ARC Document Solutions (ARC) Risk Analysis

Aspects of our business involve collecting, processing, disclosing, storing, and transmitting personal data, which are subject to certain privacy policies, contractual obligations, and laws, regulations, and directives relating to privacy and data protection. We store a substantial amount of customer and employee data, including personal data, on our networks and other systems and the cloud offerings we operate. In addition, the types of data subject to protection as personal data in the United States, and elsewhere have been expanding. In recent years, the collection and use of personal data by companies have come under increased regulatory and public scrutiny, especially in relation to the collection and processing of sensitive data, such as healthcare, biometric, genetic, financial services, and children's data, precise location data, and data regarding a person's race or ethnic origins, political opinions, or religious beliefs. For example, in the United States, protected health information is subject to HIPAA, which can provide for civil and criminal penalties for noncompliance. Entities (such as us) that engage in receiving, maintaining, or transmitting protected health information provided by covered entities and other business associates are subject to enforcement under HIPAA. Our access to protected health information triggers obligations to comply with certain privacy rules and data security requirements under HIPAA. In addition to potential enforcement by the United States Department of Health and Human Services for potential HIPAA violations, we are also potentially subject to privacy enforcement from the FTC. The FTC has been particularly focused on certain activities related to the processing of sensitive data, including the unpermitted processing of health and genetic data through its recent enforcement actions and is expanding the types of privacy violations that it interprets to be "unfair" under Section 5 of the FTC Act, as well as the types of activities it views to trigger the Health Breach Notification Rule (which the FTC also has the authority to enforce). We will need to account for the FTC's evolving rules and guidance for proper privacy and data security practices in order to mitigate our risk for a potential enforcement action, which may be costly. If we are subject to a potential FTC enforcement action, we may be subject to a settlement order that requires us to adhere to very specific privacy and data security practices, which may impact our business. We may also be required to pay fines as part of a settlement (depending on the nature of the alleged violations). If we violate any consent order that we reach with the FTC, we may be subject to additional fines and compliance requirements. We face risks of similar enforcement from State Attorneys General and, potentially, other regulatory agencies. Any systems failure or security breach that results in the release of, or unauthorized access to, personal data, or any failure or perceived failure by us or our third-party service providers to comply with applicable privacy policies, contractual obligations, or any applicable laws or regulations relating to privacy or data protection, could result in proceedings against us by domestic or foreign government entities or others, including private plaintiffs in litigation. Such proceedings could result in the imposition of sanctions, fines, penalties, liabilities, government orders, and/or orders requiring that we change our data practices, any of which could have a material adverse effect on our business, operating results, reputation, and financial condition. State privacy laws in the United States also may impact our business operations. The state of California has adopted a comprehensive privacy law, the CCPA, which took effect in January 2020 and became enforceable in July 2020. We have been required to devote substantial resources to implement and maintain compliance with the CCPA, and noncompliance could result in regulatory investigations and fines or private litigation. Moreover, in November 2020, California voters approved a privacy law, the CPRA, which amends the CCPA to create additional privacy rights and obligations in California, and went into effect on January 1, 2023. Numerous other states have passed laws similar to the CCPA, which will go into effect in 2023 and beyond. More states may follow. These laws may impose additional costs and obligations on us. The Securities and Exchange Commission also has issued new regulations related to cybersecurity that may require additional reporting and other compliance obligations, as well as creating additional risks related to public notifications concerning cyber incidents. Furthermore, the U.S. Congress is considering comprehensive privacy legislation. At this time, it is unclear whether Congress will pass such a law and if so, when and what it will require and prohibit. Moreover, it is not clear whether any such legislation would give the FTC any new authority to impose civil penalties for violations of the Federal Trade Commission Act in the first instance, whether Congress will grant the FTC rulemaking authority over privacy and information security, or whether Congress will vest some or all privacy and data security regulatory authority and enforcement power in a new agency, akin to EU data protection authorities. Complying with these and other changing requirements could cause us to incur substantial costs or pay substantial fines or penalties, require us to change our business practices, require us to take on more onerous obligations in our contracts, or limit our ability to provide certain services in certain jurisdictions, any of which could materially adversely affect our business and operating results. New laws or regulations restricting or limiting the collection or use of mobile data could also reduce demand for certain of our offerings or require changes to our business practices, which could materially adversely affect our business and operating results.

We are subject to a number of risks inherent to our status as an employer, including claims of misconduct or negligence on the part of our employees, claims by our employees and former employees of discrimination or harassment; claims relating to violations of wage, hour and other workplace regulations; and claims relating to employee benefits, entitlements to employee benefits, or errors in the calculation or administration of such benefits. If we experience significant incidents in any of the above-described areas, we could face substantial out-of-pocket losses, or fines. In addition, such claims may give rise to litigation, which may be time consuming, distracting and costly, and could have a material adverse effect on our business.

We believe that our ability to attract, retain, and successfully integrate qualified personnel is critical to our success. As we continue to place more emphasis on document management and storage technology, our need to hire and retain software and other technology-focused personnel has increased, and can be expected to continue to increase. Competition for such personnel, particularly in the San Francisco Bay Area, is intense. If we lose key personnel and/or are unable to recruit qualified personnel, our ability to manage and grow our business will be adversely affected. In addition, the loss of the services of one or more members of our senior management team would disrupt our business and impede our ability to successfully execute our business strategy.

Our access to equipment, parts, supplies, and services depends upon our relationships with, and our ability to purchase these items on competitive terms from our principal vendors. These vendors are not required to use us to distribute their equipment and are generally free to change the prices and other terms at which they sell to us. In addition, we compete with the selling efforts of some of these vendors. Our reliance on a limited number of principal vendors presents various risks. These include the risk that an interruption in our relationships with our principal vendors for any reason, such as a natural catastrophe, epidemics, pandemics, such as the COVID-19 pandemic, or actions taken in regard to increased tariffs on goods produced in certain countries such as China, we may not be able to develop an alternate source without incurring material additional costs and substantial delays. Significant deterioration in relationships with, or in the financial condition of, these significant vendors could have an adverse effect on our ability to sell equipment as well as our ability to provide effective service and technical support to our customers. If one of these vendors terminates or significantly curtails its relationship with us, or if one of these vendors ceases operations, we would be forced to expand our relationships with our other existing vendors or seek out new relationships with previously unused vendors.

Our success depends on our ability to protect and preserve the proprietary aspects of our technology products. We rely on a combination of patent, copyright, trademark and trade secret protection, confidentiality agreements, license and subscription agreements, and technical measures to establish and protect our rights in our proprietary technologies. These protections, however, may be inadequate. It is also possible that our intellectual property rights could be challenged, invalidated or circumvented, allowing others to use our intellectual property to our competitive detriment. Furthermore, we may, from time to time, be subject to intellectual property litigation which can be expensive, a burden on management's time and our Company's resources, and the outcome of any such litigation may be uncertain.

As part of our business, we process, store, and transmit our customers' and vendors' data as well as our own, including in our networks and other systems and the cloud offerings we operate. Security breaches may occur due to technological error, computer viruses, or third-party action, including intentional misconduct by computer hackers or state actors, physical break-ins, industrial espionage, fraudulent inducement of employees, customers, or channel partners to disclose sensitive information such as usernames or passwords, and employee, customer, or channel partner error or malfeasance. A security breach could result in unauthorized access to or disclosure, modification, misuse, loss, or destruction of our customers', prospects', vendors', or channel partners' data, our data (including our proprietary information, intellectual property, or trade secrets), our networks or other systems, or the cloud offerings we operate. Third parties may also conduct attacks designed to prevent access to critical data or systems through ransomware or temporarily deny customers access to our cloud environments. We, and our service providers, may in the future experience attempts by third parties to identify and exploit software and service vulnerabilities, penetrate or bypass our security measures, and gain unauthorized access to our or our customers' or service providers' cloud environments, networks, and other systems. Security measures that we or our third-party service providers have implemented may not be effective against all current or future security threats. Because there are many different security breach techniques and such techniques continue to evolve, we may be unable to anticipate, detect, or mitigate attempted security breaches and implement adequate preventative measures. Any security breach, ransomware attack, or successful denial of service attack could result in a loss of customer confidence in the security of our offerings and damage to our brand, reduce the demand for our offerings, disrupt our normal business operations, require us to spend material resources to investigate or correct the breach, require us to notify affected customers or individuals and/or applicable regulators and others, provide identity theft protection services to individuals, expose us to legal liabilities, including litigation, regulatory enforcement actions, and indemnity obligations, and materially adversely affect our revenues and operating results. Our software services operate in conjunction with and are dependent on third-party products and components across a broad ecosystem. If there is a security vulnerability in one of these products or components, and if there is a security exploit targeting it, we could face increased costs, liability claims, customer dissatisfaction, reduced revenue, or harm to our reputation or competitive position. Our insurance policies may not be adequate to compensate us for the potential losses arising from any cybersecurity breach or incident. In addition, such insurance may not be available to us in the future on economically reasonable terms, or at all. Further, our insurance may not cover all claims made against us and could have high deductibles in any event, and defending a suit, regardless of its merit, could be costly and divert management attention. These risks will increase as we continue to grow the scale of our Digital Printing and Scanning and Digital Imaging services and process, store, and transmit increasingly large amounts of our customers', vendors', and our own data. In particular, as remote working conditions have led businesses to increasingly rely on virtual environments and communication systems, there has been an increase in cyberattacks and other malicious activities.

Our IT systems are an important part of our operations. We currently store customer data on a variety of servers, including servers hosted by Amazon Web Services and at our technology center located in San Ramon, California near known earthquake fault zones. Although we have redundant systems and offsite backup procedures in place, interruption in service, damage to or destruction of our technology center or a disruption of our data storage processes resulting from sustained process abnormalities, human error, acts of terrorism, violence, war or a natural disaster, such as fire, earthquake or flood, could result in delays, in reduced levels of customer service and have a material adverse effect on the markets in which we operate and on our business operations. Although we currently maintain general property damage insurance, if we incur losses from uninsured events, we could incur significant expenses which would adversely affect our results of operations, cash flows and financial condition.

We derived approximately 30% of our net sales in 2023 from our operations in California. Accordingly, we are sensitive to economic factors affecting business activity in California, including general and local economic conditions, declines in specific industries, macroeconomic trends, political factors affecting commerce and economic development, and natural disasters (including drought, earthquakes and wildfires) the intensity and frequency of which are being exacerbated by climate change. Any adverse developments affecting California could have a disproportionately negative effect on our results of operations and financial condition.

We have international operations in China, India, the United Kingdom, Canada, and United Arab Emirates. Approximately 12% of our revenues for 2023 were derived from our international operations, with approximately 3% derived from China. We anticipate that future sales to international customers will continue to account for a significant percentage of our revenues. Risks associated with international sales and operations include, but are not limited to: a.Political and economic instability, including the war between Ukraine and Russia, the conflict in Israel and neighboring regions and potential hostilities between China and Taiwan;b.International terrorism;c.Global economic sanctions and export controls, including U.S. export controls related to China, sanctions related to Russia, and increased scrutiny of exports of digital imaging and other products;d.Failure to comply with anti-bribery legislation, including the U.S. Foreign Corrupt Practices Act;e.Changes in legal and regulatory requirements, including complex trade compliance regulations;f.U.S. and foreign government policy changes affecting the markets for our products;g.Changes in tax laws and tariffs;h.Additional deterioration in U.S. - China and U.S. - Russia relations;i.Difficulties in protection and enforcement of intellectual property rights;j.Failure to comply with the foreign data protection laws;k.New and emerging non-U.S. regulations relating to environmental, social and governance and corporate social responsibility matters, which could be costly to comply with;l.Transportation, including piracy in international waters;m.Currency exchange rate fluctuations; and n.Challenges relating to managing a global workforce with diverse cultures, backgrounds and labor laws. The impact of these factors is difficult to predict, but one or more of them could have a material adverse effect on our financial position, results of operations, or cash flows. Certain international contracts may also include industrial cooperation agreements requiring specific in-country purchases, investments, manufacturing agreements or other financial obligations, known as offset obligations, and may provide for penalties if we fail to meet such requirements.

The occurrence of a major earthquake, fire, flood or other weather events, power loss, telecommunications failure, software or hardware malfunctions, pandemics (including the COVID-19 pandemic), cyber-attack, war, terrorist attack or other catastrophic event that our disaster recovery plans do not adequately address, could adversely affect our employees, our systems, our ability to produce and distribute our products, and our reputation. A catastrophic event resulting in the destruction or disruption of our workforce, our systems, our ability to produce and distribute our products, any of our data centers or our critical business or information technology systems could adversely affect our ability to conduct normal business operations and our operating results or cash flows. The adverse effects of any such catastrophic event would be exacerbated if experienced at the same time as another unexpected and adverse event, such as the COVID-19 pandemic.

The markets for our products and services are highly competitive, with competition primarily at local and regional levels. We compete primarily based on the level and quality of customer service, technological leadership, and price. Our future success depends, in part, on our ability to continue to improve our service and product offerings, and develop and integrate new technology solutions. In addition, current and prospective customers may decide to perform certain services themselves instead of outsourcing these services to us. These competitive pressures could adversely affect our sales and consolidated results of operations.

We estimate that customers in the AEC/O industry accounted for approximately 50% of our net sales in 2023; therefore, our results largely depend on the strength of that industry. Our historical operating results reflect the cyclical and variable nature of the AEC/O industry. We believe that the AEC/O industry generally experiences downturns several months after a downturn in the general economy, and that there may be a similar delay in the recovery of the AEC/O industry following a recovery of the general economy. A downturn in the AEC/O industry would diminish demand for all of our products and services, and would therefore negatively affect our revenues and have a material adverse effect on our business, operating results and financial condition.