Baker Hughes Company (BKR) Risk Analysis

Our operations and future success depend on our ability to recruit, train, and retain key personnel. People are a key resource to developing, manufacturing, and delivering our products and providing technical services and solutions to our customers around the world. A competent, well-trained, highly skilled, motivated, and diverse workforce has a positive impact on our ability to attract and retain business. Difficulties in hiring or retaining key employees, or the unexpected loss of experienced employees resulting in the depletion of our institutional knowledge base, could have an adverse impact on our business performance, reputation, financial condition, or results of operations. Additionally, successfully executing organizational change as we restructure the Company, management transitions at leadership levels of the Company, and motivation and retention of key employees is critical to our business success. Factors that may affect our ability to attract and retain sufficient numbers of qualified employees include: employee morale, our brand reputation as an employer of choice, competition from other employers, our location strategy for key roles, investments in technology and systems, and availability of qualified individuals with the desired skills and experiences needed to grow our business. Other factors that have, and could continue to impact our workforce, are: changes to our office environments and the impact this could have on our Company culture, the adoption of new work models, and our requirements and/or expectations about when or how often certain employees work on-site or remotely, which may not meet the expectations of our employees.

We operate in a highly competitive environment for marketing our products and services and securing equipment across our portfolio. Our ability to continually provide competitive products and services can impact our ability to defend, maintain or increase prices for our products and services, maintain market share, and negotiate acceptable contract terms with our customers. In order to be competitive, we must provide new and differentiating technologies, reliable products and services that perform as expected and that create value for our customers. We continue to invest in new technologies, equipment, and facilities and to expand our capabilities and technology portfolio to meet the challenges of a net-zero future. These efforts include expanding into new energy areas such as geothermal and carbon capture, utilization and storage, strengthening our digital architecture and addressing key energy market themes. Our ability to defend, maintain or increase prices for our products and services is in part dependent on the industry's capacity relative to customer demand, on our ability to differentiate the value delivered by our products and services from our competitors' products and services and to provide innovative and competitive products and services to meet our client's evolving needs with respect to new energy areas. Managing development of competitive technology and new product introductions on a forecasted schedule and at a forecasted cost can impact our financial results. If we are unable to continue to develop and produce competitive and innovative technology or deliver it to our clients in a timely and cost-competitive manner in response to changes in the market, customer requirements, competitive pressures, or as a result of the energy transition to lower carbon emitting technology, or if competing technology accelerates the obsolescence of any of our products or services, any competitive advantage that we may hold, and in turn, our business, financial condition, results of operations and cash flows could be materially and adversely affected. We have, and may in the future enter into, agreements with third parties to jointly develop certain technologies which may include financial or other commitments. Under the terms of these agreements, we may agree to share in the associated development and marketing costs for the developed technologies. There can be no assurances that we will be able to successfully develop these technologies in collaboration with these third parties that will adequately meet our customers' needs. Also, there can be no assurances that these joint development agreements will be commercially viable, successful or profitable. As a result, these joint development agreements could have a material adverse effect on our financial condition, results of operations and cash flows.

In recent years, companies across all industries are facing increasing scrutiny from a variety of stakeholders, including investor advocacy groups, proxy advisory firms, certain institutional investors and lenders, investment funds and other influential investors and rating agencies, related to their ESG and sustainability practices. If we do not adapt to or comply with investor or other stakeholder expectations and standards on ESG matters (or meet sustainability goals and targets that we have set), as they continue to evolve, or if we are perceived to have not responded appropriately or quickly enough to growing concern for ESG and sustainability issues, regardless of whether there is a regulatory or legal requirement to do so, we may face increased litigation risk, reputational damage and our business, financial condition and/or stock price could be materially and adversely affected. In addition, our continuing efforts to research, establish, accomplish and accurately report on the implementation of our ESG strategy, including our emissions reduction commitments, may also create additional operational risks and expenses and expose us to reputational, legal and other risks. While we create and publish voluntary disclosures regarding ESG matters from time to time, some of the statements in those voluntary disclosures may be based on hypothetical expectations and assumptions that may or may not be representative of current or actual risks or events or forecasts of expected risks or events, including the costs associated therewith. Such expectations and assumptions are necessarily uncertain and may be prone to error or subject to misinterpretation given the long timelines involved and the lack of an established single approach to identifying, measuring and reporting on many ESG matters. Our voluntary disclosures of ESG data are evaluated and rated by various organizations that assess corporate ESG performance. These organizations provide information to investors on corporate governance and related matters and have developed ratings processes for evaluating companies on their approach to ESG matters. Unfavorable ESG ratings, or our inability to meet the ESG standards set by specific investors, may lead to negative investor sentiment and reputational damage, which could have an adverse impact, among other things, on our stock price and cost of capital. Regulatory requirements related to ESG or sustainability reporting have been adopted and may continue to be introduced in various jurisdictions, including, but not limited to, the European Union, Australia, and the State of California. These regulations will require the reporting of sustainability data, including greenhouse gas emissions. We expect regulatory disclosure requirements related to sustainability matters to continue to expand globally, which has and may continue to increase our cost and burden of compliance and may subject us to potential legal and reputational risk. To achieve our stated emission reduction goals, we have implemented internal decarbonization projects and may also need to rely on external factors, such as the greater deployment of carbon reduction and removal technologies and adoption of government policies that we expect would accelerate the adoption of energy transition technologies. There have been policy responses to support the energy transition in the U.S. with the passage of the Inflation Reduction Act. In addition, geopolitical instability has increased energy prices compared to the prior year and raised energy security concerns, which may result in many governments reassessing energy transition strategies, extending the timeline to ensure adequate and reasonably priced energy supplies. It is difficult to predict with certainty how these policy, economic, and energy security issues will impact the energy transition. Our failure or perceived failure to pursue or fulfill our reductions and elimination of carbon equivalent emissions commitments within the timelines we announce, or changes to these commitments or related timelines could have a negative impact on investor sentiment, ratings outcomes for evaluating our approach to ESG matters, our stock price and cost of capital and expose us to government enforcement actions and private litigation, among other material adverse impacts.

Fluctuations or devaluations in foreign currencies relative to the U.S. dollar can impact our revenue and our costs of doing business and create volatility, as well as the costs of doing business of our customers.

In the course of conducting our business, we may hold or have access to sensitive, confidential, proprietary or personal data or information belonging to us, our employees or third parties, including customers, partners or suppliers. Increased cybersecurity vulnerabilities and threats, and more sophisticated and targeted cyber-attacks and other security incidents, pose risks to our and our customers', partners', suppliers' and third-party service providers' systems, data, and business, and the confidentiality, availability, and integrity of our and our employees' and customers' data. We utilize various procedures and controls to monitor and mitigate our exposure including maintaining a dedicated Cyber Fusion Center ("CFC") and engaging third party experts. For more information see the "Risk Management & Strategy" section of Part 1 of Item 1C herein. While we attempt to mitigate these risks, we remain vulnerable to cyber-attacks and other security incidents, including ransomware incidents. Given our global footprint, the large number of customers, partners, suppliers and service providers with which we do business, and the increasing sophistication and complexity of cyber-attacks, an incident could occur and persist for an extended period without detection. Any investigation of a cyber-attack or other security incident would be inherently unpredictable, and it would take time before the completion of any investigation and the availability of full and reliable information. During such time we would not necessarily know the extent of the harm or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated, all or any of which would further increase the costs and consequences of such an incident. We may be required to expend significant resources to protect against, respond to, and recover from any cyber-attacks and other security incidents. As cyber-attacks continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. In addition, our remediation efforts may not be successful. The inability to implement, maintain and upgrade adequate safeguards could materially and adversely affect our financial condition, results of operations and cash flows. In addition to our own systems, we use third-party service providers, who in turn may also use third-party providers, to process certain data or information on our behalf. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cybersecurity incidents attributed to our service providers or other third parties to the extent affecting information we share with them. Although we contractually require these third parties to implement and maintain reasonable security measures, we cannot control third parties and cannot guarantee that a security breach will not occur in their systems. Our digital technologies and services, as well as third-party products, services and technologies on which we rely (including emerging technologies, such as artificial intelligence programs), are subject to the risk of cyberattacks. Despite our and our service providers' efforts to protect our data and information, there can be no assurance that the systems we have designed to prevent or limit the effects of cyber incidents or attacks will be sufficient to prevent or detect material consequences arising from such incidents or attacks, or to avoid a material adverse impact on our systems after such incidents or attacks occur. In the normal conduct of our business, we and our service providers have been and may in the future be vulnerable to security breaches, ransomware attacks, theft, misplaced or lost data, programming errors, phishing attacks, denial of service attacks, acts of vandalism, computer viruses, malware, employee errors and/or malfeasance or similar events, including those perpetrated by criminals or nation-state actors, that could potentially lead to the compromise, unauthorized access, use, disclosure, modification or destruction of data or information, improper use of our systems, defective products, loss of access to our data, production downtimes and operational disruptions; and, given the nature of such attacks, some incidents may remain undetected for a period of time despite efforts to detect and respond to them in a timely manner. In addition, a cyber-attack or any other significant compromise or breach of our data security, media reports about such an incident, whether accurate or not, or, under certain circumstances, our failure to make adequate or timely disclosures to the public, law enforcement agencies or affected individuals following any such event, whether due to delayed discovery or a failure to follow existing protocols, could adversely impact our operating results and result in other negative consequences, including damage to our reputation or competitiveness, harm to our relationships with customers, partners, suppliers and other third parties, distraction to our management, remediation or increased protection costs, significant litigation or regulatory action, fines and penalties. Cyberattacks are expected to accelerate on a global basis in both frequency and magnitude as threat actors become increasingly sophisticated in techniques and tools (including artificial intelligence) that circumvent controls, evade detection and even remove forensic evidence of the infiltration. Given the increased prevalence of customer-imposed connectivity, cybersecurity controls and other related contractual obligations towards customers or other third parties, there are an increased number of attack vectors and a cyber-attack or other security incident also could result in breach of contract or indemnity claims against us by customers or other counterparties. While we currently maintain cybersecurity insurance, such insurance may not be sufficient in type or amount to cover us against claims related to cybersecurity breaches or attacks, failures or other data security-related incidents, and we cannot be certain that cyber insurance will continue to be available to us on economically reasonable terms, or at all, or that an insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could materially and adversely affect our financial condition, results of operations and cash flows.