Icon (ICLR) Risk Analysis

Our quarterly effective tax rate has depended and will continue to depend on the geographic distribution of our taxable earnings amongst the multiple tax jurisdictions (such as Ireland, United States and United Kingdom) in which we operate and the tax laws in those jurisdictions. Changes in the geographic mix of our results of operations amongst these jurisdictions may have a significant impact on our effective tax rate from quarter-to-quarter. Changes in tax law in one or more jurisdictions could also have a significant impact on our tax rate and results. In addition, as we operate in multiple tax jurisdictions, we may be subject to audits in certain jurisdictions. These audits may involve complex issues which could require an extended time period before being resolved. The resolution of audit issues may lead to additional taxes, interest as well as fines and/or penalties being imposed which could have a material adverse impact on our effective tax rate and our consolidated financial results. In terms of recent legislative changes which could potentially impact our effective tax rate, on July 4, 2025, the U.S. President signed into law the Budget Reconciliation Bill, which extends various expiring tax provisions from the 2017 Tax Cuts and Jobs Act and introduces a variety of other law changes. Our assessment is that it is not expected to have a material impact on our results of operations. We cannot predict the impact of any executive orders or regulatory changes that may become effective or enacted by the administration in the United States. In terms of a global minimum tax rate, the Organization for Economic Co-operation and Development's ("OECD") Global Anti-Base Erosion ("GloBE") Model Rules proposed a global minimum tax rate of 15% and recommended that it be effective from 2024. European Union member states adopted a global minimum tax in December 2022 and member states were obliged to implement the rules by December 31, 2023, which impact large multinational groups with a consolidated revenue of over €750 million. Although there is no assurance that every country in which ICON has a presence will implement GloBE, where a particular jurisdiction has a minimum effective tax rate of less than 15%, the head office location may be obliged to pay a top-up tax. Ireland has also implemented global minimum tax legislation which has been in force from 1 January 2024. The global tax environment is becoming increasingly complex and management continues to review the impact of a global minimum tax on the Company's financial performance. Further, regulatory or policy changes in geographies in which we operate may have a material adverse impact on our results of operations.

ICON has a strong privacy posture, driven by the implementation of a core privacy governance strategy and the adoption of policies and procedures designed to help ensure that ICON, including our employees and contractors, can comply with applicable data protection laws (including, but not limited to, the General Data Protection Regulation ("GDPR") (EU) 2016/679). Notwithstanding these measures, failure to comply with applicable data protection laws may occur and could result in increased risk of liability or increased costs to us or could limit our service offerings. Administrative fines: The GDPR introduced a regime of administrative fines for data protection infringements and provided for a tiered penalty structure based on the nature of the infringement. The EU supervisory authorities for the GDPR can directly impose fines on organizations found to be in breach of the GDPR. Lower tier administrative fines allow for fines of up to 2% of worldwide turnover of the group in the preceding financial year. Higher tier administrative fines allow for fines of up to 4% of worldwide turnover of the group in the preceding financial year. Higher tier administrative fines are more likely to be levied for major infringements of the GDPR and core data protection principles (e.g. transparency, data retention, accountability). Penalties: The GDPR also permits Member States to implement rules on other penalties applicable to infringements of the GDPR, in particular, for infringements which are not subject to administrative fines under the GDPR itself. Therefore, Member States may legislate for further fines or penalties that may be criminal in nature. Any fines levied under the GDPR must be effective, proportionate, and dissuasive. Supervisory authorities have been strengthening enforcement activities across the EU in recent years in respect of breaches of GDPR. The risk of fines and penalties under the GDPR carries increased risk of liability to ICON and can result in increased costs and disruption to the delivery of our services. Right to compensation of data subjects: In addition to the risk of administrative and criminal penalties, the GDPR also provides that any person who has suffered material or non-material damage as a result of an infringement of the GDPR shall have the right to receive compensation for the damage suffered, from the controller or processor responsible for the infringement. The level of award of damages is set by the competent court in the applicable EU Member State. This carries increased risk of liability for ICON. Corrective Powers of the supervisory authorities: Each supervisory authority across the Member States of the EU also has corrective powers. Supervisory authorities have the power to order ICON to bring processing operations into compliance with the provisions of the GDPR in a specified manner within a specified time period, or to impose a temporary or definitive limitation including a ban on processing, and to order the suspension of data flows to a recipient in a third country or to an international organization. Supervisory authorities also have powers to conduct audits and investigations of ICON and instruct ICON to take certain actions. The exercise of these powers by supervisory authorities has the potential to increase costs for ICON and cause disruption to the business and delivery of our services. The foundational principles of the GDPR have helped shape the development of many other privacy laws globally. Internationally, data protection laws continue to be introduced at a rapid rate, with greater protections afforded to personal data than ever before, and greater risk of liability to organizations processing that personal data. As a global organization, ICON must ensure that our privacy posture continues to adapt to these new laws and regulations. From a U.S. perspective, the confidentiality, collection, use and disclosure of personal data, including clinical trial patient-specific information, is regulated at the federal and state level. The Federal Trade Commission, or FTC, is an independent U.S. law enforcement agency charged with protecting consumers and enhancing competition across broad sectors of the economy. The FTC's authority with respect to data privacy and security comes from Section 5 of the FTC Act. The FTC uses its broad grant of authority to regulate data privacy and security, using including, but not limited to, requiring the implementation of comprehensive privacy and security programs, biennial assessments by independent experts, monetary redress to consumers, and provision of robust notice and choice mechanisms to consumers. Similar laws exist at the state level, which are used by state attorneys general to enforce against privacy and security-related acts or practices deemed to be unfair or deceptive. Certain U.S. states have adopted a comprehensive consumer privacy law or a consumer health data privacy law that regulates how certain businesses collect, use, and disclose the personal information of consumers residing in the state. In general, these laws provide for certain consumer privacy rights and impose transparency standards for business data collection and processing practices. These laws have broad exemptions for personal information that constitutes protected health information under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and de-identified health data as defined under HIPAA. As a result, we do not expect to have compliance obligations under these laws with respect to most patient information we collect and process. However, we are required to comply with these consumer privacy laws insofar as we collect other categories of consumers' personal information, which could include, for example, information about website visitors. These state consumer privacy laws are generally enforced by the respective state Attorney General. California's law also includes a private right of action for certain data breaches. Other states are currently considering similar consumer privacy laws, which could impact our operations if enacted. The U.S. federal administrative simplification regulations under HIPAA require individuals' written authorization, in addition to any required informed consent, before protected health information may be used for research (unless an institutional review board has waived the authorization requirement or another exception applies). We are directly regulated by HIPAA as a "business associate" because we obtain individually identifiable health information from "covered entity" third parties that are subject to such regulations. We can be directly liable to the covered entity contractually for mishandling protected health information and, under HIPAA's enforcement scheme, we can be subject to up to approximately $2.1 million per year in civil money penalties for multiple violations of the same HIPAA requirement in 2025. The per violation penalties and calendar year cap on penalties are adjusted annually for inflation under the Federal Civil Penalties Inflation Adjustment Act. Additional legislation or regulation of this type might, among other things, require us to implement new security measures and processes which may require substantial expenditures or limit our ability to offer some of our services. Additionally, if we violate applicable laws, regulations or duties relating to the use, processing or security of personal data, we could be subject to civil liability or criminal prosecution, be forced to alter our business practices or suffer reputational harm.

The CRO industry is highly competitive. In particular, we compete with other large global CROs for strategic relationships with large pharmaceutical companies. If we are unable to retain and renew existing strategic relationships and win new strategic relationships, there could be a material adverse impact on our results. Similarly, we compete with other CROs for work, which comes outside of these strategic relationships, and we may also compete with the Research and Development capabilities of our customers; being unable to win work outside of the strategic relationships could have a material adverse impact on our results. The type and depth of services provided by CROs has changed in recent years. Failure to develop and market new services or expand existing service offerings could adversely affect our business and operations. New entrants may also enter the market which would further increase competition and could adversely affect our business and operations. In addition, the emergence of the use of Real World Evidence and the advancements in new approaches such as machine learning and artificial intelligence (AI), including generative, agentic and foundation models that are increasingly accessible through third-party or open-source platforms, that capitalize on the availability of large data sets may reduce the time and costs of the discovery and development process, may allow our clients to more readily perform for themselves clinical development tasks and services that we have typically provided, may cause even greater price competition and/or reduce the perceived differentiation of certain of our information, analytics and insight-based offerings. If customers are able to obtain comparable insights through alternative AI-enabled solutions, develop such capabilities internally, or shift spending toward lower-cost providers, demand for certain of our services and offerings could decline, pricing pressure could increase, and our margins and growth prospects could be adversely affected which could have a material impact on our business, financial condition, results of operations or cash flows.

Sustainability matters continue to attract significant attention from stakeholders, including customers, investors, regulators, and ratings agencies. Companies are increasingly assessed on their sustainability performance and long-term practices. Customers may also impose specific sustainability-related requirements, and failure to meet these expectations could adversely affect our ability to win or retain business. Regulatory focus on sustainability matters is also increasing globally. This has resulted in the adoption of legal and regulatory requirements designed to mitigate the effects of climate change on the environment, as well as legal and regulatory requirements requiring climate, human rights and supply chain-related disclosures. If new laws or regulations are more stringent than current legal or regulatory requirements, we may experience increased compliance burdens and costs to meet such obligations. Our selection of voluntary disclosure frameworks and standards, and the interpretation or application of those frameworks and standards, may change from time to time or may not meet the expectations of investors or other stakeholders. Our ability to achieve our sustainability expectations and commitments is subject to numerous risks, many of which are outside of our control.

We continue to pursue business transformation initiatives to embed technology and innovation including through the use of AI and deliver operational efficiencies. As part of these initiatives, we seek to improve our productivity, flexibility, quality, functionality and cost savings by our on-going investment in global technologies, continuous improvement of our business processes and functions to deliver economies of scale. These initiatives may not deliver their intended gains or be completed in a timely manner which may adversely impact our competitiveness and our ability to meet our growth objectives and therefore, could adversely affect our business and operating results, including profitability.

As a result of the Restatement, the Investigation and related risks, our current directors' and officers' liability insurance ("D&O Insurance") providers may seek to increase premiums significantly, impose additional exclusions, or refuse to renew coverage altogether. In addition, we may face challenges in obtaining comparable coverage from alternative insurance carriers on commercially reasonable terms, or at all. A reduction in the scope or amount of D&O Insurance coverage could adversely affect our ability to attract and retain qualified directors and officers, and expose us to greater potential liability, which could have a material adverse effect on our financial condition, governance, and ability to operate our business.

We believe we are one of a small group of organizations with the capability and expertise to conduct clinical trials on a global basis. We believe that this capability to provide our services globally in most major and developing pharmaceutical markets enhances our ability to compete for new business from large multinational pharmaceutical, biotechnology and medical device companies. We have expanded geographically in the past and intend to continue expanding in regions that have the potential to increase our client base or increase our investigator and patient populations. However, emerging market operations may present several risks, including civil disturbances, health concerns, cultural differences such as employment, regulatory and business practices, compliance with economic sanctions laws and regulations, volatility in gross domestic product, economic and governmental instability, the potential for nationalization of private assets and the imposition of exchange controls. In addition, operating globally means the Company faces the challenges associated with coordinating its services across different countries, time zones and cultures. Changes in the political and regulatory environment in the markets in which we operate such as price, exchange controls or tariffs could impact our revenue and profitability and could lead to penalties, sanctions and reputational damages if we are not compliant with those regulations. Political uncertainty and a lack of institutional continuity in some of the emerging, developing or other countries in which we operate could affect the orderly operation of markets in these economies. In addition, in countries with a large and complicated structure of government and administration, national, regional, local and other governmental bodies may issue inconsistent decisions and opinions that could increase our cost of regulatory compliance and/or have a material adverse effect on our business. For instance, the U.S. has a complex and evolving framework of tariffs on imports from Canada, Mexico and China. The ongoing conflict in Ukraine has resulted in economic sanctions and export controls environment applicable to our business operations in the region (including Russia and Belarus) as a result of additional trade compliance measures, including those enacted by the United States, United Kingdom and European Union. These economic sanctions and export controls restrict our ability to do business with sanctioned entities, require additional compliance resources, and could have a material adverse effect on the results of our operations. We continue to monitor developments in other regions, including the Middle East and China, and will assess any impact of trade compliance measures, or other restrictions, on our business. Uncertainty of the legal environment could also limit our ability to enforce our rights. In certain emerging and developing countries, we enjoy less comprehensive protection for some of our rights, including intellectual property rights, which could undermine our competitive position. Proceedings to enforce our future patent rights, if any, in foreign jurisdictions could result in substantial cost and divert our efforts and attention from other aspects of our business. If any of the above risks or similar risks associated with our international operations were to materialize, our results of operations and financial condition could be materially adversely affected.

Our contracts with clients are sometimes denominated in currencies other than the currency in which we incur expenses related to such contracts. Where expenses are incurred in currencies other than those in which contracts are priced, fluctuations in the relative value of those currencies could have a material adverse effect on our results of operations. In addition, we are also subject to translation exposures as our consolidated financial results are presented in U.S. dollars, while the local results of a certain number of our subsidiaries are prepared in currencies other than U.S. dollars, including, amongst others, the pound sterling and the euro. Accordingly, changes in exchange rates between the U.S. dollar and those other currencies will affect the translation of subsidiary companies' financial results into U.S. dollars in reporting our consolidated financial results.