Information Services Group Inc

Previous wording

We operate in a highly competitive and rapidly changing environment that involves numerous risks and uncertainties, some of which are beyond our control. In addition, we and our clients are affected by global economic conditions and trends. The following sections address significant factors, events and uncertainties that make an investment in our securities risky. We urge you to consider carefully the factors described below and the risks that they present for our operations, as well as the risks addressed in other reports and materials that we file with the SEC and the other information included or incorporated by reference in this Form 10-K. When the factors, events and contingencies described below or elsewhere in this Form 10-K materialize, there could be a material adverse impact on our business, prospects, results of operations, financial condition and cash flows, any of which could have a potential negative effect on the trading price of our common stock. Additional risks not currently known to us or that we now deem immaterial may also harm us and negatively affect your investment. In addition to the effects of the global economic and geopolitical climate on our business and operations discussed in Item 7 of this Form 10-K and in the risk factors below, additional or unforeseen effects from the global economic and geopolitical climate may give rise to or amplify many of these risks discussed below. Risks in this section are grouped in the following categories: (1) risks related to outstanding debt; (2) risks related to acquisitions; (3) strategy and operation risks; (4) risks related to management and employees; (5) macroeconomic risks; (6) risks related to data, cybersecurity and confidential information; and (7) general risk factors. Many risks affect more than one category, and the risks are not in order of significance or probability of occurrence because they have been grouped by categories.

Current wording

We operate in a highly competitive and rapidly changing environment that involves numerous risks and uncertainties, some of which are beyond our control. In addition, we and our clients are affected by global economic conditions and trends. The following sections address significant factors, events and uncertainties that make an investment in our securities risky. We urge you to consider carefully the factors described below and the risks that they present for our operations, as well as the risks addressed in other reports and materials that we file with the SEC and the other information included or incorporated by reference in this Annual Report on Form 10-K. When the factors, events and contingencies described below or elsewhere in this Annual Report on Form 10-K materialize, there could be a material adverse impact on our business, prospects, results of operations, financial condition and cash flows, any of which could have a potential negative effect on the trading price of our common stock. Additional risks not currently known to us or that we now deem immaterial may also harm us and negatively affect your investment. Additional or unforeseen effects from the global economic and geopolitical climate may give rise to or amplify many of these risks discussed below. Risks in this section are grouped in the following categories: (1) risks related to outstanding debt; (2) risks related to acquisitions and dispositions; (3) strategy and operation risks; (4) risks related to management and employees; (5) macroeconomic risks; (6) risks related to data, cybersecurity and confidential information; and (7) general risk factors. Many risks affect more than one category, and the risks are not in order of significance or probability of occurrence because they have been grouped by categories.

Previous wording

On February 22, 2023, the Company amended and restated its senior secured credit facility to increase the revolving commitments per the revolving facility (the “2023 Credit Agreement”) from $54.0 million to $140.0 million and eliminate its term loan. As a result of the substantial variable costs associated with the debt obligations, we expect that:

Current wording

On February 22, 2023, the Company amended and restated its senior secured credit facility to increase the revolving commitments per the revolving facility from $54.0 million to $140.0 million and eliminate its term loan (as further amended on June 27, 2024, the “2023 Credit Agreement”). As a result of the substantial variable costs associated with the debt obligations, we expect that:

Previous wording

These debt obligations may also impair our ability to obtain additional financing, if needed, and our flexibility in the conduct of our business. Our indebtedness under the senior secured revolving credit facility is secured by substantially all of our assets, leaving us with limited collateral for additional financing. Moreover, the terms of our indebtedness under the senior secured revolving credit facility restrict our ability to take certain actions, including the incurrence of additional indebtedness, mergers and acquisitions, investments and asset sales. Our ability to pay the fixed costs associated with our debt obligations will depend on our operating performance and cash flow, which in turn depend on general economic conditions and the advisory services market. A failure to pay interest or indebtedness when due could result in a variety of adverse consequences, including the acceleration of our indebtedness. In such a situation, it is unlikely that we would be able to fulfill our obligations, repay the accelerated indebtedness or otherwise cover our fixed costs. As of December 31, 2023, the total principal outstanding under the revolving credit facility was $79.2 million.

Current wording

These debt obligations may also impair our ability to obtain additional financing, if needed, and our flexibility in the conduct of our business. Our indebtedness under the 2023 Credit Agreement is secured by substantially all of our assets, leaving us with limited collateral for additional financing. Moreover, the terms of our indebtedness under the 2023 Credit Agreement restrict our ability to take certain actions, including the incurrence of additional indebtedness, mergers and acquisitions, investments and asset sales. Our ability to pay the fixed costs associated with our debt obligations will depend on our operating performance and cash flow, which in turn depend on general economic conditions and the advisory services market. A failure to pay interest or indebtedness when due could result in a variety of adverse consequences, including the acceleration of our indebtedness. In such a situation, it is unlikely that we would be able to fulfill our obligations, repay the accelerated indebtedness or otherwise cover our fixed costs. As of December 31, 2024, the total principal outstanding under the 2023 Credit Agreement was $59.2 million.

Previous wording

Our credit agreement contains financial covenants requiring that we maintain, among other things, certain leverage and interest coverage ratios. Poor financial performance could cause us to be in default of these covenants. While we were in compliance with these covenants as of December 31, 2023, there can be no assurance that we will remain in compliance in the future. If we fail to comply with the covenants in our credit agreement, we may have to seek an amendment or waiver from our lenders to avoid the termination of their commitments and/or the acceleration of the maturity of outstanding amounts under the credit facility. The cost of our obtaining an amendment or waiver could be significant, and further, there can be no assurance that we would be able to obtain an amendment or waiver.

Current wording

The 2023 Credit Agreement contains financial covenants requiring that we maintain, among other things, certain leverage and interest coverage ratios. Poor financial performance could cause us to be in default of these covenants. While we were in compliance with these covenants as of December 31, 2024, there can be no assurance that we will remain in compliance in the future. If we fail to comply with the covenants in our credit agreement, we may have to seek an amendment or waiver from our lenders to avoid the termination of their commitments and/or the acceleration of the maturity of outstanding amounts under the credit facility. The cost of our obtaining an amendment or waiver could be significant, and further, there can be no assurance that we would be able to obtain an amendment or waiver. If our lenders were unwilling to enter into an amendment or provide a waiver, all amounts outstanding under our credit facility would become immediately due and payable.

Previous wording

Borrowing under our credit facility bears interest at a rate per annum equal to either (i) the “Base Rate” (which is the highest of (a) the rate publicly announced from time to time by the administrative agent as its “prime rate,” (b) the Federal Funds Rate plus 0.5% per annum and (c) Term SOFR, plus 1.0%), plus the applicable margin (as defined below) or (ii) Term SOFR (which is the Term SOFR screen rate for the relevant interest period plus a credit spread adjustment of 0.10%) as determined by the administrative agent, plus the applicable margin. The applicable margin is adjusted quarterly based upon the Company’s consolidated leverage ratio. If interest rates increase, our debt service obligations on our variable rate indebtedness would increase even though the amount borrowed remained the same, and our cash flows could be adversely affected. An increase in debt service obligations under our variable rate indebtedness could affect our ability to make payments required under the terms of our credit facility.

Current wording

Borrowing under 2023 Credit Agreement bears interest at a rate per annum equal to either (i) the “Base Rate” (which is the highest of (a) the rate publicly announced from time to time by the administrative agent as its “prime rate,” (b) the Federal Funds Rate plus 0.5% per annum and (c) Term SOFR, plus 1.0%), plus the applicable margin or (ii) Term SOFR (which is the Term SOFR screen rate for the relevant interest period plus a credit spread adjustment of 0.10%) as determined by the administrative agent, plus the applicable margin. The applicable margin is adjusted quarterly based upon the Company’s consolidated leverage ratio. If interest rates increase, our debt service obligations on our variable rate indebtedness would increase even though the amount borrowed remained the same, and our cash flows could be adversely affected. An increase in debt service obligations under our variable rate indebtedness could affect our ability to make payments required under the terms of our credit facility.

Previous wording

Since our inception, we have expanded through acquisitions. In the future, we plan to pursue additional acquisitions and investments as opportunities arise. We may not be able to successfully integrate businesses that we acquire in the future without substantial expense, delays or other operational or financial problems. We may not be able to identify, acquire or profitably manage additional businesses. If we pursue acquisition or investment opportunities, these potential risks could disrupt our ongoing business, result in the loss of key customers or personnel, increase expenses and otherwise have a material adverse effect on our business, results of operations and financial condition.

Current wording

Since our inception, we have expanded through acquisitions. In the future, we plan to pursue additional acquisitions and investments as opportunities arise. We may not be able to successfully integrate businesses that we acquire in the future without substantial expense, delays or other operational or financial problems. In addition, we may not be able to identify, acquire or profitably manage additional businesses. If we pursue acquisition or investment opportunities, these potential risks could disrupt our ongoing business, result in the loss of key customers or personnel, increase expenses and otherwise have a material adverse effect on our business, results of operations and financial condition.

Previous wording

Integrating businesses we have acquired, or may acquire in the future, may involve unanticipated delays, costs and/or other operational and financial problems. In integrating acquired businesses, we may not achieve expected economies of scale or profitability or realize sufficient revenue to justify our investment. If we encounter unexpected problems as we try to integrate an acquired firm into our business, our management may be required to expend time and attention to address the problems, which would divert their time and attention from other aspects of our business.

Current wording

Integrating businesses we have acquired, or may acquire in the future, may involve unanticipated delays, costs and/or other operational and financial difficulties. In integrating acquired businesses, we may not achieve expected economies of scale or profitability or realize sufficient revenue to justify our investment. If we encounter unexpected problems as we try to integrate an acquired firm into our

Previous wording

Our operating results have been, and may in the future be, adversely affected by worldwide economic conditions and credit tightening.

Current wording

Our operating results have in the past been, and may in the future be, adversely affected by worldwide economic conditions and credit tightening.

Previous wording

Any material decline in our ability to secure new advisory arrangements could have an adverse impact on our revenues and financial condition.

Current wording

Any material declines in our ability to secure new advisory arrangements could have an adverse impact on our revenues and financial condition.

Previous wording

As part of our strategy, from time to time, we enter into fixed-fee contracts, in addition to contracts based on payment for time and materials with capped fees. Because of the complexity of many of our client engagements, accurately estimating the cost, scope and duration of a particular engagement can be a difficult task. If we fail to make accurate estimates, we could be forced to devote additional resources to these engagements for which we will not receive additional compensation. While losses on our fixed-fee contracts are rare, to the extent that an expenditure of additional resources is required on an engagement, this could reduce the profitability of, or result in a loss on, the engagement.

Current wording

As part of our strategy, from time to time, we enter into fixed-fee contracts, in addition to contracts based on payment for time and materials with capped fees. Because of the complexity of many of our client engagements, accurately estimating the cost, scope and duration of a particular engagement can be difficult. If we fail to make accurate estimates, we could be forced to devote additional resources to these engagements for which we will not receive additional compensation. While losses on our fixed-fee contracts are rare, to the extent that an expenditure of additional resources is required on an engagement, this could reduce the profitability of, or result in a loss on, the engagement.

Previous wording

● our inability to estimate demand for the new service offerings; and

Current wording

● any inability to estimate demand for the new service offerings; and

Previous wording

We rely on copyright and trademark laws, as well as nondisclosure and confidentiality arrangements, to protect our proprietary rights in our methods of performing our services, our data and our tools for analyzing financial and other information. There can be no assurance that the steps we have taken to protect our intellectual property rights will be adequate to deter misappropriation of our rights or that we will be able to detect unauthorized use and take timely and effective steps to enforce our rights. If substantial and material unauthorized uses of our proprietary methodologies, data and analytical tools were to occur, we may be required to engage in costly and time-consuming litigation to enforce our rights. There can be no assurance that we would prevail in such litigation. If others were able to use our intellectual property or were to independently develop our methodologies or analytical tools, our ability to compete effectively and to charge appropriate fees for our services may be adversely affected.

Current wording

We rely on copyright and trademark laws, as well as nondisclosure and confidentiality arrangements, to protect our proprietary rights in our methods of performing our services, our data and our tools for analyzing financial and other information. There can be no assurance that the steps we have taken, or may take in the future, to protect our intellectual property rights will be adequate to deter misappropriation of our rights or that we will be able to detect unauthorized use and take timely and effective steps to enforce our rights. If substantial and material unauthorized uses of our proprietary methodologies, data and analytical tools were to occur, we may be required to engage in costly and time-consuming litigation to enforce our rights. There can be no assurance that we would prevail in such litigation. If others were able to use our intellectual property or were to independently develop our methodologies or analytical tools, our ability to compete effectively and to charge appropriate fees for our services may be adversely affected.

Previous wording

Our 25 largest clients accounted for approximately 33% and 35% of revenue in 2023 and 2022, respectively. If one or more of our large clients terminate, significantly reduce their engagement or fail to remain a viable business, then our revenues could be materially and adversely affected. In addition, sizable receivable balances could be jeopardized if large clients fail to remain a going concern.

Current wording

Our 25 largest clients accounted for approximately 30% and 33% of revenue in 2024 and 2023, respectively. If one or more of our large clients terminate, significantly reduce their engagement or fail to remain a viable business, then our revenues could be materially and adversely affected. In addition, sizable receivable balances could be jeopardized if large clients fail to remain a going concern.

Previous wording

We are dependent on our management team. We grant restricted stock units (“RSUs”) from time to time to key employees and, in connection with such grants, require recipients to execute a restrictive covenant agreement. Vested and unvested RSUs will be forfeited upon any violation of the restrictive covenant agreement. We may not be able to retain these managers and may not be able to enforce the restrictive covenants. If we were to lose a number of key members of our management team and were unable to replace these people quickly, we could have difficulty maintaining our growth and certain key relationships with large clients and face competition from these former managers if the restrictive covenants are unenforceable.

Current wording

We are dependent on our management team. We grant restricted stock units (“RSUs”) from time to time to key employees and, in connection with such grants, require recipients to execute a restrictive covenant agreement. Vested and unvested RSUs will be forfeited upon any violation of the restrictive covenant agreement. We may not be able to retain these managers and may not be able to enforce the restrictive covenants. If we were to lose a number of key members of our management team and were unable to replace such individuals quickly, we could have difficulty maintaining our growth and certain key relationships with large clients and face competition from these former managers if the restrictive covenants are unenforceable.

Previous wording

We must also recruit staff globally to support our services and products. We face competition for the limited pool of these qualified professionals from, among others, technology companies, market research firms, consulting firms, financial services companies and electronic and print media companies, some of which have a greater ability to attract and compensate these professionals. Moreover, increasing wage inflation may affect our profit margin as we strive to provide compensation packages that are competitive. We face risks related to global labor shortages, and competitive markets have increased attrition throughout our sector. Some of the personnel that we attempt to hire may be subject to non-compete agreements that could impede our short-term recruitment efforts. Any failure to retain key personnel or hire and train additional qualified personnel as required supporting the evolving needs of clients or growth in our business could adversely affect the quality of our products and services, and our future business and operating results.

Current wording

We must also recruit staff globally to support our services and products. We face competition for the limited pool of these qualified professionals from, among others, technology companies, market research firms, consulting firms, financial services companies and electronic and print media companies, some of which have a greater ability to attract and compensate these professionals. Moreover, increasing wage inflation may affect our profit margin as we strive to provide compensation packages that are competitive. We face risks related to global labor shortages, and competitive markets have increased attrition throughout our sector. Some of the personnel that we attempt to hire may be subject to non-compete agreements that could impede our short-term recruitment efforts. Any failure to retain key personnel or hire and train additional qualified personnel as required to support the evolving needs of clients or growth in our business could adversely affect the quality of our products and services, and our future business and operating results.

Previous wording

We provide services primarily in connection with significant or complex sourcing transactions and other matters that provide potential competitive advantage and/or involve sensitive client information. Our engagement by a client occasionally precludes us from staffing certain advisors on new engagements with other clients because the advisors have received confidential information from a client who is a competitor of the new client. Furthermore, it is possible that our engagement by a client could preclude us from accepting engagements with such client’s competitors because of confidentiality concerns.

Current wording

We provide services primarily in connection with significant or complex sourcing transactions and other matters that provide potential competitive advantages and/or involve sensitive client information. Our engagement by a client occasionally precludes us from staffing certain advisors on new engagements with other clients because the advisors have received confidential information from a client who is a competitor of the new client. Furthermore, it is possible that our engagement by a client could preclude us from accepting engagements with such client’s competitors because of confidentiality concerns.

Previous wording

Approximately 39% of our revenues for 2023 and 42% of our revenue for 2022 were derived from sales outside of the Americas. Our operating results are subject to the risks inherent in international business activities, including:

Current wording

Approximately 36% of our revenues for 2024 and 39% of our revenue for 2023 were derived from sales outside of the Americas. Our operating results are subject to the risks inherent in international business activities, including:

Previous wording

We have significant international revenue, which is predominantly collected in local currency. It is expected that our international revenues will continue to grow as European and Asian Pacific markets adopt sourcing solutions. The translation of our revenues into U.S. dollars, as well as our costs of operating internationally, may adversely affect our business, results of operations and financial condition.

Current wording

We have significant international revenue, which is predominantly collected in local currency. It is expected that our international revenues will start to show growth as European and Asian Pacific markets adopt to sourcing solutions. The translation of our revenues into U.S. dollars, as well as our costs of operating internationally, may adversely affect our business, results of operations and financial condition.

Previous wording

In addition, there is an increasing public concern regarding data and consumer protection issues, with the result that the number of jurisdictions with data protection laws continues to increase and the scope of existing privacy laws and the data considered to be covered by such laws keep expanding. Changes in these laws (including newly released interpretations of these laws by courts and regulatory bodies) may limit our client data access, use and disclosure, and may require increased expenditures by us or may dictate that we may not offer certain types of services.

Current wording

In addition, there is an increasing public concern regarding data and consumer protection issues, with the result that the number of jurisdictions with data protection laws continues to increase and the scope of existing privacy laws and the data considered to be covered by such laws keeps expanding. Changes in these laws (including newly released interpretations of these laws by courts and regulatory bodies) may limit our client data access, use and disclosure, and may require increased expenditures by us or may dictate that we may not offer certain types of services.

Previous wording

As a global firm, ISG must comply with various international and domestic data privacy regulations such as (i) the EU and UK General Data Protection Regulation (“GDPR”), which has extra-territorial scope and substantial fines for breaches (up to 4% of global annual revenue or €20 million, whichever is greater), (ii) the California Consumer Privacy Act, which, unlike data privacy provisions enacted by other US states, covers individuals acting in a commercial or employment context not just as consumers, and (iii) the Australian Privacy Act, among others. In addition, the new India Digital Personal Data Protection Act 2023 (“DPDP”) is likely to come into force in 2024. Like the GDPR, the DPDP has extra-territorial reach. The DPDP shares many provisions with existing privacy laws, and ISG therefore anticipates that its existing processes already broadly align with the new law. However, like the GDPR, failure to comply with the DPDP may lead to substantial fines. ISG is continuing to monitor the development of the EU’s ePrivacy Regulation proposal and industry response and will determine whether to take further action, as needed, if it is adopted.

Current wording

As a global company, ISG must comply with various international and domestic data privacy regulations such as (i) the EU and UK General Data Protection Regulation (“GDPR”), which has extra-territorial scope and substantial fines for breaches (up to 4% of global annual revenue or €20 million, whichever is greater), (ii) the California Consumer Privacy Act, which, unlike data privacy provisions enacted by other US states, covers individuals acting in a commercial or employment context not just as consumers, and (iii) the Australian Privacy Act, among others. In addition, the new India Digital Personal Data Protection Act 2023 (“DPDP”) draft rules are out for consultation, which closed in February 2025. The DPDP is anticipated to come into force within two years. Like the GDPR, the DPDP has extra-territorial reach. The DPDP shares many provisions with existing privacy laws, and ISG therefore anticipates that its existing processes already broadly align with the new law. However, like the GDPR, failure to comply with the DPDP may lead to substantial fines. ISG is continuing to monitor the development of the EU’s ePrivacy Regulation and published guidelines to determine whether further action as required.

Previous wording

A significant portion of our business is conducted over the internet, and we rely on the secure processing, storage, and transmission of confidential, sensitive, proprietary and other types of information relating to our business operations and confidential and sensitive information about our clients and employees in our computer systems and networks, and in those of our third-party vendors. Individuals, groups, and state-sponsored organizations may take steps that pose threats to our operations, our computer systems, our employees, and our clients. The cybersecurity risks we face range from cyberattacks common to most industries, such as the development and deployment of malicious software to gain access to our networks and attempt to steal confidential information, launch distributed denial of service attacks, or attempt other coordinated disruptions, to more advanced threats that target us because of our prominence in the global research and advisory field. Ransomware risk has increased significantly in recent years and presents a significant risk of financial extortion and loss of data. Our operating model allows employees to continue to work remotely or on a hybrid basis, which magnifies the importance of the integrity of our remote access security measures.

Current wording

A significant portion of our business is conducted over the internet, and we rely on the secure processing, storage and transmission of confidential, sensitive, proprietary and other types of information relating to our business operations and confidential and sensitive information about our clients and employees in our computer systems and networks, and in those of our third-party vendors. Individuals, groups and state-sponsored organizations may take steps that pose threats to our operations, our computer systems, our employees, and our clients. The cybersecurity risks we face range from cyberattacks common to most industries, such as the development and deployment of malicious software to gain access to our networks and attempt to steal confidential information, launch distributed denial of service attacks or attempts at other coordinated disruptions, to more advanced threats that target us because of our prominence in the global research and advisory field. Ransomware risk has increased significantly in recent years and presents a significant risk of financial extortion and loss of data. Our operating model allows employees to continue to work remotely or on a hybrid basis, which magnifies the importance of the integrity of our remote access security measures.

Previous wording

Most of our service contracts with clients contain service level and performance requirements, including requirements relating to the quality of our services. Failure to consistently meet service requirements of a client or errors made by our employees while delivering services to our clients could disrupt the client’s business and result in a reduction in revenues or a claim for damages against us. Additionally, we could incur liability if a process we manage for a client were to result in internal control failures or impair our client’s ability to comply with their own internal control requirements.

Current wording

Most of our service contracts with clients contain service level and performance requirements, including requirements relating to the quality of our services. Failure to consistently meet the service requirements of a client or errors made by our employees while delivering services to our clients could disrupt the client’s business and result in a reduction in revenues or a claim for damages against us. Additionally,

Previous wording

We are dependent on information technology networks and systems to securely process, transmit and store electronic information and to communicate among our locations around the world and with our people, clients, alliance partners and vendors. As the breadth and complexity of this infrastructure continues to grow, because of the use of mobile technologies, social media and cloud-based services, the risk of security breaches and cyberattacks increases. Such breaches could lead to shutdowns or disruptions of or damage to our systems and those of our clients, alliance partners and vendors and unauthorized disclosure of sensitive or confidential information, including personal data.

Current wording

We are dependent on information technology networks and systems to securely process, transmit and store electronic information and to communicate among our locations around the world and with our people, clients, alliance partners and vendors. As the breadth and complexity of this infrastructure continues to grow, because of the use of mobile technologies, social media and cloud-based services, the risk of security breaches and cyberattacks increases. Such breaches could lead to shutdowns or disruptions of or damage to our systems and those of our clients, alliance partners and vendors and unauthorized disclosure of sensitive or confidential information, including confidential or personal data.

Previous wording

In addition, Third Party Cyber Security Risk is a critical focus for us. All potential new suppliers go through our Data Protection Impact Assessment (“DPIA”) process. This starts with an initial screening questionnaire. The questionnaire covers what personal data and client data is processed, whether the third party has any access requirements to our environment and how is data is transferred. From this, our security team assesses the third party, conducts further due diligence, and reviews contractual clauses. If the risk assessment identifies that the baseline Information Security & Privacy technical and organizational controls are not met, the business will be advised accordingly. The outcome of all DPIAs is recorded on the DPIA register. All new third parties processing personal data or client data are assessed to be either Tier 1, 2 or 3, with Tier 1 being the highest risk in terms of data processed or interactions to our environment from a cyber security threat perspective. Tier 1 and 2 third parties are recorded on our business-critical services register and reviewed annually, and we review the compliance documentation, such as latest ISO certifications, SOC2 reports and pen tests, of those Tier 1 and 2 third parties. Tier 3 third parties are recorded on the DPIA register, but no further due diligence is performed by the security team, as Tier 3 third parties process no client or personal data and have no access or integration to ISG’s network or systems. As part of our continuous improvement in our third-party risk management process, we plan to engage the services of a third-party risk monitoring services to monitor threat intelligence and known vulnerabilities.

Current wording

In addition, third party Cyber Security Risk is a critical focus for us. All potential new suppliers go through our Data Protection Impact Assessment (“DPIA”) process. This starts with an initial screening questionnaire. The questionnaire covers what personal data and client data is processed, whether the third party has any access requirements to our environment and how is data is transferred. From this, our security team assesses the third party, conducts further due diligence, and reviews contractual clauses. If the risk assessment identifies that the baseline Information security & privacy technical and organizational controls are not met, the business will be advised accordingly. The outcome of all DPIAs is recorded on the DPIA register. All new third parties processing personal data or client data are assessed to be either Tier 1, 2 or 3, with Tier 1 being the highest risk in terms of data processed or interactions to our environment from a cyber security threat perspective. Tier 1 and 2 third parties are recorded on our business-critical services register and reviewed annually, and we review the compliance documentation, such as latest ISO certifications, SOC2 reports and pen tests, of those Tier 1 and 2 third parties. Tier 3 third parties are recorded on the DPIA register, but no further due diligence is performed by the security team, as Tier 3 third parties process no client or personal data and have no access or integration to ISG’s network or systems. As part of our continuous improvement in our third-party risk management process, we engage the services of a third-party risk monitoring service to monitor threat intelligence and known vulnerabilities.

Previous wording

Although we seek to prevent, detect, and investigate cybersecurity threats and incidents, and have taken steps to mitigate the likelihood of network security breaches, there can be no assurance that attacks by unauthorized users will not be attempted in the future or that our security measures will be effective. Unauthorized disclosure of sensitive or confidential client data, whether through breach of our processes, systems or otherwise, could subject us to liability, damage our reputation and cause us to lose existing and potential clients. We may also be subject to civil actions and/or criminal prosecution by government or quasi-government agencies for breaches relating to such

Current wording

Although we seek to prevent, detect, and investigate cybersecurity threats and incidents, and have taken steps to mitigate the likelihood of network security breaches, there can be no assurance that attacks by unauthorized users will not be attempted in the future or that our security measures will be effective. Unauthorized disclosure of sensitive or confidential client data, whether through breach of our processes, systems or otherwise, could subject us to liability, damage our reputation and cause us to lose existing and potential clients. We may also be subject to civil actions and/or criminal prosecution by government or quasi-government agencies for breaches relating to such data. Our insurance coverage for breaches or mismanagement of such data may not continue to be available on reasonable terms or in sufficient amounts to cover one or more large claims against us.

Previous wording

Pursuant to rules adopted by the SEC implementing Section 404 of the Sarbanes Oxley Act of 2002, we are required to assess the effectiveness of our internal control over financial reporting and provide a management report on our internal control over financial reporting in all annual reports. This report contains, among other matters, a statement as to whether or not our internal control over financial reporting is effective and the disclosure of any material weaknesses in our internal control over financial reporting identified by management.

Current wording

Pursuant to rules adopted by the SEC implementing Section 404 of the Sarbanes Oxley Act of 2002, we are required to assess the effectiveness of our internal control over financial reporting and provide a management report on our internal control over financial reporting

Previous wording

From time to time, we release guidance regarding our future performance that represents our management’s estimates as of the date of release. This guidance, which consists of forward-looking statements, is prepared by our management and is qualified by, and subject to, the assumptions and the other information contained or referred to in the release. Our guidance is not prepared with a view toward compliance with published guidelines of the Public Company Accounting Oversight Board (United States) (the “PCAOB”), and neither our independent registered public accounting firm nor any other independent expert or outside party compiles or examines the guidance and, accordingly, no such person expresses any opinion or any other form of assurance with respect thereto. Guidance is based upon a number of assumptions and estimates that, while presented with numerical specificity, is inherently subject to significant business, economic and competitive uncertainties and contingencies, many of which are beyond our control and are based upon specific assumptions with respect to future business decisions, some of which will change. The principal reason that we release this data is to provide a basis for our management to discuss our business outlook with analysts and investors. We do not accept any responsibility for any projections or reports published by any such persons. Guidance is necessarily speculative in nature, and it can be expected that some or all of the assumptions of the guidance furnished by us will not materialize or will vary significantly from actual results. Accordingly, our guidance is only an estimate of what management believes is realizable as of the date of release. Actual results will vary from the guidance and the variations may be material. Investors should also recognize that the reliability of any forecasted financial data diminishes the farther in the future that the data is forecast. In light of the foregoing, investors are urged to put the guidance in context and not to place undue reliance on it. Any failure to successfully implement our operating strategy or the occurrence of any of the events or circumstances set forth in this Annual Report on Form 10-K could result in the actual operating results being different than the guidance, and such differences may be adverse and material.

Current wording

From time to time, we release guidance regarding our future performance that represents our management’s estimates as of the date of release. This guidance, which consists of forward-looking statements, is prepared by our management and is qualified by, and subject to, the assumptions and the other information contained or referred to in the release. Our guidance is not prepared with a view toward compliance with published guidelines of the Public Company Accounting Oversight Board (United States) and neither our independent registered public accounting firm nor any other independent expert or outside party compiles or examines the guidance and, accordingly, no such person or firm expresses any opinion or any other form of assurance with respect thereto. Guidance is based upon a number of assumptions and estimates that, while presented with numerical specificity, is inherently subject to significant business, economic and competitive uncertainties and contingencies, many of which are beyond our control and are based upon specific assumptions with respect to future business decisions, some of which will change. The principal reason that we release this data is to provide a basis for our management to discuss our business outlook with analysts and investors. We do not accept any responsibility for any projections or reports published by any such persons. Guidance is necessarily speculative in nature, and it can be expected that some or all of the assumptions of the guidance furnished by us will not materialize or will vary significantly from actual results. Accordingly, our guidance is only an estimate of what management believes is realizable as of the date of release. Actual results will vary from the guidance and the variations may be material. Investors should also recognize that the reliability of any forecasted financial data diminishes the farther in the future that the data is forecast. In light of the foregoing, investors are urged to put any guidance in context and not to place undue reliance on it. Any failure to successfully implement our operating strategy or the occurrence of any of the events or circumstances set forth in this Annual Report on Form 10-K could result in the actual operating results being different than the guidance, and such differences may be adverse and material.