MARSH & MCLENNAN COMPANIES INC

Previous wording

•The costs to comply with, or our failure to comply with, U.S. and foreign laws related to privacy, data security and data protection, such as the EU's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act, as amended by the California Privacy Rights Act, (CCPA), could adversely affect our financial condition, operating results and our reputation;

Current wording

•The costs to comply with, or our failure to comply with, U.S. and foreign laws related to privacy, data security and data protection, such as the EU's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act, as amended by the California Privacy Rights Act, (CCPA), Australia's CPS 234, as well as emerging AI-related laws such as the EU's AI Act, could adversely affect our financial condition, operating results and our reputation;

Previous wording

•Mercer’s Wealth business is subject to a number of risks, including risks related to public and private capital market fluctuations, third-party asset managers and custodians, operations and technology risks, conflicts of interest, ESG and greenwashing, asset performance and regulatory compliance, that, if realized, could result in significant damage to our business;

Current wording

•Mercer’s Wealth business is subject to a number of risks, including risks related to public and private capital market fluctuations, third-party asset managers and custodians, operations and technology risks, trading and execution risks, conflicts of interest, ESG and greenwashing, asset performance and regulatory compliance, that, if realized, could result in significant damage to our business;

Previous wording

Geopolitical and macroeconomic conditions, including from multiple major wars, escalating conflict throughout the Middle East and rising tension in the South China Sea, slower GDP growth or recession, lower interest rates, capital markets volatility and inflation affect our clients' businesses and the markets they serve. These conditions, including inflationary expense pressure with our clients, may reduce demand for our services or depress pricing for those services, which could have a material adverse effect on our results of operations.

Current wording

Geopolitical and macroeconomic conditions, including from multiple major wars and global conflicts, slower GDP growth or recession, lower interest rates, capital markets volatility, inflation and changes in insurance premium rates affect our clients' businesses and the markets they serve. These conditions, including inflationary expense pressure with our clients, may reduce demand for our services or depress pricing for those services, which could have a material adverse effect on our results of operations.

Previous wording

For example, the war in Ukraine and the escalating conflict throughout the Middle East have resulted in worldwide geopolitical and macroeconomic uncertainty and may negatively impact other regional and global economic markets (including Europe, the Middle East and the U.S.), companies in other countries (particularly those that have done business with Russia or have substantial exposure to, or operations in, impacted countries) and various sectors, industries and markets for securities and commodities globally, such as oil and natural gas, and may increase financial market volatility and adversely impact regional and global economic markets, industries and companies. Moreover, the COVID-19 pandemic impacted businesses, including our clients, third-party vendors and business partners, globally in every geography in which we operate. In addition, the potentially divergent laws and regulations as a result of Brexit may continue to lead to economic and legal uncertainty, causing increased economic volatility or disrupting the markets and clients we serve.

Current wording

For example, the war in Ukraine and the conflict throughout the Middle East have resulted in worldwide geopolitical and macroeconomic uncertainty and may negatively impact other regional and global economic markets (including Europe, the Middle East and the U.S.), companies in other countries (particularly those that have done business with Russia or have substantial exposure to, or operations in, impacted countries) and various sectors, industries and markets for securities and commodities globally, such as oil and natural gas, and may increase financial market volatility and adversely impact regional and global economic markets, industries and companies.

Previous wording

Our businesses provide numerous professional services, including the placement of insurance and the provision of consulting, investment advisory, investment management and actuarial services, to clients around the world. As a result, the Company and its subsidiaries are subject to a significant number of errors and omissions, breach of fiduciary duty, breach of contract and similar claims, which we refer to collectively as "E&O claims." In our Risk and Insurance Services segment, such claims include allegations of damages arising from our failure to assess clients’ risks, advise clients, place coverage, or notify insurers of potential claims on behalf of clients in accordance with our obligations to them. For example, these claims could include allegations related to losses from cyberattacks associated with policies where cyber risk was not specifically included or excluded in policies, commonly referred to as “silent cyber.”In our Consulting segment, where we increasingly act in a fiduciary capacity through our investments business, such claims could include allegations of damages arising from the provision of consulting, investment management (including, for example, from trading or other operational errors), actuarial, pension administration and other services. We may also be exposed to claims related to services or solutions offered by the Consulting segment in addition to consulting services. These Consulting segment services frequently involve complex calculations and services, including (i) making assumptions about, and preparing estimates concerning, contingent future events, (ii) drafting and interpreting complex documentation governing pension plans, (iii) calculating benefits within complex pension structures, (iv) providing individual financial planning advice including investment advice and advice relating to cashing out of defined benefit pension plans, (v) providing investment advice, including guidance on asset allocation and investment strategy, and (vi) managing client assets, including the selection of investment managers and implementation of the client’s investment policy. We provide these services to a broad client base, including clients in the public sector. Matters may relate to services provided by the Company dating back many years. Such claims may subject us to significant liability for monetary damages, including punitive and treble damages, negative publicity and reputational harm, and may divert personnel and management resources. We may be unable to effectively limit our potential liability in certain jurisdictions, including through insurance, or in connection with certain types of claims, particularly those concerning claims of a breach of fiduciary duty.

Current wording

Our businesses provide numerous professional services, including the placement of insurance and the provision of consulting, investment advisory, investment management and actuarial services, to clients around the world. As a result, the Company and its subsidiaries are subject to a significant number of errors and omissions, breach of fiduciary duty, breach of contract and similar claims, which we refer to collectively as "E&O claims." In our Risk and Insurance Services segment, such claims include allegations of damages arising from our failure to assess clients’ risks, advise clients, place coverage, or notify insurers of potential claims on behalf of clients in accordance with our obligations to them. For example, these claims could include allegations related to losses from cyberattacks associated with policies where cyber risk was not specifically included or excluded in policies, commonly referred to as “silent cyber.”In our Consulting segment, where we may act in a fiduciary capacity through our investments business, such claims could include allegations of damages arising from the provision of consulting, investment management (including, for example, from trading execution or other operational errors), actuarial, pension administration and other services. We may also be exposed to claims related to services or solutions offered by the Consulting segment in addition to consulting services. These Consulting segment services frequently involve complex calculations and services, including (i) making assumptions about, and preparing estimates concerning, contingent future events, (ii) drafting and interpreting complex documentation governing pension plans, (iii) calculating benefits within complex pension structures, (iv) providing individual financial planning advice including investment advice and advice relating to cashing out of defined benefit pension plans, (v) providing investment advice, including guidance on asset allocation and investment strategy, and (vi) managing client assets, including the selection of investment managers and implementation of a client’s investment policy and strategies. We provide these services to a broad client base, including clients in the public sector. Matters may relate to services provided by the Company dating back many years. Such claims may subject us to significant liability for monetary damages, including punitive and treble damages, negative publicity and reputational harm, and may divert personnel and management resources. We may be unable to effectively limit our potential liability in certain jurisdictions, including through insurance, or in connection with certain types of claims, particularly those concerning claims of a breach of fiduciary duty.

Previous wording

The U.S. and foreign laws and regulations that apply to our operations are complex and may change rapidly, and our efforts to comply and keep up with them require significant resources. In some cases, these laws and regulations may decrease the need for our services, increase our costs, negatively impact our revenues or impose operational limitations on our business, including on the products and services we may offer or on the amount or type of compensation we may collect. In addition, the financial and operational impact of complying with laws and regulations has increased in the current environment of increased regulatory activity and enforcement. Changes with respect to the applicable laws and regulations may impose additional and unforeseen costs on us or pose new or previously immaterial risks to us. There can be no assurance that current and future government regulations will not adversely affect our business, and we cannot predict new regulatory priorities, the form, content or timing of regulatory actions, and their impact on our business and operations. In addition, geopolitical conflict, such as the war in Ukraine and the escalating conflict throughout the Middle East, has resulted in, and may continue to result in, new and rapidly evolving trade sanctions, which may increase our costs, negatively impact our revenues or impose additional operational limitations on our businesses.

Current wording

The U.S. and foreign laws and regulations that apply to our operations are complex and may change rapidly, and our efforts to comply and keep up with them require significant resources. In some cases, these laws and regulations may decrease the need for our services, increase our costs, negatively impact our revenues or impose operational limitations on our business, including on the products and services we may offer or on the amount or type of compensation we may collect. In particular, the financial and operational impact of complying with laws and regulations has increased in the current global environment of increased regulatory activity and enforcement. In addition, in the United States, shifts in regulatory priorities, policy approaches or interpretations of existing laws by federal, state or local governments occur following changes in U.S. presidential administrations, which often leads to changes involving the level of regulatory oversight and focus on businesses and certain industries, particularly financial services. Changes or uncertainty with respect to the applicable laws and regulations may impose additional and unforeseen costs on us or pose new or previously immaterial risks to us. There can be no assurance that current and future government regulations will not adversely affect our business, and we cannot predict new regulatory priorities, the form, content or timing of regulatory actions, and their impact on our business and operations. In addition, geopolitical conflict, such as the war in Ukraine and the conflict throughout the Middle East, has resulted in, and may continue to result in, new and rapidly evolving trade sanctions, which may increase our costs, negatively impact our revenues or impose additional operational limitations on our businesses. Changes to tax laws, trade agreements, tariffs, labor policies, or environmental standards could also result in increased costs or operational changes.

Previous wording

While we attempt to comply with applicable laws and regulations, there can be no assurance that we, our employees, our consultants and our contractors and other agents are in full compliance with such laws and regulations or interpretations at all times, or that we will be able to comply with any future laws or regulations. If we fail to comply or are accused of failing to comply with applicable laws and regulations, including those referred to above, or new and evolving regulations regarding cybersecurity, AI or environmental, social and governance matters, we may become subject to investigations, criminal penalties, civil remedies or other consequences, including fines, injunctions, loss of an operating license or approval, increased scrutiny or oversight by regulatory authorities, the suspension of individual employees, limitations on engaging in a particular business or redress to clients or other parties, and we may become exposed to negative publicity or reputational damage. Moreover, our failure to comply with laws or regulations in one jurisdiction may result in increased regulatory scrutiny by other regulatory agencies in that jurisdiction or regulatory agencies in other jurisdictions. These inquiries consume significant management attention, and the cost of compliance and the consequences of failing to be in compliance could therefore have a material adverse effect on our business.

Current wording

While we attempt to comply with applicable laws and regulations, there can be no assurance that we, our colleagues, our consultants and our contractors and other agents are in full compliance with such laws and regulations or interpretations at all times, or that we will be able to comply with any future laws or regulations. If we fail to comply or are accused of failing to comply with applicable laws and regulations, including those referred to above, or new and evolving regulations regarding cybersecurity, AI or sustainability matters, we may become subject to investigations, criminal penalties, civil remedies or other consequences, including fines, injunctions, loss of an operating license or approval, increased scrutiny or oversight by regulatory authorities, the suspension of individual employees, limitations on engaging in a particular business or redress to clients or other parties, and we may become exposed to negative publicity or reputational damage. Moreover, our failure to comply with laws or regulations in one jurisdiction may result in increased regulatory scrutiny by other regulatory agencies in that jurisdiction or regulatory agencies in other jurisdictions. These inquiries consume significant management attention, and the cost of compliance and the consequences of failing to be in compliance could therefore have a material adverse effect on our business.

Previous wording

In operating our business and providing services and solutions to clients, we collect, use, store, transmit and otherwise process certain electronic information, including personal, confidential, proprietary and sensitive data such as financial records, health care, mergers and acquisitions and personal data of our clients, colleagues and vendors. We rely on the efficient, uninterrupted and secure operation of complex information technology systems and networks to operate our business and securely process, transmit and store electronic information. In the normal course of business, we also share electronic information with our vendors and other third parties. This electronic information comprises sensitive and confidential data, including information related to financial records, health care, mergers and acquisitions and clients’ personal data. Our information technology systems and information security control systems, and those of our numerous third-party providers, as well as the control systems of critical infrastructure they rely on, such as power grids, and undersea cables, are potentially vulnerable to unauthorized access, damage or interruption from a variety of external threats, including software bugs, physical attack, cyberattacks, computer viruses and other malware, malicious or destructive code, ransomware, social engineering attacks (including phising and digital or telephonic impersonation), hacking, denial-of-service attacks and other types of data and systems-related modes of attack. The techniques used to achieve such unauthorized access, damage or interruption change frequently and new techniques may not be identified until they are launched against a target, and we may be unable to anticipate these techniques or implement adequate preventative or remedial measures, resulting in potential data loss, data unavailability, data corruption or other damage to information technology systems. In addition, remote and hybrid work arrangements have increased the risk of phishing and other cybersecurity attacks, unauthorized dissemination of personal, confidential, proprietary or sensitive data, and unauthorized access to company computing assets. Further, a disruption of physical infrastructure could impact our ability to conduct business and service clients. This may include deliberate or unintentional disruption of service to electrical systems, satellite communications, undersea or terrestrial cable systems, Internet services, or other systems our colleagues or third parties rely on us to conduct business in a multitude of jurisdictions across the globe. Disruptions may be the result of weather, natural disaster, war, terrorism, pandemic, or other natural or geopolitical events. Our systems are also subject to compromise from internal threats such as fraud, mistake, misconduct or other improper action by employees, vendors and other third parties with otherwise legitimate access to our systems. Moreover, we face the ongoing challenge …

Excerpt shortened here; the source contains the full paragraph.

Current wording

In operating our business and providing services and solutions to clients, we collect, use, store, transmit and otherwise process certain electronic information, including personal, confidential, proprietary and sensitive data such as financial records, health care, mergers and acquisitions and personal data of our clients, colleagues and vendors. We rely on the efficient, uninterrupted and secure operation of complex information technology systems and networks to operate our business and securely process, transmit and store electronic information. In the normal course of business, we also share electronic information with our vendors and other third parties, which in some cases is critical to our ability to deliver services to our clients. This electronic information comprises sensitive and confidential data, including information related to financial records, health care, mergers and acquisitions and clients’ personal data. Our information technology systems and information security control systems, and those of our numerous third-party providers, as well as the control systems of critical infrastructure they rely on, such as power grids, and undersea cables, are potentially vulnerable to unauthorized access, damage or interruption from a variety of external threats, including software bugs, physical attack, cyberattacks, computer viruses and other malware, malicious or destructive code, ransomware, social engineering attacks (including phishing, business e-mail compromise and digital or telephonic impersonation), hacking theft, denial-of-service attacks and other types of data and systems-related modes of attack. The techniques used to achieve such unauthorized access, damage or interruption change frequently and new techniques may not be identified until they are launched against a target, and we may be unable to anticipate these techniques or implement adequate preventative or remedial measures, resulting in potential data loss, data unavailability, data corruption or other damage to information technology systems. In addition, remote and hybrid work arrangements have increased the risk of phishing and other cybersecurity attacks, unauthorized dissemination of personal, confidential, proprietary or sensitive data, and unauthorized access to company computing assets. Further, a disruption of physical infrastructure could impact our ability to conduct business and service clients. This may include deliberate or unintentional disruption of service to electrical systems, satellite communications, undersea or terrestrial cable systems, Internet services, or other systems our colleagues or third parties rely on us to conduct business in a multitude of jurisdictions across the globe. Disruptions may be the result of weather, natural disaster, war, terrorism, pandemic, or other natural or geopolitical events. Our systems are also subject to compromise from internal threats such as fraud, mistakes, misconduct or other improper action by employees, ve…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Cyberattacks are increasing in frequency and evolving in nature. We are at risk of attack by a variety of adversaries, including nation states, state-sponsored organizations, organized crime and hackers, through use of increasingly sophisticated methods of attack, including the deployment of AI to find and exploit vulnerabilities, "deep fakes", long-term, persistent attacks (referred to as advanced persistent threats) and the use of the IT supply chain to introduce malware through software updates or compromised suppliers accounts or hardware. In particular, the advance of AI and large language models has given rise to additional vulnerabilities and potential entry points for cyber threats. With generative AI tools, threat actors may have additional tools to automate breaches or persistent attacks, evade detection, or generate sophisticated phishing emails or other forms of digital impersonation. In addition, increasing use of generative AI models in our internal systems may create new attack methods for adversaries. Because generative AI is a new field, understanding of cybersecurity risks and protection methods continues to develop, and features that rely on generative AI, including in services provided to us by third parties, may be susceptible to unanticipated cybersecurity threats from sophisticated adversaries and other cybersecurity incidents. Further, we are at increased risk of a cyberattack during periods of heightened geopolitical conflict, such as the war in Ukraine and the escalating conflict throughout the Middle East, as diplomatic events and economic policies may trigger espionage or retaliatory cyber incidents. Despite our efforts to comply with applicable cybersecurity requirements and mitigate risks of cybersecurity threats, we cannot be certain that our security measures will definitively prevent, contain, detect, or remediate all cybersecurity threats or incidents or other instructions from malware currently in existence or developed in the future.

Current wording

Cyberattacks are increasing in frequency and evolving in nature. We are at risk of attack by a variety of adversaries, including nation states, state-sponsored organizations, opportunistic attacks, and organized crime and hackers, through use of increasingly sophisticated methods of attack, including the deployment of AI to find and exploit vulnerabilities, "deep fakes", long-term, persistent attacks (referred to as advanced persistent threats) and the use of the IT supply chain to introduce malware through software updates or compromised suppliers accounts or hardware. In particular, the advance of AI and large language models has given rise to additional vulnerabilities and potential entry points for cyber threats. With generative AI tools, threat actors may have additional tools to automate breaches or persistent attacks, evade detection, or generate sophisticated phishing emails or other forms of digital impersonation, doing so quickly and without requiring deep technical understanding of potential exploits. In addition, increasing use of generative AI models in our internal systems may create new attack methods for adversaries. Because generative AI is a new field, understanding of cybersecurity risks and protection methods continues to develop, and features that rely on generative AI, including in services provided to us by third parties, may be susceptible to unanticipated cybersecurity threats from sophisticated adversaries and other cybersecurity incidents. Further, we are at increased risk of a cyberattack during periods of heightened geopolitical conflict, such as the war in Ukraine and the conflict throughout the Middle East, as diplomatic events and economic policies may trigger espionage or retaliatory cyber incidents. Additionally, nation states may deploy threat actors masquerading as potential candidates for hire at target companies to perform corporate espionage or execute internal cyber threat activities. Despite our efforts to comply with applicable cybersecurity requirements and mitigate risks of cybersecurity threats, we cannot be certain that our security measures will definitively prevent, contain, detect, or remediate all cybersecurity threats or incidents or other instructions from malware currently in existence or developed in the future.

Previous wording

Our information systems must be continually updated, patched, and upgraded to protect against known vulnerabilities. The volume of new software vulnerabilities has increased markedly, as has the criticality of patches and other mitigation and remedial measures. In addition to mitigating and remediating newly identified vulnerabilities, previously identified vulnerabilities must also be continuously addressed. Accordingly, we are at risk that cyberattackers exploit these known vulnerabilities before they have been communicated by vendors or addressed. Due to the large number and age of the systems and platforms that we operate, the increased frequency at which vendors are issuing security patches to their products, the need to test patches and, in some cases coordinate with clients and vendors, before they can be deployed, we perpetually face the substantial risk that we cannot deploy patches in a timely manner. We are also dependent on third party vendors to keep their systems patched and secure in order to protect our data. Any failure related to these activities could have a material adverse effect on our business.

Current wording

Our information systems must be continually updated, patched, and upgraded to protect against known vulnerabilities. The volume of new software and infrastructure vulnerabilities continues to increase markedly, as has the criticality of patches and other mitigation and remedial measures. In addition to mitigating and remediating newly identified vulnerabilities, previously identified vulnerabilities must also be continuously addressed. Accordingly, we are at risk that cyberattackers exploit these vulnerabilities before they have been communicated by vendors or addressed. Due to the large number and age of the systems and platforms that we operate, the increased frequency at which vendors are issuing security patches to their products, the need to test patches and, in some cases, coordinate with clients and vendors, before they can be deployed, we perpetually face the substantial risk that we cannot deploy patches in a timely manner. Some security patches may not be compatible with other software running on our systems and therefore may not be able to be deployed. We are also dependent on third party vendors to keep their systems patched and secure in order to protect our data. Any failure related to these activities could have a material adverse effect on our business.

Previous wording

We have numerous vendors and other third parties who receive personal information from us in connection with the services we offer our clients and our employees. We also use hundreds of IT vendors and software providers to maintain and secure our global information systems infrastructure. In addition, we have migrated certain data, and may increasingly migrate data, to the cloud where it is hosted by third-party providers. Some of these vendors and third parties also have direct access to our systems or data. We are at risk of a cyberattack involving a vendor or other third party, which could result in a breakdown of such third party’s data protection processes or the cyberattackers gaining access to our infrastructure or data through a supply chain attack. Highly publicized data security breaches, such as the October 2023 attack on Okta may embolden malicious actors to target the IT supply chain and providers of business software. Our control over and ability to monitor the cybersecurity practices of our third-party vendors and service providers, and other third parties with whom we do business, remains limited, and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the cybersecurity infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.

Current wording

We have numerous vendors and other third parties who receive personal information from us in connection with the services we offer our clients and our employees. We also use hundreds of IT vendors and software providers to maintain and secure our global information systems infrastructure. In addition, we have migrated certain data, and may increasingly migrate data, to the cloud where it is hosted by third-party providers. Some of these vendors and third parties also have direct access to our systems or data. We are at risk of a cyberattack involving a vendor or other third parties, which could result in a breakdown of such third party’s data protection processes or the cyberattackers gaining access to our infrastructure or data through a supply chain attack. Highly publicized data security breaches, such as the October 2023 attack on Okta, may embolden malicious actors to target the IT supply chain and providers of business software. In addition, we depend on our third-party vendors to keep software current. Our systems’ availability could be impacted by poor or improperly tested software code and updates deployed to our environment by a third-party through normal and expected processes, which occurred with the CrowdStrike event in July 2024. Our control over and ability to monitor the cybersecurity practices of our third-party vendors and service providers, and other third parties with whom we do business, remains limited, and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the development processes or cybersecurity infrastructure or IT controls owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.

Previous wording

We have experienced data incidents and cybersecurity breaches, such as malware incursions (including computer viruses and ransomware), vulnerabilities in the software on which we rely, users exceeding their data access authorization, employee misconduct and incidents resulting from human error, such as emails sent to the wrong recipient, loss of portable and other data storage devices or misconfiguration of software or hardware resulting in inadvertent exposure of personal, sensitive, confidential or proprietary information. In April 2021, an unauthorized actor leveraged a vulnerability in a third party's software and gained access to a limited set of data in our environment. Like many companies, we are also subject to social engineering attacks such as WhatsApp scams and regular phishing email campaigns directed at our employees that can result in malware infections, fraud and data loss. Although these incidents have resulted in data loss and other damages, to date, they have not had a material adverse effect on our business or operations. In the future, these types of incidents could result in personal, sensitive, confidential or proprietary information, including client, employee or Company data, being lost or stolen, surreptitiously modified, rendered inaccessible for any period of time, or maliciously made public, which could have a material adverse effect on our business. In the event of a cyberattack, we might have to take our systems offline, which could interfere with services to our clients or damage our reputation. A cyberattack may also result in systems or data being encrypted or otherwise unavailable due to ransomware or other malware. We also may be unable to detect an incident, assess its severity or impact, or appropriately respond in a timely or adequate manner. In addition, our liability insurance, which includes cyber insurance, may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other related data and system incidents. Further, we cannot be sure that our existing coverage will continue to be available on acceptable terms or at all or that our insurers will not deny coverage as to any future claim.

Current wording

We have experienced data incidents and cybersecurity breaches, such as malware incursions (including computer viruses and ransomware), vulnerabilities in the software on which we rely, users exceeding their data access authorization, employee misconduct and incidents resulting from human error, such as emails sent to the wrong recipient, loss of portable and other data storage devices or misconfiguration of software or hardware resulting in inadvertent exposure of personal, sensitive, confidential or proprietary information or reduction of system availability. Like many companies, we are also subject to social engineering attacks such as WhatsApp scams and regular phishing email campaigns directed at our employees that can result in malware infections, fraud and data loss. Although these incidents have resulted in data loss and other damages, to date, they have not had a material adverse effect on our business or operations. In the future, these types of incidents could result in personal, sensitive, confidential or proprietary information, including client, employee or Company data, being lost or stolen, surreptitiously modified, rendered inaccessible for any period of time, or maliciously made public, which could have a material adverse effect on our business. In the event of a cyberattack, we might have to take our systems offline, which could interfere with services to our clients or damage our reputation. A cyberattack may also result in systems or data being encrypted or otherwise unavailable due to ransomware or other malware. We also may be unable to detect an incident, assess its severity or impact, or appropriately respond in a timely or adequate manner. In addition, our liability insurance, which includes cyber insurance, may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other related data and system incidents. Further, we cannot be sure that our existing coverage will continue to be available on acceptable terms or at all or that our insurers will not deny coverage as to any future claim.

Previous wording

The costs to comply with, or our failure to comply with, U.S. and foreign laws related to privacy, data security and data protection, such as the EU's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act, as amended by the California Privacy Rights Act, (CCPA), could adversely affect our financial condition, operating results and our reputation.

Current wording

The costs to comply with, or our failure to comply with, U.S. and foreign laws related to privacy, data security and data protection, such as the EU's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act, as amended by the California Privacy Rights Act, (CCPA), Australia's CPS 234, as well as emerging AI-related laws such as the EU's AI Act, could adversely affect our financial condition, operating results and our reputation.

Previous wording

Improper collection, use, disclosure, cross border transfer, retention and other processing of confidential, personal, or proprietary data could result in regulatory scrutiny, legal and financial liability, or harm to our reputation. In operating our business and providing services and solutions to clients, we store and transfer sensitive employee and client data, including personal data, in and across multiple jurisdictions. We collect data from client and individuals located all over the world and leverage systems and teams to process it. As a result, we are subject to a variety of laws and regulations in the U.S., Europe and around the world regarding privacy, data protection, data security and cyber security. These laws and regulations are continuously evolving and developing. Some of these laws and regulations are increasing the level of data handling restrictions, including rules on data localization, all of which could affect our operations and result in regulatory liability and high fines. In particular, high-profile data breaches at major companies continue to be disclosed regularly, which is leading to even greater regulatory scrutiny and fines at the highest levels they have ever been. These fines are not limited to data breaches and regulators are increasingly focusing on other data processing activities including those related to ad-tech and “data subject” rights. The number of laws that apply to us keeps increasing and the interpretation of such laws is often uncertain and may be conflicting.

Current wording

We collect data from clients and individuals located all over the world and leverage systems and teams to process it. As a result, we are subject to a variety of laws and regulations in the U.S., Europe and around the world regarding privacy, data protection, data security and cyber security. These laws and regulations are continuously evolving and developing. Some of these laws and regulations are increasing the level of data handling restrictions, including rules on data localization, all of which could affect our operations and result in regulatory liability and high fines. In particular, high-profile data breaches at major companies continue to be disclosed regularly, which is leading to even greater regulatory scrutiny and significant fines, which are not limited to data breaches as regulators increasingly focus on other data processing activities, including those related to ad-tech and “data subject” rights. The number of laws that apply to us keeps increasing and the interpretation of such laws is often uncertain and may be conflicting.

Previous wording

At the international level, we are subject to an increasing number of comprehensive privacy laws including, for example, those passed in Indonesia, the Kingdom of Saudi Arabia and India. Many of these laws, which are modeled after the GDPR, have greatly increased the jurisdictional reach of privacy laws and added a broad array of requirements for handling personal data, such as the public disclosure of data breaches, data protection impact assessments, data portability and the appointment of data protection officers in some cases. Following the UK’s withdrawal from the EU, we are also subject to the UK General Data Protection Regulation (“UK GDPR”), a version of the GDPR as implemented into UK law, and this law may not mirror the GDPR, thereby adding operational complexity and legal risk. Given the breadth and depth of changes in data protection obligations, including classifying data and committing to a range of administrative, technical and physical controls to protect data and enable data transfers across borders, our compliance with such laws will continue to require time, resources and review of the technology and systems we use. Despite a proliferation of regulatory guidance papers, there remains uncertainty in key areas related to these laws, and that uncertainty could result in potential liability for our failure to meet our obligations, including the possibility of significant fines some of which can amount to 4% or more of our global revenue. Further, despite recent developments, including a new U.S.- EU Data Privacy Framework and the U.S.-UK Data Bridge, there remains a high level of uncertainty concerning the future of the flow of personal information between the U.S. and EU, between the U.S. and the UK and between the UK and the EU, and that uncertainty may impair our ability to offer our existing and planned products and services or increase our cost of doing business. Some of the global laws enacted in recent years, including those in China and the Kingdom of Saudi Arabia, also include data localization elements that will require that certain personal data stay within their borders. These requirements are complex and our efforts to comply with them require significant resources, and we cannot guarantee we are or will be in full compliance with such laws at all times.

Current wording

At the international level, we are subject to an increasing number of comprehensive privacy laws including, for example, those passed in Indonesia, the Kingdom of Saudi Arabia, India and Australia. Many of these laws, which are modeled after the GDPR, have greatly increased the jurisdictional reach of privacy laws and added a broad array of requirements for handling personal data, such as the public disclosure of data breaches, data protection impact assessments, data portability and the appointment of data protection officers in some cases. Given the breadth and depth of changes in data protection obligations, including classifying data and committing to a range of administrative, technical and physical controls to protect data and enable data transfers across borders, our compliance with such laws will continue to require time, resources and review of the technology and systems we use. Despite a proliferation of regulatory guidance papers, there remains uncertainty in key areas related to these laws, and that uncertainty could result in potential liability for our failure to meet our obligations, including the possibility of significant fines some of which can amount to 4% or more of our global revenue. Further, despite developments such as the U.S.- EU Data Privacy Framework and the U.S.- U.K. Data Bridge, there remains a high level of uncertainty concerning the flow of personal information between the U.S. and EU, between the U.S. and the U.K. and between the U.K. and the EU. This uncertainty may impair our ability to offer our existing and planned products and services or increase our cost of doing business. Some of the global laws enacted in recent years, including those in China and the Kingdom of Saudi Arabia, also include data localization elements that will require that certain personal data stay within their borders. These requirements are complex and our efforts to comply with them require significant resources, and we cannot guarantee we are or will be in full compliance with such laws at all times.

Previous wording

At the U.S. federal level, we are subject to various privacy laws and regulations, including those promulgated under the authority of the U.S. Federal Trade Commission, which has the authority to regulate and enforce against unfair or deceptive acts or practices in or affecting commerce, including with respect to data privacy and cybersecurity. At the U.S. state level, we are subject to laws and regulations related to privacy, such as the CCPA which introduced concepts such as transparency and rights like access and deletion, that have been enacted by over a dozen states with many more on the verge of enacting such laws. These laws establish a privacy framework for covered businesses, including various obligations imposed on them related to the personal information they collect and use, and offer various rights for their state residents. Some of these laws provide a private right of action for violations and in some cases damages may be significant. Many of these laws diverge from the CCPA and create their own set of rules and this proliferation of inconsistent state level privacy laws will add operational complexity and increased risk of noncompliance or violations which could trigger enforcement action or litigation.

Current wording

At the U.S. federal level, we are subject to various privacy laws and regulations, including those promulgated under the authority of the U.S. Federal Trade Commission, which has the authority to regulate and enforce against unfair or deceptive acts or practices in or affecting commerce, including with respect to data privacy and cybersecurity. At the U.S. state level, we are subject to laws and regulations related to privacy, such as the CCPA, which introduced concepts such as transparency and rights like access and deletion, that have been enacted by over twenty states with more such laws expected to pass in future years. These laws establish a privacy framework for covered businesses, including various obligations imposed on them related to the personal information they collect and use, and offer various rights for their state residents. Some of these laws provide a private right of action for violations and in some cases damages may be significant. Many of these laws diverge from the CCPA and create their own set of rules, and this proliferation of inconsistent state level privacy laws will add operational complexity and increased risk of noncompliance or violations which could trigger enforcement action or litigation.

Previous wording

In addition to data protection and data privacy laws, foreign countries and U.S. states are enacting AI and cybersecurity laws and regulations. For example, in late 2023 the New York State Department of Financial Services (NYDFS) issued amendments to its previous cybersecurity regulations which imposed obligations on companies such as Marsh McLennan, including for example, requiring companies to provide evidence of how they are implementing their data retention, data governance and data classifications policies and procedures. A number of states have also adopted laws covering data collected by insurance licensees that include security and breach notification requirements. All of these evolving compliance and operational requirements impose significant costs that are likely to increase over time, may divert resources from other initiatives and projects and could restrict the way services involving data are offered, all of which may adversely affect our results of operations.

Current wording

In addition to data protection and data privacy laws, foreign countries and U.S. states are enacting cybersecurity laws and regulations. For example, in late 2023 the New York State Department of Financial Services (NYDFS) issued amendments to its previous cybersecurity regulations which imposed obligations on companies such as Marsh McLennan, including for example, requiring companies to provide evidence of how they are implementing their data retention, data governance and data classifications policies and procedures. A number of states have also adopted laws covering data collected by insurance licensees that include security and breach notification requirements. All of these evolving compliance and operational requirements impose significant costs that are likely to increase over time, may divert resources from other initiatives and projects and could restrict the way services involving data are offered, all of which may adversely affect our results of operations. Failure to comply with some of these obligations, especially those related to data retention requirements, could expose us to regulatory fines and other penalties.

Previous wording

We post public privacy policies and other documentation regarding our collection, use, disclosure, cross-border transfer, retention, and other processing of personal information. Although we endeavor to comply with our published policies and other documentation, we may at times fail to do so or may be perceived to have failed to do so. Moreover, despite our efforts, we may not be successful in achieving compliance if our employees, contractors, service providers, vendors or other third parties with whom we do business fail to comply with our published policies and documentation. Such failures could carry similar consequences or subject us to potential enforcement actions or investigations if they are found to be deceptive, unfair or misrepresentative of our actual practices.

Current wording

We post public privacy notices and other documentation regarding our collection, use, disclosure, cross-border transfer, retention, and other processing of personal information. Although we endeavor to comply with our published notices and other documentation, we may at times fail to do so or may be perceived to have failed to do so. Moreover, despite our efforts, we may not be successful in achieving compliance if our employees, contractors, service providers, vendors or other third parties with whom we do business fail to comply with our published notices and documentation. Such failures could carry similar consequences or subject us to potential enforcement actions or investigations if they are found to be deceptive, unfair or misrepresentative of our actual practices.

Previous wording

Furthermore, enforcement actions and investigations by regulatory authorities related to data security incidents and privacy violations, including an ongoing focus on compliance related to website "cookies" and other online trackers, as well as the use of online session recording tools in some countries or U.S. states, continue to increase. Privacy violations, including unauthorized use disclosure or transfer of sensitive, personal or confidential client or Company data, whether through systems failure, employee negligence, fraud or misappropriation, by the Company, our vendors or other parties with whom we do business (if they fail to meet the standards we impose) could damage our reputation and subject us to significant litigation, monetary damages, regulatory enforcement actions, fines and criminal prosecution in one or more jurisdictions. Given the complexity of operationalizing the various privacy laws mentioned above, the maturity level of proposed compliance frameworks and the continued lack of certainty on how to implement their requirements, we and our clients are at risk of enforcement actions taken by data protection authorities around the world or litigation from consumer advocacy groups acting on behalf of data subjects. We may not be able to respond quickly or effectively to regulatory, legislative and other developments, and these changes may in turn impair our ability to offer our existing or planned products and services and increase our cost of doing business.

Current wording

Privacy or AI-related legal or regulatory violations, including unauthorized use disclosure or transfer of sensitive, personal or confidential client or Company data, whether through systems failure, employee negligence, fraud or misappropriation, by the Company, our vendors or other parties with whom we do business (if they fail to meet the standards we impose) could damage our reputation and subject us to significant litigation, monetary damages, regulatory enforcement actions, fines and criminal prosecution in one or more jurisdictions where we operate. Given the complexity of operationalizing the various privacy, data security, data protection and AI laws and regulations mentioned above, the complexity of proposed compliance frameworks and the continued lack of certainty on how to implement their requirements, we and our clients are at risk of enforcement actions taken by applicable regulators or authorities around the world or litigation from third parties, including consumer advocacy groups acting on behalf of data subjects. Additionally, due to the ongoing fast pace of legislative and regulatory activity, we may not be able to respond quickly or effectively to new legislative, regulatory and other developments. These changes may also impair our ability to offer our existing or planned products and services and increase our cost of doing business in various countries.

Previous wording

We are actively investing in generative AI tools. While our internal generative AI tool, LenAI, was designed to meet our standards for data security and to address and mitigate the risks associated with this new technology, our use of generative AI in certain products and services may present risks and challenges that remain uncertain due to the relative novelty of this technology. These risks may include enhanced governmental or regulatory scrutiny, litigation or ethical concerns. While we are implementing certain mitigation measures and governance to the proliferation of AI tools, these measures may be inadequate or may not meet a growing number of legal and regulatory requirements related to AI.

Current wording

We are actively investing in generative AI tools. While our internal generative AI tool, LenAI, was designed to meet our standards for data security and to address and mitigate the risks associated with this new technology, our use of generative AI in certain products, services and operations may present risks and challenges that remain uncertain due to the relative novelty of this technology. These risks may include operational disruptions or failures, reputational harm, enhanced governmental or regulatory scrutiny, litigation or ethical concerns. The models underlying AI tools may be incorrectly or inadequately designed or implemented and trained on, or otherwise use, data or algorithms that are (and the output generated by such AI tools also may be) biased, unethical, discriminatory, incomplete, inaccurate, misleading or poor-quality, any of which may not be easily detectable. To the extent that we do not have sufficient rights to use the data used in or output generated by such AI tools, we may be subject to litigation by holders of third-party intellectual property, privacy, publicity, contractual or other rights. If any of our employees, contractors, consultants, vendors or service providers use any third-party AI powered software in connection with our business or the services they provide to us, it may lead to the inadvertent disclosure or incorporation of our confidential information into publicly available training sets, which may impact our ability to realize the benefit of, or adequately maintain, protect and enforce our intellectual property or confidential information, harming our competitive position and business. In addition, the use of AI by other companies has resulted in, and our use of AI may in the future result in, data incidents and cybersecurity breaches. While we have implemented certain mitigation measures and governance related to the proliferation of AI tools, these measures may be inadequate or may not satisfy a growing number of legal and regulatory requirements related to AI. Moreover, if we are perceived to exaggerate the effectiveness, safety or ethical design of AI systems, this could lead to regulatory enforcement, litigation or reputational harm. Any misrepresentation, intentional or unintentional, of our AI-related capabilities or initiatives could also erode trust among clients and regulators. There can be no assurance that our use of AI will enhance our products, services or operations or otherwise result in our intended outcomes.

Previous wording

Across all of our businesses, our colleagues are critical to developing and retaining client relationships as well as performing the services on which our revenues are earned. It is therefore important for us to attract, incentivize and retain significant revenue-producing employees and the key managerial and other professionals who support them. We face numerous challenges in this regard, including the intense competition for talent, which has accelerated in recent years. Such challenges include the increased mobility of colleagues in light of more flexible working models, market dislocation resulting from proposed and actual combinations in the industry, raids by competitors, and fostering an inclusive and diverse workplace.

Current wording

Across all of our businesses, our colleagues are critical to developing and retaining client relationships as well as performing the services on which our revenues are earned. It is therefore important for us to attract, incentivize and retain significant revenue-producing employees and the key managerial and other professionals who support them. We face numerous challenges in this regard, including the intense competition for talent, which has accelerated in recent years. Such challenges include the increased mobility of colleagues in light of more flexible working models, market dislocation resulting from proposed and actual combinations in the industry, raids by competitors, and fostering an inclusive workplace.

Previous wording

Losing colleagues who manage or support substantial client relationships or possess substantial experience or expertise could adversely affect our ability to secure and complete client engagements, which could adversely affect our results of operations. If a key employee were to join an existing competitor or form a competing company, some of our clients could choose to use the services of that competitor instead of our services. If a colleague joins us from a competitor and is subject to enforceable restrictive covenants, we may not be able to secure client engagements or maximize the colleague's potential. In addition, regulation or legislation impacting the workforce, such as the proposed U.S. Federal Trade Commission rule regarding noncompete clauses, may lead to increased uncertainty and competition for talent.

Current wording

Losing colleagues who manage or support substantial client relationships or possess substantial experience or expertise could adversely affect our ability to secure and complete client engagements, which could adversely affect our results of operations. If a key employee were to join an existing competitor or form a competing company, some of our clients could choose to use the services of a competitor instead of our services. If a colleague joins us from a competitor and is subject to enforceable restrictive covenants, we may not be able to secure client engagements or maximize the colleague's potential. In addition, regulation or legislation impacting the workforce, such as the proposed U.S. Federal Trade Commission rule regarding noncompete clauses, may lead to increased uncertainty and competition for talent.

Previous wording

Moreover, as ESG reporting standards continue to evolve, including with guidance from the International Sustainability Standards Board (ISSB) and the European Sustainability Reporting Standards (ESRS) under the Corporate Sustainability Reporting Directive (CSRD), we continue to evaluate and update our public disclosures in these areas, including refining our disclosure of metrics and goals in accordance with the guidance and our own ESG assessments and priorities. These disclosures, metrics and goals and any failure to accurately report or comply with federal, state or international ESG laws and regulations, or to achieve progress on our metrics and goals on a timely basis, or at all, may result in legal and regulatory proceedings against us and negatively impact our reputation.

Current wording

As these ESG reporting requirements and standards evolve, we continue to evaluate and update our public disclosures in these areas, including refining our disclosure of metrics and sustainability goals in accordance with the guidance and our own ESG assessments and priorities. These disclosures, metrics and sustainability goals and any failure to accurately report or comply with federal, state or international ESG laws and regulations, or achieve progress on our metrics and sustainability goals on a timely basis, or at all, may result in legal and regulatory proceedings against us and negatively impact our reputation. Implementation of our ESG initiatives also depends in part on third-party performance or data that is outside the Company's control. In addition, heightened regulatory scrutiny of ESG and sustainability-related products, funds, investment strategies and advice has increased the risk that we could be perceived as, or accused of, making inaccurate or misleading statements, or that we have otherwise run afoul of regulation. Such perceptions or accusations could damage our reputation, result in litigation or regulatory enforcement actions, and adversely affect our business.

Previous wording

In addition, organizations that provide information to investors on corporate governance and related matters have developed ratings processes for evaluating companies on their approach to ESG matters, and unfavorable ratings of our company or our industries may lead to negative investor sentiment and the diversion of investment to other companies or industries, exclusion of our stock from ESG-oriented indices or investment funds or harm our relationships with regulators and the communities in which we operate.

Current wording

Organizations that provide information to investors on corporate governance and related matters have also developed ratings processes for evaluating companies on their approach to ESG matters, and unfavorable ratings of our company or our industries may lead to negative investor sentiment and the diversion of investment to other companies or industries, exclusion of our stock from ESG-oriented indices or investment funds or harm our relationships with regulators and the communities in which we operate.

Previous wording

There is increased focus, including from governmental organizations, regulators (including the SEC in the U.S.), investors, colleagues and clients, on ESG issues such as environmental stewardship, climate change, greenhouse gas emissions, inclusion and diversity, human rights, racial justice, pay equity, workplace conduct, cybersecurity and data privacy. Negative public perception, adverse publicity or negative comments in social media could damage our reputation if we do not, or are not perceived to, adequately address these issues. Any harm to our reputation could impact colleague engagement and retention and the willingness of clients and our partners to do business with us.

Current wording

The impact of new laws and regulations, negative public perception, adverse publicity or negative comments in social media could damage our reputation, and be costly to defend, if we do not, or are not perceived to, adequately address these issues. Any harm to our reputation could impact colleague engagement and retention and the willingness of clients and our partners to do business with us.

Previous wording

We rely on a large number of vendors and other third parties, and in some cases subcontractors, to provide services, data and information such as technology, information security, funds transfers, business process management, and administration and support functions that are critical to the operations of our business. These third parties include correspondents, agents and other brokers and intermediaries, insurance markets, data providers, plan trustees, payroll service providers, software and system vendors, health plan providers, investment managers, custodians, risk modeling providers, and providers of human resource functions, such as recruiters. Many of these providers are located outside the U.S., which exposes us to business disruptions and political risks inherent when conducting business outside of the U.S. As we do not control many of the actions of these third parties, we are subject to the risk that their decisions or operations may adversely impact us and replacing these service providers could create significant delay in services or operations and additional expense.

Current wording

We rely on a large number of vendors and other third parties, and in some cases subcontractors, to provide services, data and information such as technology, information security, funds transfers, business process management, and administration and support functions that are critical to the operations of our business. These third parties include correspondents, agents and other brokers and intermediaries, insurance markets, data providers, plan trustees, payroll service providers, software and system vendors, health plan providers, investment managers, custodians, risk modeling providers, and providers of human resource functions, such as recruiters. Many of these providers are located outside the U.S., which exposes us to business disruptions and political risks inherent when conducting business outside of the U.S.

Previous wording

If we experience a local or regional disaster or other business continuity event, such as an earthquake, hurricane, flood, terrorist attack, pandemic, war or other geopolitical tensions, protests or riots, security breach, cyberattack (including manipulating the control systems of critical infrastructure), power loss or telecommunications failure, our ability to operate will depend, in part, on the continued availability of our personnel, our office facilities and the proper functioning of our computer, telecommunication and other related systems and operations. In such an event, we could experience operational challenges that could have a material adverse effect on our business. The risk of business disruption is more pronounced in certain geographic areas, including major metropolitan centers, like New York or London, where we have significant operations andapproximately 3,700 and 5,700 colleagues in those respective locations, and in certain countries andregions in which we operate that are subject to higher potential threat of terrorist attacks or military conflicts.

Current wording

If we experience a local or regional disaster or other business continuity event, such as an earthquake, hurricane, flood, terrorist attack, pandemic, war or other geopolitical tensions, protests or riots, security breach, cyberattack (including manipulating the control systems of critical infrastructure), power loss or telecommunications failure, our ability to operate will depend, in part, on the continued availability of our personnel, our office facilities and the proper functioning of our computer, telecommunication and other related systems and operations. In such an event, we could experience operational challenges that could have a material adverse effect on our business. The risk of business disruption is more pronounced in certain geographic areas, including major metropolitan centers, like New York or London, where we have significant operations andapproximately 3,900 and 5,800 colleagues inthose respective locations, and in certain countries and regions, such as India, in which we operate or are investing additional capabilities that are subject to higher potential threat of terrorist attacks or military conflicts.

Previous wording

We have a history of making acquisitions and investments, including a total of 80 in the period from 2019 to 2023. We may not be able to successfully integrate the businesses that we acquire into our own business, or achieve any expected cost savings or synergies from the integration of such businesses. Subject to standard contractual protections, we may also be responsible for legacy liabilities of companies that we acquire.

Current wording

We have a history of making acquisitions and investments, including a total of 86 in the period from 2020 to 2024, including our recent acquisition of McGriff Insurance Services, LLC ("McGriff") and Gerolamo Holding S.À.R.L. ("Cardano"). We may not be able to successfully integrate the businesses that we acquire into our own business, or achieve any expected cost savings or synergies from the integration of such businesses, including McGriff and

Previous wording

Our business depends on our ability to obtain payment from our clients of the amounts they owe us for the work we perform. As of December 31, 2023, our receivables for our commissions and fees were approximately $5.8 billion, or approximately one-quarter of our total annual revenues, and portions of our receivables are increasingly concentrated in certain businesses and geographies.

Current wording

Our business depends on our ability to obtain payment from our clients of the amounts they owe us for the work we perform. As of December 31, 2024, our receivables for our commissions and fees were approximately $6.5 billion, or approximately one-quarter of our total annual revenues, and portions of our receivables are increasingly concentrated in certain businesses and geographies.

Previous wording

Macroeconomic or geopolitical conditions, such as a slower economic growth or recession, the war in Ukraine and the escalating conflict throughout the Middle East, inflationary pressures or supply chain challenges, could result in financial difficulties for our clients, which could cause clients to delay payments to us, request modifications to their payment arrangements that could increase our receivables balance or default on their payment obligations to us.

Current wording

Macroeconomic or geopolitical conditions, such as a slower economic growth or recession, the war in Ukraine and the conflict throughout the Middle East, inflationary pressures or supply chain challenges, could result in financial difficulties for our clients, which could cause clients to delay payments to us, request modifications to their payment arrangements that could increase our receivables balance or default on their payment obligations to us.

Previous wording

The Company has significant defined benefit pension obligations to its current and former employees, totaling approximately $12.2 billion, and related plan assets of approximately $13.5 billion, at December 31, 2023 on a U.S. GAAP basis. The Company's policy for funding itsdefined benefit pension plans is to contribute amounts at least sufficient to meet the funding requirements set forth by law. In the U.S., contributions to these plans are based on ERISA guidelines. Outside the United States, contributions are generally based on statutory requirements and local funding practices, which may differ from measurements in accordance with U.S. GAAP. In the U.K., for example, the assumptions used to determine pension contributions are the result of legally-prescribed negotiations between the Company and the plan trustees. Currently, the use of these assumptions results in a lower funded status than determined in accordance with U.S. GAAP and may result in contributions irrespective of the U.S. GAAP funded status.

Current wording

The Company has significant defined benefit pension obligations to its current and former employees, totaling approximately $11.4 billion, and related plan assets of approximately $12.6 billion, at December 31, 2024 in accordance with U.S. GAAP. The Company's policy for funding its defined benefit pension plans is to contribute amounts at least sufficient to meet the funding requirements set forth by law. In the U.S., contributions to these plans are based on ERISA guidelines. Outside the U.S., contributions are generally based on statutory requirements and local funding practices, which may differ from measurements in accordance with U.S. GAAP. In the U.K., for example, the assumptions used to determine pension contributions are the result of legally- prescribed negotiations between the Company and the plan trustees. Currently, the use of these assumptions results in a lower funded status than determined in accordance with U.S. GAAP and may result in contributions irrespective of the U.S. GAAP funded status.

Previous wording

Approximately 53%of our total revenue reported in 2023 was from business outside of the U.S. We are subject to exchange rate movement because we must translate the financial results of our foreign subsidiaries into U.S. dollars and also because some of our subsidiaries receive revenue other than in their functional currencies. Exchange rate movements may change over time, and they could have a material adverse impact on our financial results and cash flows reported in U.S. dollars. For additional discussion, see "Market Risk and Credit Risk-Foreign Currency Risk" in Part II, Item 7A ("Quantitative and Qualitative Disclosures about Market Risk") of this report.

Current wording

Approximately 52%of our total revenue reported in 2024 was from business outside of the U.S. We are subject to exchange rate movement because we must translate the financial results of our foreign subsidiaries into U.S. dollars and also because some of our subsidiaries receive revenue other than in their functional currencies. Exchange rate movements may change over time, and they could have a material adverse impact on our financial results and cash flows reported in U.S. dollars. For additional discussion, see "Market Risk and Credit Risk-Foreign Currency Risk" in Part II, Item 7A ("Quantitative and Qualitative Disclosures about Market Risk") of this report.

Previous wording

•the impact on us or our clients of changes in legislation, regulation and legal guidance or interpretations in the jurisdictions in which we operate, in particular as a result of increased regulatory activity and enforcement;

Current wording

•the impact on us or our clients of changes in legislation, regulation and legal guidance or interpretations in the jurisdictions in which we operate, particularly in the U.S. as a result of the shift in the presidential administration;

Previous wording

•general economic conditions, including factors beyond our control affecting economic conditions such as global health crises or pandemics, severe weather, climate change, geopolitical unrest such as the war in Ukraine and the escalating conflict throughout the Middle East, protests and riots or other catastrophic events, since our results of operations are directly affected by the levels of business activity of our clients, which in turn are affected by the level of economic activity in the industries and markets that they serve.

Current wording

•general economic conditions, including factors beyond our control affecting economic conditions such as global health crises or pandemics, severe weather, climate change, geopolitical unrest such as the war in Ukraine and the conflict throughout the Middle East, protests and riots or other catastrophic events, since our results of operations are directly affected by the levels of business activity of our clients, which in turn are affected by the level of economic activity in the industries and markets that they serve.

Previous wording

Currently, the Company's senior debt is rated A- by S&P, A3 by Moody's and A- by Fitch. The Company carries a Stable outlook with S&P, Moody's and Fitch.

Current wording

Currently, the Company's senior debt is rated A- by S&P, A3 by Moody's and A- by Fitch. The Company's short-term debt is currently rated A-2 by S&P, P-2 by Moody's, and F-2 by Fitch.The Company carries a Stable outlook with S&P, Moody's and Fitch.

Previous wording

As of December 31, 2023, we had total consolidated debt outstanding of approximately $13.5 billion.

Current wording

At December 31, 2024, we had total consolidated debt outstanding of approximately $19.9 billion.

Previous wording

We conduct business globally. In 2023, approximately 53% of the Company's total revenue was generated from operations outside the U.S., and over one-half of our employees were located outside the U.S. In addition, we conduct our operations through four separate businesses. Potential conflicts of interest may arise across our businesses given the significant volume of our engagements.

Current wording

We conduct business globally. In 2024, approximately 52% of the Company's total revenue was generated from operations outside the U.S., and over one-half of our employees were located outside the U.S. In addition, we conduct our operations through four separate businesses. Potential conflicts of interest may arise across our businesses given the significant volume of our engagements.

Previous wording

•the implementation of the Organization for Economic Cooperation and Development (OECD) international tax framework, including the implementation of the Pillar 2 minimum tax regime by key jurisdictions in 2024 and the Pillar 1 profit reallocation regime, which could have an adverse effect on our effective tax rate, tax payments and results of operations;

Current wording

•the implementation of the Organization for Economic Cooperation and Development (OECD) international tax framework, including the implementation of the Pillar 2 minimum tax regime and the Pillar 1 profit reallocation regime, potentially resulting in an adverse effect on our effective tax rate, tax payments and results of operations, particularly as key jurisdictions adopt these changes, either partially or in full, alongside potential shifts in tax laws in response to such implementation;

Previous wording

•permanent establishments created due to colleagues traveling to and doing work in countries where the Company has no presence, or living in such countries and working remotely post-pandemic, which are not properly compensated through transfer pricing;

Current wording

•permanent establishments created due to colleagues traveling to and doing work in certain countries, or living in such countries and working remotely post-pandemic, which are not properly compensated through transfer pricing;

Previous wording

•geopolitical tensions, such as the war in Ukraine and the escalating conflict throughout the Middle East, in countries where we operate, international hostilities, international trade disputes, terrorist activities, natural disasters, pandemics, and infrastructure disruptions;

Current wording

•geopolitical tensions, such as the war in Ukraine and the conflict throughout the Middle East, in countries where we operate, international hostilities, international trade disputes, terrorist activities, natural disasters, pandemics, and infrastructure disruptions;