Risk Factors Dashboard

Once a year, publicly traded companies issue a comprehensive report of their business, called a 10-K. A component mandated in the 10-K is the ‘Risk Factors’ section, where companies disclose any major potential risks that they may face. This dashboard highlights all major changes and additions in new 10K reports, allowing investors to quickly identify new potential risks and opportunities.

View risk factors by ticker

Search filings by term

Risk Factors - HNI

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

Item 1A. Risk Factors. Actual results could differ materially from those anticipated in the forward-looking statements and from historical results due to the risks and uncertainties described elsewhere in this report, including but not limited to: the Corporation’s ultimate realization of the anticipated benefits of the Steelcase acquisition; disruptions in the global supply chain; the effects of prolonged periods of inflation and rising interest rates; labor shortages; the levels of office furniture needs and housing starts; overall demand for the Corporation’s products; general economic and market conditions in the United States and internationally; industry

Table of Contents

and competitive conditions; the consolidation and concentration of the Corporation’s customers; the Corporation’s reliance on its network of independent dealers; changes in trade policy; changes in raw material, component, or commodity pricing; market acceptance and demand for the Corporation’s new products; changing legal, regulatory, environmental, and health care conditions; the risks associated with international operations; the potential impact of product defects; the various restrictions on the Corporation’s financing activities; an inability to protect the Corporation’s intellectual property; cybersecurity threats, including those posed by potential ransomware attacks; impacts of tax legislation; force majeure events outside the Corporation’s control, including those that may result from the effects of climate change; and other risks as described under the heading "Item 1A. Risk Factors," as well as others that the Corporation may consider not material or does not anticipate at this time. Risk Factors," are not exclusive and further information concerning the Corporation, including factors that potentially could have a material effect on the Corporation’s financial results or condition, may emerge from time to time.

The Corporation assumes no obligation to update, amend, or clarify forward-looking statements, whether as a result of new information, future events, or otherwise, except as required by applicable law.

Item 1A. Risk Factors

The following risk factors and other information included in this report should be carefully considered. Other factors not currently known to the Corporation or that it currently considers to be immaterial also may adversely affect its business, operating results, cash flows, or financial condition.

Industry and Economic Risks

Unfavorable economic and industry factors could adversely affect the Corporation’s business, operating results, or financial condition.

In addition, adoption of hybrid working models has resulted in a significant decrease in worker attendance at their office locations. Despite office re-entry in many markets, office occupancy levels remain below historic levels. Lower office occupancy levels have had and could continue to have an adverse impact on the demand for workplace furnishings.

Such sales are also subject to risks associated with industry factors such as technology changes, health and safety concerns, and environmental regulation, including indoor air quality standards.

Deteriorating economic conditions, which may be caused by uncertainties and volatility in the financial markets, rising or sustained inflation and interest rates, and potential economic recessions, could affect the Corporation’s business significantly by contributing to reduced demand for the Corporation's products, insolvency of independent dealers resulting in increased provisions for credit losses, insolvency of key suppliers resulting in product delays, inability of customers to obtain credit to finance purchases of products, and decreased customer demand, including order delays or cancellations.

The Corporation may not be successful in winning new business in the highly competitive workplace furnishings and residential building products industries.

Competitive factors include price, delivery and service, brand recognition,

Table of Contents

product design, product quality, strength of dealers and other distributors, and relationships with customers and key influencers, including architects, designers, home-builders, and facility managers.

In both the workplace furnishings and residential building products industries, the Corporation faces price competition from competitors and from new market entrants who may manufacture and source products from lower cost countries.

Changes in industry dynamics, including demand and order patterns from customers, distribution changes, or the loss of a significant number of dealers, could adversely affect the Corporation’s business, operating results, or financial condition.

The Corporation sells products through multiple distribution channels, which primarily include independent dealers, national dealers, and sales representatives. These distribution channels have experienced significant consolidation, which may continue in future periods.

The loss of a dealer relationship could negatively affect the Corporation’s ability to maintain market share in the affected geographic market and to compete for and service clients in that market until a new dealer relationship is established. The loss or termination of a significant dealer or a substantial number of dealer relationships could cause significant difficulties in marketing and distributing the Corporation’s products, resulting in a decline in sales and/or impairment of the Corporation’s contract assets related to distribution agreements with the respective dealers.

Evolving trade policy between the United States and other countries may have an adverse effect on the Corporation’s business and results of operations.

The Corporation has a global supply chain for products used in workplace furnishings and residential building products.

Certain foreign governments have imposed tariffs on goods that their countries import from the United States.

The Corporation cannot predict the extent to which the United States or other countries will impose quotas, duties, tariffs, taxes, or other similar restrictions upon the import or export of products in the future, nor can the Corporation predict future trade policy or the terms of any renegotiated trade agreements and their impact on the business. The adoption and expansion of trade restrictions, the occurrence of a trade war, or other governmental action related to tariffs or trade agreements or policies has the

Table of Contents

potential to adversely impact demand for products, costs, customers, suppliers, and the United States economy, which could have a material adverse effect on the Corporation’s business, operating results, and financial condition.

The Corporation’s profitability may be adversely affected by increases in raw material and commodity costs as well as transportation and shipping challenges.

Fluctuations in the price and availability of commodities, raw materials, components, and finished goods could have an adverse effect on costs of sales, profitability, and ability to meet customers’ demand. The Corporation sources commodities, raw materials, components, and finished goods from domestic and international suppliers.

The Corporation relies primarily on third-party freight and transportation providers to deliver products to customers. Capacity-related and/or port-caused delays in the shipment or receipt of products and components, including labor disputes, have caused and could cause delayed receipt of products and components, which may adversely affect sales and profitability.

Strategic and Operational Risks

If customers do not perceive the Corporation’s products and services to be of good value, the Corporation’s brand and name recognition and reputation could suffer.

The Corporation believes that establishing and maintaining good brand and name recognition and a good reputation is critical to its business.

The Corporation’s efforts to introduce new products to meet customer and workplace demands may not be successful, which could limit sales growth or cause its sales to decline.

To meet the changing needs of customers and keep pace with market trends and evolving regulatory and industry requirements, including environmental, health, safety, and similar standards for the workplace and for product performance, the Corporation regularly introduces new workplace furnishings and residential building products.

Natural disasters, acts of God, force majeure events, or other catastrophic events may impact the Corporation’s production capacity and, in turn, negatively impact profitability.

Further, several of the Corporation’s production facilities are single-site manufacturers of certain products, and an

Table of Contents

adverse event affecting any of those facilities could significantly delay production of certain products and adversely affect operations and business conditions. Members are an integral part of the business and events such as those described above could negatively impact the availability of members for work.

The Corporation’s business and operations are subject to risks related to climate change.

The long-term effects of global climate change could present both physical risks and transition risks (such as regulatory, supply chain, or technology changes), which could be widespread and unpredictable.

A continued shortage of qualified labor could negatively affect the Corporation’s business and materially reduce earnings.

The Corporation has experienced shortages of qualified labor across its operations. Outside suppliers that the Corporation relies upon have also experienced shortages of qualified labor. A shortage of qualified labor in certain geographies, particularly where plant production workers are employed, could result in increased costs from certain temporary wage actions, such as hiring and referral bonus programs. Such shortages for a prolonged period could have a material adverse effect on the Corporation’s operating results.

The Corporation’s failure to retain its existing management team, maintain its engineering, finance, technical, and manufacturing process expertise, or continue to attract qualified personnel could adversely affect the Corporation’s business.

The Corporation depends significantly on its executive officers and other key personnel.

Failure to properly identify, value, and manage acquisitions or strategic alliances in accordance with the Corporation's strategy may negatively affect the Corporation’s business, results of operations and financial condition.

One of the Corporation’s growth strategies is to supplement its organic growth through acquisitions and strategic alliances, which may include transactions with other manufacturers of workplace furnishings and residential building products or distributors of workplace furnishings and residential building products. The Corporation may not be successful in identifying suitable acquisition or alliance opportunities, prevailing against competing potential acquirers, negotiating appropriate acquisition terms, obtaining

Table of Contents

financing, completing proposed acquisitions or alliances, or expanding into new markets or product categories. Any of such risks could adversely affect the Corporation’s business, operating results, or financial condition.

The Corporation may not be able to successfully integrate and manage acquired businesses and alliances.

The benefits of acquisitions or alliances pursued as one of the Corporation’s growth strategies may take more time than expected to develop or integrate into operations. Acquisitions and alliances involve a number of risks, including:

•diversion of management’s attention from operations;

•difficulties in assimilating the operations and products of an acquired business or in realizing projected efficiencies, cost savings and revenue synergies;

•potential loss of key employees or customers of the acquired businesses or adverse effects on existing business relationships with suppliers and customers;

•negative impact on member morale and performance as a result of job changes and reassignments;

•reallocation of amounts of capital from other operating initiatives or an increase in leverage and debt service requirements to pay the acquisition purchase prices, which could in turn restrict the ability to access additional capital when needed or to pursue other important elements of the business strategy;

•inaccurate assessment of undisclosed, contingent, or other liabilities or problems and unanticipated costs associated with the acquisition;

•possible tax costs or inefficiencies associated with integrating the operations of a combined company; and

•incorrect estimates made in accounting for acquisitions, incurrence of non-recurring charges, and write-off of significant amounts of goodwill that could adversely affect the financial results.

As of January 3, 2026, goodwill and indefinite-lived intangible assets, net represented approximately 35% of the Corporation's total consolidated assets.

Increasing health care costs could adversely affect the Corporation’s business, operating results, and financial condition.

The Corporation provides health care benefits to the majority of its member and Legacy HNI is self-insured. Health care costs have continued to rise significantly over time, which increases the annual spending on health care. Increased health care costs could adversely affect the Corporation’s business, operating results, and financial condition.

The Corporation’s international operations expose it to risks related to conducting business in multiple jurisdictions outside the United States.

Its international sales and operations are subject to a number of additional risks, including:

•social and political turmoil, official corruption, and civil and labor unrest;

•restrictive government actions, including the imposition of trade quotas and tariffs and restrictions on transfers of funds;

Table of Contents

•changes in labor laws and regulations affecting the ability to hire, retain, or dismiss members;

•the need to comply with multiple and potentially conflicting laws and regulations, including environmental and corporate laws and regulations;

•the failure of the Corporation’s compliance programs and internal training to prevent violations of the United States Foreign Corrupt Practices Act and other anti-bribery and anti-corruption laws;

•preference for locally branded products and laws and business practices favoring local competition;

•less effective protection of intellectual property and increased possibility of loss due to cyber-theft and ransomware attacks;

•unfavorable business conditions or economic instability in any country or region;

•infrastructure disruptions;

•potentially conflicting cultural and business practices;

•difficulty in obtaining distribution and support; and

•changes to border taxes or other international tax reforms.

Further, certain countries have complex regulatory systems that impose administrative and legal requirements, which make managing international operations more difficult, including approvals to transfer funds among certain countries.

The Corporation is subject to currency risk in its international operations.

Increased business in countries outside the United States creates exposure to fluctuations in foreign currency exchange rates.

The Corporation periodically reviews foreign currency exposure and evaluates whether it should enter into hedging transactions.

The Corporation’s sales to the United States federal, state, and local governments are subject to uncertain future funding levels and federal, state, and local procurement laws and are governed by restrictive contract terms, any of which factors could limit current or future business.

Business pursuant to government contracts is highly sensitive to changes in procurement laws, national, international, state, and local public priorities, and budgets at all levels of government, which frequently experience downward pressure and are subject to uncertainty, including the potential for a temporary shutdown of the United States federal government.

The Corporation’s contracts with government entities are subject to various statutes and regulations that apply to companies doing business with the government.

The Corporation's information technology systems, processes, and sites may suffer interruptions, security incidents, or failures that may affect its ability to conduct its business, cause significant damage to its reputation, and expose it to substantial legal liability.

Table of Contents

The Corporation’s operations rely upon certain key information technology systems, which are dependent on services provided by third parties and provide critical data connectivity, information, and services for internal and external users. These interactions include, among others, ordering and managing materials from suppliers, risk management activities, converting raw materials to finished products, inventory management, shipping products to customers, processing transactions, summarizing and reporting results of operations, human resources benefits and payroll management, complying with regulatory, legal and tax requirements, and other processes necessary to manage the business. Increased information technology security and social engineering threats and more sophisticated cyber crime, including advanced persistent threats, pose potential risks to the security of the Corporation’s information technology systems, networks, and services, as well as the confidentiality, availability and integrity of the Corporation’s third-party and employee data.

The frequency, sophistication and unpredictability of cybersecurity events globally have increased, and can be acute during times of geopolitical tension or instability between countries or when the Corporation makes changes to its information technology systems or implements new ones. The Corporation has been subjected in the past, and may be subjected in the future, to incidents including phishing, e-mails purporting to come from vendors making payment requests, malware, and communications from look-alike corporate domains, as well as security-related risks resulting from the Corporation’s use of third-party software and services. The use of generative artificial intelligence is increasing the sophistication and effectiveness of these types of social engineering attacks. Future data security incidents could compromise or lead to the loss of material confidential, proprietary or otherwise protected information, seize, destroy or corrupt data, or otherwise disrupt the Corporation’s operations or affect its customers or other stakeholders.

Insider or employee cyber and security threats are also a significant concern for the Corporation. Despite the Corporation’s substantial investment in physical and technological security measures, employee training and contractual precautions, the Corporation’s information technology networks and infrastructure (or those of the Corporation’s third-party vendors and other service providers) are potentially vulnerable to unauthorized access to data, loss of access to systems or breaches of confidential information due to criminal conduct, attacks by hackers, employee or insider malfeasance or human error.

The Corporation has put in place security measures to protect itself against cyber-based attacks and disaster recovery plans for its critical systems that are designed to protect its data and customer data and to prevent data loss and other security incidents. These security measures, however, cannot provide absolute security. In some cases, it is difficult to anticipate, detect or identify indicators of such incidents and assess the damage caused by the incidents. In addition, a failure to promptly disclose such material incidents as required by law may result in additional financial or regulatory consequences.

If the Corporation’s information technology systems are breached, damaged, or cease to function properly due to any number of causes, such as catastrophic events, power outages, security incidents, or cyber-based attacks, and if the Corporation’s cybersecurity response plans and disaster recovery and its cyber incident response plans do not effectively mitigate the risks on a timely basis, the Corporation may encounter significant disruptions that could interrupt its ability to manage its operations, cause loss of valuable data, and damage its reputation. Any such incidents also could subject the Corporation to government investigations or private litigation. These factors may adversely impact the Corporation’s revenues, operating results, and financial condition. The Corporation could also experience delays in reporting its financial results.

The third-party data management providers and other vendors upon which the Corporation relies may have or develop security problems or security vulnerabilities that may also affect the Corporation’s systems or data. A data security or privacy breach of the Corporation’s systems or other form of cyber-based attack may occur in the future. In addition, the Corporation uses external vendors to perform security assessments on a periodic basis to review and assess its information security. The Corporation utilizes this information to audit itself, monitor the security of its technology infrastructure, and assess whether and how to prioritize the allocation of scarce resources to protect data and systems. These security assessments and audits may not identify or appropriately categorize relevant risks or protect its computer networks against security intrusions. Although the Corporation requires its third-party vendors contractually to maintain a level of security that is acceptable to it and work closely with key vendors to address potential and actual security concerns and attacks, all confidential, proprietary, or personal information may not be protected on their systems.

Regardless of whether incidents result from an attack on the Corporation directly or on third-party vendors upon which the Corporation relies, the costs to address the foregoing security problems and security vulnerabilities before or after a cybersecurity incident could be significant. Remediation efforts may not be successful or timely and could result in interruptions, delays or cessation of service and loss of existing or potential customers that may impede the Corporation’s manufacturing, sales, or other critical functions. Breaches of its security measures and the unapproved dissemination of proprietary information or sensitive or

Table of Contents

confidential data about the Corporation, its employees, its customers or other third parties could expose the Corporation, its employees, and customers or other affected third parties to a risk of loss or misuse of this information.

The impact on our industry of the development and deployment of artificial intelligence in the workplace is unknown, and potential changes in work spaces and work patterns could impact order volume and adversely affect our business and financial results.

As companies of all sizes evaluate and deploy artificial intelligence technologies, our customers may begin to change or adapt their work patterns, workplace needs, and approach to workspace design and furniture procurement. The impact of end users’ integration of AI on our industry is unknown, and there can be no assurance that the use of AI will benefit our business or profitability.

Further, we may face competition from other companies that are developing AI technologies to improve specification and procurement process, potentially including accelerated quoting, improved accuracy, targeted product selection, and vendor coordination. If we are unable to integrate AI to increase efficiency and reduce costs for our trade partners and end users, our business may be adversely affected.

Risks Related to the Steelcase Acquisition

The Corporation may not achieve the intended benefits of the acquisition, and the acquisition may disrupt its current plans or operations.

The Corporation may not be able to successfully integrate Steelcase’s assets or otherwise realize the expected benefits of the acquisition (including operating and other cost synergies). Difficulties in integrating Steelcase into the Corporation may result in the combined company performing differently than expected, in operational challenges, in the failure to realize anticipated run-rate cost synergies and efficiencies in the expected time frame or at all, or in the difficulty or failure of utilizing available U.S. tax attributes, in which case the acquisition may not be accretive to earnings per share, may not improve the Corporation's balance sheet position, and may not enhance its ability to deliver or generate additional free cash flow due to reduced cash tax payments.

The integration of Steelcase may result in material challenges. Those challenges may include the diversion of management’s attention from ongoing business concerns; difficulty in retaining key management and other employees; challenges in retaining or attracting business opportunities and establishing or maintaining business relationships; the possibility of faulty assumptions underlying expectations regarding the integration process and associated expenses; difficulty in consolidating corporate and administrative infrastructures and eliminating duplicative operations; challenges in coordinating geographically separate organizations; unanticipated issues in integrating information technology, communications and other systems; discovery of previously unknown liabilities; unforeseen expenses relating to integration; or delays associated with the acquisition.

The results of the Corporation may be adversely impacted if it does not effectively manage its expanded operations.

The size of the Corporation's business is significantly larger than the current size of either HNI’s or Steelcase’s respective businesses prior to the acquisition. The Corporation's ability to successfully manage this expanded business will depend, in part, upon management’s ability to design and implement strategic initiatives that address not only the integration of two independent stand-alone companies, but also the increased scale and scope of the combined business with its associated increased costs and complexity. The combined company may not be successful or realize the expected operating efficiencies, cost savings and other benefits currently anticipated from the acquisition.

The Corporation will incur substantial expenses in connection with the integration of HNI and Steelcase. The expectation of substantial integration expenses reflects in part the many processes, policies, procedures, operations, technologies and systems that must be integrated, potentially including purchasing, accounting and finance, sales, payroll, pricing, revenue management, marketing and benefits. The substantial majority of the expenses of the acquisition and the integration of HNI and Steelcase will be non-recurring expenses (including financing of the acquisition) and related to facilities and systems consolidation. The Corporation may incur additional costs to maintain employee morale and to attract, motivate or retain management personnel and other key employees. HNI and Steelcase will also incur transaction fees and costs related to formulating integration plans for the combined business, and the execution of these plans may lead to additional unanticipated costs. These incremental merger-related costs may exceed the savings the Corporation expects to achieve from the elimination of duplicative costs and the realization of other efficiencies related to the integration of the businesses, particularly in the near term and in the event there are material unanticipated costs.

Table of Contents

The acquisition may result in a loss of customers, distributors, suppliers, vendors, landlords and other business partners and may result in the termination of existing contracts.

Following the acquisition, some of the customers, distributors, dealers, suppliers, vendors, landlords and other business partners of Steelcase may terminate or scale back their current or prospective business relationships with the Corporation. Some customers may not wish to source a larger percentage of their needs from a single company or may believe that the Corporation is too closely allied with one of their competitors. In addition, Steelcase has contracts with customers, distributors, dealers, suppliers, vendors, landlords and other business partners that may require it to obtain consents from these other parties in connection with the acquisition, which may not be obtained on favorable terms or at all. If relationships with customers, distributors, dealers, suppliers, vendors, landlords and other business partners are adversely affected by the acquisition, or if the Corporation, following the acquisition, loses the benefits of the contracts of Steelcase, its business and financial performance could suffer.

Legal and Regulatory Risks

The Corporation is subject to extensive environmental regulation and has exposure to potential environmental liabilities.

Costs related to product defects could adversely affect the Corporation’s profitability.

The Corporation incurs various expenses related to product defects, including product warranty costs, product recall and retrofit costs, and product liability costs. The Corporation uses chemicals and materials in products and includes components in products from external suppliers, which it believes to be safe and appropriate for their designated use. Harmful effects, however, may later become known, which could subject the Corporation to litigation and significant losses. The Corporation maintains reserves for product defect-related costs but these reserves may not be adequate to cover actual claims.

An inability to protect the Corporation’s intellectual property could have a significant impact on the business.

If third parties claim that the Corporation infringes upon their intellectual property rights, the Corporation may incur liabilities and costs and may have to redesign or discontinue an infringing product.

The Corporation faces the risk of claims that it has infringed upon third parties’ intellectual property rights. Companies operating in the Corporation’s industry routinely seek patent protection for their product designs, and many of the principal competitors

Table of Contents

have large patent portfolios.

Financing Risks

The financing arrangements of the Corporation contain restrictions and limitations that may, under certain circumstances, significantly impact the Corporation’s ability to operate its business.

As of January 3, 2026, the Corporation had $1.3 billion of long-term indebtedness, including indebtedness it incurred in connection with its acquisition of Steelcase. The agreements governing such indebtedness may, under certain circumstances, impose significant operating and financial restrictions on the Corporation. These restrictions may affect the Corporation’s ability to operate its business and may limit the Corporation’s ability to take advantage of potential business opportunities as they arise.

In addition, the agreements governing such indebtedness require the Corporation to comply with a consolidated leverage ratio financial covenant and consolidated interest coverage ratio financial covenant. The Corporation’s ability to continue to comply with these financial covenants will depend on its ongoing financial and operating performance, which in turn will be subject to economic conditions and to financial, market and competitive factors, many of which are beyond the Corporation’s control. The ability to comply with these covenants will also depend on the Corporation’s ability to successfully implement its overall business strategy and realize anticipated synergies, cost savings, innovation, and operational efficiencies.

Various risks, uncertainties and events beyond the Corporation’s control could affect its ability to comply with the covenants contained in its financing agreements. Failure to comply with any of the covenants in its existing or future financing agreements could result in a default under those agreements and under other agreements containing cross-default provisions. A default would permit lenders to accelerate the maturity of the debt under these agreements. Under these circumstances, the Corporation might not have sufficient funds or other resources to satisfy all of its obligations. In addition, the limitations imposed by financing agreements on the Corporation’s ability to incur additional debt and to take other actions might significantly impair its ability to obtain other financing.

Fluctuating interest rates including potential future rate increases may raise the interest cost on the Corporation’s debt and could materially adversely impact the Corporation’s ability to refinance existing debt and limit its acquisition and development activities going forward.

The United States Federal Reserve Board has adjusted the benchmark interest rate multiple times in recent years, and may increase the rate or slow reductions in the rate in future periods. The agreements governing the indebtedness of the Corporation contain interest rates tied to various benchmark rates in effect at any given time, so as interest rates have increased, so has the Corporation’s interest costs for any new debt assumed in connection with the merger and in the normal course of our operations and any additional increases could further increase these costs. This increased cost could make the financing of any acquisition and development activity more costly, as well as lower future period earnings due to higher cost of borrowing.

The Corporation may require additional capital in the future, which may not be available or may be available only on unfavorable terms.

The Corporation’s capital requirements depend on many factors, including its need for capital improvements, tooling, research and development, and acquisitions.

Table of Contents

Any equity or debt financing, if available, could have unfavorable terms.

Risks Related to the Common Stock

The Corporation’s results of operations and earnings may not meet guidance or expectations.

These measures may be adopted by the Board of Directors without any vote or action by the shareholders.

Item 1B. Unresolved Staff Comments

None.

Cybersecurity

Risk Management and Strategy

Cybersecurity risk management is an integral part of the Corporation’s enterprise risk management program. The cybersecurity risk management program is designed to align with industry best practices, is generally based on the framework established by the National Institute of Standards and Technology (NIST), provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of applications and services provided by third parties, and facilitates coordination across different departments of the Corporation. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a threat, including whether the threat is associated with a third-party service provider, implementing countermeasures and mitigation strategies, and informing management and the Board of Directors of material cybersecurity threats, incidents, and impact.

The cybersecurity team under the direction of the Corporation’s Chief Information and Digital Officer ("CIDO"), is responsible for assessing, deploying, and managing the cybersecurity risk management program. Recognizing the complexity and evolving nature of cybersecurity threats, the cybersecurity team engages with a range of external experts, including cybersecurity assessors and consultants in evaluating and testing the Corporation’s risk management systems. The collaboration with these independent third-parties includes regular threat assessments, such as penetration tests and table-top exercises, and consultation on security enhancements. In addition, the cybersecurity team provides training to applicable members annually and ongoing cybersecurity education. Additionally, the Corporation maintains cyber risk insurance.

Table of Contents

Depending on the products and services provided and the potential for data exchange and technology risk, suppliers and other third-party service providers are evaluated by the cybersecurity organization to assess their security and data protection capabilities. The Corporation periodically reviews independent assessments of major service providers.

Governance

The Board of Directors has overall oversight responsibility for risk management. Oversight of cybersecurity risks has been delegated to the Audit Committee of the Board of Directors. The Audit Committee also reports material cybersecurity risk to the full Board of Directors.

The Audit Committee is responsible for ensuring management has processes in place designed to identify and evaluate cybersecurity risks to which the Corporation is exposed and implement programs to manage cybersecurity risks and mitigate cybersecurity incidents.

Management under the CIDO is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential risk exposures are monitored, implementing appropriate mitigation measures and maintaining cybersecurity programs. The CIDO and cybersecurity team members are certified and/or experienced information systems security professionals and information security managers with many years of experience.

The CIDO receives reports from the cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Appropriate procedures for communication to the Audit Committee are also built into the incident response plan.

The CIDO regularly updates the Audit Committee and the full Board of Directors on the Corporation’s cybersecurity risk management program, material cybersecurity risks, and mitigation strategies. Management provides the Audit Committee with quarterly cybersecurity reports that cover, among other topics, third-party assessments of the Corporation’s cybersecurity risk management program, developments in cybersecurity, and updates to the Company’s cybersecurity risk management program and mitigation strategies.

Cybersecurity Threats

The Corporation has not identified cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect the Corporation. There can be no assurance that this will continue to be the case. Notwithstanding the Corporation’s investment in cybersecurity, it may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on its business, results of operations or financial condition. For a discussion of cybersecurity risks affecting the Corporation’s business, see "Item 1A. Risk Factors - Strategic and Operational Risks - The Corporation's information technology systems, processes, and sites may suffer interruptions, security incidents, or failures that may affects its ability to conduct its business and cause significant damage to its reputation." which is incorporated by reference into this

Recently Filed

Click on a ticker to see risk factors

Ticker *	File Date
CBL	8 minutes ago
INGM	an hour ago
AMRC	an hour ago
HNI	2 hours ago
PRME	2 hours ago
OFS	2 hours ago
SRRK	3 hours ago
PASG	3 hours ago
AMLX	3 hours ago
HYMC	14 hours ago
ANIK	15 hours ago
DAAQ	15 hours ago
RAAQ	16 hours ago
HTLD	16 hours ago
NBBK	16 hours ago
AMRN	17 hours ago
CECO	17 hours ago
SIVR	17 hours ago
GLTR	17 hours ago
PALL	17 hours ago
PPLT	17 hours ago
SGOL	17 hours ago
LINC	17 hours ago
HSTA	17 hours ago
TPB	17 hours ago
BPOP	17 hours ago
RDNT	17 hours ago
SKWD	17 hours ago
AIV	17 hours ago
NVTS	3 days, 19 hours ago
DAN	3 days, 19 hours ago
FSBC	3 days, 19 hours ago
CLMB	3 days, 19 hours ago
NPKI	3 days, 19 hours ago
SBGI	3 days, 20 hours ago
BXP	3 days, 20 hours ago
SHO	3 days, 20 hours ago
HFWA	3 days, 20 hours ago
SSP	3 days, 20 hours ago
FBP	3 days, 20 hours ago
WULF	3 days, 20 hours ago
GSG	3 days, 20 hours ago
SLV	3 days, 20 hours ago
IBIT	3 days, 20 hours ago
IAUM	3 days, 20 hours ago
IAU	3 days, 20 hours ago
ETHA	3 days, 20 hours ago
SOLV	3 days, 20 hours ago
NWN	3 days, 20 hours ago
TDC	3 days, 21 hours ago

OTHER DATASETS

House Trading

Dashboard

Corporate Flights

Dashboard

App Ratings

Dashboard

Strategies

Alerts

Browse Data

Risk Factors Dashboard

View risk factors by ticker

Search filings by term

Risk Factors - HNI

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

Recently Filed

OTHER DATASETS

House Trading

Corporate Flights

App Ratings

TRADE SMARTER

TRADE SMARTER

Strategies

Alerts

Browse Data

Risk Factors Dashboard

View risk factors by ticker

Search filings by term

Risk Factors - HNI

-New additions in green-Changes in blue-Hover to see similar sentence in last filing

Recently Filed

OTHER DATASETS

House Trading

Corporate Flights

App Ratings

TRADE SMARTER

TRADE SMARTER

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing