H2O America (HTO) Risk Analysis

We maintain insurance coverage as part of our overall legal and risk management strategy to minimize potential liabilities arising from our operations. Our insurance programs have varying coverage limits, deductibles, exclusions and maximums, and our insurance coverages include: worker's compensation, employer's liability, damage to our property, general liability, pollution liability, cybersecurity, and automobile liability. Each policy includes either deductibles or self-insured retentions and policy limits for covered claims. As a result, we may sustain losses that exceed or are excluded from our insurance coverage or for which we are self-insured. The insurance companies may also seek to challenge, reduce or deny any claims we submit, which may prevent us from recovering fully the losses we incurred. In addition, insurance companies may increase premiums or deductibles or reduce coverage limits based on factors that are beyond our control, including industry trends, financial conditions of insurance companies and catastrophic events such as wildfire, earthquake and pandemic. There can be no assurance that we can secure all necessary or appropriate insurance in the future, or that such insurance can be obtained at reasonable cost, or at all.

Inflation has the potential to adversely affect our liquidity, business, financial condition and results of operations by increasing our overall cost structure, particularly if we are unable to achieve increases in the rates we charge our customers. There is no guarantee that any future rate increase requests will be approved and granted in a timely manner and/or will be sufficient to cover costs for the impact of high inflation. The existence of inflation in the economy has resulted in, and may continue to result in, higher interest rates and capital costs, shipping costs, supply shortages, increased costs of labor and other similar effects. As a result of inflation, we have experienced and may continue to experience, cost increases. Although we may take measures to mitigate the impact of this inflation, if these measures are not effective, our business, financial condition, results of operations and liquidity could be materially adversely affected. Even if such measures are effective, there could be a difference between the timing of when these beneficial actions impact our results of operations and when the cost of inflation is incurred.

The necessity for ongoing physical and technological security has resulted, and may continue to result, in increased operating costs. Because of physical and technological threats to the health and security of the United States of America, we employ procedures to review and modify security measures. We provide ongoing training and communications to our employees about threats to our water supply, our assets and related systems and our employees' personal safety. We have incurred, and will continue to incur, costs for security measures in efforts to protect against such risks.

Information technology is key to the operation of Water Utility Services, including but not limited to payroll, general ledger activities, outsourced bill preparation and remittance processing, providing customer service and the use of supervisory control and data acquisition systems to operate our distribution system. Among other things, system malfunctions, computer viruses and security breaches could prevent us from operating or monitoring our facilities, billing, and collecting cash accurately and timely analysis and reporting of financial results. In addition, we collect, process, and store sensitive data from our customers and employees, including personally identifiable information, on our networks. Despite our security measures, our information technology and infrastructure may be vulnerable to attacks by hackers or may be breached due to employee error, malfeasance, or other disruptions. Any such breach could compromise our networks, and the information stored there could be accessed without our authorization, publicly disclosed, lost, or stolen which could result in legal claims or proceedings, violation of privacy laws or damage to our reputation and customer relationships. Our profitability and cash flow could be affected negatively in the event these systems do not operate effectively or are breached. We also rely on third-party technology vendors for critical services, including data hosting and infrastructure support. A failure or breach by these vendors could also expose our systems and sensitive information to unauthorized access or disruption. Further, ransomware and other forms of disruptive or disabling cyber-attacks targeting utility systems and other infrastructure are continuously increasing in sophistication, magnitude and frequency, and may not be recognized until launched against a target. The use of artificial intelligence by cybercriminals may increase the frequency and severity of cybersecurity attacks, including against us or our third-party vendors. Accordingly, we may be unable to anticipate these techniques or to entirely eliminate this risk. In addition, we may not be able to develop or acquire information technology that is competitive and responsive to the needs of our business, and we may lack sufficient resources to make the necessary upgrades or replacements of our outdated existing technology to allow us to continue to operate at our current level of efficiency. These risks may escalate during periods of heightened geopolitical tension. In addition, we must comply with privacy laws such as The California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA"). The CCPA requires, among other things, covered companies to provide enhanced disclosures to California consumers and to afford such consumers certain privacy rights and consumer protections. The CCPA also establishes statutory damages for victims of data security breaches, and provides additional rights for consumers to obtain their data from any business that has their personally identifying information. We are anticipating updated and finalized implementing regulations under the CCPA that may impact our compliance obligations. We are also subject to other comprehensive state privacy laws with similar obligations, including the Connecticut Data Privacy Act and the Texas Data Privacy and Security Act. While some of these laws include limited exceptions for data collected by utilities, the exceptions generally do not remove all obligations imposed by the laws. Moreover, additional federal and state privacy and cybersecurity laws and regulations have been passed or may be passed in the future, and they may have potential compliance obligations that impact our operations depending on whether we fall under their scope. The effects of these laws have been significant, requiring us to modify our data processing practices and policies and to incur costs and expenses for compliance. Any actual or perceived noncompliance with applicable data privacy or cybersecurity laws may lead to investigations, claims, and proceedings by governmental entities and private parties, damages for breach, and cause us to incur other significant costs, penalties, and other liabilities, as well as harm to our reputation.

We face competition from other utilities and service providers which might hinder our growth opportunities and mitigate our future profitability. We face risks of competition from other utilities or other entities authorized by federal, state or local agencies to expand rate-regulated or contracted utility services. Once a state utility regulator grants a franchise to a public utility to serve a specific territory, that utility effectively has an exclusive right to service that territory. Although a new franchise offers some protection against competitors, the pursuit of franchises is often competitive, where new franchises may be awarded to utilities based upon competitive negotiation. Competing entities have challenged, and may challenge in the future, our applications for new franchises.

Water Utility Services is seasonal, thus quarterly fluctuation in results of operations may be significant. Rainfall and other weather conditions also affect Water Utility Services. Water consumption typically increases during the third quarter of each year when weather tends to be warm and dry. In periods of drought, if customers are encouraged or required to conserve water due to a shortage of water supply or restriction of use, revenue tends to be lower. Similarly, in unusually wet periods, water supply tends to be higher and customer demand tends to be lower, again resulting in lower revenues. Furthermore, certain lifestyle choices made by customers can affect demand for water. For example, a significant portion of residential water use is for outside irrigation of lawns and landscaping. If there is a decreased desire by customers to maintain landscaping for their homes or restrictions are placed on outside irrigation, residential water demand would decrease, which would result in lower revenues. Conservation efforts and construction codes, which require the use of low-flow plumbing fixtures and appliances, could diminish water consumption and result in reduced revenue. In addition, in time of drought, mandatory water conservation may become a requirement that impacts the water usage of our customers. While the impacts of conservation and drought may be mitigated by certain regulatory mechanisms that may apply, such regulatory mechanisms are subject to review and change by the Regulators. Accordingly, there could be no assurance that such regulatory mechanisms will offset the effects of any revenue losses or other adverse impacts to our operating results attributable to these fluctuations in customer demand.