SiteOne Landscape Supply (SITE) Risk Factors

We purchase and sell a wide variety of products, the price and availability of which may fluctuate, and may be subject to large and significant price increases, especially in periods of high inflation. For example, certain of our contracts with suppliers include prices for commodities such as grass seed and chemicals used in fertilizer that are not fixed or tied to an index, which allows our suppliers to change the prices of their products as the input prices fluctuate. Conversely, we may experience lower Net sales in a deflationary environment. Our business is exposed to these fluctuations, as well as to fluctuations in our costs for transportation and distribution. Changes in prices for the products that we purchase affect our Net sales and Cost of goods sold, as well as our working capital requirements, levels of debt, and financing costs. We might not always be able to reflect increases in our costs in our own pricing, especially in times of extreme price volatility. Any inability to pass cost increases on to customers may adversely affect our business, financial condition, and results of operations. In addition, if market prices for the products that we sell decline, we may realize reduced profitability levels from selling such products and lower revenues from sales of existing inventory of such products.

In addition to the disruptions that may occur from interruptions in our information technology systems, cybersecurity threats and sophisticated and targeted cyberattacks pose a risk to our information technology systems, as well as those of our third-party service providers and other third parties with whom we do business and communicate. In connection with the increase in work-from-home arrangements, there has been a spike in cybersecurity attacks as work-from-home measures have led businesses to increase reliance on virtual environments and communications systems, which have been subject to increasing third-party vulnerabilities and security risks. In addition, the technology systems of businesses that we have acquired or may acquire, as well as their practices related to the collection, use, maintenance, and disclosure of data, could present issues that we were not able to identify prior the acquisition or other issues that continue to pose risk to use, such as cybersecurity vulnerabilities or past cybersecurity or privacy incidents. We have established security policies, processes, and defenses designed to help identify and protect against intentional and unintentional misappropriation or corruption of our information technology systems and information and disruption of our operations. Despite these efforts, and especially in light of increasingly sophisticated techniques used in cybersecurity attacks, our information technology systems and those of third parties with whom we do business or communicate may be damaged, disrupted, or shut down due to attacks by unauthorized access, malicious software, computer viruses, undetected intrusion, hardware failures, or other events, and in these circumstances where we cannot fully anticipate, detect, repel, or implement fully effective preventative measures, our disaster recovery plans may be ineffective or inadequate. These breaches or intrusions could lead to business interruption, exposure of proprietary or confidential information, data corruption, damage to our reputation, exposure to legal and regulatory proceedings, and other costs. A security breach might also lead to violations of privacy laws, regulations, trade guidelines or practices related to our customers and associates, and could result in potential claims from customers, associates, shareholders, or regulatory agencies. Such events could adversely impact our reputation, business, financial position, results of operations, and cash flows. In addition, we could be adversely affected if any of our significant customers or suppliers experiences any similar events that disrupt their business operations or damage their reputation. Furthermore, our increased use of mobile and cloud technologies, including as a result of changes in working environments such as work-from-home arrangements, has heighted these cybersecurity and privacy risks, including risks from cyber-attacks such as phishing, spam emails, hacking, social engineering, and malicious software. Additionally, to the extent artificial intelligence capabilities improve and are increasingly adopted, they may be used to identify vulnerabilities and craft increasingly sophisticated cybersecurity attacks. Attachments crafted with artificial intelligence tools could directly attack information systems with greater speed and/or efficiency than a human threat actor or create more effective phishing emails. Vulnerabilities may also be introduced from the use of artificial intelligence by us, our customers, suppliers, and other business partners and third-party providers. Use of artificial intelligence by us or such third parties, whether authorized or unauthorized, increases the risk that our intellectual property and other proprietary information will be unintentionally disclosed. While we maintain monitoring practices and protections of our information technology to reduce these risks and test our systems on an ongoing basis for potential threats, there can be no assurance that these efforts will prevent a cyber-attack or other security breach. We have not always been able in the past and may be unable in the future to anticipate or prevent techniques used to obtain unauthorized access or to compromise our systems because the techniques used change frequently and are generally not detected until after an incident has occurred. In July 2020, we experienced a ransomware attack on our information technology systems. There can be no guarantees that the attack will not lead to the disclosure of customer data, our trade secrets, or other intellectual property, or personal information of our employees. There can be no guarantee that the release of any of this information will not have a material adverse effect on our business, reputation, financial condition, and results of operations. In addition, the July 2020 ransomware attack could result in potential claims from customers, associates, stockholders, or regulatory agencies, which could result in significant judgements against us, penalties, and fines. The cost of investigating, mitigating, and responding to potential data security breaches and complying with applicable breach notification obligations to individuals, regulators, partners, and others could be significant. We carry cybersecurity insurance to help mitigate the financial exposure and related notification procedures in the event of intentional intrusion, including the July 2020 ransomware attack; however, there can be no assurance that our insurance will adequately protect against potential losses that could adversely affect our business.

We are subject to federal, state, provincial, and local environmental, health and safety laws and regulations, including laws that regulate the emission or discharge of materials into the environment, govern the use, packaging, labeling, transportation, handling, treatment, storage, disposal, and management of chemicals and hazardous substances and waste, and protect the health and safety of our associates and users of our products. Such laws also impose liability for investigation and remediation failures, and damages resulting from, present and past releases of hazardous substances, including releases at sites we have ever owned, leased or operated, or used as a disposal site. We could be subject to fines, penalties, civil or criminal sanctions, personal injury, property damage, or other third-party claims as a result of violations of, or liabilities under, these laws and regulations. We could also incur significant investigation and cleanup costs for contamination at any currently or formerly owned or operated facilities, including LESCO's manufacturing and blending facilities. In addition, changes in, or new interpretations of, existing laws, regulations, or enforcement policies as a result of the current presidential administration or otherwise, the discovery of previously unknown contamination, or the imposition of other environmental liabilities or obligations in the future, including obligations with respect to any potential health hazards of our products, may lead to additional compliance or other costs that could have a material adverse effect on our business, financial position, results of operations, and cash flows. In addition, in the United States, products containing herbicides and pesticides generally must be registered with the U.S. Environmental Protection Agency ("EPA") and similar state agencies before they can be sold or distributed. The failure to obtain or the cancellation of any such registration, or the withdrawal from the marketplace of such products, could have an adverse effect on our business, the severity of which would depend in part on the products involved, whether other products could be substituted, and whether our competitors were similarly affected. The herbicides and pesticides we use are manufactured by independent third parties and are evaluated by the EPA as part of its ongoing exposure risk assessment. The EPA may decide that a herbicide or pesticide we use will be limited or will not be re-registered for use in the United States. We cannot predict the outcome or the severity of the effect of the EPA's continuing evaluations. The use of certain herbicide and pesticide products is also regulated by various federal, state, provincial, and local environmental and public health agencies. We may be unable to prevent violations of these or other regulations from occurring. Even if we are able to comply with all such regulations and obtain all necessary registrations and licenses, the herbicides and pesticides or other products we supply could be alleged to cause injury to the environment, to people or to animals, or such products could be banned in certain circumstances. We are subject to such allegations from time to time. The regulations may also apply to customers who may fail to comply with environmental, health and safety laws and subject us to liabilities. Costs to comply with environmental, health and safety laws, or to address liabilities or obligations thereunder, could have a material adverse impact on our reputation, business, financial position, results of operations, and cash flows. Further, new legislation or regulatory change in response to the perceived effects of climate change has been, or is expected to be, adopted at both the state and federal level. These changes in environmental and climate change laws or regulations, including laws relating to greenhouse gas emissions, could lead to additional operational and compliance burdens, and collecting, measuring, and analyzing information relating to such matters can be costly, time-consuming, dependent on third-party cooperation, and unreliable. Such changes in climate change laws or regulations could further subject us to additional costs and restrictions, including additional investment in product designs and increased energy and raw material costs, as well as increased risk of litigation concerning our disclosures related thereto. We cannot predict how managing our climate change-related reporting obligations, as well as the consumer and retail impacts of climate change, could have a material adverse effect on our financial condition, results of operations, or cash flows.