CRAWFORD & CO

Previous wording

We manage a large amount of highly sensitive and confidential consumer information including personally identifiable information, medical/health information and financial information. Unauthorized access to, alteration or disclosure of this data, whether as a result of criminal conduct, advances in computer hacking or otherwise, could result in a material loss of business, substantial legal liability or significant harm to our reputation.

Current wording

We manage a large amount of highly sensitive and confidential consumer information including personal data, medical/health information and financial information. Unauthorized access to, alteration or disclosure of this data, whether as a result of criminal conduct, advances in computer hacking or otherwise, could result in a material loss of business, substantial legal liability or significant harm to our reputation.

Previous wording

We manage a large amount of highly sensitive and confidential consumer information including personally identifiable information, medical/health information and financial information. A security or privacy incident impacting data processed or stored in our own facilities or data maintained, processed or stored by our service providers, including cloud service providers, could compromise the confidentiality, integrity or availability of this information. Unauthorized access to or disclosure of sensitive and confidential information stored by us or our service providers may occur through break-ins, breaches of a secure network by an unauthorized party, systems and technology failures, failed internet processes, theft or misuse or other misconduct. It is also possible that unauthorized access to or disclosure of such sensitive and confidential information may be obtained through accidental or malicious failure to follow security policies or controls by us or our employees or our service providers. If there were an inadvertent disclosure of confidential consumer information, or if a third party were to gain unauthorized access to the confidential information, our operations could be disrupted, our reputation could be damaged and we could be subject to claims or other liabilities, regulatory investigations, or fines. These incidents, if successful, could also materially disrupt operational systems and result in loss of intellectual property, trade secrets, other proprietary or competitively sensitive information. In addition, such perceived or actual unauthorized disclosure of the information we collect or breach of our security could damage our reputation, result in the loss of customers and harm our business.

Current wording

We manage a large amount of highly sensitive and confidential consumer information including personal data, medical/health information and financial information. A security or privacy incident impacting data processed or stored in our own facilities or data maintained, processed or stored by our service providers, including cloud service providers, could compromise the confidentiality, integrity or availability of this information. Unauthorized access to or disclosure of sensitive and confidential information stored by us or our service providers may occur through break-ins, breaches of a secure network by an unauthorized party, systems and technology failures, failed internet processes, theft or misuse or other misconduct. It is also possible that unauthorized access to or disclosure of such sensitive and confidential information may be obtained through accidental or malicious failure to follow security policies or controls by us or our employees or our service providers. If there were an inadvertent disclosure of confidential consumer information, or if a third party were to gain unauthorized access to the confidential information, our operations could be disrupted, our reputation could be damaged and we could be subject to claims or other liabilities, regulatory investigations, or fines. These incidents, if successful, could also materially disrupt operational systems and result in loss of intellectual property, trade secrets, other proprietary or competitively sensitive information. In addition, such perceived or actual unauthorized disclosure of the information we collect or breach of our security could damage our reputation, result in the loss of customers and harm our business.

Previous wording

Malicious technology-related events, such as cyberattacks, computer hacking, computer viruses, ransomware, worms and other destructive or disruptive software and other attempts to gain access to confidential or personal data, denial of service attacks and other malicious activities are becoming increasingly diverse and sophisticated and the incidence of these events is on the rise worldwide and highlights the need for continual and effective cybersecurity awareness and education. Our business, which involves the collection, use, transmission and other processing of data, may make us and our clients and business partners attractive targets of hackers, denial of service attacks, malicious code, phishing attacks, ransomware attacks, and other threat actors, including malicious insiders (such as employees and prior employees), which may result in security incidents, including the unauthorized access, misuse, loss, corruption, inaccessibility, or destruction of this data (including personal, confidential and sensitive data), unavailability of services, or other adverse events.

Current wording

Malicious technology-related events, such as cyberattacks, computer hacking, computer viruses, ransomware, worms and other destructive or disruptive software and other attempts to gain access to confidential or personal data, denial of service attacks and other malicious activities are becoming increasingly diverse and sophisticated and the incidence of these events is on the rise worldwide and highlights the need for continual and effective cybersecurity awareness and education. Our business, which involves the collection, use, transmission and other processing of data, makes us and our clients and business partners attractive targets of hackers, denial of service attacks, malicious code, phishing attacks, ransomware attacks, and other threat actors, including malicious insiders (such as employees and prior employees), which have resulted in security incidents. Types of cybersecurity incidents may include unauthorized access, misuse, loss, corruption, inaccessibility, or destruction of data (including personal, confidential and sensitive data), unavailability of services, or other adverse events.

Previous wording

In the past three years, we have faced cyberattacks, and we expect to continue to face cyberattacks in the future. Some of these attacks have been successful, although none have been material. We have made investments in our information security policies, procedures and technical controls and routinely engage a third party to assess the maturity of our information security program against the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. However, we may not be able to prevent a cybersecurity breach of our systems or third party systems due to the increasing sophistication and frequency of such attacks. All employees receive security awareness training including communication of processes for reporting a potential security incident. We have a robust Cyber Incident Response Plan in place which provides a documented framework for handling high severity security and privacy incidents and facilitates coordination across multiple parts of the Company and with external expertise when necessary. Additionally, we have existing procedures to determine the potential materiality of a cybersecurity incident. These procedures include reporting protocols to and oversight from our Board of Directors. We also have disclosure controls and insider trading restrictions that would apply in the event of a material cybersecurity incident, and we routinely perform simulations and drills at both a technical and management level. Notwithstanding these measures, we cannot provide any assurance that we will always be able to prevent or mitigate a cybersecurity attack. These types of cybersecurity attacks and incidents can give rise to a variety of losses and costs, including legal exposure and regulatory fines, damages to reputation, and others.

Current wording

In the past three years, we have faced cyberattacks, and we expect to continue to face cyberattacks in the future. Some of these attacks have been successful, although none have been material. We have made investments in our information security policies, procedures and technical controls and routinely engage a third party to assess the maturity of our information security program against the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. However, we do not believe it is possible to protect our systems or third-party systems against every attempt at a malicious breach due to the increasing sophistication and frequency of such attacks. All employees receive security awareness training including communication of processes for reporting a potential security incident. We have a robust Cyber Incident Response Plan in place which provides a documented framework for handling high severity security and privacy incidents and facilitates coordination across multiple parts of the Company and with external expertise when necessary. Additionally, we have existing procedures to determine the potential materiality of a cybersecurity incident. These procedures include reporting protocols to and oversight from our Board of Directors. We also have disclosure controls and insider trading restrictions that would apply in the event of a material cybersecurity incident, and we routinely perform simulations and drills at both a technical and management level. Notwithstanding these measures, we cannot provide any assurance that we will always be able to prevent or mitigate a cybersecurity attack. These types of cybersecurity attacks and incidents can give rise to a variety of losses and costs, including legal exposure and regulatory fines, damages to reputation, and others.

Previous wording

Transferring personal information across international borders is increasingly complex and subject to a growing body of enforcement decisions. The increased focus on cross-border data transfers in various countries, in addition to new data protection and privacy laws, means our clients are also more attune to data sharing and requiring data transfer impact assessments for countries which are not deemed to provide an adequate level of protection as the data-originating country. These requirements are often complex, conflicting, unclear or ever changing, all of which can make compliance challenging and may result in an increase in the obligations required to provide our services in the EU or in sanctions and fines for non-compliance. Several other countries, including Brazil, China, Canada and Australia, have also established specific legal requirements for cross-border transfers of personal information. These ongoing developments in the EU and elsewhere could increase our operating costs in these jurisdictions and impact the way we operationalize our business models, with effects on results of operations and financial condition.

Current wording

Transferring personal information across international borders is increasingly complex and subject to a growing body of enforcement decisions. The increased focus on cross-border data transfers in various countries, in addition to new data protection and privacy laws, means our clients are also more attune to data sharing and requiring data transfer impact assessments for countries which are not deemed to provide an adequate level of protection as the data-originating country. These requirements are often complex, conflicting, unclear or ever changing, all of which can make compliance challenging and may result in an increase in the obligations required to provide our services in the U.K. and EU or in sanctions and fines for non-compliance. Several other countries, including Brazil, China, Canada and Australia, have also established specific legal requirements for cross-border transfers of personal information. These ongoing developments in the U.K. and EU and elsewhere could increase our operating costs in these jurisdictions and impact the way we operationalize our business models, with effects on results of operations and financial condition.

Previous wording

Our business may be negatively affected by instability, disruption or destruction in the many geographic regions where we operate. Natural or manmade disasters, including storm, flood, fire, earthquake, pandemics and other regional or global health crises, as well as war, terrorism, riot, civil insurrection or social unrest, may cause damage to our facilities or disrupt our services. This includes our shared services centers which exist in international geographies. Specifically, we continue to increase employees and processes performed by our Global Business Service Center located in the Philippines. Our crisis management procedures, business continuity plans and disaster recovery capabilities may not be effective at preventing or mitigating the effects of such disasters, particularly in the case of a catastrophic event. These events may pose significant security risks to our employees, the facilities where they work, our operations, electricity and other utilities, communications, travel and network services and the disruption of any or all of them could materially adversely affect our financial results.

Current wording

Our business may be negatively affected by instability, disruption or destruction in the many geographic regions where we operate. Natural or manmade disasters, including storm, flood, fire, earthquake, pandemics and other regional or global health crises, as well as war, terrorism, riot, civil insurrection or social unrest, may cause damage to our facilities or disrupt our services. This includes our shared services centers which exist in international geographies. Specifically, we continue to increase employees and processes performed by our Global Business Service Centers located in the Philippines. Our crisis management procedures, business continuity plans and disaster recovery capabilities may not be effective at preventing or mitigating the effects of such disasters, particularly in the case of a catastrophic event. These events may pose significant security risks to our employees, the facilities where they work, our operations, electricity and other utilities, communications, travel and network services and the disruption of any or all of them could materially adversely affect our financial results.

Previous wording

As of December 31, 2022, we identified a material weakness in internal control over financial reporting in our United Kingdom information technology general controls. Although such material weakness was remediated in 2023, if we identify one or more material weaknesses in the future, any such newly identified material weakness could limit our ability to prevent or detect a misstatement of our accounts or disclosures that could result in a material misstatement of our annual or interim financial statements. In such case, we may be unable to maintain compliance with securities laws regarding timely filing of periodic reports in addition to applicable stock exchange listing requirements, investors may lose confidence in our financial reporting and our stock price may decline as a result. We cannot be certain that the measures we have taken to date, or any measures we may take in the future, will be sufficient to avoid potential future material weaknesses.

Current wording

Although no material weaknesses exist as of December 31, 2024, if we identify material weaknesses in the future, any such newly identified material weakness could limit our ability to prevent or detect a misstatement of our accounts or disclosures that could result in a material misstatement of our annual or interim financial statements. In such case, we may be unable to maintain compliance with securities laws regarding timely filing of periodic reports in addition to applicable stock exchange listing requirements, investors may lose confidence in our financial reporting and our stock price may decline as a result. We cannot be certain that the measures we have taken to date, or any measures we may take in the future, will be sufficient to avoid potential future material weaknesses.

Previous wording

At the end of the most recent measurement period for our U.S. Qualified Plan, the projected benefit obligation was underfunded by $22.3 million. In 2021 we made voluntary contributions to this plan, but we did not do so in 2022 or 2023, and do not expect to make any discretionary contributions to the U.S. Qualified Plan in the next fiscal year. Volatility in the capital markets, mortality changes and future legislation may have a negative impact on our pension plan, which may further increase the underfunded portion and our attendant funding obligations. Any future contributions to our underfunded defined benefit pension plan could reduce our liquidity, restrict available cash for our operating, financing, and investing needs and may materially adversely affect our financial condition and our ability to deploy capital to other opportunities. Any decision to terminate the plan and settle the defined-benefit pension obligation would result in a non-cash charge within the Consolidated Statements of Operations related to unrecognized actuarial losses in accumulated other comprehensive income, which totals $190.3 million as of December 31, 2023.

Current wording

At the end of the most recent measurement period for our U.S. Qualified Plan, the projected benefit obligation was underfunded by $19.0 million. We did not make any voluntary contributions to this plan in 2022, 2023, or 2024, and do not expect to make any discretionary contributions to the U.S. Qualified Plan in the next fiscal year. Volatility in the capital markets, mortality changes and future legislation may have a negative impact on our pension plan, which may further increase the underfunded portion and our attendant funding obligations. Any future contributions to our underfunded defined benefit pension plan could reduce our liquidity, restrict available cash for our operating, financing, and investing needs and may materially adversely affect our financial condition and our ability to deploy capital to other opportunities. Any decision to terminate the plan and settle the defined-benefit pension obligation would result in a non-cash charge within the Consolidated Statements of Operations related to unrecognized actuarial losses in accumulated other comprehensive income, which totals $178.9 million as of December 31, 2024.

Previous wording

While we do not anticipate any contribution in 2024, we intend to comply with any future funding requirements through the use of cash from operations. However, there can be no assurance that we will generate enough cash to do so. Our inability to fund these obligations through cash from operations could require us to seek funding from other sources, including through additional borrowings under our Credit Facility (defined below), if available, proceeds from debt or equity financings, or asset sales. There can be no assurance that we would be able to obtain any such external funding in amounts, at times and on terms that we deem commercially reasonable, in order for us to meet these obligations. Furthermore, any of the foregoing could materially increase our outstanding debt or debt service requirements, or dilute the value of the holdings of our current shareholders, as the case may be. Our inability to comply with any funding obligations in a timely manner could materially adversely affect our financial condition.

Current wording

While we do not anticipate any contributions in 2025, we intend to comply with any future funding requirements through the use of cash from operations. However, there can be no assurance that we will generate enough cash to do so. Our inability to fund these obligations through cash from operations could require us to seek funding from other sources, including through additional borrowings under our Credit Facility (defined below), if available, proceeds from debt or equity financings, or asset sales. There can be no assurance that we would be able to obtain any such external funding in amounts, at times and on terms that we deem commercially reasonable, in order for us to meet these obligations. Furthermore, any of the foregoing could materially increase our outstanding debt or debt service requirements or dilute the value of the holdings of our current shareholders, as the case may be. Our inability to comply with any funding obligations in a timely manner could materially adversely affect our financial condition.

Previous wording

We are party to a credit facility, effective as of November 5, 2021, with Bank of America, N.A., Wells Fargo Bank, N.A., Truist Bank, and the other lenders a party thereto, (the "Credit Facility"). The Credit Facility consists of a $450 million revolving credit facility, with a letter of credit sub-commitment of $125 million. The available borrowing capacity under the Credit Facility totaled $232.1 million on December 31, 2023. The Credit Facility contains various representations, warranties and covenants, including covenants limiting liens, indebtedness, guarantees, mergers and consolidations, substantial asset sales, investments and loans, sale and leasebacks, restrictions on dividends and distributions, and other fundamental changes in our business. Additionally, the Credit Facility contains covenants requiring us to remain in compliance with a maximum leverage ratio and a minimum interest coverage ratio.

Current wording

We are party to a credit facility, effective as of November 5, 2021, with Bank of America, N.A., Wells Fargo Bank, N.A., Truist Bank, and the other lenders a party thereto, (the "Credit Facility"). The Credit Facility consists of a $450 million revolving credit facility, with a letter of credit sub-commitment of $125 million. The available borrowing capacity under the Credit Facility totaled $219.4 million on December 31, 2024. The Credit Facility contains various representations, warranties and covenants, including covenants limiting liens, indebtedness, guarantees, mergers and consolidations, substantial asset sales, investments and loans, sale and leasebacks, restrictions on dividends and distributions, and other fundamental changes in our business. Additionally, the Credit Facility contains covenants requiring us to remain in compliance with a maximum leverage ratio and a minimum interest coverage ratio.

Previous wording

Each year, and more frequently on an interim basis if appropriate, we are required by ASC Topic 350, "Intangibles--Goodwill and Other," to assess the carrying value of our indefinite lived intangible assets and goodwill to determine whether the carrying value of those assets is impaired. Such assessment and determination involves significant judgments to estimate the fair value of our reporting units, including estimating future cash flows, near term and long term revenue growth, and determining appropriate discount rates, among other assumptions. We intend to continue to monitor the performance of our reporting units and, should actual operating earnings consistently fall below forecasted operating earnings, we will perform an interim goodwill impairment analysis. Any such charges could materially adversely affect our financial results in the periods in which they are recorded.

Current wording

Each year, and more frequently on an interim basis if appropriate, we are required by Accounting Standards Codification ("ASC") Topic 350, "Intangibles--Goodwill and Other," to assess the carrying value of our indefinite lived intangible assets and goodwill to determine whether the carrying value of those assets is impaired. Such assessment and determination involves significant judgments to estimate the fair value of our reporting units, including estimating future cash flows, near term and long term revenue growth, and determining appropriate discount rates, among other assumptions. We intend to continue to monitor the performance of our reporting units and, should actual operating earnings consistently fall below forecasted operating earnings, we will perform an interim goodwill impairment analysis. Any such charges could materially adversely affect our financial results in the periods in which they are recorded.

Previous wording

As of December 31, 2023, Jesse C. Crawford, a member of our Board of Directors, and the father of Jesse C. Crawford, Jr., who is also a member and Chair of the Board of Directors, beneficially owned approximately 66% of our outstanding voting Class B Common Stock. As a result, he has the ability to control substantially all matters submitted to our shareholders for approval, including the election and removal of directors. He also has the ability to control our management and affairs. As of December 31, 2023, Mr. Crawford also beneficially owned approximately 36% of our outstanding non-voting Class A Common Stock. This concentration of ownership of our stock may delay or prevent a change in control; impede a merger, consolidation, takeover, or other business combination involving us; discourage a potential acquirer from making a tender offer or otherwise attempting to obtain control of us; reduce the liquidity, and thus the trading price, of our stock; or result in other actions that may be opposed by, or not be in the best interests of, the Company and our other shareholders.

Current wording

As of December 31, 2024, Jesse C. Crawford, a member of our Board of Directors, and the father of Jesse C. Crawford, Jr., who is also a member and Chair of the Board of Directors, beneficially owned approximately 68% of our outstanding voting Class B Common Stock. As a result, he has the ability to control substantially all matters submitted to our shareholders for approval, including the election and removal of directors. He also has the ability to control our management and affairs. As of December 31, 2024, Mr. Crawford also beneficially owned approximately 36% of our outstanding non-voting Class A Common Stock. This concentration of ownership of our stock may delay or prevent a change in control; impede a merger, consolidation, takeover, or other business combination involving us; discourage a potential acquirer from making a tender offer or otherwise attempting to obtain control of us; reduce the liquidity, and thus the trading price, of our stock; or result in other actions that may be opposed by, or not be in the best interests of, the Company and our other shareholders.

Previous wording

Many of our employees possess skills and expertise that are important to maintain our competitiveness and to operate our business efficiently. We compete with other employers when just we hire new employees, but also for the retention of our existing employees. Such competition could reduce availability, increase our costs and reduce our revenues. Such competition may require us to increase wages and benefits to recruit and retain qualified employees. Furthermore, even with increases in wages and benefits, employment shortages may nonetheless result from such competition. If we are not successful in attracting and retaining sufficient skilled employees on terms acceptable to us, our business could be materially and adversely affected.

Current wording

Many of our employees possess skills and expertise that are important to maintain our competitiveness and to operate our business efficiently. We compete with other employers not just when we hire new employees, but also for the retention of our existing employees. Such competition could reduce availability, increase our costs and reduce our revenues. Such competition may require us to increase wages and benefits to recruit and retain qualified employees. Furthermore, even with increases in wages and benefits, employment shortages may nonetheless result from such competition. If we are not successful in attracting and retaining sufficient skilled employees on terms acceptable to us, our business could be materially and adversely affected.

Previous wording

Many of the employees in our industry, including those that we employ directly, are approaching retirement age. As these experienced employees retire, we may have difficulty recruiting new employees with comparable qualifications and experience, and we may be unable to transfer our employees’ institutional knowledge successfully to new qualified employees. Any such failures would be exacerbated at times of peak demand and could cause us to rely more heavily on outside resources. Our failure to recruit and train new employees and to ensure they obtain the adequate qualifications and experience could result in reduced revenues, loss of customer goodwill and a material negative impact on our results of operations.

Current wording

Many of the employees in our industry, including those that we employ directly, are approaching retirement age. As these experienced employees retire, we may have difficulty recruiting new employees with comparable qualifications and experience, and we may be unable to transfer our employees’ institutional knowledge successfully to new qualified employees. Any such failures would be exacerbated at times of peak demand and could cause us to rely more heavily on outside resources. Our failure to recruit and train new employees and to ensure they obtain the adequate qualifications and experience could result in reduced revenues, loss of customer goodwill and a negative impact on our results of operations.