Where Food Comes From (WFCF) Risk Factors

We continually seek to expand our product and service offerings in international markets. As we expand into new international markets, we will have only limited experience in marketing and operating our products and services in such markets. In other instances, we may rely on the efforts and abilities of foreign business partners in such markets. Certain international markets may develop more slowly than domestic markets, and our operations in international markets may not develop at a rate that supports our level of investment. In addition to uncertainty about our ability to expand into international markets, there are certain risks inherent in doing business internationally, including, but not limited to: - trade barriers and changes in trade regulations;   - difficulties in developing, staffing and simultaneously managing varying foreign operations as a result of distance, language and cultural differences;   - differing local labor laws and regulations;   - longer payment cycles;   - currency exchange rate fluctuations;   - political or social unrest or economic instability;   - import or export restrictions;   - seasonal volatility in business activity;   - risks related to government regulation or required compliance with local laws in certain jurisdictions, including those more fully described above; and   - potentially adverse tax consequences. One or more of these factors could harm our future international operations and consequently could harm our brand, business, operating results and financial condition.

Companies across many industries are facing increasing scrutiny related to their environmental, social and governance ("ESG") practices. Investor advocacy groups, certain institutional investors, investment funds and other influential investors are also increasingly focused on ESG practices and in recent years have placed increasing importance on the non-financial impacts of their investments. We take social responsibility very seriously. It's the entire reason we spend day in and day out helping farmers, ranchers and brands around the world provide transparency to their consumers by communicating authentic, sustainable and traceable stories that directly impact our future. However, if our ESG practices do not meet investor or other industry stakeholder expectations, which continue to evolve, we may incur additional costs. Also, our brand, ability to attract and retain qualified employees and business may be harmed.

We compete with many other vendors of products and services designed for tracking cattle and other livestock, for herd management, for crop production practices and other verification of marketing claims over processed foods. Our competitors range from small start-up companies to multi-national firms. Our competitors may have significantly more financial, technical and marketing resources than we do. Competition is likely to intensify as current competitors expand their service offerings and as new companies enter the market. Additionally, competition may intensify as our competitors enter into business combinations or alliances, and established companies in other market segments expand to become competitive with our business. Increasing competition may result in reduced margins and the loss of market share. Our competitors may offer broader service offerings or technologies that are more commercially attractive and gain greater market acceptance than our current or future products. Additionally, new technology may render our products and services obsolete.

We will be able to protect our intellectual property ("IP") from unauthorized use by third parties only to the extent that it is covered by valid and enforceable patents and trademarks. IP protection generally involves complex legal and factual issues and, therefore, the enforceability of IP rights cannot be predicted with certainty. Moreover, the laws of some foreign countries do not protect proprietary rights to the same extent as do the laws of the United States. In the event that IP owned by us does not provide adequate protection, we may not be able to prevent competitors from offering substantially similar products and services. In the event that third parties claim that our current or future products or services infringe upon their intellectual property, we may face litigation and be prevented from selling the products and services at issue. Infringement or other claims could be asserted or prosecuted against us in the future, and it is possible that past or future assertions or prosecutions could harm our business. Litigation either in defense of our IP rights or in response to infringement claims made by others may be both expensive and time consuming, which in turn would adversely affect our business.

We rely heavily on information technology networks and systems, including the Internet, to manage or support a wide variety of important business processes and activities throughout our operations. Our information technology systems may be susceptible to damage, disruptions or shutdowns due to failures during the process of upgrading or replacing software, databases or components thereof, power outages, hardware failures, computer viruses, cyber-attacks, ransomware attacks, malware attacks, malicious employees or other insiders, telecommunications failures, human errors or catastrophic events. Hackers, foreign governments, cyber-terrorists and cyber-criminals, acting individually or in coordinated groups, may launch distributed denial of service attacks or other coordinated attacks that may cause service outages, gain inappropriate or block legitimate access to systems or information, or result in other interruptions in our business. Such attacks are increasing in their frequency, levels of persistence, levels of sophistication and intensity. In addition, breaches in security could expose us and our customers, or the individuals affected, to a risk of loss or misuse of proprietary information and sensitive or confidential data, including personal information of customers, employees and others. Like many other companies, we experience attempted cybersecurity actions on a periodic basis, and the frequency of such attempts could increase in the future. While we have invested in the protection of data and information technology, there can be no assurance that our efforts will prevent or quickly identify service interruptions or security breaches. The techniques used by cybercriminals change frequently, may not be recognized until launched and can originate from a wide variety of sources. We cannot assure that our data protection efforts and our investment in information technology will prevent significant breakdowns, data leakages or breaches in our systems or those of our third-party services providers or partners. We also depend on and interact with the information technology networks and systems of third parties for many aspects of our business operations, including our customers and service providers such as cloud service providers and third-party delivery services. These third parties may have access to information we maintain about our company, operations, customers, employees and vendors, or operating systems that are critical to or can significantly impact our business operations. Like us, these third parties are subject to risks imposed by data breaches and cyber-attacks and other events or actions that could damage, disrupt or close down their networks or systems. Security processes, protocols and standards that we have implemented and contractual provisions requiring security measures that we may have sought to impose on such third parties may not be sufficient or effective at preventing such events, which could result in unauthorized access to, or disruptions or denials of access to, or misuse of, information or systems that are important to our business, including proprietary information, sensitive or confidential data, and other information about our operations, customers, employees and suppliers, including personal information. Any of these events that impact our information technology networks or systems, or those of acquired businesses, customers, service providers or other third parties, could result in disruptions in our operations, the loss of existing or potential customers, damage to our brand and reputation, regulatory scrutiny, and litigation and potential liability for the Company. Among other consequences, our customers' confidence in our ability to protect data and systems and to provide services consistent with their expectations could be impacted, further disrupting our operations. Similarly, an actual or alleged failure to comply with applicable U.S. or foreign data protection regulations or other data protection standards may expose us to litigation, fines, sanctions or other penalties. We have invested and continue to invest in technology security initiatives, information technology risk management and disaster recovery plans. The cost and operational consequences of implementing, maintaining and enhancing further data or system protection measures could increase significantly to overcome increasingly intense, complex and sophisticated global cyber threats. Despite our best efforts, we are not fully insulated from data breaches and system disruptions. There is no assurance that such impacts will not be material in the future, and our efforts to deter, identify, mitigate and/or eliminate future breaches may require significant additional effort and expense and may not be successful.

Both John and Leann Saunders' reputation and prominence in the field provide us with a strong competitive advantage. While they are currently bound by employment agreements, we can offer no assurance that John and/or Leann Saunders will be able to continue to work for us in the event of an unforeseen accident, severe injury or major disease, or on a long-term basis. The loss of key personnel could have a material adverse effect on our business and operating results.