PART II - OTHER INFORMATION
Information with respect to litigation is set forth in Note 15 of the Notes to Consolidated Financial Statements, and such information is incorporated herein by reference.
There have been no significant changes to the “Risk Factors” in Part I, Item 1A of the company’s 2021 Form 10-K filed with the SEC on February 22, 2022, except for the following:
We have identified material weaknesses in our disclosure controls and procedures and internal control over financial reporting. Failure to remediate the material weaknesses or any other material weaknesses that we identify in the future could result in material misstatements in our financial statements.
Pursuant to Section 404 of the Sarbanes-Oxley Act of 2002, as amended, our management is required to report on, and our independent registered public accounting firm is required to attest to, the effectiveness of our internal control over financial reporting. The rules governing the standards that must be met for management to assess our internal control over financial reporting are complex and require significant documentation, testing and possible remediation. Annually, we perform activities that include reviewing, documenting and testing our internal control over financial reporting. In addition, if we fail to maintain the adequacy of our internal control over financial reporting, we will not be able to conclude on an ongoing basis that we have effective internal control over financial reporting in accordance with Section 404 of the Sarbanes-Oxley Act of 2002. If we fail to achieve and maintain an effective internal control environment, we could suffer misstatements in our financial statements and fail to meet our reporting obligations, which would likely cause investors to lose confidence in our reported financial information. This could result in significant expenses to remediate any internal control deficiencies and lead to a decline in our stock price.
Following an investigation by the company’s Audit & Finance Committee (Audit Committee) into the company’s internal control environment, the company has reevaluated the effectiveness of the company’s disclosure controls and procedures and internal control over financial reporting and identified material weaknesses in the company’s disclosure controls and procedures and internal control over financial reporting. A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of a company’s annual or interim financial statements will not be prevented or detected on a timely basis. Our management may be unable to conclude in future periods that our disclosure controls and procedures are effective due to the effects of various factors, which may, in part, include unremediated material weaknesses in internal control over financial reporting.
Management is committed to maintaining a strong internal control environment and believes its remediation efforts will represent an improvement in existing controls. Management anticipates that the new controls, as implemented and when tested for a sufficient period of time, will remediate the material weaknesses. We may not be successful in promptly remediating the material weaknesses identified by management, or be able to identify and remediate additional control deficiencies, including material weaknesses, in the future. If not remediated, our failure to establish and maintain effective disclosure controls and procedures and internal control over financial reporting could result in material misstatements in our financial statements and a failure to meet our reporting and financial obligations, each of which could have a material adverse effect on our financial condition and the trading price of our common stock.
The company has received, and may receive in the future, regulatory, investigative and enforcement inquiries, subpoenas or demands arising from, related to, or in connection with these matters. Professional costs resulting from the investigation that resulted in the identification of the material weaknesses have been significant and are expected to continue to be significant, in particular if litigation costs relating to these regulatory, investigative and enforcement inquiries, subpoenas and demands grow. Although we believe that no significant business has been lost to date, it is possible that a change in the perceptions of our business partners could occur as a result of the investigation and the material weaknesses. In addition, as a result of the investigation and remediation efforts, certain operational changes have occurred and may continue to occur in the future. Any or all of these impacts based on the findings of the investigation and related matters and the surrounding circumstances could exacerbate the other risks described herein and directly or indirectly have a material adverse effect on our operations and/or financial performance.
Cybersecurity incidents could result in the company incurring significant costs and could harm the company’s business and reputation.
The company’s business includes managing, processing, storing and transmitting proprietary and confidential data, including personal information, intellectual property and proprietary business information, within the company’s own IT systems and those that the company designs, develops, hosts or manages for clients. These systems are critical to the company’s business activities, and shutdowns or disruptions of, and cybersecurity attacks on, these systems pose increasing risks. Cybersecurity incidents and network security incidents may include, but are not limited to, attempts to access or unauthorized access of information, exploitation of vulnerabilities (including those of third-party software or systems), computer viruses, ransomware, denial of service and other electronic security incidents. Attacks also include social engineering and cyber extortion to induce customers, contractors, business partners, vendors, employees and other third parties to disclose information, transfer funds, or unwittingly provide access to systems or data. Cyberattacks from computer hackers and cyber criminals and other malicious internet-based activity continue to increase generally, and the company’s services and systems, including the systems of the company’s outsourced service providers, have been and may in the future continue to be the target of various forms of cybersecurity incidents such as DNS attacks, wireless network attacks, viruses and worms, malicious software, ransomware, cyber extortion, misconfigurations, supply chain attacks, application centric attacks, peer-to-peer attacks, phishing attempts, backdoor trojans and distributed denial of service attacks.
The techniques used by computer hackers and cyber criminals to obtain unauthorized access to data or to sabotage computer systems change frequently and are growing in sophistication, and these new techniques generally are not detected until after an incident has occurred. Cybersecurity incidents involving the company’s systems, despite established security controls, could result in disruption of the company’s services, misappropriation, misuse, alteration, theft, loss, corruption, leakage, falsification, and accidental or premature release or improper disclosure or misuse of confidential or other information, including intellectual property and personal information (of the company, third parties, employees, clients or others). The company could be exposed to liability, litigation, and regulatory or other government action, as well as the loss of existing or potential customers, damage to the company’s brand and reputation, damage to the company’s competitive position, and other financial loss, any of which could have a material adverse effect on the company’s business, financial condition and results of operations. In addition, the cost and operational consequences of responding to cybersecurity incidents and implementing remediation measures could be significant. In the company’s industry, security vulnerabilities are increasingly discovered, publicized and exploited across a broad range of hardware, software or other infrastructure, elevating the risk of attacks and the potential cost of response and remediation for the company.
Although the company continuously takes significant steps to mitigate cybersecurity risk across a range of functions, such measures can never eliminate the risk entirely or provide absolute security, and the company has experienced and expects to continue to experience cyberattacks on its information systems. While there have not been cybersecurity incidents or vulnerabilities that have had a material adverse effect on the company, there is no assurance that there will not be cybersecurity incidents or vulnerabilities that will have a material adverse effect in the future.
The company has significant underfunded pension obligations.
The company has significant underfunded obligations under its U.S. and non-U.S. defined benefit pension plans. In 2021, the company made cash contributions of $52.4 million, primarily for its international defined benefit pension plans. Based on current legislation, global regulations, recent interest rates and expected returns, in 2022 the company expects to make cash contributions of approximately $38.5 million, primarily for its international defined benefit pension plans. Estimates for future cash contributions are likely to change based on a number of factors including market conditions and changes in discount rates. The company may need to obtain additional funding in order to make future contributions. In this event, there is no assurance that the company would be able to obtain such funding or that the company will have enough cash on hand to pay the required cash contributions. Deterioration in the value of the company’s worldwide defined benefit pension plan assets, as well as discount rate changes, asset return changes, or changes in economic or demographic trends, could require the company to make cash contributions to its defined benefit pension plans in the future in an amount larger than currently anticipated. Increased cash contribution requirements or an acceleration in the due date of such cash contributions would further reduce the cash available for working capital, capital expenditures and other corporate uses and may worsen the adverse impact on the company’s operations, financial condition and liquidity.
CAUTIONARY STATEMENT PURSUANT TO THE U.S. PRIVATE SECURITIES LITIGATION REFORM ACT OF 1995
Risks and uncertainties that could cause the company’s future results to differ materially from those expressed in “forward-looking” statements include:
Implementation of Business Strategy in Information Technology Market
| • | | our ability to attract and retain experienced personnel in key positions; |
| • | | our ability to grow revenue and expand margin in our Digital Workplace Solutions and Cloud, Applications & Infrastructure Solutions businesses; |
| • | | our ability to maintain our installed base and sell new solutions and related services; |
32