TerrAscend Corp (TSND) Risk Analysis

The Company's operations are subject to environmental and safety laws and regulations concerning, among other things, emissions and discharges to water, air and land, the handling and disposal of hazardous and non-hazardous materials and wastes, and employee health and safety. Changes in environmental, employee health and safety or other laws, more vigorous enforcement thereof or other unanticipated events could require extensive changes to the Company's operations or give rise to material liabilities, which could have a material adverse effect on the business, results of operations and financial condition of the Company.

The Company's success depends on its ability to attract and retain customers and patients. There are many factors which could impact the Company's ability to attract and retain customers and patients, including but not limited to the Company's ability to continually produce desirable and effective products and, the successful implementation of a customer and patient-acquisition plan. The Company's failure to acquire and retain customers and patients would have a material adverse effect on the Company's business, operating results and financial condition.

The Company's products may be subject to recalls or returns for a variety of reasons, including product defects such as contamination, unintended harmful side effects or interactions with other substances, packaging safety, inadequate or inaccurate labeling disclosure, or other reasons outside of the control of the Company. In certain circumstances, state regulators may change certain regulations after products are already in the market, that may require the Company to issue a recall. If any of the Company's products are recalled due to an alleged product defect or for any other reason, the Company could be required to incur the unexpected expense of the recall and any legal proceedings that might arise in connection therewith. The Company may lose a significant amount of sales and may not be able to replace those sales at an acceptable margin or at all, in addition to writing off a substantial amount of inventory or materials. Additionally, a product recall may require significant management attention. Although the Company has detailed procedures in place for testing its products, there can be no assurance that any quality, potency or contamination problems will be detected in time to avoid unforeseen product recalls, regulatory action or lawsuits. If one of the products produced by the Company were subject to a recall, the image of that product and the Company could be harmed. A recall for any of the foregoing reasons could lead to decreased demand for the Company's products and could have a material adverse effect on the results of operations and financial condition of the Company. Additionally, product recalls may lead to increased scrutiny of the Company's operations by regulatory agencies, requiring further management attention and potential legal fees and other expenses.

The success of the Company is dependent upon the ability, expertise, judgment, discretion and good faith of its senior management, which are key personnel. Moreover, the Company's future success depends on its continuing ability to attract, develop, motivate and retain highly qualified and skilled employees. Qualified individuals are in high demand, and the Company may incur significant costs to attract and retain them. The Company does not maintain "key man" insurance policies on the lives of its key personnel, or the lives of any of its other employees. In order to induce valuable employees to continue their employment with the Company, the Company has provided certain key personnel stock options and restricted stock units that vest over time. The value to employees of such equity grants that vest over time is significantly affected by movements in the price of the Common Share that are beyond the Company's control, and may at any time be insufficient to counteract more lucrative offers from other companies. The Company is limited in its ability to address declines in the value of employee equity grants in an effort to retain key personnel, Should the Company pursue any stock option re-grant or re-pricing efforts, such efforts may not be approved by the Company's shareholders or the stock exchanges on which the Common Shares are listed. Additionally, if the Company were to reprice any share option without the approval of our shareholders, as permitted under certain circumstances, then proxy advisory firms may issue a negative recommendation on certain of our compensation-related proposals at future annual meetings of our shareholders. In addition, if the Company's share-based compensation otherwise ceases to be viewed as a valuable benefit, the Company's ability to attract, retain and motivate key personnel could be weakened, which could harm its business. The loss of the services of key personnel, or an inability to attract other suitably qualified persons when needed, could have a material adverse effect on the Company's ability to execute on its business plan and strategy, and the Company may be unable to find adequate replacements on a timely basis, or at all. While employment agreements are customarily used as a primary method of retaining the services of such key personnel these agreements cannot assure the continued services of such employees. There is no assurance that any of the Company's existing personnel who presently or may in the future require a security clearance will be able to obtain or renew such clearances or that new personnel who require a security clearance will be able to obtain one. A failure by such key personnel to maintain or renew their security clearance would result in a material adverse effect on the Company's business, financial condition and results of operations. In addition, if any key personnel leave the Company, and the Company is unable to find a suitable replacement that has a security clearance in a timely manner, or at all, it could have a material adverse effect on the Company's business, financial condition and results of operations. The Company may not be able to attract or retain qualified management and other key employees in the future due to the intense competition for a limited number of qualified personnel in its industry. Many of the other cannabis companies that it competes against for qualified personnel have greater financial and other resources, different risk profiles and a longer history in the industry than the Company does. They also may provide more diverse opportunities and better chances for career advancement. Some of these characteristics may be more appealing to high quality candidates than what the Company has to offer. If the Company is unable to continue to attract and retain high quality personnel, the rate and success at which it can develop and market its products will be limited. In addition, certain of the Company's employees are covered by collective bargaining agreements. These agreements typically contain provisions regarding the general working conditions of such employees, including provisions that could affect the Company's ability to restructure its operations, close facilities, or reduce the number of its employees. The Company may not be able to extend existing collective bargaining agreements or, upon the expiration of such agreements, negotiate such agreements in a favorable and timely manner or without work stoppages, strikes or similar actions. Any deterioration of the relationships with its employees, unions and other employee representatives, or any material work stoppage, strike or similar action could have a material adverse effect on the Company's business results, cash flows, financial condition or prospects. Furthermore, the Company's actions or responses to any such negotiations, labor disputes, work stoppages or strikes could negatively impact its corporate reputation and have adverse effects on its business.

The ability of the Company to compete and grow will be dependent on it having access, at a reasonable cost and in a timely manner, to required equipment, parts and components. No assurances can be given that the Company will be successful in maintaining its required supply of equipment, parts and components. Global supply challenges have added further uncertainties around availability and price of equipment, parts and components. It is also possible that the final costs of the major equipment contemplated by the Company's capital expenditure plans may be significantly greater than anticipated by the Company's management and may be greater than funds available to the Company, in which circumstance the Company may curtail, or extend the timeframes for completing, its capital expenditure plans. This could have an adverse effect on the business, financial condition, results of operations or prospects of the Company. The cannabis business is dependent on a number of key inputs and their related costs including raw materials and supplies related to growing operations, as well as electricity, water and other local utilities. Any significant interruption or negative change in the availability or economics of the supply chain for key inputs could materially impact the business, financial condition, results of operations or prospects of the Company. In addition, any restrictions on the ability to secure required supplies or utility services or to do so on commercially acceptable terms could have a materially adverse impact on the business, financial condition and operating results. Some of these inputs may only be available from a single supplier or a limited group of suppliers. If a sole source supplier was to go out of business, the Company might be unable to find a replacement for such source in a timely manner or at all. If a sole source supplier were to be acquired by a competitor, that competitor may elect not to sell to the Company in the future. Any inability to secure required supplies and services or to do so on appropriate terms and/or agreeable terms could have a materially adverse impact on the business, financial condition, results of operations or prospects of the Company.

The global economy, including credit and financial markets, has experienced extreme volatility and disruptions, including, among other things, severely diminished liquidity and credit availability, declines in consumer confidence, declines in economic growth, supply chain shortages, fluctuating inflation rates and interest rates and uncertainty about economic stability. Increased inflation rates can adversely affect the Company by increasing the Company's costs, including labor and employee benefit costs. Higher interest rates, coupled with reduced government spending and volatility in financial markets may increase economic uncertainty and affect consumer spending. In addition, if the equity and credit markets deteriorate, including as a result of political unrest or war, such as the war in Ukraine and the hostilities in the Middle East, it may make any necessary debt or equity financing more difficult to obtain in a timely manner or on favorable terms, and more costly or more dilutive.

The Company's business involves the cultivation of the cannabis plant. The cultivation of this plant is subject to agricultural risks related to insects, plant diseases, unstable growing conditions, water and electricity availability and cost, and force majeure events. Certain agricultural risks, such as insects or plant diseases, can result in a prolonged disruption of its operations. Although the Company cultivates its cannabis plants indoors or in greenhouses, each with climate-controlled rooms staffed by trained personnel, there can be no assurance that agricultural risks will not have a material adverse effect on the cultivation of its cannabis. The Company may, in the future, cultivate cannabis plants outdoors, which would also subject it to related agricultural risks.

The introduction of new products embodying new methodologies, including new manufacturing processes, and the emergence of new industry standards may render the Company's products obsolete, less competitive or less marketable. The process of developing the Company's products is complex and requires significant continuing costs, development efforts and third-party commitments. The Company's failure to develop new methodologies and products and the obsolescence of existing methodologies could adversely affect the business, financial condition and operating results of the Company. The Company may be unable to anticipate changes in its potential customer requirements that could make the Company's existing methodologies obsolete. The development of the Company's proprietary methodologies entails significant technical and business risks. The Company may not be successful in using its new methodologies or exploiting its niche markets effectively or adapting its businesses to evolving customer or medical requirements or preferences or emerging industry standards.

The ownership and protection of trademarks, patents, trade secrets and intellectual property rights are significant aspects of the Company's future success. The Company has no patented technology or trademarked business methods at this time, nor has it registered any patents. The Company has filed trademark applications in the United States and Canada. The Company will continue to seek trademark protection in the United States and Canada. The Company's ability to obtain registered trademark protection for cannabis-related goods and services, in particular for cannabis itself, may be limited in certain countries outside of Canada, including the United States, where registered federal trademark protection is currently unavailable for trademarks covering cannabis-related products and services that are illegal under the Controlled Substances Act. Accordingly, the Company's ability to obtain intellectual property rights or enforce intellectual property rights against third-party uses of similar trademarks may be limited in certain countries. The U.S. Patent and Trademark Office released a policy on May 2, 2019 that clarifies that applications for trademarks for products that meet the definition of hemp could be accepted for registration, with certain exceptions. Even if the Company moves to protect its technology with trademarks, patents, copyrights or by other means, the Company is not assured that competitors will not develop similar technology, business methods or that the Company will be able to exercise its legal rights. The Company may have limited or no enforcement options, should its intellectual property be infringed on by illicit operators. Furthermore, other countries may not protect intellectual property rights to the same standards as the United States or Canada. Actions taken to protect or preserve intellectual property rights may require significant financial and other resources which may have a significant impact on the Company's ability to successfully grow the business. In addition, other parties may claim that the Company's products infringe on their proprietary and perhaps patent protected rights. Such claims, whether or not meritorious, may result in the Company's expenditure of significant financial and managerial resources, legal fees, result in injunctions, temporary restraining orders and/or require the payment of damages.

In the ordinary course of its business, the Company, and the third parties with whom it works, collects, receives, stores, processes, generates, uses, transfers, discloses, makes accessible, protects, secures, disposes of, transmits, and shares personal data about its patients, adult-use customers and guests and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, sensitive third-party data, business plans, transactions, and financial information (collectively, "sensitive data"). If there was a breach in physical security systems and the Company became victim to a robbery or theft or if there was a failure of information technology systems or a component of information technology systems, or if the Company's sensitive data were otherwise compromised, it could, depending on the nature of any such security incident or other interruption, adversely impact the Company's reputation, business continuity and results of operations. Any such security incident or other interruption could expose the Company to additional liability and to potentially costly litigation, government enforcement actions, additional reporting requirements and/or oversight, indemnification obligations, negative publicity, increase expenses relating to the resolution and future prevention of these security incident or other interruption and may deter potential customers from choosing the Company's products. A security incident or other interruption may occur through procedural or process failure, information technology malfunction, or deliberate unauthorized intrusions. Cyber-attacks, malicious internet-based activity, online and offline fraud such as phishing schemes, and other similar activities threaten the confidentiality, integrity, and availability of the Company's sensitive data and information technology systems, and those of the third parties with whom it works. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer "hackers," threat actors, "hacktivists," organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, the Company, and the third parties with whom it works are vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt its systems and operations, supply chain, and ability to produce, sell and distribute its goods and services. The Company and the third parties with whom it works are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing attacks, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, attacks enhanced or facilitated by AI, cable cuts, damage to physical plants, power loss, vandalism, theft, and other similar threats. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in the Company's operations, loss of sensitive data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but the Company may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Remote work has increased risks to the Company's information technology systems and data, as its employees utilize network connections, computers, and devices outside its premises or network, including working at home, while in transit and in public locations. Additionally, future or past business transactions (such as acquisitions or integrations) could expose the Company to additional cybersecurity risks and vulnerabilities, as its systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. Furthermore, the Company may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into the Company's information technology environment and security program should any security issues be identified. In addition, the Company's reliance on third parties could introduce new cybersecurity risks and vulnerabilities, including supply-chain attacks, and other threats to its business operations. The Company has entered into agreements with third parties for hardware, software, telecommunications and other information technology services in connection with its operations. The Company attempts to ensure SOX compliance by requiring vendors that interact with financially material data to provide SOC certification (Type 1 or Type 2) of their internal controls. Additionally, every new software provider Company works with is required to go through a security audit of their infrastructure and security practices. However, the Company's ability to ensure these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. If these third parties experience a security incident or other interruption, the Company could experience adverse consequences. While the Company may be entitled to damages if these third parties fail to satisfy their privacy or security-related obligations to the Company, any award may be insufficient to cover the Company's damages, or the Company may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and the Company cannot guarantee that third parties' infrastructure in its supply chain or the third parties' with whom it works supply chains have not been compromised. The Company's operations depend, in part, on how well it and the third parties with whom it works protect networks, equipment, information technology systems and software against compromise or damage from of the aforementioned or similar threats. The Company's operations also depend on the timely maintenance, upgrade and replacement of networks, equipment, information technology systems and software, as well as pre-emptive expenses to mitigate the risks of failures. The Company expends resources or may have to modify its business activities to try to protect against security incidents or other interruption. Additionally, certain data privacy and security obligations require the Company to implement and maintain specific security measures or industry-standard or reasonable security measures to protect its information technology systems and sensitive data. In 2024, the Company identified and quickly contained and remediated several non-material cybersecurity incidents. The Company takes steps designed to detect, mitigate and remediate vulnerabilities in its information systems (such as its hardware or software, including that of third parties with whom it works), but it may not be able to detect and remediate all such vulnerabilities, including on a timely basis. Further, the Company may in the future experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities. Vulnerabilities could be exploited and result in a security incident or other interruption. While the Company has implemented security measures designed to protect against security incidents and other interruptions, there can be no assurance that these measures will be effective. It may be difficult or costly to detect, investigate, mitigate, contain, and remediate a security incident or other interruption. Despite the Company's efforts to detect, investigate, mitigate, contain, and remediate a security incident, the Company may not be successful. Actions taken by the Company or the third parties with whom it works to detect, investigate, mitigate, contain, and remediate a security incident or other interruption could result in outages, data losses, and disruptions of the Company's business. Threat actors may also gain access to other networks and systems after a compromise of the Company's networks and systems. Certain of the previously identified or similar threats have in the past and may in the future cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to the Company's sensitive data or its information technology systems, or those of the third parties with whom it works. For example, in September 2024, the Company became aware of a security incident where a contractor's firewall VPN account was accessed. This allowed a threat actor to scan a site's network and attempt to login to devices unsuccessfully, as the incident was immediately detected and stopped. A security incident or other interruption could disrupt the Company's ability (and that of the third parties with whom it works) to provide its goods and services. Applicable data privacy and security obligations may require the Company, or it may voluntarily choose, to notify relevant stakeholders (including affected individuals, customers, regulators, and investors) of security incidents or other interruptions, or to take other actions, such as providing credit monitoring and identity theft protection services. Such disclosures and related actions are costly, and the disclosure or the failure to comply with applicable requirements could lead to adverse consequences. Some of the Company's contracts do not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in its contracts are sufficient to protect it from liabilities, damages, or claims related to its data privacy and security obligations. The Company cannot be sure that its insurance coverage will be adequate or sufficient to protect it from, or to mitigate liabilities arising out of its privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims. In addition to experiencing a security incident or other interruption, third parties may gather, collect, or infer sensitive data about it from public sources, data brokers, or other means that reveals competitively sensitive details about the Company and could be used to undermine its competitive advantage or market position. Additionally, sensitive information of the Company or its customers could be leaked, disclosed, or revealed as a result of or in connection with its employees', personnel's, or vendors' use of generative AI technologies.