Simulations Plus (SLP) Risk Analysis

Our business relies on the secure electronic transmission, storage, and hosting of sensitive information, including clinical data, financial information, and other sensitive information relating to our customers, company, and workforce. As a result, we face some risk of a deliberate or unintentional incident involving unauthorized access to our computer systems (including, among other methods, cyberattacks or social engineering) that could result in misappropriation or loss of assets or sensitive information, data corruption, or other disruption of business operations. Our contracts with our clients typically contain provisions that require us to keep confidential the information generated from these studies. In the event the confidentiality of such information was compromised, we could suffer significant harm. In light of this risk, we have devoted significant resources to protecting and maintaining the confidentiality of our information, including implementing security and privacy programs and controls, training our workforce, and implementing new technology. We have no guarantee that these programs and controls will be adequate to prevent all possible security threats. We believe that any compromise of our electronic systems, including the unauthorized access, use, or disclosure of sensitive information, or a significant disruption of our computing assets and networks, would adversely affect our reputation and our ability to fulfill contractual obligations, and would require us to devote significant financial and other resources to mitigate such problems, and could increase our future cybersecurity costs. Moreover, unauthorized access, use, or disclosure of such sensitive information could result in contractual or other liability. In addition, any real or perceived compromise of our security or disclosure of sensitive information may result in lost revenues by deterring customers from using or purchasing our products and services in the future or prompting them to use competing service providers.

The collection, use, disclosure, storage, disposal, protection and other processing of information about individuals, in particular healthcare data and sensitive personal information, is highly regulated in the United States, EU, and other jurisdictions, including but not limited to, under the U.S. Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH") and other U.S. privacy, security and breach notification and healthcare information laws; the EU GDPR and its national implementing laws; the UK GDPR, data privacy laws in other countries around the world (e.g., China's PIPL), as well as data privacy laws in individual states in the U.S. (e.g., the California Consumer Privacy and Protection Act ("CCPA"), the California Privacy Rights Act ("CPRA"), the New York State Personal Privacy Protection Law ("PPPL") and the New York Privacy Act ("NYPA")). Although we require our customers who send their clinical data to us for analyses to provide it in de-identified form within the meaning of HIPAA, in certain parts of our business, such as in conjunction with certain services we offer customers, we may process personal information relating to persons who have been, are, and may in the future be involved in clinical trials. The collection, retention, use, disclosure, and other processing of such personal information is governed, by the applicable data privacy and cybersecurity laws. While we do not consider our service offerings to generally cause us to be considered a covered entity under HIPAA, HIPAA does require the use of standard contract language in contracts with our customers who are covered entities under HIPAA which define our obligations to safeguard the protected health information of patients if provided by our covered-entity customers. We have adopted policies, practices, procedures, and training to safeguard the receipt, maintenance, processing, retention and transmission of such personal information. In addition to the laws specifically passed to regulate the processing of personal information, the Federal Trade Commission (the "FTC") and many state attorneys may generally interpret federal, state and local consumer protection laws to impose evolving standards for the handling and security of personal information. As noted above, certain states have also adopted personal data privacy laws. For example, the CCPA, CPRA, PPPL and NYPA impose obligations and restrictions on businesses regarding their collection, use, and sharing of personal information of, as well as defining certain data privacy rights to, California and New York residents, respectively. Such data privacy rights include the right to access or have deleted their personal information that is processed by businesses and the right to opt out of certain sharing or processing of their personal information. Most state data privacy laws also impose monetary penalties for violations of the respective law. The interpretation and application of the new state data privacy laws are still evolving, which provides some uncertainty. The EU GDPR and the UK GDPR also impose numerous requirements on companies that process personal data of residents from those respective jurisdictions, including requirements relating to processing health and other sensitive personal data, cross-border transfers, notice and consent, and contractual obligations with vendors and service providers who process personal data on behalf of a business. Both the EU GDPR and UK GDPR also provide individuals who are residents with certain data privacy rights with respect to an individual's personal data processed by a business such as, for example, the right of access, the right to rectification, the right to erasure, the right to restrict processing, and the right to data portability. The EU GDPR permits data protection authorities to impose significant penalties for violations of the EU GDPR including potential fines of up to €20 million or 4% of annual global revenues, whichever is greater. The UK GDPR provides for similar penalties for violations of the UK GDPR. The interpretation and application of these laws by the judicial systems are still evolving. Legal developments in Europe have created complexity and uncertainty regarding transfers of personal data from the EU to the United States. Recently, the EU or UK and the U.S. agreed to a new Data Privacy Framework which will allow businesses to transfer data from the EU to the US in a secure and compliant way. We also currently rely on the standard contractual clauses with our customers to transfer personal data outside the EU to the U.S., among other data transfer mechanisms pursuant to the EU GDPR or the UK GDPR. While the standard contractual clauses and the new Data Privacy Framework have been determined to be adequate personal data transfer mechanism for transfer of personal information from the EU to the U.S. by some regulatory authorities, there remains the possibility that challenges will be raised to the sufficiency of such transfer mechanisms which has created uncertainty. In view of the trend for enactment of data privacy laws globally, we have implemented a comprehensive data privacy management program that includes physical, technological, and operational safeguards (such as policies, notices, processes, contractual provisions, and employee trainings) to help ensure that we process personal information about our employees and personal information received from our customers in a compliant manner. We have also appointed VeraSafe, a global leader in privacy law and data protection, as our Data Protection Officer. As data protection laws expand in number and scope with relevance to the kinds of personal information we process, we may need to modify our data privacy program and practices, and incur additional expenses, to accommodate such expansion and adjustments.

Our success depends to a significant extent on the continued services of our senior management and other members of management. We have employment agreements with our CEO, CFO, and certain of our other members of our leadership team that range from one to three years. If our CEO, CFO, business unit presidents, or other members of senior management do not continue in their present positions, our business may suffer. Because of the specialized scientific nature of our business, we are highly dependent upon attracting and retaining qualified scientific and technical and managerial personnel. While we have a strong record of employee retention, there is still significant competition for qualified personnel in the software, pharmaceutical, and biotechnology fields. Therefore, we may not be able to attract and retain the qualified personnel necessary for the development of our business. The loss of the services of existing personnel, as well as the failure to recruit additional key scientific, technical, and managerial personnel in a timely manner, could harm our business.

Substantially all of the computer hardware necessary to provide Cognigen solutions to our customers is located at our internal hosting facility in Buffalo, New York. In addition to our dedicated hosting facility, we utilize third-party cloud computing services from Amazon Web Services ("AWS") to help us efficiently scale our cloud-based solutions and provide training. Because we cannot easily switch our AWS-serviced operations to another cloud provider, any disruption of or interference with our use of AWS would impact our operations, and our business would be adversely impacted. Our systems and operations or those of AWS could suffer damage or interruption from human error, fire, flood, power loss, telecommunications failure, break-ins, terrorist attacks, acts of war, and similar events. The occurrence of a natural disaster, an act of terrorism or other unanticipated problems at our or AWS' hosting facilities could result in lengthy interruptions in our service. Although we and AWS maintain backup facilities and disaster recovery services in the event of a system failure, these may be insufficient or fail. Any system failure, including network, software, or hardware failure, which causes an interruption in our Buffalo data center or our use of AWS, or that causes a decrease in responsiveness of our cloud-based solutions, could damage our reputation and cause us to lose customers, which could harm our business and results of operations. Our business may be harmed if our customers and potential customers believe our service is unreliable.

Certain of our customer contracts are subject to cancellation by our customers at any time with limited notice. Customers engaged in clinical trials may terminate or delay a clinical trial for various reasons, including the failure of the tested product to satisfy safety or efficacy requirements, unexpected or undesired clinical results, decisions to de-emphasize a particular product or forgo a particular clinical trial, decisions to downsize clinical development programs, insufficient patient enrollment or investigator recruitment, and production problems resulting in shortages of required clinical supplies. Any termination or delay in the clinical trials would likely result in a consequential delay or termination in those customers' service contracts. We have experienced terminations and delays of our customer service contracts in the past (although no such past terminations have had a significant impact on our results of operations), and we expect to experience additional terminations and delays in the future. The termination of single-study arrangements could result in decreased revenues and the delay of our customers' clinical trials could result in delayed professional services revenues, which could adversely impact our business.

We derive a significant portion of our total revenue from our operations in international markets. Our global business may be affected by local economic conditions, including inflation, recession, and currency-exchange-rate fluctuations. In addition, political and economic changes, including the imposition of import restrictions or tariffs, geopolitical instability, international conflicts and terrorist acts, throughout the world may interfere with our or our customers' activities in particular locations and result in a material adverse effect on our business, financial condition, and operating results. Potential trade restrictions, exchange controls, adverse tax consequences, and legal restrictions may affect the repatriation of funds into the U.S. Also, we could be subject to unexpected changes in regulatory requirements, the difficulties of compliance with a wide variety of foreign laws and regulations, potentially negative consequences from changes in or interpretations of U.S. and foreign tax laws, import and export licensing requirements, and longer accounts receivable cycles in certain foreign countries. These risks, individually or in the aggregate, could have an adverse effect on our results of operations and financial condition. While our employees, distributors, and agents are required to comply with these laws, we cannot be sure that our internal policies and procedures will always protect us from violations of these laws despite our commitment to legal compliance and corporate ethics. The occurrence or allegation of these types of risks may adversely affect our business, performance, prospects, value, financial condition, and results of operations.

We operate on a global basis. As we continue to increase our international operations, our revenues and expenditures in foreign currencies are expected to become more material and subject to greater foreign currency exchange-rate fluctuations. Also, our foreign distributors typically sell our products in local currency, which impacts the price to foreign consumers. Additionally, SLP France's functional currency is the Euro. Future foreign currency exchange rate fluctuations and global credit markets may cause changes in the U.S. dollar value of our purchases or sales and materially affect our revenues, profit margins, and results of operations, when converted to U.S. dollars. Changes in the value of the U.S. dollar relative to other currencies could result in material foreign currency exchange-rate fluctuations and, as a result, our net earnings could be materially adversely affected. As we continue to expand international operations and increase purchases and sales in foreign currencies, we may utilize derivative instruments, as needed, to hedge our foreign currency exchange-rate risk. Our hedging strategies will depend on our forecasts of revenues, expenses, and cash flows, which are inherently subject to inaccuracies. Foreign currency exchange-rate hedges, transactions, re-measurements, or translations could materially impact our consolidated financial statements.