CORVEL CORP

Previous wording

If we are unable to apply technology and data analytics effectively in driving value for our clients through technology-based solutions or gain internal efficiencies and maintain effective internal controls through the application of technology and related tools, our operating results, client relationships, growth and compliance programs could be adversely affected.

Current wording

If we are unable to apply technology and data analytics effectively in driving value for our clients through technology-based solutions or gain internal efficiencies and maintain effective financial internal controls through the application of technology and related tools, our operating results, client relationships, growth and compliance programs could be adversely affected.

Previous wording

Our future success depends, in part, on our ability to anticipate and respond effectively to the threat and opportunity presented by digital disruption, “big data” and data analytics, and other developments in technology. These may include new applications or insurance-related services based on artificial intelligence, machine learning, robotics, blockchain, the metaverse or new approaches to data mining that impact the nature of how we generate revenue. We may be exposed to competitive risks related to the adoption and application of new technologies by established market participants or new entrants such as technology companies, start-up companies and others. These new entrants are focused on using technology and innovation, including artificial intelligence and blockchain, in an attempt to simplify and improve the client experience, increase efficiencies, alter business models and effect other potentially disruptive changes in the industries in which we operate. We must also develop and implement technology solutions and technical expertise among our employees that anticipate and keep pace with rapid and continuing changes in technology, industry standards, client preferences and internal control standards. We may not be successful in anticipating or responding to these developments on a timely and cost-effective basis and our ideas may not be accepted in the marketplace. Additionally, the effort to gain technological expertise, make use of data analytics, and develop new technologies in our business requires us to incur significant expenses. Investments in technology systems and data analytics capabilities may not deliver the benefits or perform as expected, or may be replaced or become obsolete more quickly than expected, which could result in operational difficulties or additional costs. If we cannot offer new technologies or data analytics solutions as quickly as our competitors, or if our competitors develop more cost-effective technologies, data analytics solutions or other product offerings, we could experience a material adverse effect on our operating results, client relationships, growth and compliance programs.

Current wording

Our future success depends, in part, on our ability to anticipate and respond effectively to the risk of, and conversely, the opportunity presented by digital disruption, “big data” and data analytics, and other developments in technology. These may include new applications or insurance-related services based on artificial intelligence, machine learning, robotics, blockchain, the metaverse or new approaches to data mining that impact the nature of how we generate revenue. We may be exposed to competitive risks related to the adoption and application of new technologies by established market participants or new entrants such as technology companies, start-up companies and others. These new entrants are focused on using technology and innovation, including artificial intelligence and blockchain, in an attempt to simplify and improve the client experience, increase efficiencies, alter business models and effect other potentially disruptive changes in the industries in which we operate. We must also develop and implement technology solutions and technical expertise among our employees that anticipate and keep pace with rapid and continuing changes in technology, industry standards, client preferences and internal control standards. We may not be successful in anticipating or responding to these developments on a timely and cost-effective basis and our ideas may not be accepted in the marketplace. Data produced by or contained in technology that uses artificial intelligence may contain a degree of inaccuracy and error. Additionally, the effort to gain technological expertise, make use of data analytics, and develop new technologies in our business requires us to incur significant expenses. Investments in technology systems and data analytics capabilities may not deliver the benefits or perform as expected, or may be replaced or become obsolete more quickly than expected, which could result in operational difficulties or additional costs. If we or our third-party vendors fail to effectively implement these new technologies, including, artificial intelligence, we could be subject to additional risks that we do not understand or cannot adequately mitigate, which could have a material adverse effect on our results of operations and financial condition. Further, if we cannot offer new technologies or data analytics solutions as quickly as our competitors, or if our competitors develop more cost-effective technologies, data analytics solutions or other product offerings, we could experience a material adverse effect on our operating results, client relationships, growth and compliance programs.

Previous wording

If we lose several customers in a short period, our results may be materially adversely affected.

Current wording

If we lose several recurring customers in a short period, our results may be materially adversely affected.

Previous wording

Our results may decline if we lose several customers during a short period. Most of our customer contracts permit either party to terminate without cause. If several customers terminate, or do not renew or extend their contracts with us, our results could be materially and adversely affected. Many organizations in the insurance industry have consolidated and this could result in the loss of one or more of our customers through a merger or acquisition. Additionally, we could lose customers due to competitive pricing pressures or other reasons.

Current wording

Our results may decline if we lose several recurring customers during a short period. Most of our customer contracts permit either party to terminate without cause. If several customers terminate, or do not renew or extend their contracts with us, our results could be materially and adversely affected. Many organizations in the insurance industry have consolidated and this could result in the loss of one or more of our customers through a merger or acquisition. Additionally, we could lose customers due to competitive pricing pressures or other reasons.

Previous wording

We may be vulnerable to damage from severe weather conditions or natural disasters, including hurricanes, fires, floods, earthquakes, power loss, communications failures, and similar events, including the effects of pandemics, war or acts of terrorism. If a disaster were to occur, our ability to operate our business could be seriously or completely impaired or destroyed. The insurance we maintain may not be adequate to cover our losses resulting from disasters or other business interruptions. If there is a resurgence in the COVID-19 pandemic, or if any other pandemic arises, it could materially adversely impact our business operations, financial position and results of operations in unpredictable ways that depend on highly-uncertain future developments, such as determining the effectiveness of current or future government actions to address the public health or economic impacts of the pandemic. Any of these risks might have a materially adverse effect on our business operations and our financial position or results of operations.

Current wording

We may be vulnerable to damage from severe weather conditions or natural disasters, including hurricanes, fires, floods, earthquakes, power loss, communications failures, and similar events, including the effects of pandemics, war or acts of terrorism. If a disaster were to occur, our ability to operate our business could be seriously or completely impaired or destroyed. The insurance we maintain may not be adequate to cover our losses resulting from disasters or other business interruptions. If there is a resurgence in global pandemics, or if any other pandemic arises, it could materially adversely impact our business operations, financial position and results of operations in unpredictable ways that depend on highly-uncertain future developments, such as determining the effectiveness of current or future government actions to address the public health or economic impacts of the pandemic. Any of these risks might have a materially adverse effect on our business operations and our financial position or results of operations.

Previous wording

We rely on information technology to support our business activities. Our business involves the storage and transmission of a significant amount of personal, confidential, or sensitive information, including the personal information of our customers and employees, and our company’s financial, operational and strategic information. As with many businesses, we are subject to numerous data privacy and security risks, which may prevent us from maintaining the privacy of this information, result in the disruption of our business and online systems, and require us to expend significant resources attempting to secure and protect such information and respond to incidents, any of which could materially adversely affect our business, financial condition or results of operations. The loss, theft, misuse, unauthorized disclosure, or unauthorized access of such information could lead to significant reputational or competitive harm, result in litigation or regulatory proceedings, or cause us to incur substantial liabilities, fines, penalties or expenses.

Current wording

We rely on information technology to support our business activities. Our business involves the storage and transmission of a significant amount of personal, confidential, or sensitive information, including the personal information of our customers and employees, and our financial, operational and strategic information. As with many businesses, we are subject to numerous data privacy and security risks. These risks may prevent us from maintaining the confidentiality and integrity of this information, result in the disruption of our business and online systems, and require us to expend significant resources to attempt to secure and protect such information and respond to incidents, any of which could materially adversely affect our business, financial condition or results of operations. The loss, theft, misuse, unauthorized disclosure, or unauthorized access of such sensitive information could lead to significant reputational or competitive harm, result in litigation or regulatory proceedings, or cause us to incur substantial liabilities, fines, penalties or expenses.

Previous wording

Cybersecurity breaches of any of the systems on which we rely may result from circumvention of security systems, denial-of-service attacks or other cyber-attacks, hacking, “phishing” attacks, computer viruses, ransomware, malware, employee or insider error, malfeasance, social engineering, physical breaches or other actions. According to media reports, the frequency, intensity, and sophistication of cyber-attacks, ransomware attacks, and other data security incidents generally has significantly increased around the globe in recent years. As with many other businesses, we have experienced, and are continually at risk of being subject to, attacks and incidents, including cybersecurity breaches such as computer viruses, unauthorized parties gaining access to our information technology systems and similar incidents. Cybersecurity breaches could cause us, and in some cases, materially, to experience reputational harm, loss of customers, loss and/or delay of revenue, loss of proprietary data, loss of licenses, regulatory actions and scrutiny, sanctions or other statutory penalties, litigation, liability for failure to safeguard customers’ information, financial losses or a drop in our stock price. We have invested in and continue to expend significant resources on information technology and data security tools, measures, processes, initiatives, policies and employee training designed to protect our information technology systems, as well as the personal, confidential or sensitive information stored on or transmitted through those systems, and to ensure an effective response to any cyber-attack or data security incident. These expenditures could have an adverse impact on our financial condition and results of operations, and divert management’s attention from pursuing our strategic objectives. In addition, the cost and operational consequences of implementing, maintaining and enhancing further system protective measures could increase significantly as cybersecurity threats increase, and there can be no assurance that the security measures we employ will effectively prevent cybersecurity breaches or otherwise prevent unauthorized persons from obtaining access to our systems and information.

Current wording

Cybersecurity incidents affecting the systems on which we rely may result from circumvention of security measures, denial-of-service attacks or other cyber-attacks, hacking, “phishing” attacks, computer viruses, ransomware, malware, employee or insider error, malfeasance, social engineering, physical breaches or other actions. According to media reports, the frequency, intensity, and sophistication of cyber-attacks, ransomware attacks, and other data security incidents has significantly increased worldwide in recent years, including as a result of the increasing sophistication in the development and use of artificial intelligence tools. As with many other businesses, we have experienced, and are continually at risk of being subject to, attacks that result in cybersecurity incidents caused by computer viruses, unauthorized parties gaining access to our information technology systems, and other similar threats. In some cases, cybersecurity incidents could cause reputational harm, loss of customers, loss and/or delay of revenue, loss of proprietary data, loss of licenses, regulatory actions and scrutiny, sanctions or other statutory penalties, litigation, liability for failure to safeguard customers’ information, financial losses, or a drop in our stock price. If we acquire any businesses, the process of integrating the information systems of the businesses we acquire is complex and exposes us to additional risks as we might not adequately identify weaknesses in the acquired company’s information systems, which could expose us to unexpected liabilities or make our own systems more vulnerable to attack. We have invested in and continue to expend significant resources on information technology and information security tools, measures, processes, initiatives, policies and employee training designed to protect our information technology systems, as well as the personal, confidential or sensitive information stored on or transmitted through those systems, and to ensure an effective response to any cyber-attack or security incident, however, such measures cannot provide absolute security and may fail to operate as intended or be circumvented. These expenditures could also have an adverse impact on our financial condition and results of operations, and divert management’s attention from pursuing our strategic objectives. In addition, the cost and operational consequences of implementing, maintaining and further enhancing our system’s protective measures could increase significantly as cybersecurity threats increase. There can be no assurance that the security measures we employ will effectively prevent cybersecurity incidents or otherwise prevent malicious actors from obtaining access to our systems and information.

Previous wording

As these threats evolve, cybersecurity incidents could be more difficult to detect, defend against, and remediate. Cyber-attacks or data incidents could remain undetected for some period, which could potentially result in significant harm to our systems, as well as unauthorized access to the information stored on and transmitted by our systems. Further, despite our security efforts and training, our employees may purposefully or inadvertently cause security breaches that could harm our systems or result in the unauthorized disclosure of or access to information. Any measures we do take to prevent security breaches, whether caused by employees or third parties, could have the potential to harm relationships with our customers or restrict our ability to meet our customers’ expectations.

Current wording

As these threats evolve, cybersecurity incidents could be more difficult to detect, prevent, and remediate. Cybersecurity-attacks or data handling incidents could remain undetected for some period of time, which could not only result in significant harm to our systems, but also lead to unauthorized access to the information stored on and transmitted by our systems. Further, despite our security efforts and training, our employees may purposefully or inadvertently cause cybersecurity incidents. Any occurrence of cybersecurity incidents, whether caused by employees or third parties, could have the potential to adversely impact our relationships with our customers or restrict our ability to meet our customers’ expectations.

Previous wording

If a cyber-attack or other data incident results in the loss, theft, misuse, unauthorized disclosure, or unauthorized access of personal, confidential, or sensitive information belonging to our customers or employees, it could put us at a competitive disadvantage, result in the deterioration of our customers’ confidence in our services, cause our customers to reconsider their relationship with our company or impose more onerous contractual provisions, cause us to lose our regulatory licenses, and subject us to potential litigation, liability, fines and penalties. For example, we could be subject to regulatory or other actions pursuant to privacy laws. This could result in costly investigations and litigation, civil or criminal penalties, operational changes and negative publicity that could adversely affect our reputation, as well as our results of operations and financial condition.

Current wording

If a cyber-attack or other data incident results in the loss, theft, misuse, unauthorized disclosure, or unauthorized access of personal, confidential, or sensitive information belonging to our customers or employees, it could put us at a competitive disadvantage, result in the deterioration of our customers’ confidence in our services, cause our customers to reconsider their relationship with us, impose more onerous contractual provisions, cause us to lose our regulatory licenses, or subject us to potential litigation, liability, fines and penalties. For example, we could become subject to regulatory or other actions pursuant to privacy laws. This could result in costly investigations and litigation, civil or criminal penalties, operational changes, and negative publicity that could adversely affect our reputation, as well as our results of operations and financial condition.

Previous wording

customers cannot access our websites and online systems; or

Current wording

our customers lose the ability to access our websites and online systems; or

Previous wording

We rely largely on our own security systems, confidentiality procedures, and employee nondisclosure agreements to maintain the privacy and security of our and our customers’ proprietary information. Accidental or willful security breaches or other unauthorized access by third parties to our information systems, the existence of computer viruses in our data or software, and misappropriation of our proprietary information could expose us to a risk of information loss, litigation, and other possible liabilities which may have a material adverse effect on our business, financial condition, and results of operations. If security measures are breached because of third-party action, employee error, malfeasance, or otherwise, or if design flaws in our software are exposed and exploited, and, as a result, a third party obtains unauthorized access to any customer data, our relationships with our customers and our reputation will be damaged, our business may suffer, and we could incur significant liability. Because techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not recognized until launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures.

Current wording

We rely on industry standard security systems, confidentiality procedures, and employee nondisclosure agreements to maintain the privacy and security of our and our customers’ proprietary information. Intentional or unintentional incidents, like unauthorized access by third parties to our information systems, the infection of our systems or software with malware, and misappropriation of our proprietary information could expose us to a risk of information loss, litigation, and other possible liabilities which may have a material adverse effect on our business, financial condition, and results of operations. If cybersecurity incidents occur because of third-party actions, employee errors, malfeasance, or otherwise, or if design flaws in our software are exposed and exploited, and, as a result, a third party obtains unauthorized access to any customer data, our relationships with our customers and our reputation could be significantly damaged, our business may suffer, and we could incur significant liability. Cybersecurity threats are rapidly evolving and those threats and the means for obtaining access to our systems are becoming increasingly sophisticated. Because techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not recognized until launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures. The rapid evolution and growing adoption of artificial intelligence technologies may heighten our cybersecurity risks, including through the use of artificial intelligence by malicious actors seeking to identify and exploit vulnerabilities.

Previous wording

Certain aspects of our business are dependent upon our ability to store, retrieve, process, and manage data and to maintain and upgrade our data processing capabilities. Interruption of data processing capabilities for any extended length of time, loss of stored data, programming errors or other system failures could cause customers to cancel their service and could have a material adverse effect on our business, financial condition, and results of operations.

Current wording

Certain aspects of our business are dependent upon our ability to store, retrieve, process, and manage data and to maintain and upgrade our data processing capabilities. An interruption of data processing capabilities for any extended length of time, loss of stored data, programming errors or other system failures could impair our ability to perform for our customers on a timely basis and cause customers to cancel their service and could have a material adverse effect on our business, financial condition, and results of operations.

Previous wording

There has also been increased regulatory scrutiny of the use of “big data” techniques, machine learning, and artificial intelligence. It is likely that we will be subject to new regulations that could materially adversely affect our operations or ability to write business profitably in one or more jurisdictions. In addition, regulators have recently requested information from insurers on their use of algorithms, artificial intelligence and machine learning. We have internal policies governing the use of artificial intelligence by our employees designed to protect us from breaches of data privacy, liability and regulatory enforcement risk; however, if our employees violate these policies, it could expose us to such risks. Our exposure to these risks also could increase if our vendors, suppliers, or other third-party providers employ artificial intelligence in relation to the products or services they provide to us, as we have limited control over such use in third-party products or services. These risks include, among others, the input of confidential information, including material non-public information, in contravention of our policies or contractual restrictions to which any of the foregoing are subject, or in violation of applicable laws or regulations, including those relating to data protection. We cannot predict what, if any, regulatory actions may be taken with regard to “big data,” but any limitations could have a material impact on our business, business processes, financial condition, and results of operations.

Current wording

There has also been increased regulatory scrutiny of the use of “big data” techniques, machine learning, and artificial intelligence. It is likely that we will be subject to new regulations that could materially adversely affect our operations or ability to write business profitably in one or more jurisdictions. The legal and regulatory framework governing artificial intelligence is evolving rapidly and remains highly uncertain. Federal and state agencies are actively proposing or implementing new regulations and guidelines targeting artificial intelligence. With many of these artificial intelligence regulations still in the early stages of development, it is difficult to predict the impact they will have on our business. These regulations may require changes to our implementation of artificial intelligence technology, increase compliance costs, or increase the risk of non-compliance. Any failure to comply with applicable laws or regulations related to artificial intelligence could expose us to investigations, enforcement actions, lawsuits, fines, or other penalties, which could have a material adverse effect on our business, results of operation and financial condition. In addition, regulators have recently requested information from insurers on their use of algorithms, artificial intelligence and machine learning. We have internal policies governing the use of artificial intelligence by our employees designed to protect the Company from breaches of data privacy, liability and regulatory enforcement risk; however, if our employees violate these policies, it could expose us to such risks. Our exposure to these risks also could increase if our vendors, suppliers, or other third-party providers employ artificial intelligence in relation to the products or services they provide to us, as we have limited control over such use in third-party products or services. These risks include, among others, the input of confidential information, including material non-public information, in contravention of our policies or contractual restrictions to which any of the foregoing are subject, or in violation of applicable laws or regulations, including those relating to data protection. We cannot predict what, if any, regulatory actions may be taken with regard to “big data,” but any limitations could have a material impact on our business, business processes, financial condition, and results of operations.

Previous wording

In 1996, the Board of Directors authorized a stock repurchase program and, since then, has periodically increased the number of shares authorized for repurchase under the program. The most recent increase occurred in November 2022 and brought the number of shares authorized for repurchase over the life of the program to 117,000,000 shares. There is no expiration date for the repurchase program. The timing and actual number of shares repurchased, if any, will depend on a variety of factors including the timing of open trading windows, trading price, corporate and regulatory requirements, and market conditions. The stock repurchase program does not obligate us to acquire any amount of common stock and may be suspended or discontinued at any time at our discretion. Repurchases pursuant to our stock repurchase program could affect our stock price, increase the volatility of the price of our common stock and reduce the market liquidity for our common stock. Additionally, repurchases under our stock repurchase program will diminish our cash reserves, which could strain our liquidity, impact our ability to pursue future strategic opportunities and acquisitions, and result in lower overall returns on our cash balances. There can be no assurance that any further stock repurchases will enhance stockholder value because the market price of our common stock may decline below the levels at which we repurchased shares of common stock. Although our stock repurchase program is intended to enhance long-term stockholder value, there is no guarantee we will be successful in achieving this objective.

Current wording

In 1996, the Board of Directors authorized a stock repurchase program and, since then, has periodically increased the number of shares authorized for repurchase under the program. The most recent increase occurred in November 2022 and brought the number of shares authorized for repurchase over the life of the program to 117,000,000 shares. There is no expiration date for the repurchase program. The timing and actual number of shares repurchased, if any, will depend on a variety of factors including the timing of open trading windows, trading price, corporate and regulatory requirements, and market conditions. The stock repurchase program does not obligate us to acquire any amount of common stock and may be suspended or discontinued at any time without notice. Repurchases pursuant to our stock repurchase program could affect our stock price, increase the volatility of the price of our common stock and reduce the market liquidity for our common stock. Additionally, repurchases under our stock repurchase program will diminish our cash reserves, which could strain our liquidity, impact our ability to pursue future strategic opportunities and acquisitions, and result in lower overall returns on our cash balances. There can be no assurance that any further stock repurchases will enhance stockholder value because the market price of our common stock may decline below the levels at which we repurchased shares of common stock. Although our stock repurchase program is intended to enhance long-term stockholder value, there is no guarantee we will be successful in achieving this objective.