IdaCorp (IDA) Risk Analysis

Idaho Power operates in an industry that requires the continuous use and operation of sophisticated information technology and increasingly complex operational technology systems and network infrastructure. Idaho Power's generation and transmission facilities and its grid operations are potential targets for terrorist acts and threats, acts of war, social unrest, cyber and physical security attacks, and other disruptive activities of individuals or groups, including by nation states or nation state-sponsored groups. There have been cyber and physical attacks on energy infrastructure within the energy industry and on Idaho Power specifically in the past, and there are likely to be additional attacks in the future. Idaho Power and its vendors have been subject to, and will likely continue to be subject to, attempts to gain unauthorized access to systems and confidential information or to disrupt operations. The utility industry is continuing to experience an increase in the frequency and sophistication of cybersecurity incidents. Some of Idaho Power's facilities are deemed "critical infrastructure" under federal standards, in that incapacity or destruction of the facilities could have a debilitating impact on security, reliability, or operability of the bulk electric power system, national economic security, and public health and safety. Infrastructure facilities, such as power generation facilities and electric transmission or distribution facilities, could be direct targets of, or potential indirect casualties of, an act of terror or war or cyber or physical attack (whether originating internal to Idaho Power or externally), which might affect Idaho Power's operations by limiting the ability to generate, purchase, or transmit power. Idaho Power's electric transmission systems are part of an interconnected regional grid, and therefore, it faces the risk of causing or being subject to a long-term power outage due to grid disturbances or disruptions on a neighboring interconnected grid system. Cyber and physical threats and attacks can have cascading impacts that unfold with increasing speed across networks, information systems, and other technologies. Network, information systems, and technology-related events, including those caused by IDACORP or Idaho Power through process breakdowns, human error, security architecture or design vulnerabilities, or by third parties through cyber or physical security attacks, could result in a degradation or disruption in the energy grid and the services of the companies, as well as the ability to record, process, and report customer, business, and financial information. Physical or cyber attacks against key suppliers or service providers could have a similar effect on Idaho Power. Idaho Power's business operations require the continuous availability of information technology systems and network infrastructure, and in the normal course of business, Idaho Power or its vendors collect and store sensitive and confidential customer and employee information and proprietary information of Idaho Power. Idaho Power's technology systems are dependent upon connectivity to the internet and third-party vendors to host, maintain, modify, and update its systems, which may experience significant system failures or cyber attacks that could compromise the security of Idaho Power's assets and information. All information technology systems are vulnerable to being disabled, unauthorized access, unintentional defects, user error, errors in system changes, and cybersecurity incidents. Idaho Power is in the process of pursuing complex business system upgrades, and these significant changes increase the risk of system interruption. Any data security breaches, such as misappropriation, misuse, leakage, falsification or accidental release or loss of information maintained in Idaho Power's information technology systems or on third-party systems, including customer or employee data, could result in violations of privacy and other laws and associated litigation and liability for damages, fines, and penalties; financial loss to Idaho Power or to its customers; customer dissatisfaction or diminished customer confidence; and damage to Idaho Power's reputation, all of which could materially adversely affect Idaho Power's financial condition and results of operations. No security measures can completely shield Idaho Power's systems, infrastructure, and data from vulnerabilities to cyber attacks, human error, intrusions, or other catastrophic events that could result in their failure or reduced functionality, and ultimately the potential loss of sensitive information or the loss of Idaho Power's ability to fulfill critical business functions and provide reliable electric power to customers. Despite the steps Idaho Power may take to detect, mitigate, or eliminate threats and respond to security incidents, the techniques used by those who seek to obtain unauthorized access, and possibly disable or sabotage systems or abscond with information and data, change frequently and Idaho Power may not be able to protect against all such actions. Idaho Power actively monitors developments in cybersecurity and is involved in various related government and industry groups, and the company's board receives security updates at least quarterly. Although Idaho Power continues to make investments in its cybersecurity program, including personnel, technologies, and training of personnel, there can be no assurance that these systems or their expected functionality will be implemented, maintained, or expanded effectively; nor can security measures completely eliminate the possibility of a cybersecurity breach. Further, the implementation of security guidelines and measures has resulted in, and Idaho Power expects to continue to result in, increased costs. Terrorist attacks, acts of war, social unrest, cyber and physical security attacks, and similar incidents can also have indirect impacts by creating political, economic, social, or financial market instability, and can cause damage to or interference with Idaho Power's operating assets, customers, or suppliers. This may result in business interruption, lost revenue, higher commodity prices, disruption in fuel supplies, lower energy consumption, and unstable commodity and financial markets,particularly with respect to electricity and natural gas, any of which may materially adversely affect Idaho Power. These events, and governmental actions in response, could result in a material decrease in revenues and increase costs to protect, repair, and insure Idaho Power's assets and operate its infrastructure, systems, and business.

The power and gas utility industry faces stakeholder scrutiny related to sustainability matters. Certain stakeholders, such as investors, customers, suppliers, and lenders focus on the impact and social cost associated with climate change. Customers, suppliers, or other stakeholders could pursue, and in some cases have pursued, alternatives to Idaho Power's services or business as a result of their sustainability-related expectations. GHG emissions, including, most significantly CO2, could be further restricted in the future in response to additional state and federal regulatory requirements, increased scrutiny, and changing stakeholder expectations with respect to environmental and climate change programs, judicial decisions, and international accords. If new laws, regulations, or enforcement policies were to become effective, they could result in significant additional compliance and remediation costs that could negatively impact Idaho Power's future financial position, results of operations, and cash flows if such costs are not timely recovered through regulated rates. In addition, the focus on climate change and regulatory and legal requirements may result in Idaho Power facing adverse reputational risks associated with certain of its operations producing GHG emissions. If Idaho Power is unable to satisfy the climate-related expectations of certain stakeholders, IDACORP and Idaho Power may suffer reputational harm, which could cause IDACORP's stock price to decrease or cause certain investors and financial institutions not to purchase the companies' debt or equity securities or otherwise provide the companies with capital or credit on favorable terms, which may cause IDACORP's and Idaho Power's cost of capital to increase.

Operating risks associated with Idaho Power's power supply, transmission, and distribution facilities include equipment failures, volatility in fuel and transportation pricing, interruptions in fuel supplies, increased regulatory compliance costs, changes necessitated by environmental legislation or litigation, labor disputes or attrition, accidents and workforce safety matters, environmental damage, property damage, wildfires, acts of terrorism or war or sabotage (both cyber and asset-based), disruptions in supply chains or price increases resulting in the inability to obtain needed equipment or materials on reasonable terms or at all, the loss of cost-effective disposal options for solid waste such as coal ash, operator error, and the occurrence of catastrophic events at the facilities. Idaho Power maintains business continuity and disaster recovery plans, but such plans may be inadequate or not function as anticipated, which could result in delayed recovery after any such events. Diminished availability or performance of those facilities could result in reduced customer satisfaction, reputational harm, liability to third parties (including tort liability), and regulatory inquiries and fines. Operation of Idaho Power's owned and co-owned generating stations below expected capacity levels, or unplanned outages at these stations, could cause reduced energy output and lower efficiency levels and result in lost revenues and increased expenses for alternative fuels or wholesale market power purchases. Further, during high-load periods and other extraordinary events such as wildfires, the transmission system servicing Idaho Power's service area in the past has been, and in the future may be, constrained, limiting the ability to transmit electric energy within the service area and access electric energy from outside the service area. Idaho Power's transmission facilities are also interconnected with those of third parties, and thus operation of Idaho Power's and third-parties' facilities could be adversely affected by unexpected or uncontrollable events, such as wildfires. These transmission constraints and events could result in failure to provide reliable service to customers and the inability to deliver energy from generating facilities to the power grid, and the inability to access lower cost sources of electric energy. Idaho Power also enters into agreements with third-party contractors to perform work on its power supply, transmission, and distribution facilities, and may in some circumstances retain liability for the quality and completion of those contractors' work, potentially subjecting Idaho Power to penalties, liability for personal injury, loss of life, or property damage, reputational harm, or enforcement actions or liability if a contractor violates applicable laws, rules, regulations, or orders. Accidents, acts of terrorism or war, electrical contacts, fires, explosions, catastrophic failures, general system damage or dysfunction, intentional acts of destruction, uncontrolled release of water from hydropower dams, and other unplanned events related to Idaho Power's infrastructure would increase repair costs and may expose Idaho Power to liability for personal injury, loss of life, and property damage. Idaho Power maintains insurance coverage for such operating and event risks, but insurance coverage is subject to terms and limitations and may not be sufficient to cover Idaho Power's ultimate liability. Idaho Power may be unable to recover costs in excess of insurance through customer rates or regulatory mechanisms and, even if such recovery is possible, it could take several years to collect. If the amount of insurance is insufficient or otherwise unavailable, and if Idaho Power is unable to fully recover in rates the costs of uninsured losses, IDACORP's and Idaho Power's financial condition, results of operations, or cash flows could be materially adversely affected.

Idaho Power provides a noncontributory defined benefit pension plan covering most employees, as well as a defined benefit postretirement benefit plan (consisting of health care and death benefits) that covers eligible retirees. Costs of providing these benefits are based in part on the value of the plans' assets and, therefore, adverse investment performance for these assets or the failure to maintain sustained growth in pension investments over time could increase Idaho Power's plan costs and funding requirements related to the plans. Idaho Power's self-insured costs of health care benefits for eligible employees and retirees have increased in recent years and Idaho Power believes that future legislative changes related to the provision of health care benefits and other external market conditions and factors, could cause such costs to continue to rise. As benefit costs continue to rise, there is no assurance that the IPUC and OPUC will continue to allow recovery. The key actuarial assumptions that affect pension funding obligations are the expected long-term return on plan assets and the discount rate used in determining future benefit obligations. Idaho Power evaluates the actuarial assumptions on an annual basis, taking into account changes in market conditions, trends, and future expectations. Estimates of future investment market performance, changes in interest rates, and other factors Idaho Power and its actuary firms use to develop the actuarial assumptions are inherently uncertain, and actual results could vary significantly from the estimates. Changes in demographics, including timing of retirements or changes in life expectancy assumptions, may also increase Idaho Power's plan costs and funding requirements. Future pension funding requirements and the timing of funding payments are also subject to the impacts of changes in legislation. Depending on the timing of contributions to the plans and Idaho Power's ability to recover costs through rates, cash contributions to the plans could reduce the cash available for the companies' businesses and payment of dividends. For additional information regarding Idaho Power's funding obligations under its benefit plans, see Note 11 - "Benefit Plans" to the consolidated financial statements included in this report.

Idaho Power enters into transactions to buy and sell power, natural gas, and transmission service, enters into transactions to hedge its positions in coal, natural gas, power, and other commodities, and enters into economic hedge transactions to mitigate in part exposure to variable commodity prices. IDACORP and Idaho Power could recognize losses as a result of volatility in the market value of these contracts or if a counterparty fails to perform. The derivative instruments used for hedging might not offset the underlying exposure being mitigated as intended, due to pricing inefficiencies or other terms of the derivative instruments, and any such failure to mitigate exposure could result in losses. Certain of Idaho Power's purchase or sale, hedging, and derivative agreements may result in the receipt of, or posting of, collateral with counterparties. Fluctuations in commodity prices that lead to the posting of collateral with counterparties negatively impact liquidity, and downgrades in Idaho Power's credit ratings may lead to additional collateral posting requirements. In 2024, Idaho Power recorded losses on economic hedges of $63.3 million, compared with $16.2 million of losses in 2023. At times, Idaho Power's energy risk management policy results in Idaho Power entering into economic hedges in an environment where prices are high, and if prices are lower at the time the economic hedge settles, Idaho Power will record losses on the economic hedges. Depending on the volume of economic hedges and the degree of price volatility, those losses can be substantial, and the power cost adjustment mechanisms generally provide that Idaho Power will incur a portion of those losses. Forecasts of future fuel needs and loads and available resources to meet those loads are inherently uncertain and may cause Idaho Power to over- or under-hedge actual resource needs, exposing the company to market risk on the over- or under-hedged position. To the extent that commodity markets are illiquid, Idaho Power may not be able to execute its risk management strategies, which could result in undesired over-exposure to unhedged positions that Idaho Power may not be able to collect in customer rates. The FERC may take action to limit volatility in the energy market by imposing price limits or other market restrictions to control rates in market-based sales, which could adversely affect the companies' financial results. As a result, risk management actions, or the failure or inability to manage commodity availability and price and counterparty risk, may adversely affect IDACORP's and Idaho Power's financial condition and results of operations. Idaho Power has additional indirect credit exposures to financial institutions in the form of letters of credit provided as security by power suppliers under various purchased power contracts, by vendors for infrastructure development projects, and by customers or potential customers. If any of the credit ratings of the letter of credit issuers were to drop below investment grade, the vendor, supplier, customer, or potential customer would need to replace the security with an acceptable substitute, which may be impracticable and may expose Idaho Power to losses resulting from a default of the counterparty. If the security were not replaced, the counterparty could be in default under the contract and Idaho Power's remedies for default may be inadequate to fully compensate Idaho Power for its losses. Further, the bankruptcy or insolvency of a counterparty to commodity or other transactions could impair Idaho Power's ability to collect amounts receivable from those counterparties, potentially including the ability to collect or retain collateral posted by a counterparty. Idaho Power is a participant in the energy markets, including the Western EIM, and engages in direct and indirect power purchase and sale transactions in connection with that participation. The Western EIM has collateral posting requirements based on established credit criteria, but there is no assurance the collateral will be sufficient to cover obligations that counterparties may owe each other in the Western EIM and any such credit losses could be socialized to all Western EIM participants, including Idaho Power. A significant failure of a participant in the Western EIM to make payments when due on its obligations could have a ripple effect on various Idaho Power counterparties in the power, gas, and derivative markets if those counterparties experience ancillary liquidity issues, and could generally result in a decline in the ability of Idaho Power's counterparties to perform on their obligations.

Idaho Power's electric power sales are seasonal, with demand in Idaho Power's service area peaking during the hot summer months, with a secondary peak during the cold winter months. Electric power demands by irrigation customers in Idaho Power's service area, which are impacted by temperatures and the timing and amount of precipitation, can also create significant seasonal changes in usage. Seasonality of revenues may be further impacted by Idaho Power's tiered rate structure, under which rates charged to customers are often higher during higher-load periods, such as hot summers and cold winters. Market prices for power also often increase significantly during these peak periods, at times when Idaho Power is required to purchase power in the wholesale markets to meet customer demand. While Idaho Power has regulatory mechanisms to help mitigate the impact of weather on power supply costs, there is no assurance that it will continue to receive such regulatory protection in the future. By contrast, when temperatures are relatively mild or where precipitation supplants irrigation systems, loads are often lower as customers are not using electricity for heating and air conditioning or irrigation purposes. Thus, weather conditions and the timing and extent of precipitation can cause IDACORP's and Idaho Power's results of operations and financial condition to fluctuate seasonally, quarterly, and from year to year. Climate change could also have significant physical effects in Idaho Power's service area, such as increased frequency and severity of storms, lightning, high winds, icing events, droughts, heat waves, fires, floods, snow loading, and other extreme weather events. These extreme weather events and their associated impacts could damage transmission, distribution, and generation facilities, causing service interruptions and extended or mass outages, increasing costs, and limiting Idaho Power's ability to meet customer energy demand. Sustained drought conditions or decreased snow pack due to reduced precipitation or higher temperatures are likely to decrease power generation from hydropower plants. Prolonged periods of unfavorable wind or solar conditions will temporarily reduce or eliminate the availability of power from wind and solar facilities, respectively. This could limit Idaho Power's ability to meet customer demand for those periods. The costs of repairing and replacing infrastructure or any costs related to Idaho Power liability for personal injury, loss of life, and property damage from utility equipment that fails, including as a result of significant weather and weather-related events and the increasing threat of fires, may not be covered by insurance. Costs incurred in connection with such events might also not be recovered through customer rates if the costs incurred are greater than those allowed for recovery by regulators. Idaho Power's customers' energy needs vary with weather and to the extent weather conditions are affected by climate change, customers' energy use could increase or decrease. Increased energy use due to weather changes may require Idaho Power to invest in generating assets and transmission and distribution infrastructure, while decreased energy use due to weather changes may result in decreased revenues. Extreme weather conditions creating high energy demand may raise wholesale electricity prices for power that Idaho Power purchases to serve customers, increasing the cost of energy Idaho Power provides to its customers, and at the same time can increase the revenues Idaho Power receives for wholesale market sales of excess generation during regional extreme weather events. Variations in hydropower generation that increase Idaho Power's reliance on market purchases may lead to more costly power supply sources for its customers and reduce benefits from selling surplus hydropower in the wholesale market. The price of power in the wholesale energy markets tends to be higher during periods of high regional demand that tends to occur with weather extremes, which may cause Idaho Power to purchase power in the wholesale market during peak price periods, increasing power supply costs. Idaho Power has in place mechanisms to help mitigate the effects of energy market price volatility, but there is no assurance these mechanisms will continue to be in place or function as intended. In addition, state and federal legislation and regulations have been proposed in recent years and may be implemented in the future, intended to limit the severity and impact of climate change. Proposals have included imposing mandatory reductions in GHG emissions, which could increase Idaho Power's power supply and compliance costs or require generation facilities to be retired early, resulting in potential stranded costs and write-downs or write-offs if Idaho Power is unable to fully recover investments in such facilities. For additional information relating to legislation, regulations, and legal proceedings related to environmental matters, see Part II - Item 7 - MD&A - "Environmental Matters" in this report.

Changes in the number of customers and customers' use of electricity are affected by a number of factors, such as population growth or decline in Idaho Power's service area, expansion or loss of service area, changes in customer needs and expectations, changes to customer rates, adoption rates of energy efficiency measures, customer-generated power such as from solar panels and gas-fired generators, demand-side management requirements, regulation or deregulation, and economic conditions. Continued inflationary pressures, including as a result of new or increased tariffs or other trade restrictions, or an economic downturn or recession, could also negatively impact customer use and reduce revenues and cash flows, thus adversely affecting results of operations. Many electric utilities, including Idaho Power, have experienced a long-term decline in usage per customer, in part attributable to energy efficiency activities. State or federal regulations may be enacted to encourage or require mandatory energy conservation or technological advances that increase energy efficiency, which could further reduce usage per customer. Also, changing customer needs and expectations, such as a desire for increased renewable or low GHG-emitting sources of energy, increased customer rates as a result of recent rate cases and any future rate cases, and increased competition from customer-owned generation could lead to lower customer satisfaction, reduced loyalty, difficulty in obtaining rate increases, legislation to deregulate electric service, and customers seeking alternative sources of energy and electric service. If customers choose to generate their own energy, discontinue a portion or all service from Idaho Power, or replace electric power for heating with natural gas, demand for Idaho Power's energy may decline and adversely impact the affordability of its services for remaining customers. While Idaho Power has recently experienced a net growth in usage due to an increase in the number of customers, when adjusted for the impacts of weather, the average monthly usage on a per customer basis for Idaho Power's residential customers has declined from 1,032 kWh in 2012 to 914 kWh in 2024. There is also no guarantee that Idaho Power will continue to experience an increase in the number of customers at the current rate of growth or at all. Rate mechanisms, such as the Idaho FCA for residential and small commercial customers, are designed to address the financial disincentive associated with promoting energy efficiency activities, but there is no assurance that the mechanism will result in full or timely collection of Idaho Power's fixed costs, which are currently collected in large part through the company's volume-based energy rates that are based on historical sales volume. Any undercollection of fixed costs would adversely impact revenues, earnings, and cash flows. The formation of municipal utilities or similar entities for distribution systems within Idaho Power's service area could also result in a load decrease. Idaho Power is experiencing a rapid addition of new industrial and commercial customer load. It is possible that such new industrial and commercial customers may not meet forecasted power usage ramp rates or amounts. The loss of loads resulting from any of these events may result in excess infrastructure and stranded costs and require IDACORP and Idaho Power to modify or eliminate large generation, storage, or transmission projects. This could in turn result in reduced revenues as well as write-downs or write-offs if regulators determine that the costs of the projects were incurred imprudently, which could have a material adverse impact on IDACORP's and Idaho Power's financial condition, results of operations, and cash flows. Conversely, if Idaho Power were to experience an unanticipated increase in the demand for energy through, for example, the rapid addition of new industrial and commercial customers or population growth in the service area, Idaho Power may be required to rely on higher-cost purchased power to meet peak system demand and may need to accelerate investment in additional generation or transmission resources. Idaho Power's 2023 IRP preferred resource portfolio and action plan included a need to acquire significant generation and storage resources to meet forecasted increasing energy and capacity needs. There can be no assurance that these energy and capacity needs will not change or that the resources will be adequate to meet load demands, in which case Idaho Power would need to rely on additional wholesale power purchases and would be subject to the volatility of wholesale markets. If the incremental costs associated with unanticipated changes in loads exceed the incremental revenue received from the sales to the new customers, and Idaho Power is unable to secure timely and full rate relief to recover those increased costs, the resulting imbalance could have an adverse effect on IDACORP's and Idaho Power's financial condition, results of operations, and cash flows.