Kroger Company (KR) Risk Analysis

Our indebtedness could reduce our ability to obtain additional financing for working capital, mergers and acquisitions or other purposes and could make us vulnerable to future economic downturns as well as competitive pressures. If debt markets do not permit us to refinance certain maturing debt, we may be required to dedicate a substantial portion of our cash flow from operations to payments on our indebtedness. Changes in our credit ratings, or in the interest rate environment, could have an adverse effect on our financing costs and structure.

Our operating results could be materially affected by changes in overall economic conditions and other economic factors that affect consumer confidence and spending, including discretionary spending. Future economic conditions affecting disposable consumer income such as employment levels, business conditions, overall economic slowdown or recession, changes in housing market conditions, changes in government benefits such as SNAP/EBT, student loan relief, or child care credits, the availability of credit, interest rates, inflation, disinflation or deflation, tax rates and other matters could reduce consumer spending. Inflation could materially affect our operating results through increases to our cost of goods, supply chain costs and labor costs. In addition, the economic factors listed above, or any other economic factors or circumstances resulting in higher transportation, labor, insurance or healthcare costs or commodity prices, and other economic factors can increase our merchandise costs and operating, general and administrative expenses and otherwise adversely affect our financial condition, results of operations or cash flows. Increased fuel prices also have an effect on consumer spending and on our costs of producing and procuring products that we sell. A deterioration in overall economic conditions, including the uncertainty caused by inflation rate volatility, could adversely affect our business in many ways, including slowing sales growth, reducing overall sales and reducing gross margins. Geopolitical and catastrophic events, such as wars and conflicts, civil unrest, acts of terrorism or other acts of violence, including active shooter situations (which have occurred in the past at our locations), or the loss of merchandise as a result of shrink or industry-wide theft and organized retail crime, or pandemics or other health crises, and other matters that could reduce consumer spending, could materially affect our financial condition, results of operations or cash flows. We regularly maintain cash balances at third-party financial institutions in excess of the Federal Deposit Insurance Corporation ("FDIC") insurance limit and are therefore reliant on banks and other financial institutions to safeguard and allow ready access to these assets. If banks or financial institutions enter receivership or become insolvent in the future in response to financial conditions affecting the banking system and financial markets, our ability to access our existing cash, cash equivalents and investments may be threatened. We are unable to predict how the global economy and financial markets will perform. If the global economy and financial markets do not perform as we expect, it could adversely affect our business, financial condition, results of operations or cash flows. Our operating results could be adversely affected by any future disease outbreak, including pandemics, epidemics, or similar widespread health concerns. We cannot predict with certainty the extent that our operations may be affected by any effects of the foregoing on us or on our customers, suppliers, vendors, and other business partners, and each of their financial conditions; however, any adverse effect on these parties could materially and adversely affect us. To the extent that any health crisis affects the U.S. and global economy and our business, it may also heighten other risks described in this section, including but not limited to those related to consumer behavior and expectations, competition, implementation of strategic initiatives, cybersecurity threats, payment-related risks, supply chain disruptions, labor availability and cost, litigation and operational risk as a result of regulatory requirements.

We are subject to various laws, regulations, and administrative practices that affect our business, including laws and regulations involving antitrust and competition, privacy, data protection, environmental, healthcare, anti-bribery, anti-corruption, tax, accounting, and financial reporting or other matters. These and other rapidly changing laws, regulations, policies and related interpretations, as well as increased enforcement actions by various governmental and regulatory agencies, create challenges for us, may alter the environment in which we do business and may increase the ongoing costs of compliance, which could adversely affect our financial condition, results of operations and cash flows. If we are unable to continue to meet these challenges and comply with all laws, regulations, policies and related interpretations, it could negatively affect our reputation and our business results. Additionally, we are currently, and in the future may be, subject to a number of inquiries, investigations, claims, proceeding, and requests for information from governmental agencies or private parties, the adverse outcomes of which could harm our business. Failure to successfully manage these new or pending regulatory and legal matters and resolve such matters without significant liability or damage to our reputation may adversely affect our financial condition, results of operations and cash flows. Furthermore, if new or pending legal or regulatory matters result in fines or costs in excess of the amounts accrued to date, that may also materially affect our financial condition, results of operations or cash flows. In addition, increasing governmental and societal attention to environmental, social, and governance ("ESG") matters, including expanding voluntary reporting, diligence, and disclosure on topics such as climate change, waste production, water usage, human capital, labor, and risk oversight, could expand the nature, scope, and complexity of matters that we are required to control, assess, and report and could negatively affect our reputation. Given our commitment to our ESG strategy, we have established and publicly announced certain goals which we may refine or even expand further in the future. The execution of this strategy to achieve these goals is subject to risks and uncertainties, many of which may be outside of our control and prove to be more costly than we anticipate. These risks and uncertainties include, but are not limited to, our ability to achieve our goals within the currently projected costs and the expected timeframes; unforeseen operational and technological difficulties; the outcome of research efforts and future technology developments; and the success of our collaborations with and reliance on third parties. Any failure, or perceived failure, to achieve these goals or the setting or publication of certain targets could damage our reputation and customer, investor and other stakeholder relationships, and may even result in regulatory enforcement action. Such conditions could have an adverse effect on our business, financial condition, results of operations or cash flows. Additionally, we must comply with numerous provisions regulating, among other things, health and sanitation standards, food labeling and safety, equal employment opportunity, minimum wages and licensing for the sale of food, drugs, and alcoholic beverages. We cannot predict future laws, regulations, interpretations, administrative orders, or applications, or the effect they will have on our operations. They could, however, significantly increase the cost of doing business. They also could require the reformulation of some of the products that we sell (or manufacture for sale to third parties) to meet new standards. We also could be required to recall or discontinue the sale of products that cannot be reformulated. These changes could result in additional record keeping, expanded documentation of the properties of certain products, expanded or different labeling, or scientific substantiation. Any or all of these requirements could have an adverse effect on our financial condition, results of operations or cash flows.

From time to time, we are a party to legal proceedings, including matters involving personnel and employment issues, personal injury, contract disputes, regulatory claims and other proceedings. Other legal proceedings purport to be brought as class actions on behalf of similarly situated parties. Some of these proceedings could result in a substantial loss to Kroger. We estimate our exposure to these legal proceedings and establish accruals for the estimated liabilities, where it is reasonably possible to estimate and where an adverse outcome is probable. Assessing and predicting the outcome of these matters involves substantial uncertainties. Adverse outcomes in these legal proceedings, or changes in our evaluations or predictions about the proceedings, could have an adverse effect on our financial condition, results of operations or cash flows. Please also refer to the "Litigation" section in Note 12 to the Consolidated Financial Statements. We use a combination of insurance and self-insurance to provide for potential liability for workers' compensation, automobile and general liability, property, director and officers' liability, cyber risk exposure and associate health care benefits. Any actuarial projection of losses is subject to a high degree of variability. With respect to insured matters, we are liable for retention amounts that vary by the nature of the claim, and some losses may not be covered by insurance. Changes in legal claims, trends and interpretations, variability in inflation rates, changes in the nature and method of claims settlement, benefit level changes due to changes in applicable laws, insolvency of insurance carriers, and changes in discount rates could all affect our financial condition, results of operations or cash flows.

The operating environment for the food retailing industry continues to be characterized by the proliferation of local, regional, and national retailers, including both retail and digital formats, and intense and ever-increasing competition ranging from online retailers, mass merchant, club stores, regional chains, deep discounters, and dollar stores, as well as ethnic, specialty and natural food stores. With the proliferation of grocery delivery – both by retailers and third-party delivery service providers – customers have an even wider range of retailers from which to choose. Customers continue to expect a great shopping experience both in-store and online. The industry continues to be shaped by e-commerce, cooking at home and prepared foods to go and other customer needs and preferences. Customers want to be able to shop on their own terms with zero compromise whether at brick and mortar stores or online, pick-up or delivery, depending on their particular trip needs and other factors. If we do not appropriately or accurately anticipate customer preferences or fail to quickly adapt to these ever-changing preferences, our sales and profitability could be adversely affected. If we fail to meet the evolving needs of our customers, our ability to compete and our financial condition, results of operations or cash flows could be adversely affected. We are continuing to enhance the customer connection with investments in our four strategic pillars – Seamless, Personalization, Fresh, and Our Brands. Each of these strategies is designed to better serve our customers and to generate customer loyalty and sustainable growth momentum. We believe our plans to continue to improve these four strategic pillars will enable us to meet the wide-ranging needs and expectations of our customers. If we are unable to continue to enhance the foregoing key elements of our connection with customers, or they fail to strengthen customer loyalty, our ability to compete and our financial condition, results of operations or cash flows could be adversely affected. Our ecosystem monetizes the traffic and data insights generated by our retail grocery business to create fast-growing, asset-light and margin-rich revenue streams. Growth in loyal households, customer traffic and digitally engaged customers allow us to grow profits and power the flywheel in our model. We may be unsuccessful in implementing our alternative profit strategy, which could adversely affect our business growth and our financial condition, results of operations or cash flows. The nature and extent to which our competitors respond to the evolving and competitive industry by developing and implementing their competitive strategies could adversely affect our profitability. In addition, evolving customer preferences and the advancement of online, delivery, ship to home and mobile channels in our industry increase the competitive environment. We must anticipate and meet these evolving customer preferences and continue to implement technology, software and processes to be able to conveniently and cost-effectively fulfill customer orders. Providing flexible fulfillment options and implementing new technology is complex and may not meet customer preferences. If we are not successful in reducing or offsetting the cost of fulfilling orders outside of our in-store channel with efficiencies, cost-savings, expense reductions, or alternative revenues, our financial condition, results of operations or cash flows could be adversely affected. ? In addition, if we do not successfully develop and maintain a relevant digital experience for our customers, our business, financial condition, results of operations or cash flows could be adversely affected. Digital retailing is rapidly evolving, and we must keep pace with new developments by our competitors as well as the evolving needs and preferences of our customers. We must compete by offering a convenient shopping experience for our customers regardless of how they choose to shop with us, and by investing in providing and maintaining relevant customer-facing apps and interfaces that have the features customers want that are also reliable and easy to use. The future success of the digital business will also depend on the efficiency and cost effectiveness of fulfilling orders across our modalities, whether in store, in pickup-only locations or through customer fulfillment centers powered by Ocado.

We accept payments using a variety of methods, including cash and checks, select credit and debit cards, and Kroger Pay, a mobile payment solution. As we offer new payment options to our customers, we may be subject to additional rules, regulations, compliance requirements, and higher fraud losses. For certain payment methods, we pay interchange and other related acceptance fees, along with additional transaction processing fees. We rely on third parties to provide payment transaction processing services for credit and debit cards. It could disrupt our business if these companies become unwilling or unable to provide these services to us, including due to short term disruption of service. We are also subject to evolving payment card association and network operating rules, including data security rules, certification requirements and rules governing electronic funds transfers. For example, we are subject to Payment Card Industry Data Security Standards ("PCI DSS"), which contain compliance guidelines and standards with regard to our security surrounding the physical and electronic storage, processing and transmission of individual cardholder data. If our payment card terminals or internal systems are breached or compromised, we may be liable for card re-issuance costs and other costs, subject to fines and higher transaction fees, and lose our ability to accept card payments from our members, or if our third-party service providers' systems are breached or compromised, our business, financial condition, results of operations or cash flows could be adversely affected.

Our business is increasingly dependent on information technology systems that are complex and vital to continuing operations, resulting in an expansion of our technological presence and corresponding risk exposure. If we were to experience difficulties maintaining or operating existing systems or implementing new systems, we could incur significant losses due to disruptions in our operations. As we modernize legacy systems, if we are unable to successfully implement those systems in a coordinated manner across internal and external stakeholders, we could be subject to business interruption or reputation risk with our customers, suppliers or associates. ? Through our sales and marketing activities, we collect and store some personal information that our customers provide to us. We also gather and retain information about our associates in the normal course of business. Under certain circumstances, we may share information with vendors that assist us in conducting our business, as required by law, or otherwise in accordance with our privacy policy. Our technology systems have been, and may be in the future, disrupted from circumstances beyond our control, as we regularly defend against and respond to data security incidents. Cyber-attackers have targeted and accessed, and may in the future again target and, if successful, access information stored in our or our vendors' systems in order to misappropriate confidential customer or business information. Due to ongoing geopolitical conflicts, there is an increased possibility of cyberattacks that could either directly or indirectly affect our operations. Although we have implemented procedures to protect our information, and require our vendors to do the same, we cannot be certain that our security systems will successfully defend against, or be able to effectively respond to, rapidly evolving, increasingly sophisticated cyber-attacks as they become more difficult to detect and defend against. Further, a Kroger associate, a contractor or other third party with whom we do business may in the future circumvent our security measures in order to obtain information or may inadvertently cause a breach involving information. In addition, hardware, software or applications we may use may have inherent defects, vulnerabilities, or could be inadvertently or intentionally applied or used in a way that could compromise our information security. Our cybersecurity program, continued investment in our information technology systems, and our processes to evaluate and select vendors with reasonable information security controls may not effectively insulate us from potential attacks, data breaches or disruptions to our business operations, which could result in a loss of customers or business information, negative publicity, damage to our reputation, and exposure to claims from customers, financial institutions, regulatory authorities, payment card associations, associates and other persons. Any such events could have an adverse effect on our business, financial condition, results of operations or cash flows and may not be covered by our insurance. In addition, compliance with privacy and information security laws and standards may result in significant expense due to increased investment in technology and the development of new operational processes and may require us to devote significant management resources to address these issues. The costs of attempting to protect against the foregoing risks and the costs of responding to cyber-attacks are significant. Following a cyber-attack, our and/or our vendors' remediation efforts may not be successful, and a cyber-attack could result in interruptions, delays or cessation of service, and loss of existing or potential customers. In addition, breaches of our and/or our vendors' security measures and the unauthorized dissemination of sensitive personal information or confidential information about us or our customers could expose our customers' private information and our customers to the risk of financial or medical identity theft, or expose us or other third parties to a risk of loss or misuse of this information, and result in investigations, regulatory enforcement actions, material fines and penalties, loss of customers and business relationships, litigation or other actions which could have a material adverse effect on our brands, reputation, business, financial condition, results of operations or cash flows. Data governance failures can adversely affect our reputation and business. Our business depends on our customers' willingness to entrust us with their personal information. Events that adversely affect that trust, including inadequate disclosure to our customers of our uses of their information, failures to honor new and evolving data privacy rights, failing to keep our information technology systems and our customers' sensitive information secure from significant attack, theft, damage, loss or unauthorized disclosure or access, whether as a result of our action or inaction (including human error) or that of our business associates, vendors or other third parties, could adversely affect our brand and reputation and operating results and also could expose and/or has exposed us to mandatory disclosure to the media, litigation (including class action litigation), governmental investigations and enforcement proceedings, material fines, penalties and/or remediation costs, and compensatory, special, punitive and statutory damages, consent orders, and/or injunctive relief, any of which could adversely affect our businesses, financial condition, results of operations or cash flows. Large scale data breaches at other entities, including supply chain security vulnerabilities, increase the challenge we and our vendors face in maintaining the security of our information technology systems and proprietary information and of our customers' information. There can be no assurance that such failures will not occur, or if any do occur, that we will detect them or that they can be sufficiently remediated. The use of data by our business and our business associates is highly regulated. Privacy and information-security laws and regulations change, and compliance with them may result in cost increases due to, among other things, systems changes and the development of new processes. If we, our third-party service providers, or those with whom we share information fail to comply with laws and regulations, or self-regulatory regimes, that apply to all or parts of our business, such as section 5 of the FTC Act, the California Consumer Privacy Act (CCPA), the Health Insurance Portability and Accountability Act (HIPAA), or applicable international laws such as the EU General Data Protection Regulation (GDPR), our reputation could be damaged, possibly resulting in lost business, and we could be subjected to additional legal risk or financial losses as a result of non-compliance.