisions, Grainger may not be able to recover sufficiently, or at all, under such provisions to adequately offset any losses it may incur. In addition, a Grainger team member, contractor or other third party with whom Grainger does business may attempt to circumvent security measures or otherwise access Grainger's information. Grainger's systems may have integrations with customer systems and a breach of Grainger's systems could be used as an attempt to gain illicit access to customer systems and information. There can be no assurance that any future incidents will not be material to Grainger's business, operations or financial condition. Techniques used to obtain unauthorized access or to sabotage systems change frequently and may not be recognized until they are launched against a target. Although Grainger has a dedicated Information Security team, Grainger may be unable to anticipate, detect or prevent these techniques or implement effective preventative measures in all circumstances. Security measures and efforts may not be effective in each instance and may be subject to human error or failures. Any breach of Grainger's security measures or any breach, error or malfeasance by its third-party business partners could cause Grainger to incur significant costs to respond to and remediate such incidents, including implementing additional safeguards and addressing impacts to customers, suppliers, team members and other parties whose information is compromised. Such a breach could also cause Grainger to make changes to its information systems and administrative processes to address security issues. Although Grainger maintains insurance coverage that may, subject to policy terms and conditions, cover certain aspects of cybersecurity risks, depending on the nature, scope and extent of any event, such insurance coverage may be insufficient to cover all losses. Grainger has not had an information security or cybersecurity incident deemed to be material to Grainger and Grainger has neither incurred any material net expenses nor been materially penalized or subject to any material settlement amounts with respect to such incident. However, there can be no assurance that a future breach or incident would not be material to Grainger's operations and financial condition. For further information regarding Grainger's cybersecurity risk management strategy and the Board's oversight role, see Part I, Item 1C: Cybersecurity of this Form 10-K.

As of December 31, 2025, Grainger's consolidated indebtedness was approximately $2.5 billion. The Company's indebtedness could, among other things, limit Grainger's ability to respond to rapidly changing business and economic conditions, require the Company to dedicate a substantial portion of its cash flows to the payment of principal and interest on its indebtedness, reducing the funds available for other business purposes, and make it more difficult to satisfy the Company's financial obligations as they come due during periods of adverse economic and industry conditions. The agreements governing Grainger's debt obligations and instruments contain representations, warranties, affirmative, negative and financial covenants, and default provisions. Grainger's failure to comply with these restrictions and obligations could result in a default under such agreements, which may allow Grainger's creditors to accelerate the related indebtedness. Any such acceleration could have a material adverse effect on Grainger's business, financial condition, results of operations, cash flows, and its ability to obtain financing on favorable terms in the future. In addition, Grainger may in the future seek to raise additional financing for working capital, capital expenditures, refinancing of indebtedness, share repurchases, dividends, corporate investments, mergers and acquisitions, joint ventures, or other general corporate purposes. Grainger's ability to obtain additional financing will be dependent on, among other things, the Company's financial condition, prevailing market conditions and numerous other factors beyond the Company's control. Such additional financing may not be available on commercially reasonable terms or at all. Any inability to obtain financing when needed could materially adversely affect the Company's business, financial condition or results of operations.

Grainger's products are purchased from more than 5,000 primary suppliers located in various countries around the world, not one of which accounted for more than 5% of total purchases in the year ended December 31, 2025. Disruptions in procuring sources of supply could occur due to factors beyond Grainger's control. These factors could include economic downturns, recessions, outbreaks of pandemic disease, natural or human induced disasters, cybersecurity attacks, extreme weather, geopolitical unrest, new, threatened or increased tariffs, trade issues and policies, detention orders or withhold release orders on imported products, labor problems or shortages experienced by Grainger's suppliers or others in the supply chain, transportation availability, staffing and cost, shortage of raw materials, supplier consolidation, unilateral product cost increases by suppliers of products in short supply, inflation and other factors, any of which could adversely affect a supplier's ability to manufacture or deliver products or could result in an increase in Grainger's product costs. Further, Grainger sources products from Asia and other areas of the world. This increases the risk of supply disruption due to the additional lead time required, distances involved, and the range of potential consequences of various geopolitical risks. If Grainger was unable to promptly replace sources of supply that become disrupted, there could be adverse effects on inventory levels, results of operations, customer relationships and Grainger's reputation. In addition, Grainger has strategic relationships with a number of vendors. In the event Grainger was unable to maintain those relations, there might be a loss of competitive pricing arrangements which could, in turn, adversely affect results of operations. For products sold in the U.S., Canada, Mexico and Japan, Grainger requires its suppliers and sub-suppliers, to comply with Grainger's Supplier Code of Ethics, or other similar responsible sourcing standards, as a condition of doing business with Grainger. Grainger's Supplier Code of Ethics focuses on four main areas of ethical sourcing: (i) human rights and labor standards (including prohibitions on child and forced labor); (ii) environment, health and safety; (iii) sanctions, trade, bribery and corruption; and (iv) privacy and information security. Grainger's Supplier Code of Ethics also addresses how to report potential Supplier Code of Ethics violations and related concerns. Grainger does not control its suppliers and their sub-suppliers, and neither Grainger nor its suppliers or other partners may be able to uncover all instances of noncompliance with Grainger's Supplier Code of Ethics and ethical and lawful business practices. Even an isolated incident, or the aggregate effect of individually insignificant incidents, can erode trust and confidence, particularly if they result in adverse publicity, governmental attention or investigations, product recalls, or litigation, and as a result, could tarnish Grainger's brand and lead to adverse effects on Grainger's business and results of its operations.

Market variables, such as inflation of product costs, labor rates, fuel, freight and energy costs, as well as geopolitical events, could negatively impact Grainger's ability to effectively manage its operating and administrative expenses. For example, geopolitical conflicts and related international responses have exacerbated, and may continue to exacerbate inflationary pressures, including increases in fuel and other energy costs. Additionally, climate-related policies, carbon pricing mechanisms, and regulations aimed at reducing emissions may increase energy and raw material costs, which could put additional pressure on Grainger's margins. Inflation may also reduce demand for products, resulting in lower sales volumes. In addition, Grainger's inability to pass on increases in costs to customers in a timely manner, or at all, could cause Grainger's operating and administrative expenses to grow more rapidly than net sales, which could result in lower gross profit margins and lower net earnings.