IQVIA Holdings (IQV) Risk Analysis

We rely upon the security of our computer and communications systems infrastructure to protect us from cyberattacks and unauthorized access. Cyberattacks can include malware, computer viruses, hacking or other significant disruption of our computer, communications and related systems. Third parties may attempt to improperly persuade customers, suppliers, vendors, partners, employees or others to disclose sensitive information such as user names, passwords or other information that can be used to gain unauthorized access to systems or data. Cyber threats are rapidly evolving and are becoming increasingly sophisticated. As cyber threats evolve and become more difficult to detect and successfully defend against, one or more cyber threats might defeat the measures that we or our vendors take to anticipate, detect, avoid or mitigate such threats. Certain techniques used to obtain unauthorized access, introduce malicious software, disable or degrade service, or sabotage systems may be designed to remain dormant until a triggering event and we may be unable to anticipate these techniques or implement adequate preventative measures since techniques change frequently or are not recognized until launched, and because cyberattacks can originate from a wide variety of sources. Our preventive and remedial actions may not be successful. We have acquired various companies, products, services and technologies over the years. While we make significant efforts to identify and address IT security issues with respect to these acquisitions, we may still inherit security risks associated with these activities. The size and complexity of our IT and information security systems, and those of our vendors (and the large amounts of confidential information that is present on them), make such systems potentially vulnerable to service interruptions or to security breaches from inadvertent or intentional actions including, but not limited to, by our employees, contingent workers, service providers, business partners, customers or malicious attackers. Such attacks, whether successful or unsuccessful, could result in our incurring costs related to, for example, rebuilding internal systems, defending against litigation, responding to regulatory inquiries or actions, paying damages or fines, or taking other remedial steps with respect to third parties. Publicity about vulnerabilities and attempted or successful incursions could damage our reputation with clients and data suppliers and reduce demand for our services. We also store proprietary and sensitive information in connection with our business, which could be compromised by a cyberattack. To the extent that any disruption or security breach results in a loss or damage to our data, an inappropriate disclosure of proprietary or sensitive information, an inability to access data sources, or an inability to process data or provide our offerings to our clients, it could cause significant damage to our reputation, affect our relationships with our data suppliers and clients (including loss of suppliers and clients), lead to claims against us and ultimately harm our business. We may be required to incur significant costs to alleviate, remedy or protect against damage caused by these disruptions or security breaches in the future. We may also face inquiry or increased scrutiny from government agencies as a result of any such disruption or breach. While we have insurance coverage for certain instances of a cyber security breach, our coverage may not be sufficient if we suffer a significant attack or multiple attacks. Any such breach or disruption could have a material adverse effect on our operating results and our reputation as a service provider. Some of our vendors have significant responsibility for the security of certain of our data centers and computer-based platforms or software-as-a-service ("SaaS") applications upon which our businesses rely to host or process data or to perform various functions. Also, our data suppliers have responsibility for security of their own computer and communications environments. These third parties face risks relating to cyber security similar to ours, which could disrupt their businesses and therefore materially impact ours. Accordingly, we are subject to any flaw in or breaches to their computer and communications systems or those that they operate for us, which could result in a material adverse effect on our business, operations and financial results. The risk of cyberattacks has increased in connection with geopolitical events and dynamics. State-sponsored parties or their supporters may launch retaliatory cyberattacks, and may attempt to cause supply chain disruptions, or carry out other geopolitically motivated actions that may adversely disrupt or degrade our operations and may result in data compromise. State-sponsored actors have carried out cyberattacks to accomplish their goals that may include espionage, monetary gain, disruption, and destruction.

Our effective income tax rate is influenced by our projected profitability in the various taxing jurisdictions in which we operate. Changes in a jurisdiction's income tax rates and the distribution of our profits and losses among such jurisdictions may have a significant impact on our effective income tax rate, which in turn could have an adverse effect on our net income and earnings per share. Other factors that may affect our effective income tax rate include, but are not limited to: - changes in the value of deferred tax assets and liabilities;- changes in tax laws in various jurisdictions;- audits by taxing authorities; and - the establishment of valuation allowances against deferred income tax assets if we determined that it is more likely than not that future income tax benefits will not be realized. In the course of our business, there are many transactions and calculations where the ultimate tax determination is uncertain which may require the use of estimates and significant judgement to account for their impact on the effective income tax rate in our consolidated financial statements. As the regulations and guidance evolve with respect to current and newly enacted tax law, our results may differ from previous estimates and may materially affect our consolidated financial statements. All of these items described above may cause fluctuations in our effective income tax rate through increased income tax liability and/or the loss of tax attributes in any given year that could adversely affect our results of operations and impact our earnings and earnings per share. Additional information regarding our income taxes is presented in Note 16 to our audited consolidated financial statements included in this Annual Report on Form 10-K.

The confidentiality, collection, use, retention, security, transfer and disclosure of personal data, including individually identifiable health information and clinical trial patient-specific information, are subject to governmental regulation generally in the country that the personal data were collected or used (collectively, "Privacy Laws"). For example, United States federal regulations under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") create specific requirements for the protection of the privacy and security of individual health information. These provisions apply to both "covered entities" (primarily health care providers and health insurers) and their "business associates" or service providers. As there are some instances where we are a HIPAA "business associate" of a "covered entity," we can be directly liable for mishandling protected health information. Under HIPAA's enforcement scheme, we can be subject to significant penalties in connection with HIPAA violations, along with the potential for significant other expenditures related to these activities. These rules require individuals' written authorization in many situations, in addition to any required informed consent, before protected health information may be used for research. We are both directly and indirectly affected by the privacy provisions surrounding individual authorizations because many investigators with whom we are involved in clinical trials are directly subject to them and because we obtain identifiable health information from third parties that are subject to such various Privacy Laws. In general, patient health information is among the most sensitive (and highly regulated) of personal information. Privacy Laws in the United States and around the world are designed to ensure that information about an individual's healthcare is properly protected from inappropriate access, use and disclosure. Privacy Laws also include the European Union's ("EU") General Data Protection Regulation, Canada's Personal Information Protection and Electronic Documents Act and other data protection, privacy, data security, data localization and similar national, state/provincial and local laws. In the EU and in many other regions or countries, personal data includes any information that relates to an identifiable natural person. Health information about an identifiable person carries additional obligations under these laws, including obtaining the explicit consent from the individual for collection, use or disclosure of the information. In addition, we are subject to EU rules with respect to cross-border transfers of such data out of the EU (along with similar data transfer requirements or data localization requirements in other countries). We have established frameworks, models, processes and technologies to manage privacy and security for many data types, from a variety of sources, and under a myriad of Privacy Laws. In addition, we rely on our data suppliers to deliver information to us in a form and in a manner that complies with applicable Privacy Laws. These laws are complex and there is no assurance that the safeguards and controls employed by us or our data suppliers will be sufficient to prevent a breach of these laws, or that claims will not be filed against us or our data suppliers despite such safeguards and controls. Failure to comply with such laws, certain certification/registration and annual re-certification/registration provisions associated with these data protection and privacy regulations, and similar rules in various jurisdictions, or to resolve any serious privacy complaints, may result in, among other things, regulatory sanctions, criminal prosecution, civil liability, negative publicity, damage to our reputation, or data being blocked from use or liability under contractual provisions. Laws and expectations relating to privacy continue to evolve, and we continue to adapt to changing needs. For example, the definition of "personally identifiable information" and "personal data" continues to evolve and broaden and many new laws and regulations are being enacted. In addition, certain established programs have been (or are at risk of being) declared invalid (such as the EU-U.S. Privacy Shield framework that operated for several years but was struck down by the European Court of Justice in July, 2020). While the replacement for the EU-U.S. Privacy Shield (the EU-U.S. Data Privacy Framework or "DPF") has been approved for the transfer of personal data from the EU to certified companies in the U.S., the DPF is also subject to legal challenges and potential invalidation, thereby rendering data transfers from the EU to the US legally uncertain and keeping the area of data transfers in a state of flux. Changes to these programs may adversely impact our ability to provide services to our clients or develop new products or services. Federal, state and foreign governments are contemplating or have proposed or adopted new Privacy Laws or modifications to existing Privacy Laws, including by amendment, replacement or interpretation through judicial or administrative decisions. New or modified Privacy Laws might, among other things, require us to implement new security measures and processes or bring within the scope of the Privacy Law other data not currently regulated, each of which may require substantial expenditures or limit our ability to offer some of our services. Additionally, changes in Privacy Laws may limit our data access, use and disclosure, and may require increased expenditures by us or may dictate that we not offer certain types of services. Any of the foregoing may have a material adverse impact on our ability to provide services to our clients or maintain our profitability. There is ongoing concern from privacy advocates, regulators and others regarding data protection and privacy issues, and the number of jurisdictions with Privacy Laws has been increasing. Also, there are ongoing public policy discussions regarding whether the standards for de-identified, anonymous or pseudonymized health information are sufficient, and the risk of re-identification sufficiently small, to adequately protect patient privacy. These discussions may lead to further restrictions on the use of such information. There can be no assurance that these initiatives or future initiatives will not adversely affect our ability to access and use data or to develop or market current or future services. Many Privacy Laws protect more than patient information, and although they vary by jurisdiction, these laws can extend to employee information, business contact information, provider information and other information relating to identifiable individuals. Failure to comply with these laws may result in, among other things, civil and criminal liability, negative publicity, damage to our reputation and liability under contractual provisions. In addition, compliance with such laws may require increased costs to us or may dictate that we not offer certain types of services. The occurrence of any of the foregoing could impact our ability to provide the same level of service to our clients, require us to modify our offerings or increase our costs, which could materially and adversely affect our operating results and financial condition.

Our success substantially depends on the collective performance, contributions and expertise of our personnel including senior management and key personnel, qualified professional, scientific and technical operating staff and qualified sales representatives for our contract sales services. There is significant and increasing competition for qualified personnel, particularly those with higher educational degrees, such as a medical degree, a Ph.D. or an equivalent degree, or relevant experience in the industry, including highly technical specialties such as clinical research associates, project managers and technology developers, and in the locations in which we operate. Increases in inflation, competition and shortages of qualified personnel in certain specialty areas may make it more difficult to hire and retain our key employees and could result in substantial increased costs, such as increased wage rates to attract and retain employees. The departure of our key employees, or our inability to continue to identify, attract and retain qualified personnel or replace departed personnel in a timely fashion, may impact our ability to grow our business and compete effectively in our industry and may negatively affect our ability to meet financial and operational goals.

Each of our Technology & Analytics Solutions information services is derived from data we collect from third parties. These data suppliers are numerous and diverse, reflecting the broad scope of information that we collect and use in our business. Although we typically enter into long-term contractual arrangements with many of these suppliers of data, at the time of entry into a new contract or renewal of an existing contract, suppliers may increase restrictions on our use of such data, increase the price they charge us for data or refuse altogether to license the data to us. In addition, during the term of any data supply contract, suppliers may fail to adhere to our data quality control standards or fail to deliver data. Further, although no single individual data supplier is material to our business, if a number of suppliers collectively representing a significant amount of data that we use for one or more of our services were to impose additional contractual restrictions on our use of or access to data, fail to adhere to our quality-control standards, repeatedly fail to deliver data or refuse to provide data, now or in the future, our ability to provide those services to our clients could be materially adversely impacted, which may harm our operating results and financial condition. Additionally, we depend on third parties for support services to our business. Such support services include, but are not limited to, third- party transportation providers, suppliers of drugs for patients participating in clinical trials, suppliers of kits for use in our clinical trial laboratories business, suppliers of reagents for use in our testing equipment and providers of maintenance contracts for our equipment. The failure of any of these third parties to adequately provide the critical support services could have a material adverse effect on our business.

We maintain insurance designed to provide coverage for ordinary risks associated with our operations and our ordinary indemnification obligations. The coverage provided by such insurance may not be adequate for all claims we may make or may be contested by our insurance carriers. If our insurance is not adequate or available to pay liabilities associated with our operations, or if we are unable to purchase adequate insurance at reasonable rates in the future, our profitability may be adversely impacted.

We have significant operations in countries that may require complex arrangements to deliver services throughout the world for our clients. Additionally, we have established operations in locations remote from our most developed business centers. As a result, we are subject to heightened risks inherent in conducting business internationally, including the following: - required compliance with a variety of local laws and regulations which may be materially different than those to which we are subject in the United States or which may change unexpectedly; for example, conducting a single clinical trial across multiple countries is complex, and issues in one country, such as a failure to comply with local regulations or restrictions, may affect the progress of the clinical trial in the other countries, resulting in delays or potential cancellation of contracts, which in turn may result in loss of revenues;- the United States or foreign countries have and could continue to enact legislation or impose regulations or other restrictions, including unfavorable labor regulations, tax policies, trade barriers, or economic sanctions, which could have an adverse effect on our ability to conduct business in or expatriate profits from the countries in which we operate, including hiring, retaining and overseeing qualified management personnel for managing operations in multiple countries, differing employment practices and labor issues, and tax-related risks, including the imposition of taxes and the lack of beneficial treaties, that result in a higher effective tax rate for us;- foreign countries are expanding or may expand their regulatory framework with respect to patient informed consent, protection and compensation in clinical trials, which could delay or inhibit our ability to conduct clinical trials in such jurisdictions;- the regulatory or judicial authorities of foreign countries may not enforce legal rights and recognize business procedures in a manner in which we are accustomed or would reasonably expect;- local, economic, political and social conditions, including sustained increases in inflation rates and/or potential hyperinflationary conditions, political instability, and potential nationalization, repatriation, expropriation, price controls or other restrictive government actions, including changes in political and economic conditions may lead to changes in the business environment in which we operate, as well as changes in foreign currency exchange rates;- immigration laws are subject to legislative change and varying standards of application and enforcement due to political forces, economic conditions or other events (including proposals in the U.S. to change limitations on temporary and permanent workers), and local immigration laws may require us to meet certain other legal requirements as a condition to obtaining or maintaining entry visas, which may impact our ability to provide services to our clients;- potential violations of local laws or anti-bribery laws, such as the United States Foreign Corrupt Practices Act ("FCPA"), and the UK Bribery Act, may cause difficulty in managing foreign operations, as well as significant consequences to us if those laws are violated;- clients in foreign jurisdictions may have longer payment cycles, and it may be more difficult to collect receivables in foreign jurisdictions; and - natural disasters, public health emergencies and pandemics such as the COVID-19, including any variants, or international conflict, such as the ongoing conflict between Russia and Ukraine, or terrorist acts, could interrupt our services, endanger our personnel, lower patient visits and increase patient drop-out rates, cause delays in recruitment of new patients, decrease the productivity of our clinical research associates, cause other project delays or loss of clinical trial materials or results. These risks and uncertainties could negatively impact our ability to, among other things, perform large, global projects for our clients. Furthermore, our ability to deal with these issues could be affected by applicable United States laws and the need to protect our assets. Any such risks could have an adverse impact on our financial condition and results of operations.

While we have determined that, at this time, climate change does not present a material risk to our business given the nature of our activities, we continue to evaluate and mitigate our business risks associated with climate change, and we recognize that there are inherent climate-related risks wherever business is conducted. Any of our office or IT systems locations may be vulnerable to the adverse effects of climate change. Furthermore, climate change may impact patients in our clinical trials and our employees, particularly where they work remotely. Changing market dynamics, global policy developments, and the increasing frequency and impact of extreme weather events on critical infrastructure have the potential to disrupt our business, the business of our third-party suppliers, and the business of our customers, and may cause us to experience losses and additional costs to maintain or resume operations.

Because a large portion of our revenues and expenses are denominated in currencies other than the United States dollar and our financial statements are reported in United States dollars, changes in foreign currency exchange rates could significantly affect our results of operations and financial condition. Exchange rate fluctuations between local currencies and the United States dollar create risk in several ways, including: - Foreign Currency Translation Risk. The revenues and expenses of our foreign operations are generally denominated in local currencies and translated into United States dollars for financial reporting purposes. Accordingly, exchange rate fluctuations will affect the translation of foreign results into United States dollars for purposes of reporting our consolidated results. Unanticipated currency fluctuations have affected and could continue to affect our financial results and cause our results to differ from investor expectations or our own guidance in any future periods. - Foreign Currency Transaction Risk. We are subject to foreign currency transaction risk for fluctuations in exchange rates during the period of time between the consummation and cash settlement of a transaction. We earn revenues from our service contracts over a period of several months and, in some cases, over several years. Accordingly, exchange rate fluctuations during this period may affect our profitability with respect to such contracts. - Foreign Currency Risk from Differences in Customer Contract Currency and Operating Costs Currency. The majority of our Research & Development Solutions global contracts are denominated in U.S. dollars or Euros while our operating costs in foreign countries are denominated in various local currencies. Fluctuations in the exchange rates of the currencies we use to contract with our customers and the currencies in which we incur cost to fulfill those contracts can have an adverse impact on our results of operations. We may aim to limit these risks through exchange rate fluctuation provisions stated in our service contracts, or we may hedge our transaction risk with foreign currency exchange contracts or options. We have not, however, hedged all of our foreign currency transaction risk, and we may experience fluctuations in financial results from our operations outside the United States and foreign currency transaction risk associated with our service contracts.