cyber-attacks and other cyber-incidents from being successful, the Group cannot guarantee that its security efforts will protect against breaches or breakdowns of its, or its third-party service providers’, IT Systems since the techniques used in these attacks change frequently and may be difficult to detect for periods of time, and so such cyber-attacks may from time to time succeed. In addition, the Group cannot guarantee that it or its third-party service providers’ response to any such incidents will fully remedy the extent of the damage caused by these incidents. Although the Group has policies and procedures in place to ensure that all personal information collected by it or its third-party service providers is securely maintained, data breaches due to human error or intentional or unintentional conduct may still occur in future.
Furthermore, the Group periodically upgrades its IT Systems or adopts new technologies. If such an upgrade or new technology does not function as designed, does not go as planned or increases the Group’s exposure to a cyber-attack or cyber incident, it may adversely impact the Group’s business, including its ability to ship products to customers, issue invoices and process payments or order raw and packaging materials. If the Group were to suffer a significant loss or disclosure of confidential business or stakeholder information as a result of a breach of its IT Systems, including those of third-party service providers with whom it has contracted, or otherwise, the Group may suffer reputational, competitive and/or business harm, incur significant costs and be subject to government investigations, litigation, fines and/or damages, which may materially and adversely impact the Group’s business, prospects, results of operations and financial condition.
While the Group has disaster recovery and business continuity plans in place, if its IT Systems were damaged, breached or were to cease to function properly for any reason, including the poor performance of, failure of or cyber-attack on, third-party service providers, catastrophic events, power outages, cyber-security breaches, network outages, failed upgrades or other similar events and if the disaster recovery and business continuity plans do not effectively resolve such issues on a timely basis, the Group may suffer interruptions in its ability to manage or conduct business as well as reputational harm, and may be subject to governmental investigations and litigation, any of which may materially and adversely impact the Group’s business, prospects, results of operations and financial condition.
The Group relies on third parties in many aspects of its business and ineffective management of these relationships could increase the Group’s financial, legal, reputational and operational risk
Due to the scale and scope of the Group’s business, the Group relies on relationships with third parties, including its suppliers, contract manufacturers, distributors, contractors, commercial banks, joint venture partners and external business partners, for route to market and for certain functions (including the outsourcing of certain back office and consumer relations services). If the Group is unable to effectively manage and maintain its third-party relationships and the agreements under which the Group’s third-party partners operate, its results of operations could be adversely impacted.
For example, in China, part of the Group’s business is conducted through Sino-American Tianjin Smith Kline & French Laboratories Ltd., which is a joint venture between GlaxoSmithKline Consumer Healthcare (Overseas) Limited, the Tianjin Pharmaceutical Group and the Tianjin Zhongxin Pharmaceutical Group (the “TSK&F Joint Venture”), pursuant to a joint venture agreement which is due to expire in September 2024. If the Group does not renew these arrangements or implement alternative measures, in either case on acceptable terms, then the continuity and development of part of its operations and route to market in China, as well as its business, results of operations and cash flows in that market, may be adversely affected.
Failure of third parties to meet their obligations to the Group or substantial disruptions in the relationships between the Group and third parties could adversely impact the Group’s operations and financial results. Additionally, while the Group has policies and procedures for managing these relationships, they inherently involve a lesser degree of control over business operations, and compliance with laws, regulations and Group
40