Dillard's (DDS) Risk Factors

We conduct our retail merchandise business under highly competitive conditions. Competition is characterized by many factors including location, reputation, fashion, merchandise assortment, advertising, operating efficiency, price, quality, customer service and credit availability. We have numerous competitors nationally, locally and on the Internet, including conventional department stores, specialty retailers, off-price and discount stores, boutiques, mass merchants, and Internet and mail-order retailers. Although we are a large regional department store, some of our competitors are larger than us with greater financial resources and, as a result, may be able to devote greater resources to sourcing, promoting and selling their products. Additionally, we compete in certain markets with a substantial number of retailers that specialize in one or more types of merchandise that we sell. Also, online retail shopping continues to rapidly evolve, and we continue to expect competition in the e-commerce market to intensify in the future as the Internet facilitates competitive entry and comparison shopping. We anticipate that intense competition will continue from both existing competitors and new entrants. If we are unable to maintain our competitive position, we could experience downward pressure on prices, lower demand for products, reduced margins, the inability to take advantage of new business opportunities and the loss of market share.

We offer our customers quality products at competitive prices and a high level of customer service, resulting in a well-recognized brand and customer loyalty. As discussed in the immediately preceding risk factor, our brand and customer loyalty depend, in part, on our ability to predict or respond to changes in fashion trends and consumer preferences in a timely manner. Failure to respond rapidly to changing trends could diminish brand and customer loyalty and impact our reputation with customers. Additionally, the value of our reputation is based, in part, on subjective perceptions of the quality of our merchandise selections. Isolated incidents involving us or persons currently or formerly associated with us (including employees, celebrities, social media influencers, brand affiliates and partners or others who speak publicly about our brand or our products, whether authorized or not) or our merchandise that erode trust or confidence could adversely affect our reputation and our business, particularly if the incidents result in significant adverse publicity or governmental investigation or inquiry. Similarly, information posted about us, including our lines of exclusive brand merchandise, on the Internet, including social media platforms that allow individuals access to a wide audience of consumers and other interested persons, may adversely affect our reputation, even if the information is inaccurate. Any significant damage to our brand or reputation could negatively impact sales, diminish customer trust and generate negative sentiment, any of which would harm our business and results of operation.

The retail merchandise business is highly sensitive to changes in overall economic and political conditions that impact consumer confidence and spending. Various economic conditions affect the level of disposable income consumers have available to spend on the merchandise we offer, including unemployment rates, inflation, interest rates, taxation, energy costs, the availability of consumer credit, the price of gasoline, consumer confidence in future economic conditions and general business conditions. Due to the Company's concentration of stores in energy producing regions, volatile conditions in these regions could adversely affect the Company's sales. Consumer purchases of discretionary items and other retail products generally decline during recessionary periods, and also may decline at other times when changes in consumer spending patterns affect us unfavorably. In addition, any significant decreases in shopping mall traffic could also have an adverse effect on our results of operations.

Our construction segment recognizes contract revenues based on the cost-to-cost method. Under this method, estimated contract revenues are measured based on the ratio of costs incurred to total estimated contract costs. Estimated contract losses are recognized in full when determined. Total contract revenues and cost estimates are reviewed and revised at a minimum on a quarterly basis as the work progresses and as change orders are approved. Adjustments are reflected in contract revenues in the period when these estimates are revised. To the extent that these adjustments result in an increase, a reduction or an elimination of previously reported contract profit, we are required to recognize a credit or a charge against current earnings, which could be material.

Our business depends upon our operations to generate strong cash flow and to some extent upon the availability of financing sources to supply capital to fund our general operating activities, capital projects, interest and debt repayments, stock repurchases and dividends. Our inability to continue to generate sufficient cash flows to support these activities or the lack of available financing in adequate amounts and on appropriate terms when needed could adversely affect our financial performance including our earnings per share.

We receive and store certain personal information about our employees and our customers, including information permitting cashless payments, both in our stores and through our online operations at dillards.com. In addition, our operations depend upon the secure transmission of confidential information over public networks. Further, our ability to supply merchandise to and operate our stores, process transactions and generate performance and financial reports are largely dependent on the security and integrity of our information technology network. We, like other companies, face a risk of unauthorized access to devices and technology assets, as well as computer viruses, worms, bot attacks, ransomware and other destructive or disruptive software and attempts to misappropriate customer or employee information and cause system failures and disruptions. Such events can result in theft, alteration, deletion or encryption of data, or disruption of services provided by the devices and assets, as well as demands to pay a third party to regain access to encrypted files and prevent publication of stolen data. In addition, employee error, malfeasance or security lapses could result in exposure of confidential information or otherwise adversely disrupt or affect our operations. We rely on third-party service providers to provide hardware, software and services necessary to operate our information technology systems, and the same issues could occur at those third parties and have an effect on our operational technology or data. Such attacks, if successful, have the potential for creating a loss of sales, business disruption, reputational impact, litigation, liability to consumers, regulatory investigations, or otherwise adversely affect our ability to operate our business. We have a longstanding Information Security program committed to regular risk assessment and risk mitigation practices surrounding the protection of confidential data and our information technology systems and network. Our security controls include network segmentation, firewalls, identity and access controls, endpoint protection solutions, as well as specific measures like point-to-point encryption and tokenization solutions for payment card data. We also maintain data breach preparedness plans, conduct exercises to test response plans, and employ other methods to protect our data and networks, and promote security awareness. Our Senior Management and Board of Directors exercise oversight of our security measures through various methods, including participation in response preparedness discussions and discussions regarding assessments, expenditures related to security and security controls. It is possible that unauthorized persons might defeat our security measures, those of third-party service providers or vendors, and obtain personal information of customers, employees or others, or compromise our information technology systems. A breach, whether in our information technology systems or those of our third-party service providers or vendors, resulting in personal information being obtained by or exposed to unauthorized persons, could adversely affect our operations, results of operations, financial condition and liquidity, and could result in litigation against us or the imposition of penalties. Our reputation and our ability to attract new customers could be adversely impacted if we fail, or are perceived to have failed, to properly prevent and respond to these incidents. In addition, a security breach could require that we expend significant additional resources related to our information security systems and could result in a disruption of our operations, particularly our online sales operations. A ransomware attack may also result in exposure to business interruption and lost sales, ransom payments, costs associated with recovery of data and replacement of systems, exposure to customer and employee litigation from disclosure of confidential information, fines and penalties. A security breach also could result in a violation attributable to the Company of applicable privacy and other laws, and subject us to litigation by private customers, business partners, or securities litigation and regulatory investigations and proceedings, any of which could result in our exposure to civil or criminal liability. The regulatory environment surrounding information security, cybersecurity, and privacy is increasingly demanding, with new and changing requirements, such as the California Consumer Privacy Act. Security breaches, cyber incidents or allegations that we used personal information in violation of applicable privacy and other laws could result in significant legal and financial exposure.

Our operations are largely dependent upon the integrity, security and consistent operation of various systems and data centers, including the point-of-sale systems in the stores, our Internet website, data centers that process transactions, communication systems and various software applications used throughout our Company to order merchandise, track inventory flow, process transactions and generate performance and financial reports. Our information technology systems are also subject to damage or interruption from power outages, computer and telecommunications failures, computer viruses, cyberattacks and ransomware attacks, usage errors by our employees and other items discussed previously in Item 1A, catastrophic events such as fires, floods, earthquakes, tornadoes, hurricanes and acts of war or terrorism. We rely on third-party service providers to provide hardware, software and services necessary to operate our information technology systems. Outages, failures, viruses, attacks, catastrophic events, acts of war or terrorism, and usage errors by third-party service providers (or their vendors) could also affect our information technology systems. If our information technology systems are damaged or cease to function properly, we may have to make a significant investment to repair or replace them, and we may suffer loss of critical data and interruptions or delays in our operations in the interim, which could adversely affect our business and operating results. Additionally, to keep pace with changing technology, we must continuously provide for the design and implementation of new information technology systems and enhancements of our existing systems. We could encounter difficulties in developing new systems or maintaining and upgrading existing systems. Such difficulties could lead to significant expenses or to losses due to disruption in our business.

In the ordinary course of business, we may be involved in lawsuits and regulatory actions. We are impacted by trends in litigation, including, but not limited to, class-action allegations brought under various consumer protection, employment and privacy and information security laws. Additionally, we may be subject to employment-related claims alleging discrimination, harassment, wrongful termination and wage issues, including those relating to overtime compensation. We are susceptible to claims filed by customers alleging responsibility for injury suffered during a visit to a store or from product defects and to lawsuits filed by patent holders alleging patent infringement. We are also subject to claims filed under our employee stock ownership plan alleging failure to properly manage the plan. These types of claims, as well as other types of lawsuits to which we are subject from time to time, can distract management's attention from core business operations and impact operating results, particularly if a lawsuit results in an unfavorable outcome.