CORVEL CORP

Previous wording

If we are unable to apply technology and data analytics effectively in driving value for our clients through technology-based solutions or gain internal efficiencies and maintain internal controls through the application of technology and related tools, our operating results, client relationships, growth and compliance programs could be adversely affected.

Current wording

If we are unable to apply technology and data analytics effectively in driving value for our clients through technology-based solutions or gain internal efficiencies and maintain effective internal controls through the application of technology and related tools, our operating results, client relationships, growth and compliance programs could be adversely affected.

Previous wording

Our future success depends, in part, on our ability to anticipate and respond effectively to the threat and opportunity presented by digital disruption, “big data” and data analytics, and other developments in technology. These may include new applications or insurance-related services based on artificial intelligence, machine learning, robotics, blockchain, the metaverse or new approaches to data mining that impact the nature of how we generate revenue. We may be exposed to competitive risks related to the adoption and application of new technologies by established market participants or new entrants such as technology companies, start-up companies and others. These new entrants are focused on using technology and innovation, including artificial intelligence and blockchain, in an attempt to simplify and improve the client experience, increase efficiencies, alter business models and effect other potentially disruptive changes in the industries in which we operate. We must also develop and implement technology solutions and technical expertise among our employees that anticipate and keep pace with rapid and continuing changes in technology, industry standards, client preferences and internal control standards. We may not be successful in anticipating or responding to these developments on a timely and cost-effective basis and our ideas may not be accepted in the marketplace. Additionally, the effort to gain technological expertise, make use of data analytics, and develop new technologies in our business requires us to incur significant expenses. Investments in technology systems and data analytics capabilities may not deliver the benefits or perform as expected, or may be replaced or become obsolete more quickly than expected, which could result in operational difficulties or additional costs. If we cannot offer new technologies or data analytics solutions as quickly as our competitors, or if our competitors develop more cost-effective technologies, data analytics solutions or other product offerings, we could experience a material adverse effect on our operating results, client relationships, growth and compliance programs.

Current wording

Our future success depends, in part, on our ability to anticipate and respond effectively to the risk of, and conversely, the opportunity presented by digital disruption, “big data” and data analytics, and other developments in technology. These may include new applications or insurance-related services based on artificial intelligence, machine learning, robotics, blockchain, the metaverse or new approaches to data mining that impact the nature of how we generate revenue. We may be exposed to competitive risks related to the adoption and application of new technologies by established market participants or new entrants such as technology companies, start-up companies and others. These new entrants are focused on using technology and innovation, including artificial intelligence and blockchain, in an attempt to simplify and improve the client experience, increase efficiencies, alter business models and effect other potentially disruptive changes in the industries in which we operate. We must also develop and implement technology solutions and technical expertise among our employees that anticipate and keep pace with rapid and continuing changes in technology, industry standards, client preferences and internal control standards. We may not be successful in anticipating or responding to these developments on a timely and cost-effective basis and our ideas may not be accepted in the marketplace. Data produced by or contained in technology that uses artificial intelligence may contain a degree of inaccuracy and error. Additionally, the effort to gain technological expertise, make use of data analytics, and develop new technologies in our business requires us to incur significant expenses. Investments in technology systems and data analytics capabilities may not deliver the benefits or perform as expected, or may be replaced or become obsolete more quickly than expected, which could result in operational difficulties or additional costs. If we or our third-party vendors fail to effectively implement these new technologies, including, artificial intelligence, we could be subject to additional risks that we do not understand or cannot adequately mitigate, which could have a material adverse effect on our results of operations and financial condition. Further, if we cannot offer new technologies or data analytics solutions as quickly as our competitors, or if our competitors develop more cost-effective technologies, data analytics solutions or other product offerings, we could experience a material adverse effect on our operating results, client relationships, growth and compliance programs.

Previous wording

Cybersecurity breaches of any of the systems on which we rely may result from circumvention of security systems, denial-of-service attacks or other cyber-attacks, hacking, “phishing” attacks, computer viruses, ransomware, malware, employee or insider error, malfeasance, social engineering, physical breaches or other actions. According to media reports, the frequency, intensity, and sophistication of cyber-attacks, ransomware attacks, and other data security incidents generally has significantly increased around the globe in recent years. As with many other businesses, we have experienced, and are continually at risk of being subject to, attacks and incidents, including cybersecurity breaches such as computer viruses, unauthorized parties gaining access to our information technology systems and similar incidents. Cybersecurity breaches could cause us, and in some cases, materially, to experience reputational harm, loss of customers, loss and/or delay of revenue, loss of proprietary data, loss of licenses, regulatory actions and scrutiny, sanctions or other statutory penalties, litigation, liability for failure to safeguard customers’ information, financial losses or a drop in our stock price. We have invested in and continue to expend significant resources on information technology and data security tools, measures, processes, initiatives, policies and employee training designed to protect our information technology systems, as well as the personal, confidential or sensitive information stored on or transmitted through those systems, and to ensure an effective response to any cyber-attack or data security incident. These expenditures could have an adverse impact on our financial condition and results of operations, and divert management’s attention from pursuing our strategic objectives. In addition, the cost and operational consequences of implementing, maintaining and enhancing further system protective measures could increase significantly as cybersecurity threats increase, and there can be no assurance that the security measures we employ will effectively prevent cybersecurity breaches or otherwise prevent unauthorized persons from obtaining access to our systems and information.

Current wording

Security incidents of any of the systems on which we rely may result from circumvention of security measures, denial-of-service attacks or other cyber-attacks, hacking, “phishing” attacks, computer viruses, ransomware, malware, employee or insider error, malfeasance, social engineering, physical breaches or other actions. According to media reports, the frequency, intensity, and sophistication of cyber-attacks, ransomware attacks, and other data security incidents generally has significantly increased around the globe in recent years. As with many other businesses, we have experienced, and are continually at risk of being subject to, attacks that result in incidents, caused by computer viruses, unauthorized parties gaining access to our information technology systems and similar threats. Cybersecurity incidents could cause in some cases, reputational harm, loss of customers, loss and/or delay of revenue, loss of proprietary data, loss of licenses, regulatory actions and scrutiny, sanctions or other statutory penalties, litigation, liability for failure to safeguard customers’ information, financial losses or a drop in our stock price. We have invested in and continue to expend significant resources on information technology and information security tools, measures, processes, initiatives, policies and employee training designed to protect our information technology systems, as well as the personal, confidential or sensitive information stored on or transmitted through those systems, and to ensure an effective response to any cyber-attack or security incident. These expenditures could have an adverse impact on our financial condition and results of operations, and divert management’s attention from pursuing our strategic objectives. In addition, the cost and operational consequences of implementing, maintaining and enhancing further system protective measures could increase significantly as cybersecurity threats increase, and there can be no assurance that the security measures we employ will effectively prevent cybersecurity incidents or otherwise prevent malicious actors from obtaining access to our systems and information.

Previous wording

As these threats evolve, cybersecurity incidents could be more difficult to detect, defend against, and remediate. Cyber-attacks or data incidents could remain undetected for some period, which could potentially result in significant harm to our systems, as well as unauthorized access to the information stored on and transmitted by our systems. Further, despite our security efforts and training, our employees may purposefully or inadvertently cause security breaches that could harm our systems or result in the unauthorized disclosure of or access to information. Any measures we do take to prevent security breaches, whether caused by employees or third parties, could have the potential to harm relationships with our customers or restrict our ability to meet our customers' expectations.

Current wording

As these threats evolve, cybersecurity incidents could be more difficult to detect, prevent, and remediate. Cyber-attacks or data handling incidents could remain undetected for some period, which could potentially result in significant harm to our systems, as well as unauthorized access to the information stored on and transmitted by our systems. Further, despite our security efforts and training, our employees may purposefully or inadvertently cause incidents that could harm our systems or result in the unauthorized disclosure of or access to information. Any measures we do take to prevent security incidents, whether caused by employees or third parties, could have the potential to impact our relationships with our customers or restrict our ability to meet our customers' expectations.

Previous wording

A cyber-attack or other data security incident could result in the significant and protracted disruption of our business such that:

Current wording

A cyber-attack resulting in a security incident could have a significant impact on the business up to a protracted disruption of our business:

Previous wording

A breach of security may cause our customers to curtail or stop using our services.

Current wording

A security breach may cause our customers to curtail or stop using our services.

Previous wording

We rely largely on our own security systems, confidentiality procedures, and employee nondisclosure agreements to maintain the privacy and security of our and our customers’ proprietary information. Accidental or willful security breaches or other unauthorized access by third parties to our information systems, the existence of computer viruses in our data or software, and misappropriation of our proprietary information could expose us to a risk of information loss, litigation, and other possible liabilities which may have a material adverse effect on our business, financial condition, and results of operations. If security measures are breached because of third-party action, employee error, malfeasance, or otherwise, or if design flaws in our software are exposed and exploited, and, as a result, a third party obtains unauthorized access to any customer data, our relationships with our customers and our reputation will be damaged, our business may suffer, and we could incur significant liability. Because techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not recognized until launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures.

Current wording

We rely on industry standard security solutions, confidentiality procedures, and employee nondisclosure agreements to maintain the privacy and security of our and our customers’ proprietary information. Intentional or unintentional incidents, like unauthorized access by third parties to our information systems, the infection of our systems or software with malware, and misappropriation of our proprietary information could expose us to a risk of information loss, litigation, and other possible liabilities which may have a material adverse effect on our business, financial condition, and results of operations. If third-party actions, employee errors, malfeasance, or otherwise, or if design flaws in our software are exposed and exploited, and, as a result, a third party obtains unauthorized access to any customer data, our relationships with our customers and our reputation could be significantly be damaged, our business may suffer, and we could incur significant liability. Because techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not recognized until launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures.

Previous wording

There has also been increased regulatory scrutiny of the use of “big data” techniques, machine learning, and artificial intelligence. It is likely that we will be subject to new regulations that could materially adversely affect our operations or ability to write business profitably in one or more jurisdictions. In addition, regulators have recently requested information from insurers on their use of algorithms, artificial intelligence and machine learning. We have internal policies governing the use of artificial intelligence by our employees designed to protect the company from breaches of data privacy, liability and regulatory enforcement risk; however, if our employees violate these policies, it could expose us to such risks. Our exposure to these risks also could increase if our vendors, suppliers, or other third-party providers employ artificial intelligence in relation to the products or services they provide to us, as we have limited control over such use in third-party products or services. These risks include, among others, the input of confidential information, including material non-public information, in contravention of our policies or contractual restrictions to which any of the foregoing are subject, or in violation of applicable laws or regulations, including those relating to data protection. We cannot predict what, if any, regulatory actions may be taken with regard to “big data,” but any limitations could have a material impact on our business, business processes, financial condition, and results of operations.

Current wording

There has also been increased regulatory scrutiny of the use of “big data” techniques, machine learning, and artificial intelligence. It is likely that we will be subject to new regulations that could materially adversely affect our operations or ability to write business profitably in one or more jurisdictions. The legal and regulatory framework governing artificial intelligence is evolving rapidly and remains highly uncertain. Federal and state agencies are actively proposing or implementing new regulations and guidelines targeting artificial intelligence. With many of these artificial intelligence regulations still in the early stages of development, it is difficult to predict the impact they will have on our business. These regulations may require changes to our implementation of artificial intelligence technology, increase compliance costs, or increase the risk of non-compliance. Any failure to comply with applicable laws or regulations related to artificial intelligence could expose us to investigations, enforcement actions, lawsuits, fines, or other penalties, which could have a material adverse effect on our business and results of operation. In addition, regulators have recently requested information from insurers on their use of algorithms, artificial intelligence and machine learning. We have internal policies governing the use of artificial intelligence by our employees designed to protect the company from breaches of data privacy, liability and regulatory enforcement risk; however, if our employees violate these policies, it could expose us to such risks. Our exposure to these risks also could increase if our vendors, suppliers, or other third-party providers employ artificial intelligence in relation to the products or services they provide to us, as we have limited control over such use in third-party products or services. These risks include, among others, the input of confidential information, including material non-public information, in contravention of our policies or contractual restrictions to which any of the foregoing are subject, or in violation of applicable laws or regulations, including those relating to data protection. We cannot predict what, if any, regulatory actions may be taken with regard to “big data,” but any limitations could have a material impact on our business, business processes, financial condition, and results of operations.

Previous wording

We cannot assure our stockholders that our stock repurchase program will enhance long-term stockholder value and stock repurchases, if any, could increase the volatility of the price of our common stock, reduce the market liquidity for our common stock, and diminish our cash reserves.

Current wording

We cannot assure our stockholders that our stock repurchase program will enhance long-term stockholder value, and Stock repurchases, if any, could increase the volatility of the price of our common stock, and will diminish our cash reserves.

Previous wording

In 1996, the Board authorized a stock repurchase program and, since then, has periodically increased the number of shares authorized for repurchase under the program. The most recent increase occurred in November 2022 and brought the number of shares authorized for repurchase over the life of the program to 117,000,000 shares. There is no expiration date for the repurchase program. The timing and actual number of shares repurchased, if any, will depend on a variety of factors including the timing of open trading windows, trading price, corporate and regulatory requirements, and market conditions. The stock repurchase program does not obligate us to acquire any amount of common stock and may be suspended or discontinued at any time at our discretion. Repurchases pursuant to our stock repurchase program could affect our stock price, increase the volatility of the price of our common stock and reduce the market liquidity for our common stock. Additionally, repurchases under our stock repurchase program will diminish our cash reserves, which could strain our liquidity, impact our ability to pursue future strategic opportunities and acquisitions, and result in lower overall returns on our cash balances. There can be no assurance that any further stock repurchases will enhance stockholder value because the market price of our common stock may decline below the levels at which we repurchased shares of common stock. Although our stock repurchase program is intended to enhance long-term stockholder value, there is no guarantee we will be successfully in achieving this objective.

Current wording

In 1996, the Board of Directors authorized a stock repurchase program (the “stock repurchase program”) and, since then, has periodically increased the number of shares authorized for repurchase under the program. In 2022, the Board of Directors authorized the repurchase of additional shares under the stock repurchase program, thereby increasing the total number of shares of common stock approved for repurchased under the program to 117,000,000. There is no expiration date for the repurchase program. The timing and actual number of shares repurchased, if any, will depend on a variety of factors including the timing of open trading windows, trading price, corporate and regulatory requirements, and market conditions. The stock repurchase program does not obligate us to acquire any amount of common stock and may be suspended or discontinued at any time at our discretion. Repurchases pursuant to our stock repurchase program could affect our stock price, increase the volatility of the price of our common stock and reduce the market liquidity for our common stock. Additionally, repurchases under our stock repurchase program will diminish our cash reserves, which could strain our liquidity, impact our ability to pursue future strategic opportunities and acquisitions, and result in lower overall returns on our cash balances. There can be no assurance that any further stock repurchases will enhance stockholder value because the market price of our common stock may decline below the levels at which we repurchased shares of common stock. Although our stock repurchase program is intended to enhance long-term stockholder value, there is no guarantee we will be successful in achieving this objective.

Previous wording

The following table sets forth the repurchases of our common stock made by or on behalf of the Company during the quarter ended December 31, 2024, all of which were made in open-market purchases pursuant to our publicly announced stock repurchase plan. During the quarter ended December 31, 2024, the Company effected the Stock Split. All prior period share, equity award and per share amounts and calculations in this report and in the consolidated financial statements contained in this report have been retroactively adjusted to reflect this split.

Current wording

The following table sets forth the repurchases of our common stock made by or on behalf of the Company during the quarter ended June 30, 2025, all of which were made in open-market purchases pursuant to our publicly announced stock repurchase plan.

Previous wording

In 1996, the Board authorized a stock repurchase program for up to 100,000 original shares of our common stock. The Board has periodically increased the number of shares authorized for repurchase under the repurchase program. In November 2022, the Board increased the number of shares of common stock authorized to be repurchased over the life of the program by 3,000,000 shares to 117,000,000 shares. There is no expiration date for the program. The program does not obligate us to acquire any amount of common stock and may be suspended or discontinued at any time at our discretion.

Current wording

In 1996, the Board of Directors authorized a stock repurchase program for up to 100,000 original shares of our common stock. The Board has periodically increased the number of shares authorized for repurchase under the repurchase program. In November 2022, the Board increased the number of shares of common stock authorized to be repurchased over the life of the program by 3,000,000 shares to 117,000,000 shares. There is no expiration date for the program. The program does not obligate us to acquire any amount of common stock and may be suspended or discontinued at any time at our discretion.

Previous wording

During the three months ended December 31, 2024, the Company repurchased 85,710 shares of its common stock for $9.5 million under the program, reflecting an average price of $111.87 per share. As of December 31, 2024, the Company repurchased 114,396,030 shares of its common stock over the life of the program.

Current wording

During the three months ended June 30, 2025, the Company repurchased 87,105 shares of its common stock for $9.6 million under the program, reflecting an average price of $110.01 per share. As of June 30, 2025, the Company repurchased 114,563,796 shares of its common stock over the life of the program.