Sigma and CWG Merger Risks and Management Overview

19 61 NOT FOR DISTRIBUTION OR RELEASE IN THE UNITED STATES Key Risks - Risks that are Common to Both Sigma and CWG Key Risk Failure to achieve expected growth in store roll-outs Inadequate IT infrastructure and systems Cyber risk Summary Each Merger Party has identified a number of growth strategies to continue to drive sales which includes for CWG, growing its store network in Australia and overseas. There is a risk CWG may not be able to successfully execute its growth plans or that doing so may take longer or cost more than anticipated, which will impact its future financial prospects and position. For example, CWG's store roll-out plan may be impacted by a number of factors, including the availability of new franchisees, suitable sites in target locations and regulatory restrictions. If a Merger Party fails to execute on its growth strategies, including for CWG to achieve the expected growth in store roll-outs, and associated expected increase in consumer goods sales and other revenue, it may experience adverse financial impacts, potential reputational damage, and the risk that the impacted Merger Party becomes uncompetitive in the market. Any of these could have an adverse effect on a Merger Party's financial performance. Sigma is already pursuing a consolidation of its banner brands to focus on its Amcal and DDS brands and to grow the number of pharmacies under each brand. In seeking to transition pharmacy franchisees under other of Sigma's banner brands to Amcal and DDS, there is a risk that Sigma may not be successful in transitioning all franchisees (who may move to competing franchisors or alternative service providers), or that doing so will take longer or cost more than anticipated, which will impact revenue and sales. There is also a risk that Sigma may lose franchisee pharmacies whose arrangements have expired or are being held over, including to competing franchisors or alternative service providers. Both Merger Parties rely heavily on IT infrastructure and systems to manage their respective businesses, including their compliance with various regulatory, legal and tax requirements. These systems include inventory management software, enterprise resource planning systems, supply chain and distribution systems, data analytics, e-commerce systems, computer systems and hardware, network and telecommunications equipment and systems, and financial and document management systems. Any failure to successfully maintain adequate systems, or implement updates or changes across business operations without disruptions, may negatively impact a Merger Party's business and performance. Both Merger Parties rely on third party providers for various services, including IT software. There is a risk that any disruption or interference with the operations of any of the relevant Merger Party's third party providers may restrict, interrupt or adversely affect that Merger Party's business. In addition, either Merger Party could be subject to various IT system damage or failures, corruption, network disruptions, cybersecurity attacks (discussed further below), loss of data or, breaches in data security, and other malicious or non-malicious disruptions and incidents, any of which may interrupt or otherwise have a material adverse effect on that Merger Party's operations, financial condition and operating results. A failure may be caused by various factors including equipment failure, information technology failure, stock handling procedures breakdowns, labour shortages or work stoppages, events that impede transportation of products, failure of third parties or malicious activities. Given the Merger Parties' dependence on IT systems and infrastructure, each of them is vulnerable to cyber-attacks (including state-sponsored attacks), ransomware attacks, computer viruses or data breaches. This is particularly the case given the increasing frequency and sophistication of attacks. If a Merger Party were to experience a significant cyber security incident, this could result in financial loss, operational disruption or reputational damage. A security breach or cyber-attack could result in significant business disruption and cost, misappropriation of funds, the unavailability of core business systems, loss of intellectual property and disclosure of sensitive business information or personal data. Other consequences could include legal or regulatory liability (or increased regulatory scrutiny), loss of business and reputational damage or adverse effects on customer relations. In addition, a Merger Party may incur significant costs to investigate and rectify the incidents, including identifying system vulnerabilities or introducing additional safeguards to minimise the risk of future events. Any of these could have a material adverse effect on that Merger Party's financial performance.

View entire presentation