Kforce (KFRC) Risk Analysis

Our management, including our Chief Executive Officer and Chief Financial Officer, does not expect that our disclosure controls and internal controls will prevent all errors and all fraud. A control system, no matter how well conceived and operated, can provide only reasonable assurance that the objectives of the control system are met. If our management is unable to certify the effectiveness of our internal controls, including those over our third-party vendors, our independent registered public accounting firm cannot render an opinion on the effectiveness of our internal controls over financial reporting, or if material weaknesses in our internal controls are identified, we could be subject to regulatory scrutiny and a loss of public confidence, which could cause our stock price to decline.

We have a credit facility consisting of a revolving line of credit of up to $200.0 million, subject to certain limitations. Borrowings under the credit facility are secured by substantially all of the tangible and intangible assets of the Firm and certain other designated collateral. Adverse changes in credit markets, including increases in interest rates, could increase our cost of borrowing and/or make it more difficult to refinance our existing indebtedness, if necessary. Kforce is subject to certain affirmative and negative covenants under our credit facility. Our failure to comply with such restrictive covenants could result in an event of default, which, if not cured or waived, could result in Kforce being required to repay the outstanding balance before the due date. If this occurs, we may not be able to repay our debt or we may be forced to refinance on terms not acceptable to us, which could have a material adverse effect on our operating results and financial condition.

We expect to continue allocating significant investments towards our multi-year transformation program for our back-office technology, investing in our managed teams and project solutions capabilities, and evolving our nearshore and offshore delivery strategy. These improved capabilities are expected to help deliver exceptional service to our clients, consultants and candidates and improve the productivity of our associates and the scalability of our organization. New business strategies and initiatives, such as these, can be distracting to our management team and associates, and can also be disruptive to our operations. New business initiatives could also involve significant unanticipated challenges and risks, including not advancing our business strategy, not realizing the expected return on the investment, experiencing difficulty in implementing initiatives, or diverting management's attention from our other businesses. New business initiatives and strategic changes in the composition of our business mix can be a diversion to our management's attention from other business concerns and could be disruptive to our operations, which could cause our business and results of operations to suffer materially.

Our business is subject to regulation and licensing in many states. There can be no assurance that we will be able to continue to obtain all necessary licenses or approvals or that the cost of compliance will not prove to be material. If we fail to comply, such failure could have a material adverse effect on our financial results. A large part of our business entails employing individuals on a temporary basis and placing such individuals in client workplaces. Increased government regulation of the workplace or of the employer/employee relationship could have a material adverse effect on Kforce. For example, changes to government regulations, including changes to statutory hourly wage and overtime regulations, could adversely affect the Firm's results of operations by increasing its costs. Due to the substantial number of state and local jurisdictions in which we operate and the disparity among state and local laws that continues to accelerate, there also is a risk that we may be unaware of, or unable to adequately monitor, actual or proposed changes in, or the interpretation of, the laws or governmental regulations of such states and localities. Any delay in our compliance with changes in such laws or governmental regulations could result in potential fines, penalties or other sanctions for non-compliance.

Part of our business strategy includes enhancing our service offerings and relationships with larger consumers of our services, which is intended to provide relative durability to our revenue stream during adverse economic environments and enable us to grow our revenues more profitably. However, it also creates the potential for concentrating a significant portion of our revenues among our largest clients and exposes us to increased risks arising from decreases in the volume of business from, the pricing of business with, or the possible loss of business, with these clients. Organizational changes occurring within those clients, a deterioration of their financial condition or business prospects, or a change in their business strategies could reduce their need for our services and result in a significant decrease in the revenues we derive from those clients, which could have a material adverse effect on our financial results.

The COVID-19 economic and health crisis (including all of its variants) impacted many of our clients' business operations due to reduced demand, which in some cases was caused by government closures and/or initiatives to reduce costs or preserve cash, thereby decreasing demand for our services and/or adversely affecting our profitability and collectability of our accounts receivable. Outbreaks of disease, including epidemics and pandemics, can affect our operations and financial performance if potential new variants are declared, vaccines are mandated, and government actions to prevent and manage disease spread. Outbreaks of diseases could negatively affect our business, financial position, results of operations and/or cash flows in the future.

We are continuously exposed to unauthorized attempts to compromise sensitive information from network or information technology used by our associates and consultants. Attacks on information technology systems continue to grow in frequency and sophistication. These attacks include, but are not limited to, attempts to gain unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data or causing operational disruption. While we have policies, procedures and systems in place to prevent, deter and detect cyberattacks or security incidents, and, although we have not experienced a material data breach, we remain vulnerable to sophisticated techniques used to obtain unauthorized access, or cause system interruption, that change frequently and may not produce immediate signs of intrusion. As a result, we may be unable to anticipate these incidents or techniques, timely discover them or implement adequate preventative measures. Any cyberattack, unauthorized intrusion, malicious software infiltration, network disruption, corruption of data, misuse or theft of private or other sensitive information, or inadvertent acts by our associates, consultants or third-party independent contractors, could result in the disclosure or misuse of confidential or proprietary information, and could adversely impact our systems, services, operations, financial results and reputation with clients and potential clients. The collection, possession and use of personal information and data in conducting our business subjects us to legislative and regulatory burdens and compliance risk. Other results of these incidents could include, but are not limited to, increased cybersecurity protection costs, litigation, regulatory penalties, monetary damages and reputational damage adversely affecting client or investor confidence. We may be required to incur significant expenses to comply with mandatory privacy and security standards and protocols imposed by law, regulation, industry standards or contractual obligations. We maintain cyber risk insurance, but this insurance may not be sufficient to cover all of our losses suffered as a result of a breach of our systems or information. Our information technology may not provide sufficient protection, and as a result we may lose significant information about us, our employees, candidates, consultants, vendors, or clients. Additionally, many of our information technology systems and networks are cloud-based or managed by third parties, whose future performance and reliability we cannot control. The risk of a cyberattack or security breach on a third party carries the same risks to Kforce as those associated with our internal systems. We seek to reduce these risks by performing vendor due diligence procedures prior to engaging with any third-party vendor who will have access to sensitive data. Additionally, we require audits of certain third parties' information technology processes on an annual basis. However, there can be no assurance that such parties will not experience cybersecurity incidents that could adversely affect our employees, consultants, customers and businesses, or that our audit or diligence processes will successfully deter or prevent such breach.

Kforce is dependent on the proper functioning of information systems in operating our business. Critical information systems are used in every aspect of our daily operations, perhaps most significantly, in the identification and matching of resources to client assignments and in the client billing and consultant or vendor payment functions. Kforce's information systems may not perform as expected and are vulnerable to damage or interruption, including natural disasters, fire or casualty, theft, technical failures, terrorist acts, cybersecurity breaches, power outages, telecommunications failures, physical or software intrusions, computer viruses, employee errors or other events. While many of our systems are cloud-based, certain of our systems are still on location. Our corporate headquarters and data center are located in a hurricane-prone area. Failure or interruption of our critical information systems may require significant additional capital and management resources to resolve, which could have a material adverse effect on our business.