Information Services Group (III) Risk Analysis

Our clients may decide at any time to abandon, postpone and/or reduce our involvement in an engagement. Our engagements can be terminated, or the scope of our responsibilities may be diminished, with limited advance notice. If an engagement is terminated, delayed or reduced unexpectedly, the professionals working on the engagement could be underutilized until we assign them to other projects. Accordingly, the termination or significant reduction in the scope of a single large engagement, or multiple smaller engagements, could harm our business results.

We provide services primarily in connection with significant or complex sourcing transactions and other matters that provide potential competitive advantages and/or involve sensitive client information. Our engagement by a client occasionally precludes us from staffing certain advisors on new engagements with other clients because the advisors have received confidential information from a client who is a competitor of the new client. Furthermore, it is possible that our engagement by a client could preclude us from accepting engagements with such client's competitors because of confidentiality concerns.

Our business involves the delivery of advisory and consulting services. Therefore, our continued success depends in large part upon our ability to attract, develop, motivate, retain and train skilled advisors and other professionals who have advanced information technology and business processing domain expertise, financial analysis skills, project management experience and other similar abilities.  These advisors could resign and join one of our competitors or provide sourcing advisory services to our clients through their own ventures. We must also recruit staff globally to support our services and products. We face competition for the limited pool of these qualified professionals from, among others, technology companies, market research firms, consulting firms, financial services companies and electronic and print media companies, some of which have a greater ability to attract and compensate these professionals. Moreover, increasing wage inflation may affect our profit margin as we strive to provide compensation packages that are competitive. We face risks related to global labor shortages, and competitive markets have increased attrition throughout our sector. Some of the personnel that we attempt to hire may be subject to non-compete agreements that could impede our short-term recruitment efforts. Any failure to retain key personnel or hire and train additional qualified personnel as required to support the evolving needs of clients or growth in our business could adversely affect the quality of our products and services, and our future business and operating results.

Artificial Intelligence ("AI") presents new risks and challenges that may affect our business. We have made, and expect to continue to make, investments to integrate AI and machine learning technology into our services. Given the nature of AI technology, we face significant competition from other companies and an evolving regulatory landscape. Our AI efforts may not be successful, and our competitors may incorporate AI into their products more successfully than us, which could impair our ability to compete effectively and adversely affect our financial results. The rapid evolution of AI combined with the uncertain and often inconsistent regulatory landscape may require significant additional resources and costs and could in some cases limit our ability to implement AI capabilities in our solutions or potentially result in the implementation failing to produce the desired outcome. Despite our implementation of programs designed to support responsible AI use and development, we may not successfully address all issues that may arise. For example, privacy concerns, user consent, supply chain security, transparency and the accuracy, completeness and suitability of data sets are all potential issues that could adversely affect our business, reputation or financial results.

We are dependent on information technology networks and systems to securely process, transmit and store electronic information and to communicate among our locations around the world and with our people, clients, alliance partners and vendors. As the breadth and complexity of this infrastructure continues to grow, because of the use of mobile technologies, social media and cloud-based services, the risk of security breaches and cyberattacks increases. Such breaches could lead to shutdowns or disruptions of or damage to our systems and those of our clients, alliance partners and vendors and unauthorized disclosure of sensitive or confidential information, including confidential or personal data. In addition, third party Cyber Security Risk is a critical focus for us. All potential new suppliers go through our Data Protection Impact Assessment ("DPIA") process. This starts with an initial screening questionnaire. The questionnaire covers what personal data and client data is processed, whether the third party has any access requirements to our environment and how is data is transferred. From this, our security team assesses the third party, conducts further due diligence, and reviews contractual clauses. If the risk assessment identifies that the baseline Information security & privacy technical and organizational controls are not met, the business will be advised accordingly. The outcome of all DPIAs is recorded on the DPIA register. All new third parties processing personal data or client data are assessed to be either Tier 1, 2 or 3, with Tier 1 being the highest risk in terms of data processed or interactions to our environment from a cyber security threat perspective.  Tier 1 and 2 third parties are recorded on our business-critical services register and reviewed annually, and we review the compliance documentation, such as latest ISO certifications, SOC2 reports and pen tests, of those Tier 1 and 2 third parties. Tier 3 third parties are recorded on the DPIA register, but no further due diligence is performed by the security team, as Tier 3 third parties process no client or personal data and have no access or integration to ISG's network or systems. As part of our continuous improvement in our third-party risk management process, we engage the services of a third-party risk monitoring service to monitor threat intelligence and known vulnerabilities. Although we seek to prevent, detect, and investigate cybersecurity threats and incidents, and have taken steps to mitigate the likelihood of network security breaches, there can be no assurance that attacks by unauthorized users will not be attempted in the future or that our security measures will be effective. Unauthorized disclosure of sensitive or confidential client data, whether through breach of our processes, systems or otherwise, could subject us to liability, damage our reputation and cause us to lose existing and potential clients. We may also be subject to civil actions and/or criminal prosecution by government or quasi-government agencies for breaches relating to such data. Our insurance coverage for breaches or mismanagement of such data may not continue to be available on reasonable terms or in sufficient amounts to cover one or more large claims against us.

Our success depends in part upon our ability to anticipate rapidly changing technologies and market trends and to adapt our advice, services and products to meet the changing sourcing advisory needs of our clients. Our clients regularly undergo frequent and often dramatic changes. That environment of rapid and continuous change presents significant challenges to our ability to provide our clients with current and timely analysis, strategies and advice on issues of importance to them. Meeting these challenges requires the commitment of substantial resources. Any failure to continue to respond to developments, technologies and trends in a manner that meets market needs could have an adverse effect on our business results.

Most of our service contracts with clients contain service level and performance requirements, including requirements relating to the quality of our services. Failure to consistently meet the service requirements of a client or errors made by our employees while delivering services to our clients could disrupt the client's business and result in a reduction in revenues or a claim for damages against us. Additionally,we could incur liability if a process we manage for a client was to result in internal control failures or impair our client's ability to comply with their own internal control requirements. Under our service agreements with our clients, our liability for breach of our obligations is generally limited to actual damages suffered by the client and is typically capped at the greater of an agreed amount or the fees paid or payable to us under the relevant agreement.  These limitations and caps on liability may be unenforceable or otherwise may not protect us from liability for damages. In addition, certain liabilities, such as claims of third parties for which we may be required to indemnify our clients or liability for breaches of confidentiality, are generally not limited under those agreements. Although we have general commercial liability insurance coverage, the coverage may not continue to be available on acceptable terms or in sufficient amounts to cover one or more large claims. The successful assertion of one or more large claims against us that exceed available insurance coverage or changes in our insurance policies (including premium increases or the imposition of large deductible or co-insurance requirements) could have a material adverse effect on our business.

Most of the data we use to populate our databases comes from our client engagements. The insight sought by clients from us relates to the contractual data and terms, including pricing and costs, to which we have access while assisting our clients in the negotiation of our sourcing agreements. Data is obtained through the course of our engagements with clients who agree to contractual provisions permitting us to consolidate and utilize on an aggregate basis such information. If we were unable to utilize key data from previous client engagements, our business, financial condition and results of operations could be adversely affected.