Icf International (ICFI) Risk Analysis

Our client relationships and professional reputation are key factors in maintaining and growing our business, revenue, and profit levels under contracts with our clients. We continually bid for and execute new contracts, and our existing contracts regularly become subject to re-competition and expiration. If we are not able to replace the revenue from these contracts, either through follow-on contracts or new contracts for those requirements or for other requirements, our revenue and operating results may be adversely affected. On the expiration of a contract, we typically seek a new contract or subcontractor role relating to that client to replace the revenue generated by the expired contract. There can be no assurance that those expiring contracts we are servicing will continue after their expiration, that the client will re-procure those requirements, that any such re-procurement will not be restricted in a way that would eliminate us from the competition (e.g., set asides for small businesses), or that we will be successful in any such re-procurements or in obtaining subcontractor roles. Any factor that diminishes client relationships and/or professional reputation with federal, state and local, and international government clients, as well as commercial clients, could make it substantially more difficult for us to compete successfully for new engagements and qualified employees. To the extent our client relationships and/or professional reputation deteriorate, our revenue and operating results could be adversely affected.

We must comply with laws, rules, and regulations that affect how we do business with our government clients and impose added costs on our business. Each government client has its own laws, rules, and regulations that affect its contracts. Some of the more significant laws and regulations affecting the formation, administration, and performance of U.S. government contracts include: - U.S. Federal Acquisition Regulation, as well as Cost Accounting Standards, and agency and department regulations analogous or supplemental to federal regulation;- U.S. Foreign Corrupt Practices Act;- U.S. Truthful Cost or Pricing Data Act (formerly known as the Truth in Negotiations Act);- U.S. Procurement Integrity Act;- U.S. Civil False Claims Act and the False Statements Act; and - U.S. laws, rules and regulations restricting (i) the use and dissemination of information classified for national security purposes, (ii) the exportation of specified products, technologies, and technical data, and (iii) the use and dissemination of sensitive but unclassified data. Any failure to comply with applicable federal, and/or state and local government laws, rules and regulations could subject us to civil and criminal penalties and administrative sanctions, including termination of contracts, repayment of amounts already received under contracts, forfeiture of profits, suspension of payments, fines, and suspension or debarment from doing business with federal and/or state and local government agencies and departments, any of which could adversely affect our reputation, our revenue, our operating results, and/or the value of our stock. In addition, the federal government and other governments with which we do business may change their procurement practices or adopt new contracting laws, rules, or regulations that could be costly to satisfy or that could impair our ability to obtain new contracts and reduce our revenue and profit, such as curtailing the use of services firms or increasing the use of firms with a "preferred status," such as small businesses. In addition to our U.S. operations, we also have a significant presence in key markets outside the U.S., including offices in the U.K., Belgium, India, and Canada. Failure to abide by laws, rules and regulations applicable to us because of our work outside the U.S., such as the U.K. Bribery Act and the European Union's ("E.U.") General Data Protection Regulation ("GDPR"), could have similar effects to those described above.

Government departments and agencies we work for, including non-U.S., U.S. federal, and many state and local government clients, review, audit and investigate our contract performance, pricing practices, cost structure, financial capability, and compliance with applicable laws, rules, and regulations. We have experienced growth in services related to disaster recovery in recent years, and those activities, by their nature, may become politicized and involve interaction with multiple tiers of national, state, territorial and local governments, subcontractors, and citizens that increase the risk of claims, audits, investigations, reviews, monitoring and litigation. Any of these reviews, audits and investigations could raise issues that have significant adverse effects, including, but not limited to, delayed payments, substantial adjustments to our previously reported operating results and substantial effects on future operating results. If a government review, audit, or investigation uncovers improper or illegal activities, we may be subject to civil and criminal penalties and administrative sanctions, including termination of contracts, repayment of amounts already received under contracts, forfeiture of profits, suspension of payments, fines, and suspension or debarment from doing business with government agencies and departments, any of which could adversely affect our reputation, our revenue, our operating results, and/or the value of our stock. In addition, we could suffer serious harm to our reputation and our stock price could decline if allegations of impropriety are made against us, whether true or not. Federal government audits have been completed on our incurred contract costs only through 2011 for our NIH-cognizant indirect rates and through 2015 for our USAID-cognizant indirect rates. Audits for costs incurred on work performed since then have not yet been completed. In addition, non-audit reviews may still be conducted on all of our government contracts, even for periods before 2011.

We and our vendors process increasingly large amounts of personal and sensitive personal data (collectively, "Personal Data") concerning our existing and potential employees, clients, client customers, vendors, or other third parties (collectively, "Data Subjects"), as well as handle confidential information on our clients' behalf. Therefore, we must ensure that we, as well as our vendors, can comply and demonstrate compliance with the various countries' and U.S. states' privacy and data protection laws, rules, and regulations (collectively, "Privacy and Data Protection Law(s)") in any location where we or our vendors process Data Subjects' Personal Data. Privacy and Data Protection Laws often vary significantly, and the changes to existing laws and adoption of new, more rigorous laws occurs on an increasing basis. For example, the GDPR requires us to meet stringent requirements regarding (i) our access, use, disclosure, transfer, protection, or other processing of Personal Data; and (ii) the ability of Data Subjects to exercise their related various rights such as to access, correct or delete their Personal Data. The 2018 California Consumer Privacy Act ("CCPA"), which went into effect January 2020, now imposes similar requirements. New privacy laws in California, Colorado, and Virginia will take effect in 2023, with others likely to follow. Several privacy bills have also been introduced in Congress. Key markets in the Asia-Pacific region have also recently adopted GDPR-like legislation, including China's new Personal Information Protection Law. Failure to meet Privacy and Data Protection Law requirements could result in significant civil penalties (including fines up to 4% of annual worldwide revenue under the GDPR) as well as criminal penalties. Privacy and Data Protection Law requirements also confer a private right of action in some countries, including under the GDPR. We may incur substantial costs associated with protecting Personal Data and maintaining compliance with the various Privacy and Data Protection Laws, including restrictions on international data transfers, in particular in light of the increasing scrutiny by supervisory authorities. These costs could adversely affect our results of operations. In addition, any inability, real or perceived, to adequately address privacy and data protection concerns, or to comply with applicable Privacy and Data Protection Laws, policies, industry standards, or contractual obligations could result in additional cost and liability to us, damage our reputation, negatively impact our ability to win new contracts or process Personal Data in certain geolocations, and otherwise adversely affect our business.

We have offices in the U.K., Belgium, India, China, and Canada, among others, and expect to continue to have international operations and offices, some of which are in economically developing countries that do not have a well-established business infrastructure. We also perform work in some countries where we do not have a physical office. Some of the countries in which we work have a history of political instability or may expose our employees and subcontractors to physical danger over and above pandemic-related risk. Expansion into selective new geographic regions requires considerable management and financial resources, the expenditure of which may negatively impact our results, and we may never see any return on our investment. Our international operations are subject to risks associated with operating in, and selling to and in, countries other than the U.S., that could, directly or indirectly, adversely affect our international and domestic operations and our overall revenue, profit, and operating results including, but not limited to: - Compliance with the laws, rules, regulations, policies, legal standards, and enforcement mechanisms of the U.S. and the other countries in which we operate, including bribery and anti-corruption laws, economic sanctions, trade restrictions, local tax and income laws, and local labor and employment laws, which are sometimes inconsistent;- Restrictions on the ability to repatriate profits to the U.S. or otherwise move funds;- Potential personal injury to personnel who may be exposed to military conflicts and other hostile situations in foreign countries;- Expropriation and nationalization of our assets or those of our subcontractors, and other inabilities to protect our property rights; and/or - Difficulties in managing and staffing such operations, including obtaining work permits or visas, identifying qualified local employees, operating according to different local labor laws and regulations, dealing with different local business cultures and practices, and collecting contract receivables. In addition, because of our work with international clients, certain of our revenues and costs are denominated in other currencies, then translated to U.S. dollars for financial reporting purposes. Our revenues and profits may decrease as a result of currency fluctuations and devaluations and limitations on the conversion of foreign currencies into U.S. dollars and in the conversion between foreign currencies. We may, from time to time, have forward contract agreements ("hedges") related to our operations in the U.K., to hedge the remeasurement between the Euro and the pound sterling. We recognize the changes in the fair value of the economic hedges in our results of operations. We cannot be sure that our hedges will be successful in reducing the risks to us of our exposure to foreign currency fluctuations and, in fact, the hedges may adversely affect our operating results. Presently, there is active armed conflict across the territory of Ukraine as a result of Russian invasion. The war has impacted member states of the E.U. in a variety of ways, including through their provision of weapons, humanitarian supplies, and substantial financial support to Ukraine, and their absorption of millions of Ukrainian and other refugees. While no E.U. member states have become active participants in the conflict, a number of them have greatly increased their defense preparations and investments, reflecting a wholesale shift in the security environment on the continent. It is not currently foreseen that an immediate diplomatic resolution to the conflict is likely. In such an environment, it is possible that E.U. spending priorities may shift suddenly, that our current programs could be disrupted, and that our future opportunities could be diminished.

We face various risks and uncertainties related to health epidemics, pandemics and similar outbreaks, including the global pandemic resulting from the outbreak of COVID-19 and its variants. These risks relate to, among other things, the demand for our services, the availability of our staffing and business partners, a possible slowdown of client decision-making as to our services, a significant deterioration of global supply chains and other business conditions, and a possible reprioritization of spending by our clients. We serve both government and commercial clients around the globe, with our services concentrated in the U.S. and Europe, both of which have experienced severe levels of COVID-19 illness. The effects of the pandemic on client needs, priorities, spending patterns and decision-making can have a material effect on our activity levels and revenues. The pandemic may also affect significant portions of our workforce, and that of our subcontractors and other suppliers and business partners, who may be unable to work effectively due to illness, lockdowns and quarantines, facility closures, travel restrictions, or other government actions and reasons in connection with the COVID-19 pandemic. As a result, our operations and operating results could be adversely affected by factors such as an inability to perform fully or efficiently on our contracts, and some of our costs may not be fully recoverable or be adequately covered by insurance. It is possible that the spread of new variants of COVID-19 or other infectious diseases may also cause delays in the willingness or ability of clients to perform, including making timely payments to us, and other unpredictable events. In addition, volatility in the global capital markets that may result from the pandemic and related business conditions could restrict our access to capital and/or increase our cost of capital. We continue to work with our stakeholders (including customers, employees, subcontractors and other suppliers and business partners) to assess, address and mitigate the impact of this global pandemic. While efforts have been made to curtail the pandemic, at this time given potential new variants, we cannot predict the continuing impact of the COVID-19 pandemic, but it could have a material adverse effect on our business, financial position, results of operations, and/or cash flows.

As part of our corporate strategy, we are attempting to leverage our advisory services to sell our full suite of services across the life cycle of a policy, program, project, or initiative and we are regularly searching for ways to provide new services to clients. In addition, we plan to extend our services to new clients, lines of business, and selected geographic locations, including outside the U.S., and to seek out cross-border opportunities. As we focus more on our delivery of a full range of consulting services from advisory through implementation and attempt to develop new services, clients, practice areas, and lines of business, these efforts could be unsuccessful and adversely affect our results of operations. Such growth efforts place substantial additional demands on our management and staff, as well as on our information, financial, cash flow, and administrative and operational systems. We may not be able to manage these demands successfully. Growth may require increased recruiting efforts, business development, and selling, marketing and other actions that are expensive and increase risk. We may need to invest more in our people and systems, controls, compliance efforts, policies, and procedures than we anticipate. Further, we may need to enhance or modify our systems or processes, or transition to more efficient or effective ones, and these changes and how we handle them may impact the business. Therefore, even if we do grow, the demands on our people and systems, controls, compliance efforts, policies, and procedures may adversely affect the quality of our work, our operating margins, and our operating results, at least in the short-term, and perhaps in the long-term. Efforts involving a different focus, new services, new clients, new practice areas, new lines of business, and increasing internationalization include risks associated with our inexperience and competition from mature participants in those areas. Our expansion of services may result in decisions that could harm our profit and operating results. In particular, implementation and improvement services often relate to the development, implementation, and improvement of critical infrastructure or operating systems that our clients may view as "mission critical". If we fail to satisfy the needs of our clients in providing these services, we could incur reputational damage and clients could claim significant costs and losses for which they could seek compensation from us.

Our success depends in part upon our internally developed technology and models, proprietary processes, and other intellectual property that we incorporate in our products and utilize to provide our services. If we fail to protect our intellectual property, our competitors could market services or products similar to our services and products, which could reduce demand for our offerings. Government clients typically retain a perpetual, worldwide, royalty-free right to use the intellectual property we develop for them in a manner defined within government regulations, including providing it to other government agencies or departments, as well as to our competitors in connection with their performance of government contracts. When necessary, we seek authorization to use intellectual property developed for the government or to secure export authorization. Government clients may grant us the right to commercialize software developed with government funding, but they are not required to do so. If we improperly use intellectual property that was even partially funded by government clients, these clients could seek damages and royalties from us, sanction us, and prevent us from working on future government contracts. Actions could also be taken against us if we improperly use intellectual property belonging to others besides our government clients. In addition, there can be substantial costs associated with protecting our intellectual property, which can also have an adverse effect on our results of operations.

The continued occurrence of high-profile data breaches of other companies provides evidence of an external environment hostile to information security. In particular, cybersecurity attacks are increasing in number and sophistication for the Company. We face a constant risk of cybersecurity threats, whether from deliberate attacks or unintentional events, including computer viruses, attacks by computer hackers, malicious code, cyber and phishing attacks, and other electronic security breaches such as unauthorized access to our and our clients' systems. Any of these could lead to disruptions in critical systems, unauthorized releases of confidential or otherwise protected information, and/or corruption of data. The so-called "insider threat," the introduction of unauthorized data and changes into systems by employees and contractors, is an increasingly present risk to be managed. As a federal government contractor, we face a heightened risk of a security breach or disruption with respect to personally identifiable, controlled unclassified information, classified, or otherwise protected data resulting from an attack by computer hackers, foreign governments, and/or cyber terrorists. Improper disclosure of this information could harm our reputation and affect our relationships with business partners, lead to legal exposure, or subject us to liability under laws, rules, and regulations that protect personal or other confidential data, resulting in increased costs or loss of revenue. Although we devote significant resources to our cybersecurity programs and have implemented security measures to protect our systems and to prevent, detect, and respond to cybersecurity incidents, we have been the target of these types of attacks in the past. We have not identified a material adverse impact on our business or our financial results, individually or in the aggregate, due to being the target of prior cyber-attacks. While we are committed to threat detection and mitigation efforts to reduce such impact, there can be no assurance that our efforts will prevent such attacks or their impact in the future. As these security threats continue to evolve, we may be required to devote additional resources to protect, prevent, detect, and respond against cybersecurity attacks, system disruptions and security breaches. Moreover, we also rely in part on third-party software and information technology vendors to run our information systems. Any failure of these third-party systems, which are outside of our control but still impact us, could have similar adverse effects.

Any interruption in our operations or any systems failures, including, but not limited to: (i) the inability of our staff to perform their work in a timely fashion, whether caused by limited access to and/or closure of our and/or our clients' offices or otherwise; (ii) the failure of network, software and/or hardware systems; and (iii) other interruptions and failures, whether caused by us, a third-party service provider, unauthorized intruders and/or hackers, computer viruses, natural disasters, power shortages, terrorist attacks or otherwise, could cause loss of data and interruptions or delays in our business or that of our clients, or both. In addition, the failure or disruption of mail, communications and/or utilities could cause an interruption or suspension of our operations or otherwise harm our reputation or business. Our property and business interruption insurance may be inadequate to compensate us for all losses that may occur as a result of any system or operational failure or disruption and, as a result, revenue, profits and operating results could be adversely affected.

Our business, which entails the provision of professional services to government and commercial clients, largely depends on our ability to attract and retain qualified employees who are often in demand. Additionally, as our business continues to evolve, as we acquire new businesses, and as we provide a wider range of services, we become increasingly dependent on the capabilities of our employees in order to meet the needs of our diverse client base. If we are unable to recruit and retain a sufficient number of qualified employees that are committed to our mission and vision, we may incur higher costs related to an increase in subcontractors, hiring, training and retention. We also rely on key senior members of management. As a result, effective succession planning is important to our long-term success. Failure to ensure effective transfer of knowledge and smooth transitions involving these key employees could hinder our strategic planning and execution as well as impair our ability to effectively serve our clients and maintain and grow our business. Such developments could adversely affect our future revenue and operating results.

We derive a portion of our revenue from contracts under which we act as a subcontractor or from "teaming" arrangements in which we and other contractors jointly bid on particular contracts, projects, or programs. As a subcontractor or team member, we often lack control over fulfillment of a contract. Poor performance on the contract, whether resulting from our performance or the performance of another contractor, could tarnish our reputation, result in a reduction of the amount of our work under, or termination of, that contract or other contracts, and cause us to not obtain future work, even when we perform as required. Moreover, our revenue, profit and operating results could be adversely affected if any prime contractor or teammate does not pay our invoices in a timely fashion, chooses to offer products or services of the type that we provide, teams with other companies to provide such products or services, or otherwise reduces its reliance upon us for such products or services.

It is important for us to accurately estimate and control our contract costs and maintain positive operating margins and profitability. As described elsewhere in this Form 10-K, we generally enter into three principal types of contracts with our clients: fixed-price, time-and-materials and cost-based. We derived 45%, 41%, and 35% of our revenue from fixed-price contracts in 2022, 2021, and 2020, respectively. Under fixed-price contracts, we receive a fixed price irrespective of the actual costs we incur and, consequently, we are exposed to a number of risks. We realize a profit on fixed-price contracts only if we can control our costs and prevent cost overruns while also meeting contract requirements. Fixed-price contracts require cost and scheduling estimates that are based on a number of assumptions, including those about future economic conditions, costs, and availability of labor, equipment and materials, and other exigencies. We could experience cost overruns if these estimates are inaccurate as a result of errors or ambiguities in the contract specifications or if they become inaccurate as a result of a change in circumstances following the submission of the estimate due to, among other things, unanticipated technical problems, difficulties in obtaining permits or approvals, changes in local laws or labor conditions, weather delays, or the inability of our vendors or subcontractors to perform. If cost overruns occur, we could experience reduced profits or, in some cases, a loss for that project. If a project is significant, or if there are one or more common issues that impact multiple projects, cost overruns could increase the unpredictability of our earnings, as well as have an adverse impact on our business and earnings.