Global Industrial Company (GIC) Risk Analysis

Our ability to maintain available capacity in our distribution operations for stocked inventory and to enable on time shipment and deliveries, such as by timely implementing additional distribution resources, whether in the form of expanded or additional temporary and permanent facilities we operate or by outsourcing certain functions to third-party distribution and logistics partners, is critical to our ability to service our growing business. If we do not accurately forecast our future warehousing and distribution center needs, and then timely plan, fund on budget, launch and efficiently operate new distribution resources and facilities when needed, our operations and financial results could be materially adversely impacted. In addition, expanding and/or enhancing our distribution network would have an adverse impact on operating expenses as a percentage of sales, inventory turnover, and working capital requirements in the periods prior to and for some time following the commencement of operations for each such expansion or enhancement.

Our industry is subject to risks associated with U.S. and foreign laws relating to importing products, including quotas, duties, tariffs or taxes, as well as other charges or restrictions, which could adversely affect our ability to import products at desired cost or volume levels. The United States has enacted three sets of tariffs on a variety of foreign sourced goods which have impacted a number of the private brand products we source directly from China as well as third-party branded products our U.S. suppliers source from China. We strategically increased prices in an effort to offset the incremental costs on certain products and shift certain products to alternative sources where available. Our use of alternate sources of supply, such as utilizing new vendors in additional countries, entails various risks, such as identifying, vetting and managing new business relationships, reliance on new vendors, maintaining quality control over their products, and protecting our intellectual property rights. These tariffs have increased and will continue to increase our costs of procurement. If the Company is able to adequately review its supply chain and monitor sell prices in the market, and successfully work with suppliers to mitigate costs, the Company does not expect any material impact on its business from the tariff actions and continues to believe that any impact from the tariffs currently in effect will be gradual and not material to the business, although there can be no assurance that this will be the case. There can also be no assurance that we will be able to effectively or expeditiously mitigate these trade challenges, which could disrupt our operations, negatively impact our sales and would have a material adverse effect on our financial results. However, we do not believe that we will be disproportionately impacted by these costs as compared to our competitors, and we will continue to evaluate marketplace conditions and implement other actions or strategies as the need arises. Finally, we cannot predict whether additional U.S. and foreign customs quotas, duties (including anti-dumping or countervailing duties), tariffs, taxes or other charges or restrictions, requirements as to where raw materials must be purchased, additional workplace regulations or other restrictions on our imports will be imposed in the future and if so, what effect such actions would have on our costs of operations.

Our operations are dependent upon information technology that encompasses all of our major business functions. We use our information systems to, among other things, monitor our supply chain, make purchasing decisions, manage and replenish inventories, coordinate our sales and marketing activities, fill and ship customer orders on a timely basis and to monitor and record our financial transactions and results of operations. These systems also process, transmit and store sensitive electronic data, including employee personal information, supplier and customer records, allow vendors and customers to register on our portals and websites, as applicable, or otherwise allow third parties to communicate or interact with us. In addition, we depend on IT systems of third parties, to, among other things, market and distribute products, to operate our websites, host and manage our services, store data, and process transactions. We may share information with these third parties that participate in certain aspects of our business, and we obtain external auditor certification on the controls and security of any significant outsourced service provider according to the SSAE 18 standard. However, there is always a risk that the confidentiality of data held or accessed by them may be compromised. In processing our sales orders, we often collect personal information and transmit credit card information of our customers. If there was a security breach resulting in unauthorized access to or use of such information, we could be subject to claims for identity theft, unauthorized purchases and claims alleging misrepresentation of our privacy and data security practices or other related claims. While the Company believes it conforms to appropriate Payment Card Industry ("PCI") security standards, any breach involving the loss of credit card information may lead to significant PCI related fines. In the event of a severe breach, credit card providers may prevent our accepting of credit cards. We measure our data security effectiveness through industry accepted methods and remediate significant findings. We maintain and routinely test backup systems and disaster recovery, along with external network security penetration testing by an independent third-party as part of our business continuity preparedness. We also have processes in place to prevent disruptions resulting from the implementation of new software and systems of the latest technology. We have implemented solutions, processes, and procedures to help mitigate the risk of cyber-attacks, such as conducting annual vulnerability testing, identifying remediation initiatives and establishing emergency response plans, but there can be no assurance these efforts will successfully deter future cyber-attacks. Our Audit Committee is responsible for oversight of the activities of our IT department (which reports to our Senior Vice President and Chief Information Officer ("CIO")) and receives quarterly reports from our CIO that cover, among other things, cybersecurity threats, mitigation measures, and preventative procedures and software. Although our IT systems are protected through various network security measures, our facilities and systems, and those of our third-party service providers with which we do business, may nevertheless be vulnerable to security breaches, cyber-attacks (any adverse event that threatens the confidentiality, integrity or availability of our information resources) vandalism, power outages, natural disasters, computer system failures, telecommunication or network failures, computer viruses, malware, misplaced or lost data, programming and/or human errors or other similar events. From time to time, we have experienced efforts by unknown persons, including "bots", to access or breach our information systems, and these efforts can be expected to continue in the future. Furthermore, the ongoing military conflicts between Ukraine and Russia and in the Middle East and the potential for retaliatory acts of cyberwarfare from Russia or other state or non-state actors against U.S. companies could result in increased cyber-attacks against us. While we have successfully defended against such efforts in the past, there can be no assurance we will be able to protect sensitive data and/or the integrity of the Company's information systems and to defend against such efforts in the future. Any security breach involving the misappropriation, loss or other unauthorized disclosure of our confidential information or confidential information of our customers, employees, or suppliers, whether by us or by our third-party service providers, could disrupt our business, expose us to risks of litigation (such as customer or third-party claims that their data has been compromised) and liability, result in a loss of assets or cause reputational damage, and otherwise have a material adverse effect on our operations and financial condition. Any substantial disruption of our systems could impair our ability to process orders, maintain proper levels of inventories, manage customer billings and collections, prepare and present accurate financial statements and related information, and otherwise materially adversely affect our ability to manage our business. We maintain cyber liability risk insurance, but this insurance may not be sufficient to cover all of our losses from any future breaches of our systems, or to cover the cause of the future specific situation/loss at hand. In addition, as privacy and information security laws and standards evolve, we may need to incur significant additional investment in technology and other processes to meet new legal requirements.

From time to time, we are involved in lawsuits or other legal proceedings arising in the ordinary course of our business. These include patent, trademark or other intellectual property matters, employment law matters, states sales tax claims on internet/e-commerce transactions, product liability, commercial disputes, consumer sales practices, or other matters. In addition, as a public company we could from time to time face claims relating to corporate or securities law matters. The defense and/or outcome of such lawsuits or proceedings could have a material adverse effect on our business. See "Legal Proceedings".

Under various national, state and local environmental laws and regulations in North America, a current or previous owner or operator (including the lessee) of real property may become liable for the costs of removal or remediation of hazardous substance at such real property. Such laws and regulation often impose liability without regard to fault. We lease all of our facilities. In connection with such leases, we could be held liable for the costs of removal or remedial actions with respect to hazardous substances. Although we have not been notified of, and are not otherwise aware of, any material real property environmental liability, claim or non-compliance, there can be no assurance that we will not be required to incur remediation or other costs in connection with real property environmental matters in the future. If such costs were to prove material, our operating results could be adversely affected.