MCKESSON CORP

We might record significant charges from impairment to goodwill, intangibles, and other long-lived assets.

We are required under U.S. Generally Accepted Accounting Principles (“GAAP”) to test our goodwill for impairment annually, or more frequently if indicators for potential impairment exist. Indicators that are considered include significant changes in performance relative to expected operating results, significant changes in the use of the assets, significant negative industry or economic trends, or a significant decline in the Company’s stock price and/or market capitalization for a sustained period of time. In addition, we periodically review our intangible and other long-lived assets for impairment when events or changes in circumstances indicate the carrying value may not be recoverable. Factors that may be considered a change in circumstances indicating that the carrying value of our intangible and other long-lived assets may not be recoverable include slower growth rates, the loss of a significant customer, burdensome new laws or other adverse legal developments, or divestiture of a business or asset for less than its carrying value. There are inherent uncertainties in management’s estimates, judgments, and assumptions used in assessing recoverability of goodwill, intangibles, and other long-lived assets. Any material changes in key assumptions, including failure to meet business plans, negative changes in government reimbursement rates, a deterioration in the U.S. and global financial markets, an increase in interest rates, an increase in inflation, or an increase in the cost of equity financing by market participants within the industry, or other unanticipated events and circumstances, may decrease the projected cash flows or increase the discount rates and could potentially result in an impairment charge. We have in the past recorded, and may be required to record, a significant charge to earnings in our consolidated financial statements during the period in which any impairment of our goodwill or intangible and other long-lived assets is determined, which might have a materially adverse impact on our business operations and our financial position or results of operations. See Financial Note 10, “Goodwill and Intangible Assets,” for descriptions of impairments of goodwill or intangible or other long-lived assets in recent periods.

We experience cybersecurity incidents that might significantly compromise our technology systems or might result in material data breaches.

We, our external service providers, vendors, and other third parties with which we do business, use technology and systems to perform our business operations, such as the secure electronic transmission, processing, storage, and hosting of sensitive information, including protected health information and other types of personal information, confidential financial information, proprietary information, and other sensitive information relating to our customers, company, and workforce. Despite our physical, technical, and administrative security measures as well as third party risk management processes as discussed in “Cybersecurity” in Item 1C of Part I below, technology systems and operations of the Company and third parties, including our external service providers and vendors, with which we do business, have experienced cybersecurity incidents and are subject to future cyberattacks and cybersecurity incidents. Companies in the healthcare industry are increasingly targeted for cyberattacks. Cybersecurity incidents include unauthorized occurrences on or conducted through our or our third parties’ information systems, such as tampering, malware insertion, ransomware attacks, or other system integrity events. The risk and efficacy of cyberattacks increases from time to time due to a variety of internal and external factors, including, but not limited to, the use by threat actors of sophisticated and rapidly evolving techniques, such as adversarial AI (which makes cyberattacks more likely and may make them more difficult to detect, contain, or mitigate), and the existence of political or military unrest. Our own adoption and use of AI also may create new attack surfaces or methods and generally increase cybersecurity and data protection risks and costs. A cybersecurity incident might involve a material data breach or other material impact to the confidentiality, integrity, availability, or operations of our technology systems or data (including the misuse, loss, disclosure, or corruption of proprietary or personal information), which might result in harm to patients, consumers, or employees; litigation or regulatory action; disruption of our business operations; loss of customers or revenue; cash flow impacts; and increased expense. Additionally, it may take considerable time for us to investigate and evaluate the full impact of incidents, particularly for sophisticated attacks. These factors may inhibit our ability to provide prompt, full, and reliable information about the incident to our customers, regulators, and the public. Any cybersecurity incident might have a materially adverse impact on our business, our operations, our reputation, and our financial position or results of operations.

We experience significant problems with information systems or networks.

We rely on sophisticated information systems and networks to perform our business operations, such as to obtain, rapidly process, analyze, and manage data that facilitate the purchase and distribution of thousands of inventory items from distribution centers. We provide remote services that involve hosting customer data and operating software on our own or third-party systems. Our customers rely on their ability to access and use these systems, and their data, as needed, and our ability to compete effectively is increasingly dependent on access to, and interpretation of, data. Data quality impacts customer ordering, order fulfillment and higher order processing. If we fail to effectively implement and maintain data governance structures across our businesses, to effectively interpret and utilize such data, or protect the integrity of such data, including systems powered by or incorporating AI and machine learning, our operations could be impacted, and we may be at a competitive disadvantage. Our networks and hosting systems are also vulnerable to interruption or damage from sources beyond our control. When those information systems or networks are disrupted, or if the timely delivery of medical care or other customer business requirements are impaired, we experience injury to patients or consumers, litigation or regulatory action, disruption of our business operations, loss of customers or revenue, cash flow impacts, and increased expense. In addition, hardware, software, and other applications and updates procured from third parties may contain defects that have, or may in the future, unexpectedly restrict access to or interfere with the proper operations of our information systems and hardware. Any such problems might have a materially adverse impact on our business, our reputation, and our financial position or results of operations.

Our technology products or services might not conform to specifications or perform as we intend.

We sell and provide services involving complex software and technology that may contain errors, especially when first introduced to market. Healthcare professionals delivering patient care have heightened sensitivity to system and software errors due, among other reasons, to the critical nature of healthcare decisions. If our software and technology services are alleged to have contributed to faulty clinical decisions, compromised continuity of patient care, or injury to patients, we might be subject to regulatory scrutiny or claims by users of our software or services and/or their patients. Errors or failures might damage our reputation and negatively affect future sales. A failure of a system or software to conform to specifications might constitute a breach of warranty that could result in repair costs, contract termination, refunds, or claims for damages. The adoption and use of new technologies, including AI, may introduce new or enhanced risks, such as data inaccuracy, unreliability, or bias, as well as ethical or privacy concerns. Any of these types of errors, failures, or risks might have a materially adverse impact on our reputation, our business operations, and our financial position or results of operations.

The adoption and use of AI in our business operations exposes us to risks and uncertainties.

We increasingly rely on technologies powered by or incorporating AI in our internal operations and business processes. The use of AI technologies introduces risks and uncertainties. AI can generate outputs that are false, misleading, incomplete, biased, or inconsistent. AI performance may degrade over time, or earlier than we planned, due to changes in inputs, data drift, updates by vendors, adversarial manipulations, and other causes. Our investments in AI may not yield anticipated benefits, and we might expend significant resources to maintain responsible and effective AI capabilities. Reliance on third-party AI tools and solutions may expose us to risks that are outside of our control, including compliance gaps. Our AI policies and safeguards may not be sufficient to protect us against negative outcomes, such as the misuse or loss of data or the compromise of our intellectual property. Any of the foregoing risks could adversely impact our reputation, our business operations, and our financial position or results of operations.

Pharmaceutical and medical products that we distribute might not conform to specifications or perform as intended.

We distribute pharmaceutical, medical, and other FDA-regulated products manufactured by third parties and by our private label businesses, including medications that may be temperature sensitive or have limited shelf lives. Our systems and procedures are designed to maintain the safety and efficacy of the products throughout the sourcing and distribution process. Issues affecting product safety or efficacy can arise from manufacturing, storing, distributing, dispensing, or using products, and can result in adverse consequences such as safety alerts, seizures, bans, recalls, withdrawals or other market action, suspensions, and other regulatory actions and sanctions, civil lawsuits, increased costs, disruptions, delays, and reputational damage. Any of these types of issues or results might have a materially adverse impact on our reputation, our business operations, and our financial position or results of operations.

We might not realize expected benefits from business process initiatives.

From time to time, we implement restructuring, cost reduction, or other business process initiatives that result in significant charges and expenses. These initiatives might fail to achieve our desired objectives or have unintended consequences such as distraction of our management and employees, business disruption, attrition beyond any planned reduction in workforce, inability to attract or retain key personnel and reduced employee productivity. Any of these risks might have a materially adverse impact on our business operations and our financial position or results of operations.

We might be unable to successfully complete or integrate acquisitions or other strategic transactions, and our investments in businesses may not perform as we expect.

Our growth strategy includes consummating acquisitions, investments, or other strategic transactions that either expand or complement our business. To fund these strategic transactions, we may require financing that may not be available on acceptable terms. We may not receive governmental approvals needed to complete proposed transactions, or such approvals may be subject to delays or conditions that reduce transaction benefits. Achieving the desired outcomes of these strategic transactions involves significant risks including: diverting management’s attention from other business operations or priorities; challenges with assimilating the acquired businesses, such as integration of operations, systems, and technologies; failure or delay in realizing operating synergies; difficulty retaining key acquired company personnel; unanticipated accounting or financial systems issues with the acquired business, which might affect our internal controls over financial reporting; disputes with the sellers of acquired businesses; unanticipated compliance issues in the acquired business; unknown or unanticipated cybersecurity issues, as well as heightened vulnerabilities during integration; challenges retaining customers of the acquired business; unanticipated expenses or charges to earnings, including depreciation and amortization or potential impairment charges; risks of known and unknown assumed liabilities in the acquired business; failure of an acquired business or investment to perform as projected in the near or long term; and changes in laws or their interpretation or application with respect to an acquired business or investment, such as potential restrictions on certain healthcare ownership structures or arrangements (see “Government Regulation” in Item 1 of Part I above). Certain of these factors at times have negatively affected, and any of these factors could in the future negatively affect, our ability to achieve the anticipated benefits of an acquisition, investment, or other strategic transaction. Any of the foregoing risks might have a materially adverse impact on our business operations and our financial position or results of operations.

From time to time we are adversely impacted by delays or other difficulties with divestitures.

When we decide to sell or otherwise divest assets or a business, we may encounter difficulty in finding buyers or exit strategies on acceptable terms or in a timely manner, which could delay the achievement of our strategic objectives. After the disposition, we might experience greater dissynergies than expected, and the impact of the divestiture on our revenue or profit might be larger than we expected. We might have difficulties with pre-closing conditions such as governmental approvals, which could delay or prevent the divestiture. We might have financial exposure in a divested business, such as through minority equity ownership, financial or performance guarantees, indemnities, or other obligations, such that conditions outside of our control might negate the expected benefits of the disposition. Any of these risks could adversely affect our ability to achieve the anticipated benefits of a divestiture and might have a materially adverse impact on our business operations and our financial position or results of operations.

Our planned separation of Medical-Surgical Solutions is contingent upon the satisfaction of certain conditions, may not be completed on the currently contemplated terms or timeline, or at all, and, if completed, may not achieve the intended financial and strategic benefits.

The Company intends to separate the Medical-Surgical Solutions segment into an independent company (“NewCo”). The separation is expected to be effected, ultimately, through a split-off or spin-off, or a combination of both (the “Exit”), intended to qualify as a tax-free transaction to the Company and its stockholders for U.S. federal income tax purposes. Completion of the planned separation will be subject to the satisfaction of various conditions, including, among others: the receipt of a favorable opinion from outside legal counsel as to the tax-free nature of the Exit; the effectiveness of a registration statement to be filed with the SEC; the receipt of other governmental approvals; the finalization of the NewCo capital structure; and the approval of our Board of Directors. The planned separation is complex in nature, and unanticipated business, market, governmental, or other developments could delay or prevent completion of the separation or cause the separation to occur on less favorable terms. We face certain risks in connection with the separation, including, among others: the diversion of management’s attention from other business operations and priorities; a determination by the Internal Revenue Service (the “IRS”) or any court that the Exit (or any aspect thereof) is taxable for U.S. federal income tax purposes; and challenges in maintaining transitional services and operational continuity between the Company and NewCo, in establishing or maintaining standalone functions and infrastructure at NewCo, or in retaining existing or attracting new business and operational relationships, including with customers, suppliers, and employees. There can be no assurance that the separation, if completed, will achieve the intended financial and strategic benefits (which are based on a number of assumptions, some or all of which may prove incorrect) or provide greater value to our stockholders than is currently reflected in our stock price, or that the dissynergies from the separation will not be greater than expected. Any of these factors could negatively affect our stock price or have a materially adverse impact on our business operations and on our financial condition or results of operations.

We might not realize the expected tax treatment from our split-off of Change Healthcare.

On March 10, 2020, the Company completed a separation of its interest in Change Healthcare LLC (“Change Healthcare JV”). The divestiture was effected through the split-off of PF2 SpinCo, Inc. (“SpinCo”), a wholly owned subsidiary of the Company that held all of the Company’s interest in the Change Healthcare JV, to certain of the Company’s stockholders through an exchange offer (the “Exchange Offer”), followed by a merger of SpinCo with and into Change Healthcare Inc. (“Change”), with Change surviving the merger (the “Merger” and, together with the Exchange Offer, the “Transactions”). The Company received an opinion from outside legal counsel to the effect that the Transactions qualified as generally tax-free transactions to the Company and its stockholders for U.S. federal income tax purposes. An opinion of legal counsel is not binding on the IRS or the courts, and the IRS or the courts may not agree with the intended tax-free treatment of the Transactions. In addition, the opinion could not be relied upon if certain assumptions, representations, and undertakings upon which the opinion was based are materially inaccurate or incomplete, or are violated in any material respect. If the intended tax-free treatment of the Transactions is not sustained, the Company and its stockholders who participated in the Transactions may be required to pay substantial U.S. federal income taxes. In connection with the Transactions, the Company, SpinCo, Change, and the Change Healthcare JV entered into the Tax Matters Agreement, which governs their respective rights, responsibilities, and obligations with respect to tax liabilities and benefits, tax attributes, tax contests, and other tax sharing regarding U.S. federal, state, and local, and non-U.S. taxes, other tax matters, and related tax returns. Under the Tax Matters Agreement, Change is required to indemnify the Company if the Transactions become taxable as a result of certain actions by Change or SpinCo, or as a result of certain changes in ownership of the stock of Change after the Merger. If Change does not honor its obligations to indemnify the Company, or if the Transactions fail to qualify for the intended tax-free treatment for reasons not related to a disqualifying action by Change or SpinCo, the resulting tax to the Company could have a significant adverse effect on our financial position or results of operations.

We might be adversely impacted by outsourcing or similar third-party relationships.

We rely on third parties to perform certain business and administrative functions for us. We might not adequately develop, implement, and monitor these outsourced service providers, and we might not realize expected cost savings or other benefits. Third-party service providers experience cybersecurity incidents and other disruptions and can fail to perform their obligations due to various causes, which might cause us to incur operational difficulties, additional compliance requirements, or increased costs related to outsourced services. For example, our ability to use outsourcing resources in certain jurisdictions might be limited by legislative action or customer contracts, with the result that the work must be performed at greater expense or we may be subject to sanctions for non-compliance. Any of these risks might have a materially adverse impact on our reputation, our business operations, and our financial position or results of operations.

We may be unsuccessful in achieving our strategic growth objectives.

Our business strategy as a diversified healthcare services company includes investing, organically and inorganically, to further build an integrated oncology and multispecialty care platform and expand our biopharma services business. Our ability to grow those businesses will depend, among other things, on our: hiring and retaining talented individuals with necessary knowledge and skills; acquiring, developing, and implementing new technologies and capabilities, including AI; establishing new offerings and pivoting or enhancing existing ones; successfully identifying, completing, and realizing the anticipated benefits of strategic transactions; forming and expanding business relationships; anticipating the needs of our customers; and successfully competing against providers of similar services. New technologies, such as AI, may not result in the benefits we anticipate, may not enable us to keep pace with our competitors and the rapidly evolving technological landscape, and may require us to expend significant resources, including to maintain our capabilities. We have increased, and expect to continue to increase, our use of AI technology, which could heighten these risks. Additionally, some of our historical competitors and a growing number of new competitive entrants have more experience than we do in enabling technologies such as data analytics, machine learning, or AI. As described in “Government Regulation” in Item 1 of Part I above, we also face certain regulatory risks in executing our growth strategy, including potential laws that place restrictions on certain healthcare ownership structures or arrangements. We may not achieve our desired return on our investments through our growth strategy, or acceptable sales and profitability in our strategic growth areas. Any of the foregoing risks might have a materially adverse impact on our business prospects and our financial position or results of operations.

We are impacted by customer purchase reductions, contract non-renewals, payment defaults, and bankruptcies.

Some of our customers from time to time reduce the amounts they purchase from us, do not renew their purchase contracts with us, renew their purchase contracts at less favorable terms, delay or default on their payments to us, or avoid payments to us through bankruptcy proceedings. At March 31, 2026, sales to our largest customer represented approximately 24% of our total consolidated revenues and approximately 21% of our total trade receivables, and those of our ten largest customers combined accounted for approximately 73% of our consolidated revenues and approximately 43% of our trade receivables. Refer to “Other Information about the Business” in Item 1 of Part I above for additional details on our customers. One or more customer purchase reductions, contract non-renewals, renewals at less favorable terms, payment defaults, or bankruptcies might have a materially adverse impact on our business operations and our financial position or results of operations.

Our contracts with governmental entities involve future funding and compliance risks.

Our contracts with governmental entities are subject to risks such as lack of funding and compliance with unique requirements. For example, government contract purchase obligations are typically subject to the availability of funding, which may be eliminated or reduced. In addition, the future volume of products or services purchased by a government customer is often uncertain. Our government contracts might not be renewed or might be terminated for convenience with little prior notice. They might be modified with less favorable terms. Government contracts typically expose us to higher potential liability than do other types of contracts. In addition, government contracts typically are subject to procurement laws that include socio-economic, employment practices, environmental protection, recordkeeping and accounting, and other requirements. For example, our contracts with the U.S. government generally require us to comply with the Federal Acquisition Regulation, Procurement Integrity Act, Buy American Act, Trade Agreements Act, and other laws and requirements. New or revised laws, requirements, and policies, or changes in the interpretation of existing laws, requirements, and policies, could adversely affect our business and competitiveness and increase our compliance costs. We are subject to government audits, investigations, and oversight proceedings. Governmental agencies routinely review and audit government contractors to determine whether they are complying with contractual and legal requirements. If we fail to comply with these requirements, or we fail an audit, we may be subject to various sanctions such as monetary damages, criminal and civil penalties, contract delays or terminations, and suspension or debarment from government contract work. These requirements complicate our business and increase our compliance burden. The occurrence of any of these risks could harm our reputation and might have a materially adverse impact on our business operations and our financial position or results of operations.

We might be harmed by changes in our relationships or contracts with suppliers.

We attempt to structure our distribution agreements with manufacturers to ensure that we are appropriately and predictably compensated for the services we provide. Certain distribution agreements with manufacturers include product price inflation as a component of our consideration, and we cannot control the frequency or magnitude of price changes. Laws limiting or reducing product prices, and changes to manufacturers’ pricing policies or practices as a result of changing laws, impact our distribution agreements or arrangements. We might be unable to renew or modify distribution agreements with manufacturers in a timely and favorable manner. Any of these risks might have a materially adverse impact on our business operations and our financial position or results of operations.

We might infringe intellectual property rights or our intellectual property protections might be inadequate.

We believe that our products and services do not infringe the proprietary rights of third parties, but third parties have asserted infringement claims against us and may do so in the future. If a court were to hold that we infringed other’s rights, we might be required to pay substantial damages, develop non-infringing products or services, obtain a license, stop selling or using the infringing products or services, or incur other sanctions. We rely on trade secret, patent, copyright, and trademark laws, nondisclosure obligations, and other contractual provisions and technical measures to protect our proprietary rights in our products and solutions. We might initiate costly and time-consuming litigation to protect our trade secrets, to enforce our patent, copyright, and trademark rights, and to determine the scope and validity of the proprietary rights of others. Our intellectual property protection efforts might be inadequate to protect our rights. Our competitors might develop non-infringing products or services equivalent or superior to ours. Our development and use of AI technologies may result in new or enhanced risks, including the misappropriation of proprietary and confidential inputs or infringement of third-party rights as well as uncertainties over the ownership of AI-generated outputs. Any of these risks might have a materially adverse impact on our business operations and our financial position or results of operations.

Our use of third-party data is subject to risks and limitations that could impede the growth of our data services business.

We attempt to structure our processes to satisfy contractual and other operative data usage rights and limitations associated with customers, industry partners, and other third-party data flowing through our businesses. These rights and limitations can apply to confidential commercial data and personal data provided to us. Failure to satisfy these data usage rights and limitations can lead to legal claims such as contractual breaches or data protection and privacy law violations. If a court were to hold that our use of data is not consistent with our rights and limitations, we might be required to pay substantial damages; we might need to stop using, sharing, and/or selling certain products and services; or we might incur other financial, legal, and/or reputational consequences. In addition, we might be unable to negotiate and/or obtain at an acceptable cost the data usage rights needed to advance our data strategy growth and AI-related objectives. Any of these risks might have a materially adverse impact on our business operations and our financial position or results of operations.

We might be unable to successfully recruit and retain qualified employees.

Our ability to attract, engage, develop, and retain qualified and experienced employees, including key executives and other talent, is essential for us to meet our objectives. We compete with many other businesses to attract and retain employees. Competition among potential employers results in increased salaries, benefits, or other employee-related costs, or in our failure to recruit and retain employees. We may experience loss of key personnel, including unexpectedly. Although we must adequately plan for timely succession of key management roles, our succession plans might not be effective, and employees might not successfully transition into new roles. Any of these risks might have a materially adverse impact on our business operations and our financial position or results of operations.