SPS COMMERCE INC

Previous wording

If we fail to attract, retain, and train members of our senior management team and other key personnel, or if we are not able to successfully manage the transition of our Chief Executive Officer or our President and Chief Operating Officer, our business could be adversely affected.

Current wording

If we fail to attract, retain, and train members of our senior management team and other key personnel, our business could be adversely affected.

Previous wording

Further, our former Chief Executive Officer, Archie Black, retired as Chief Executive Officer effective October 2, 2023, and the board of directors appointed his successor, Chad Collins, as of that date. We also announced the planned retirement of our President and Chief Operating Officer, James Frome, effective December 31, 2024. Leadership transitions and management changes involve inherent risks, can be difficult to manage and may cause uncertainty or a disruption, which could adversely affect our business.

Current wording

Further, we announced the retirement of our President and Chief Operating Officer, James Frome, effective December 31, 2024. Leadership transitions and management changes involve inherent risks, can be difficult to manage, and may cause uncertainty or a disruption, which could adversely affect our business.

Previous wording

We derive, and expect to continue to derive, substantially all of our revenues from providing cloud-based supply chain management products to retailers, grocers, distributors, suppliers, and logistics firms. The market for these products has historically experienced growth, but it is uncertain whether these products will continue or sustain growing levels of demand and market acceptance. Our success will depend on the willingness of retailers and their trading partners to accept our products as an alternative to traditional licensed hardware and software products.

Current wording

We derive, and expect to continue to derive, substantially all of our revenues from providing cloud-based supply chain management products to retailers, grocers, distributors, suppliers, manufacturers, and logistics firms. The market for these products has historically experienced growth, but it is uncertain whether these products will continue or sustain growing levels of demand and market acceptance. Our success will depend on the willingness of retailers and their trading partners to accept our products as an alternative to traditional licensed hardware and software products.

Previous wording

Fully integrating an acquired company or business into our operations may take a significant amount of time and resources. In addition, we may only be able to conduct limited due diligence on an acquired company’s operations. Following an acquisition, we may be subject to liabilities arising from an acquired company’s past or present operations, including liabilities related to data security, encryption and privacy of customer data, and these liabilities may be greater than the warranty and indemnity limitations that we negotiate. We cannot assure you that we will be successful in overcoming these risks or any other problems encountered with acquisitions. To the extent we do not successfully avoid or overcome the risks or problems related to any acquisitions, our results of operations and financial condition could be adversely affected. Future acquisitions also could impact our financial position and capital needs and could cause substantial fluctuations in our quarterly and yearly results of operations. We also may not be able to achieve anticipated synergies or financial results post acquisition, which could negatively impact our operations and financial results. Acquisitions could include significant goodwill and intangible assets, which may result in future impairment charges that would reduce our stated earnings.

Current wording

Fully integrating an acquired company or business into our operations may take a significant amount of time and resources. In addition, we may only be able to conduct limited due diligence on an acquired company’s operations. Following an acquisition, we may be subject to liabilities arising from an acquired company’s past or present operations, including liabilities related to data security, encryption and privacy of customer data, and these liabilities may be greater than the warranty and indemnity limitations that we negotiate, or the coverage we secure under representation and warranty insurance. We cannot assure you that we will be successful in overcoming these risks or any other problems encountered with acquisitions. To the extent we do not successfully avoid or overcome the risks or problems related to any acquisitions, our results of operations and financial condition could be adversely affected. Future acquisitions also could impact our financial position and capital needs and could cause substantial fluctuations in our quarterly and yearly results of operations. We also may not be able to achieve anticipated synergies or financial results post acquisition, which could negatively impact our operations and financial results. Acquisitions could include significant goodwill and intangible assets, which may result in future impairment charges that would reduce our stated earnings.

Previous wording

A failure to protect the integrity and security of our customers’ information and prevent cyber-attacks could materially damage our reputation, expose us to claims and litigation, and lead to service disruptions and harm our business. Additionally, the growing costs to avoid or reduce the risks of such a failure could adversely affect our results of operations.

Current wording

A failure to protect the confidentiality and integrity of our customers’ information and prevent cyber-attacks could materially damage our reputation, expose us to claims and litigation, and lead to service disruptions and harm our business. Additionally, the growing costs to avoid or reduce the risks of such a failure could adversely affect our results of operations.

Previous wording

As demonstrated by the frequency and sophistication of material and high-profile data security breaches within the retail industry; computer malware, viruses, computer hacking, phishing attacks, spamming, ransomware, and other cyber threats have become more prevalent in our industry. Given the interconnected nature of the retail supply chain, our significant presence in the retail industry, and the occurrence of cyber-attacks on our system in the past, we believe that we are a target for such attacks.

Current wording

As demonstrated by the frequency and sophistication of material and high-profile data security breaches across industries, computer malware, viruses, phishing, spam, ransomware, and other cyber threats continue to pose a pervasive issue for business. Given the interconnected and technology-dependent nature of the retail supply chain, our significant presence and impact in the retail industry, and past cyber events affecting our systems, it's reasonable to believe that we are a target for such attacks.

Previous wording

Any failure to maintain performance, reliability, security and availability of our cloud-based products to the satisfaction of our customers, or any unauthorized access to our customers’ information or systems may cause service disruptions, harm our reputation, impair our ability to retain existing customers and attract new customers and expose us to legal claims or government action, each of which could have a material adverse impact on our financial condition, results of operations and growth prospects. Although we are allocating more resources to address cyber threats and safeguard our products and services, including insurance in the event of a breach, we cannot assure you that these efforts to protect this confidential information and prevent unauthorized access to such information systems will be successful, and the growing costs related to these efforts could adversely affect our results of operations. In addition, because of the critical nature of information security and system access, any actual or perceived failure of our security measures could cause existing or potential customers not to use our products and harm our reputation.

Current wording

Any failure to maintain performance, reliability, security and availability of our cloud-based products to the satisfaction of our customers, or any unauthorized access to our customers’ information or systems may cause service disruptions, harm our reputation, impair our ability to retain existing customers and attract new customers and expose us to legal claims or government action, each of which could have a material adverse impact on our financial condition, results of operations and growth prospects. Although we are allocating more resources to address cyber threats and safeguard our products and services, including cyber insurance, we cannot assure you that these efforts to protect this confidential information and prevent unauthorized access to such information systems will be successful, and the growing costs related to these efforts could adversely affect our results of operations. In addition, because of the critical nature of information security and system access, any actual or perceived failure of our security measures could cause existing or potential customers not to use our products and harm our reputation.

Previous wording

Businesses in the retail industry have experienced material sales declines after discovering data security breaches, and our business could be similarly impacted in the event of a breach or other cyber incident. Furthermore, many U.S. states and international jurisdictions have enacted laws requiring companies to notify consumers of data security breaches involving their personal data. Additionally, the SEC recently issued final rules related to cybersecurity risk management and incident disclosure, which may further increase our required disclosures and cost of compliance in such events. These mandatory disclosures regarding a data security breach or other cyber incident often lead to widespread negative publicity, which may cause our customers to lose confidence in our products and the effectiveness of our data security measures. If we fail to comply with these laws and regulations, we could be subject to enforcement action or litigation, which could harm our business.

Current wording

Businesses in the retail industry have experienced material sales declines after discovering data security breaches, and our business could be similarly impacted in the event of a breach or other cyber incident. Furthermore, many U.S. states and international jurisdictions have enacted laws requiring companies to notify consumers of data security breaches involving their personal data and to increase transparency related to cybersecurity risk management and incident disclosure, all of which may further increase our costs of compliance. These mandatory disclosures regarding a data security breach or other cyber incident often lead to widespread negative publicity, which may cause our customers to lose confidence in our products and the effectiveness of our cybersecurity measures. If we fail to comply with these laws and regulations, we could be subject to enforcement action or litigation, which could harm our business.

Previous wording

While we monitor the use of open source software in our products, processes and technology and work to ensure that open source software is not used in such a way as to require us to disclose the source code to the related product or products, such use could inadvertently occur. Additionally, if a third-party software provider has incorporated certain types of open source software into software we license from such third-party for our products, we could, under certain circumstances, be required to disclose the source code to our products. This could harm our intellectual property position and have a material adverse effect on our business, results of operations and financial condition.

Current wording

While we have established standards for the use of open source software in our products, processes and technology to ensure that open source software is not used in such a way as to require us to disclose the source code to the related product or products, such use could inadvertently occur. Additionally, if a third-party software provider has incorporated certain types of open source software into software we license from such third-party for our products, we could, under certain circumstances, be required to disclose the source code to our products. This could harm our intellectual property position and have a material adverse effect on our business, results of operations and financial condition.

Previous wording

Regulation related to the provision of services on the internet is increasing, as federal, state, and foreign governments continue to adopt new laws and regulations addressing eCommerce generally, data privacy and the collection, processing, storage and use of personal information, including but not limited to the European Union's General Data Protection Regulation. We are particularly sensitive to these risks because the internet and the collection, processing, storage, and use of personal information are critical components of our cloud-based business model. Further, laws are increasingly aimed at the use of personal information for marketing purposes, such as the European Union’s e-Privacy Directive, and the country-specific regulations that implement that directive. Such laws and regulations are subject to differing interpretations and are inconsistent among jurisdictions. These and other requirements could reduce demand for our products or restrict our ability to store and process data or, in some cases, impact our ability to offer, or develop new, services and products in certain locations.

Current wording

Regulation related to the provision of services on the internet is increasing, as federal, state, and foreign governments continue to adopt new laws and regulations addressing eCommerce generally, data privacy and the collection, processing, storage and use of personal information, including but not limited to the European Union's General Data Protection Regulation ("GDPR"). We are particularly sensitive to these risks because the internet and the collection, processing, storage, and use of personal information are critical components of our cloud-based business model. Further, laws are increasingly aimed at the use of personal information for marketing purposes, such as the European Union’s e-Privacy Directive, and the country-specific regulations that implement that directive. Such laws and regulations are subject to differing interpretations and are inconsistent among jurisdictions. These and other requirements could reduce demand for our products or restrict our ability to store and process data or, in some cases, impact our ability to offer, or develop new, services and products in certain locations.

Previous wording

Ensuring that we have internal financial and accounting controls and procedures adequate to produce accurate financial statements on a timely basis is a costly and time-consuming effort that needs to be re-evaluated periodically. The Sarbanes-Oxley Act requires, among other things, that we maintain effective internal control over financial reporting and disclosure controls and procedures. In particular, we are required to perform annual system and process evaluation and testing of our internal control over financial reporting to allow management and our independent registered public accounting firm to report on the effectiveness of our internal control over financial reporting, as required by Section 404 of the Sarbanes-Oxley Act. Furthermore, implementing any appropriate future changes to our internal control over financial reporting may entail substantial costs in order to modify our existing accounting systems, may take a significant period of time to complete and may distract our officers, directors, and employees from the operation of our business. If we are not able to comply with the requirements of Section 404 in the future, or if material weaknesses are identified, our business could be harmed and investor confidence in our financial reporting diminished.

Current wording

Ensuring that we have internal financial and accounting controls and procedures adequate to produce accurate financial statements on a timely basis is a costly and time-consuming effort that needs to be re-evaluated periodically. The Sarbanes-Oxley Act requires, among other things, that we maintain effective internal control over financial reporting and disclosure controls and procedures. In particular, we are required to perform annual system and process evaluation and testing of our internal control over financial reporting to allow management and our independent registered public accounting firm to report on the effectiveness of our internal control over financial reporting, as required by Section 404 of the Sarbanes-Oxley Act. Furthermore, implementing any appropriate future changes to our internal control over financial reporting, including internal controls related to acquisitions and organic business growth, may entail substantial costs in order to modify our existing accounting systems, may take a significant period of time to complete and may distract our officers, directors, and employees from the operation of our business. If we are not able to comply with the requirements of Section 404 in the future, or if material weaknesses are identified, our business could be harmed and investor confidence in our financial reporting diminished.