CORVEL CORP

Previous wording

Past financial performance is not necessarily a reliable indicator of future performance, and investors in our common stock should not use historical performance to anticipate results or future period trends. Investing in our common stock involves a high degree of risk. Investors should consider carefully the following risk factors, as well as the other information in this report and our other filings with the SEC, including our consolidated financial statements and the related notes, before deciding whether to invest or maintain an investment in shares of our common stock. If any of the following risks actually occurs, our business, financial condition, and results of operations would suffer. In this case, the trading price of our common stock would likely decline. The risks described below are not the only ones we face. Additional risks that we currently do not know about or that we currently believe to be immaterial may also impair our business operations.

Current wording

Past financial performance is not necessarily a reliable indicator of future performance, and investors in our common stock should not use historical performance to anticipate results or future period trends. Investing in our common stock involves a high degree of risk. Investors should consider carefully the following risk factors, as well as the other information in this Quarterly Report and our other filings with the SEC, including our consolidated financial statements and the related notes, before deciding whether to invest or maintain an investment in shares of our common stock. If any of the following risks actually occurs, our business, financial condition, and results of operations would suffer. In this case, the trading price of our common stock would likely decline. The risks described below are not the only ones we face. Additional risks that we currently do not know about or that we currently believe to be immaterial may also impair our business operations.

Previous wording

If we are unable to apply technology and data analytics effectively in driving value for our clients through technology-based solutions or gain internal efficiencies and maintain effective internal controls through the application of technology and related tools, our operating results, client relationships, growth and compliance programs could be adversely affected.

Current wording

If we are unable to apply technology and data analytics effectively in driving value for our clients through technology-based solutions or gain internal efficiencies and maintain effective financial internal controls through the application of technology and related tools, our operating results, client relationships, growth and compliance programs could be adversely affected.

Previous wording

We are dependent, to a substantial extent, upon the continuing efforts and abilities of certain key management personnel. In addition, we face competition for experienced employees with professional expertise in the workers’ compensation managed care area. The loss of key personnel, especially Michael Combs, our Chairman, Chief Executive Officer and President, or the inability to attract qualified employees, could have a material adverse effect on our business, financial condition, and results of operations.

Current wording

We are dependent, to a substantial extent, upon the continuing efforts and abilities of certain key management personnel. In addition, we face competition for experienced employees with professional expertise in the workers’ compensation managed care area. The loss of key personnel, especially Sarah Scott, our Chief Executive Officer and President, or the inability to attract qualified employees, could have a material adverse effect on our business, financial condition, and results of operations.

Previous wording

If we lose several customers in a short period, our results may be materially adversely affected.

Current wording

If we lose several recurring customers in a short period, our results may be materially adversely affected.

Previous wording

Our results may decline if we lose several customers during a short period. Most of our customer contracts permit either party to terminate without cause. If several customers terminate, or do not renew or extend their contracts with us, our results could be materially and adversely affected. Many organizations in the insurance industry have consolidated and this could result in the loss of one or more of our customers through a merger or acquisition. Additionally, we could lose customers due to competitive pricing pressures or other reasons.

Current wording

Our results may decline if we lose several recurring customers during a short period. Most of our customer contracts permit either party to terminate without cause. If several customers terminate, or do not renew or extend their contracts with us, our results could be materially and adversely affected. Many organizations in the insurance industry have consolidated and this could result in the loss of one or more of our customers through a merger or acquisition. Additionally, we could lose customers due to competitive pricing pressures or other reasons.

Previous wording

We may be vulnerable to damage from severe weather conditions or natural disasters, including hurricanes, fires, floods, earthquakes, power loss, communications failures, and similar events, including the effects of pandemics, war or acts of terrorism. If a disaster were to occur, our ability to operate our business could be seriously or completely impaired or destroyed. The insurance we maintain may not be adequate to cover our losses resulting from disasters or other business interruptions. If there is a resurgence in the COVID-19 pandemic, or if any other pandemic arises, it could materially adversely impact our business operations, financial position and results of operations in unpredictable ways that depend on highly-uncertain future developments, such as determining the effectiveness of current or future government actions to address the public health or economic impacts of the pandemic. Any of these risks might have a materially adverse effect on our business operations and our financial position or results of operations.

Current wording

We may be vulnerable to damage from severe weather conditions or natural disasters, including hurricanes, fires, floods, earthquakes, power loss, communications failures, and similar events, including the effects of pandemics, war or acts of terrorism. If a disaster were to occur, our ability to operate our business could be seriously or completely impaired or destroyed. The insurance we maintain may not be adequate to cover our losses resulting from disasters or other business interruptions. If there is a resurgence in global pandemics, or if any other pandemic arises, it could materially adversely impact our business operations, financial position and results of operations in unpredictable ways that depend on highly-uncertain future developments, such as determining the effectiveness of current or future government actions to address the public health or economic impacts of the pandemic. Any of these risks might have a materially adverse effect on our business operations and our financial position or results of operations.

Previous wording

A cybersecurity attack or other disruption to our information technology systems could result in the loss, theft, misuse, unauthorized disclosure, unauthorized access of sensitive customer or Company information, or disruption of our operations, which could damage our relationships with customers or employees, expose us to litigation or regulatory proceedings, or harm our reputation, any of which could materially adversely affect our business, financial condition or results of operations.

Current wording

A cybersecurity attack or other disruption to our information technology systems could result in the loss, theft, misuse, unauthorized disclosure, or unauthorized access of customer or sensitive company information or could disrupt our operations, which could damage our relationships with customers or employees, expose us to litigation or regulatory proceedings, or harm our reputation, any of which could materially adversely affect our business, financial condition or results of operations.

Previous wording

We rely on information technology to support our business activities. Our business involves the storage and transmission of a significant amount of personal, confidential, or sensitive information, including the personal information of our customers and employees, and our Company’s financial, operational and strategic information. As with many businesses, we are subject to numerous data privacy and security risks. These risks may prevent us from maintaining the confidentiality of this information, result in the disruption of our business and online systems, and require us to expend significant resources to attempt to secure and protect such information and respond to incidents, any of which could materially adversely affect our business, financial condition or results of operations. The loss, theft, misuse, unauthorized disclosure, or unauthorized access of such sensitive information could lead to significant reputational or competitive harm, result in litigation or regulatory proceedings, or cause us to incur substantial liabilities, fines, penalties or expenses.

Current wording

We rely on information technology to support our business activities. Our business involves the storage and transmission of a significant amount of personal, confidential, or sensitive information, including the personal information of our customers and employees, and our financial, operational and strategic information. As with many businesses, we are subject to numerous data privacy and security risks. These risks may prevent us from maintaining the confidentiality and integrity of this information, result in the disruption of our business and online systems, and require us to expend significant resources to attempt to secure and protect such information and respond to incidents, any of which could materially adversely affect our business, financial condition or results of operations. The loss, theft, misuse, unauthorized disclosure, or unauthorized access of such sensitive information could lead to significant reputational or competitive harm, result in litigation or regulatory proceedings, or cause us to incur substantial liabilities, fines, penalties or expenses.

Previous wording

Cybersecurity incidents of any of the systems on which we rely may result from circumvention of security measures, denial-of-service attacks or other cyber-attacks, hacking, “phishing” attacks, computer viruses, ransomware, malware, employee or insider error, malfeasance, social engineering, physical breaches or other actions. According to media reports, the frequency, intensity, and sophistication of cyber-attacks, ransomware attacks, and other data security incidents has significantly increased worldwide in recent years. As with many other businesses, we have experienced, and are continually at risk of being subject to, attacks that result in cybersecurity incidents caused by computer viruses, unauthorized parties gaining access to our information technology systems, and other similar threats. In some cases, cybersecurity incidents could cause reputational harm, loss of customers, loss and/or delay of revenue, loss of proprietary data, loss of licenses, regulatory actions and scrutiny, sanctions or other statutory penalties, litigation, liability for failure to safeguard customers’ information, financial losses, or a drop in our stock price. We have invested in and continue to expend significant resources on information technology and information security tools, measures, processes, initiatives, policies and employee training designed to protect our information technology systems, as well as the personal, confidential or sensitive information stored on or transmitted through those systems, and to ensure an effective response to any cyber-attack or security incident. These expenditures could have an adverse impact on our financial condition and results of operations, and divert management’s attention from pursuing our strategic objectives. In addition, the cost and operational consequences of implementing, maintaining and further enhancing our system’s protective measures could increase significantly as cybersecurity threats increase. There can be no assurance that the security measures we employ will effectively prevent cybersecurity incidents or otherwise prevent malicious actors from obtaining access to our systems and information.

Current wording

Cybersecurity incidents affecting the systems on which we rely may result from circumvention of security measures, denial-of-service attacks or other cyber-attacks, hacking, “phishing” attacks, computer viruses, ransomware, malware, employee or insider error, malfeasance, social engineering, physical breaches or other actions. According to media reports, the frequency, intensity, and sophistication of cyber-attacks, ransomware attacks, and other data security incidents has significantly increased worldwide in recent years, including as a result of the increasing sophistication in the development and use of artificial intelligence tools. As with many other businesses, we have experienced, and are continually at risk of being subject to, attacks that result in cybersecurity incidents caused by computer viruses, unauthorized parties gaining access to our information technology systems, and other similar threats. In some cases, cybersecurity incidents could cause reputational harm, loss of customers, loss and/or delay of revenue, loss of proprietary data, loss of licenses, regulatory actions and scrutiny, sanctions or other statutory penalties, litigation, liability for failure to safeguard customers’ information, financial losses, or a drop in our stock price. If we acquire any businesses, the process of integrating the information systems of the businesses we acquire is complex and exposes us to additional risks as we might not adequately identify weaknesses in the acquired company’s information systems, which could expose us to unexpected liabilities or make our own systems more vulnerable to attack. We have invested in and continue to expend significant resources on information technology and information security tools, measures, processes, initiatives, policies and employee training designed to protect our information technology systems, as well as the personal, confidential or sensitive information stored on or transmitted through those systems, and to ensure an effective response to any cyber-attack or security incident, however, such measures cannot provide absolute security and may fail to operate as intended or be circumvented. These expenditures could also have an adverse impact on our financial condition and results of operations, and divert management’s attention from pursuing our strategic objectives. In addition, the cost and operational consequences of implementing, maintaining and further enhancing our system’s protective measures could increase significantly as cybersecurity threats increase. There can be no assurance that the security measures we employ will effectively prevent cybersecurity incidents or otherwise prevent malicious actors from obtaining access to our systems and information.

Previous wording

As these threats evolve, cybersecurity incidents could be more difficult to detect, prevent, and remediate. Cybersecurity-attacks or data handling incidents could remain undetected for some period of time, which could not only result in significant harm to our systems, but also lead to unauthorized access to the information stored on and transmitted by our systems. Further, despite our security efforts and training, our employees may purposefully or inadvertently cause cybersecurity incidents. Any occurrence of cybersecurity incidents, whether caused by employees or third parties, could have the potential to impact our relationships with our customers or restrict our ability to meet our customers’ expectations.

Current wording

As these threats evolve, cybersecurity incidents could be more difficult to detect, prevent, and remediate. Cybersecurity-attacks or data handling incidents could remain undetected for some period of time, which could not only result in significant harm to our systems, but also lead to unauthorized access to the information stored on and transmitted by our systems. Further, despite our security efforts and training, our employees may purposefully or inadvertently cause cybersecurity incidents. Any occurrence of cybersecurity incidents, whether caused by employees or third parties, could have the potential to adversely impact our relationships with our customers or restrict our ability to meet our customers’ expectations.

Previous wording

Additionally, as artificial intelligence technologies continue to develop and become more accessible, malicious actors are increasingly leveraging it to carry out advanced cyber-attacks. These artificial intelligence tools can be used to automate and scale attacks, generate phishing or social engineering schemes, employ deepfakes, identity system vulnerabilities, or evade transitional detection methods. Consequently, the use of artificial intelligence by malicious actors may result in an increase in the frequency, speed, and severity of cyber threats targeting our systems, networks, and employees.

Current wording

Additionally, as artificial intelligence technologies continue to develop and become more accessible, malicious actors are increasingly leveraging such technologies to carry out advanced cyber-attacks. These artificial intelligence tools can be used to automate and scale attacks, generate phishing or social engineering schemes, employ deepfakes, identity system vulnerabilities, or evade transitional detection methods. Consequently, the use of artificial intelligence by malicious actors may result in an increase in the frequency, speed, and severity of cybersecurity threats targeting our systems, networks, and employees.

Previous wording

critical business systems becoming inoperable or requiring a significant amount of time or cost to restore;

Current wording

critical business systems become inoperable or require a significant amount of time or cost to restore;

Previous wording

key personnel being unable to perform their duties or communicate with employees, customers or other third-parties;

Current wording

key personnel are unable to perform their duties or communicate with employees, customers or other third-parties;

Previous wording

the loss, theft, misuse, unauthorized disclosure, or unauthorized access of customer or Company information;

Current wording

it results in the loss, theft, misuse, unauthorized disclosure, or unauthorized access of customer or Company information;

Previous wording

our customers losing the ability to access our websites and online systems; or

Current wording

our customers lose the ability to access our websites and online systems; or

Previous wording

A security breach may cause our customers to curtail or stop using our services.

Current wording

A breach of security may cause our customers to curtail or stop using our services.

Previous wording

We rely on industry standard security solutions, confidentiality procedures, and employee nondisclosure agreements to maintain the privacy and security of our and our customers’ proprietary information. Intentional or unintentional incidents, like unauthorized access by third parties to our information systems, the infection of our systems or software with malware, and misappropriation of our proprietary information could expose us to a risk of information loss, litigation, and other possible liabilities which may have a material adverse effect on our business, financial condition, and results of operations. If third-party actions, employee errors, malfeasance, or otherwise, or if design flaws in our software are exposed and exploited, and, as a result, a third party obtains unauthorized access to any customer data, our relationships with our customers and our reputation could be significantly be damaged, our business may suffer, and we could incur significant liability. Because techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not recognized until launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures.

Current wording

We rely on industry standard security systems, confidentiality procedures, and employee nondisclosure agreements to maintain the privacy and security of our and our customers’ proprietary information. Intentional or unintentional incidents, like unauthorized access by third parties to our information systems, the infection of our systems or software with malware, and misappropriation of our proprietary information could expose us to a risk of information loss, litigation, and other possible liabilities which may have a material adverse effect on our business, financial condition, and results of operations. If cybersecurity incidents occur because of third-party actions, employee errors, malfeasance, or otherwise, or if design flaws in our software are exposed and exploited, and, as a result, a third party obtains unauthorized access to any customer data, our relationships with our customers and our reputation could be significantly damaged, our business may suffer, and we could incur significant liability. Cybersecurity threats are rapidly evolving and those threats and the means for obtaining access to our systems are becoming increasingly sophisticated. Because techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not recognized until launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures. The rapid evolution and growing adoption of artificial intelligence technologies may heighten our cybersecurity risks, including through the use of artificial intelligence by malicious actors seeking to identify and exploit vulnerabilities.

Previous wording

Certain aspects of our business are dependent upon our ability to store, retrieve, process, and manage data and to maintain and upgrade our data processing capabilities. Interruption of data processing capabilities for any extended length of time, loss of stored data, programming errors or other system failures could cause customers to cancel their service and could have a material adverse effect on our business, financial condition, and results of operations.

Current wording

Certain aspects of our business are dependent upon our ability to store, retrieve, process, and manage data and to maintain and upgrade our data processing capabilities. An interruption of data processing capabilities for any extended length of time, loss of stored data, programming errors or other system failures could impair our ability to perform for our customers on a timely basis and cause customers to cancel their service and could have a material adverse effect on our business, financial condition, and results of operations.

Previous wording

There has also been increased regulatory scrutiny of the use of “big data” techniques, machine learning, and artificial intelligence. It is likely that we will be subject to new regulations that could materially adversely affect our operations or ability to write business profitably in one or more jurisdictions. The legal and regulatory framework governing artificial intelligence is evolving rapidly and remains highly uncertain. Federal and state agencies are actively proposing or implementing new regulations and guidelines targeting artificial intelligence. With many of these artificial intelligence regulations still in the early stages of development, it is difficult to predict the impact they will have on our business. These regulations may require changes to our implementation of artificial intelligence technology, increase compliance costs, or increase the risk of non-compliance. Any failure to comply with applicable laws or regulations related to artificial intelligence could expose us to investigations, enforcement actions, lawsuits, fines, or other penalties, which could have a material adverse effect on our business and results of operation. In addition, regulators have recently requested information from insurers on their use of algorithms, artificial intelligence and machine learning. We have internal policies governing the use of artificial intelligence by our employees designed to protect the Company from breaches of data privacy, liability and regulatory enforcement risk; however, if our employees violate these policies, it could expose us to such risks. Our exposure to these risks also could increase if our vendors, suppliers, or other third-party providers employ artificial intelligence in relation to the products or services they provide to us, as we have limited control over such use in third-party products or services. These risks include, among others, the input of confidential information, including material non-public information, in contravention of our policies or contractual restrictions to which any of the foregoing are subject, or in violation of applicable laws or regulations, including those relating to data protection. We cannot predict what, if any, regulatory actions may be taken with regard to “big data,” but any limitations could have a material impact on our business, business processes, financial condition, and results of operations.

Current wording

There has also been increased regulatory scrutiny of the use of “big data” techniques, machine learning, and artificial intelligence. It is likely that we will be subject to new regulations that could materially adversely affect our operations or ability to write business profitably in one or more jurisdictions. The legal and regulatory framework governing artificial intelligence is evolving rapidly and remains highly uncertain. Federal and state agencies are actively proposing or implementing new regulations and guidelines targeting artificial intelligence. With many of these artificial intelligence regulations still in the early stages of development, it is difficult to predict the impact they will have on our business. These regulations may require changes to our implementation of artificial intelligence technology, increase compliance costs, or increase the risk of non-compliance. Any failure to comply with applicable laws or regulations related to artificial intelligence could expose us to investigations, enforcement actions, lawsuits, fines, or other penalties, which could have a material adverse effect on our business, results of operation and financial condition. In addition, regulators have recently requested information from insurers on their use of algorithms, artificial intelligence and machine learning. We have internal policies governing the use of artificial intelligence by our employees designed to protect the Company from breaches of data privacy, liability and regulatory enforcement risk; however, if our employees violate these policies, it could expose us to such risks. Our exposure to these risks also could increase if our vendors, suppliers, or other third-party providers employ artificial intelligence in relation to the products or services they provide to us, as we have limited control over such use in third-party products or services. These risks include, among others, the input of confidential information, including material non-public information, in contravention of our policies or contractual restrictions to which any of the foregoing are subject, or in violation of applicable laws or regulations, including those relating to data protection. We cannot predict what, if any, regulatory actions may be taken with regard to “big data,” but any limitations could have a material impact on our business, business processes, financial condition, and results of operations.

Previous wording

In 1996, the Board of Directors (the “Board”) authorized a stock repurchase program (the “stock repurchase program”) and, since then, has periodically increased the number of shares authorized for repurchase under the program. In 2022, the Board authorized the repurchase of additional shares under the stock repurchase program, thereby increasing the total number of shares of common stock approved for repurchase under the program to 117,000,000. There is no expiration date for the repurchase program. The timing and actual number of shares repurchased, if any, will depend on a variety of factors including the timing of open trading windows, trading price, corporate and regulatory requirements, and market conditions. The stock repurchase program does not obligate us to acquire any amount of common stock and may be suspended or discontinued at any time at our discretion. Repurchases pursuant to our stock repurchase program could affect our stock price, increase the volatility of the price of our common stock and reduce the market liquidity for our common stock. Additionally, repurchases under our stock repurchase program will diminish our cash reserves, which could strain our liquidity, impact our ability to pursue future strategic opportunities and acquisitions, and result in lower overall returns on our cash balances. There can be no assurance that any further stock repurchases will enhance stockholder value because the market price of our common stock may decline below the levels at which we repurchased shares of common stock. Although our stock repurchase program is intended to enhance long-term stockholder value, there is no guarantee we will be successful in achieving this objective.

Current wording

In 1996, the Board of Directors authorized a stock repurchase program and, since then, has periodically increased the number of shares authorized for repurchase under the program. The most recent increase occurred in November 2022 and brought the number of shares authorized for repurchase over the life of the program to 117,000,000 shares. There is no expiration date for the repurchase program. The timing and actual number of shares repurchased, if any, will depend on a variety of factors including the timing of open trading windows, trading price, corporate and regulatory requirements, and market conditions. The stock repurchase program does not obligate us to acquire any amount of common stock and may be suspended or discontinued at any time without notice. Repurchases pursuant to our stock repurchase program could affect our stock price, increase the volatility of the price of our common stock and reduce the market liquidity for our common stock. Additionally, repurchases under our stock repurchase program will diminish our cash reserves, which could strain our liquidity, impact our ability to pursue future strategic opportunities and acquisitions, and result in lower overall returns on our cash balances. There can be no assurance that any further stock repurchases will enhance stockholder value because the market price of our common stock may decline below the levels at which we repurchased shares of common stock. Although our stock repurchase program is intended to enhance long-term stockholder value, there is no guarantee we will be successful in achieving this objective.

Previous wording

During the three months ended December 31, 2025, the Company repurchased 185,559 shares of its common stock for $13.4 million under the program, reflecting an average price of $72.47 per share. As of December 31, 2025, the Company repurchased 114,893,129 shares of its common stock over the life of the program.

Current wording

During the three months ended June 30, 2026, the Company repurchased 377,098 shares of its common stock for $21.8 million under the program, reflecting an average price of $57.77 per share. As of June 30, 2026, the Company repurchased 115,636,533 shares of its common stock over the life of the program.